commit 376a3960e5efe85ff765abfb5b5b7e4655ad6aed Author: Karan Tilak Kumar Date: Mon Aug 10 04:06:27 2026 -0700 scsi: fnic: Fix built-in NVMe/FC build The fnic NVMe/FC code is guarded with IS_ENABLED(CONFIG_NVME_FC). That also evaluates true when NVME_FC is built as a module. When fnic is built into vmlinux and NVME_FC=m, fnic_nvme.o still references the NVMe/FC transport helpers even though those helpers are not reachable from built-in code. The final vmlinux link then fails with undefined nvme_fc_* symbols. Use IS_REACHABLE(CONFIG_NVME_FC) for the fnic NVMe/FC implementation and prototypes so built-in fnic uses the disabled stubs unless the NVMe/FC transport is reachable. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608092246.XZe7Hlrt-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Signed-off-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260810110627.4521-1-kartilak@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit 15b7fe6db602d0202761902d2c50bc1e8bbe6cea Author: Roman Demidov Date: Fri Aug 7 12:18:50 2026 +0300 scsi: fnic: Fix invalid comparison for error The current comparison err != ERR_ECMDUNKNOWN is useless because err < 0 and ERR_ECMDUNKNOWN == 5. The logic is that if the CMD_CAPABILITY command was executed, there is no need to respond to unknown errors. Therefore, the sign of the number in the comparison must be changed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Roman Demidov Reviewed-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260807091852.13151-1-roman.demidov.nn@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 626147717bea776b61ed3631d2c26283760c4cc4 Author: Petr Vaganov Date: Mon Jun 29 01:52:21 2026 +0700 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310 __dma_map_sg_attrs+0x217/0x310 dma_map_sg_attrs+0x4a/0x70 ata_qc_issue+0x9f8/0x1420 __ata_scsi_queuecmd+0x1657/0x1740 ata_scsi_queuecmd+0x79a/0x920 scsi_queue_rq+0x4472/0x4f40 blk_mq_dispatch_rq_list+0x1cca/0x3ee0 __blk_mq_sched_dispatch_requests+0x458/0x630 blk_mq_sched_dispatch_requests+0x15b/0x340 __blk_mq_run_hw_queue+0xe5/0x250 __blk_mq_delay_run_hw_queue+0x138/0x780 blk_mq_run_hw_queue+0x4bb/0x7e0 blk_mq_sched_insert_request+0x2a7/0x4c0 blk_execute_rq+0x497/0x8a0 sg_io+0xbe0/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Uninit was created at: __alloc_pages+0x5c0/0xc80 alloc_pages+0xe0e/0x1050 blk_rq_map_user_iov+0x2b77/0x6100 blk_rq_map_user_io+0x2fa/0x4d0 sg_io+0xad6/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem. Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 40b01b9bbdf5 ("block: update bio according to DMA alignment padding") Cc: stable@vger.kernel.org Signed-off-by: Petr Vaganov Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260628185229.37957-1-p.vaganov@ideco.ru Signed-off-by: Martin K. Petersen (Oracle) commit 32d9a4e296524e51879af0477c5898b933eb51df Author: Heiko Carstens Date: Thu Aug 6 15:47:59 2026 +0200 scsi: zfcp: Enable CONTEXT_ANALYSIS The zfcp driver passes clang's compile time context analysis. Therefore enable CONTEXT_ANALYSIS. Signed-off-by: Heiko Carstens Link: https://patch.msgid.link/20260806134759.2122369-3-hca@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit ea598cfa561bcc0c8e7bc07fd9b1c22b64c756b3 Author: Heiko Carstens Date: Thu Aug 6 15:47:58 2026 +0200 scsi: zfcp: Add __must_hold() attribute to zfcp_qdio_sbal_get() Add __must_hold() attribute to zfcp_qdio_sbal_get() in order to let clang's context analysis know that qdio->req_q_wq must be held on function entry. This is also documented above the function. Without this annotation this leads to a valid warning when context analysis is enabled: drivers/s390/scsi/zfcp_qdio.c:287:8: warning: expecting spinlock '->req_q_lock' to be held at start of each loop [-Wthread-safety-analysis] 287 | ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq, | ^ Signed-off-by: Heiko Carstens Link: https://patch.msgid.link/20260806134759.2122369-2-hca@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit 9639c6324524ea3f934908bd51f02430000954ab Author: Linkai Gong Date: Fri Jul 31 15:38:20 2026 +0800 scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor with kzalloc_obj() (default GFP_KERNEL) while holding vlans_lock via spin_lock_irqsave(). GFP_KERNEL may sleep, which is not allowed in this atomic context and can trigger a sleeping-from-invalid-context warning or deadlock. Pass GFP_ATOMIC so the allocation is safe under the IRQ-safe spinlock. Fixes: 098585aa8aca ("scsi: fnic: Add and integrate support for FIP") Cc: stable@vger.kernel.org Signed-off-by: Linkai Gong Reviewed-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260731073820.16449-1-gonglinkai@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit 4c84c2e08a36077d288ca28953b8818c4c1c0b79 Author: Laurence Oberman Date: Thu Jul 23 12:37:43 2026 -0400 scsi: storvsc: Support manual scans for all Hyper-V targets The Fibre Channel transport topology created by storvsc exposes only one dummy remote port per SCSI host. Its scsi_target_id is always zero. As a result, the FC transport user-scan path looks up the remote port using target ID 0. It cannot initiate a scan for Target 1 or higher. No SCSI command is therefore sent to Hyper-V when userspace explicitly requests a scan of one of these targets. storvsc itself supports up to STORVSC_FC_MAX_TARGETS and already passes scmnd->device->id to Hyper-V as vm_srb->target_id. Devices on Target 1 and higher work when initially discovered. They can also be rediscovered by a full host scan, such as the scan triggered after an FC port bounce. Provide a storvsc-specific user_scan callback that uses the exported scsi_scan_target() interface. Iterate over the requested channel and target ranges so that wildcard and explicitly addressed scans retain the expected SCSI sysfs scan semantics. This bypasses the single-rport lookup in fc_user_scan() and allows userspace to explicitly scan any target supported by storvsc without requiring one synthetic fc_rport for every Hyper-V target. Signed-off-by: Laurence Oberman Link: https://patch.msgid.link/20260723163743.1274830-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit a640d4546b11be5709a82bdc63d7dafd8ddc6c9e Author: Yang Xiuwei Date: Tue Jul 7 11:03:33 2026 +0800 scsi: sd: Fix sd_done() sense handling condition Only enter the sense_key switch when the command returned CHECK CONDITION with valid, non-deferred sense. The old condition let deferred or invalid sense fall through and mis-handle the I/O. Fixes: 03aba2f79594 ("[SCSI] sd/scsi_lib simplify sd_rw_intr and scsi_io_completion") Reviewed-by: Damien Le Moal Signed-off-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260707030333.22245-4-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit bb31844d88b77138b67aa20c3600203baff40140 Author: Yang Xiuwei Date: Tue Jul 7 11:03:32 2026 +0800 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page. Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page. Fixes: 81d926e8b552 ("sd: split sd_setup_discard_cmnd") Reviewed-by: Damien Le Moal Signed-off-by: Yang Xiuwei Reviewed-by: John Garry Link: https://patch.msgid.link/20260707030333.22245-3-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit e3cc6ea1a745e7f5d326f919a428b244fa119d8f Author: Yang Xiuwei Date: Tue Jul 7 11:03:31 2026 +0800 scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry. Fixes: 7179e626b76e ("scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver") Reviewed-by: Damien Le Moal Signed-off-by: Yang Xiuwei Reviewed-by: John Garry Link: https://patch.msgid.link/20260707030333.22245-2-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit c4f6916a99cf105c3ff340b6210fcbba3fa66b35 Author: Xu Rao Date: Mon Aug 3 17:53:28 2026 +0800 scsi: scsi_debug: Negate wrapped memcmp() result comp_write_worker() returns true when the compared data matches. memcmp() returns zero for equal data and non-zero for different data, so its result must be negated before it is stored in a bool. The first segment already uses !memcmp(), but the wrapped segment uses memcmp() directly, reversing the match result. Use !memcmp() there as well. Fixes: 38d5c8336e60 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: John Garry Link: https://patch.msgid.link/E5AD42E9C0E18633+20260803095328.3445311-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen (Oracle) commit ca76824a3af0ba9e00c5ea50095db495f523555f Author: Dongdong Hao Date: Tue Aug 4 15:02:26 2026 +0800 scsi: leapraid: Add driver documentation This patch adds the necessary documentation for the LeapRAID SCSI driver to the kernel's documentation tree. Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Signed-off-by: Dongdong Hao Link: https://patch.msgid.link/6dc9239844dc00cd053ea0649cc9fe05cad1d98a.1785823793.git.doubled@leap-io-kernel.com Signed-off-by: Martin K. Petersen (Oracle) commit 5597088c9e79c94905367c580bb3ff21136b084a Author: Dongdong Hao Date: Tue Aug 4 15:02:25 2026 +0800 scsi: leapraid: Add new SCSI driver The LeapRAID driver provides support for LeapRAID PCIe RAID controllers, enabling communication between the host operating system, firmware, and hardware for efficient storage management. The driver is organized into several logical modules, each with a clear responsibility: leapraid_os.c: Integrates with the Linux SCSI subsystem, handling host template callbacks, PCIe device probing, and initialization. leapraid_func.c: Contains low-level routines for firmware/hardware interaction, interrupt handling, and reset logic. leapraid_app.c: Provides the ioctl interface for user-space tools. leapraid_transport.c: Manages interactions with the SCSI transport layer for SAS PHYs and ports. leapraid_func.h: Contains internal definitions shared among driver modules. leapraid.h: Contains low-level hardware definitions for driver/firmware interaction. The leapraid_probe() function orchestrates the setup: it allocates the adapter structure and SCSI host, configures hardware interfaces, and registers it with the SCSI mid-layer. Following registration, scsi_scan_host() is invoked to initiate device discovery, with firmware reporting devices via interrupt-driven events. This initial commit provides the necessary infrastructure for subsequent development of full I/O path handling, error recovery, and advanced management features. Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Signed-off-by: Dongdong Hao Link: https://patch.msgid.link/0cbc6245aabdc6e8c90587675e76ba316c5b549e.1785823793.git.doubled@leap-io-kernel.com Signed-off-by: Martin K. Petersen (Oracle) commit 732cb6bb37fd26863d5786522fb1997e7f5865b4 Author: Zizhi Wo Date: Thu Jul 23 12:12:38 2026 +0800 scsi: core: Do not block on tag allocation in scsi_eh_lock_door() scsi_eh_lock_door() is called from scsi_restart_operations() while the host is still in the SHOST_RECOVERY state, i.e. before the host is switched back to SHOST_RUNNING and scsi_run_host_queues() restarts the queues. It allocates a request via scsi_alloc_request() with no flags, so blk_mq_get_tag() may block waiting for a free sched tag when all tags are already in use. Those tags can be held by commands that were just requeued by scsi_eh_flush_done_q() during error handling. Such commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called - which only happens *after* scsi_eh_lock_door() returns. This forms a circular dependency: - scsi_eh_lock_door(), running in the SCSI error handler thread, waits for a sched tag held by a requeued command; - the requeued command cannot complete and release its sched tag until the error handler thread leaves scsi_restart_operations() and restart the queues. For devices with a single driver tag (e.g. USB storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been reproduced in our environment. Locking the door is a best-effort operation, and scsi_eh_lock_door() already returns silently when the request allocation fails. Pass BLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency and allows the error handler to finish restarting the queues, after which the pending commands are dispatched normally. Signed-off-by: Zizhi Wo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260723041238.1584632-1-wozizhi@huaweicloud.com Signed-off-by: Martin K. Petersen (Oracle) commit 8f5bbff8749ab886557cc27dc09729c911c122fa Author: Hyeoncheol Jeong Date: Tue Jul 28 18:27:41 2026 +0900 scsi: ufs: Add support for the aggregated read query opcode UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet in a single query request. The packet may bundle multiple Descriptors, Attributes and Flags as group-headed groups, returned in the Data Segment of the QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor (up to a few KiB vs the 255-byte descriptor limit), so its response UPIU buffer must be enlarged. Enlarging the shared utp_transfer_cmd_desc would waste that extra space per tag, so add a dedicated utp_devman_cmd_desc with a 4 KiB response area (ALIGNED_DEVMAN_RSP_SIZE), allocated once for the reserved (device management) tag that aggregated read uses. Regular tags keep the 512-byte descriptor in a pool of (nutrs - UFSHCD_NUM_RESERVED) entries, leaving normal I/O unchanged. ufshcd_init_lrb() and ufshcd_host_memory_configure() pick the devman descriptor for the reserved tag and index the pool at (tag - UFSHCD_NUM_RESERVED) otherwise. The pre-4.1 MCQ tag recovery adds one compare against the devman UCD address and returns the reserved tag (UFSHCI 4.1+ carries the tag in the CQE), and the BSG raw-UPIU and device management paths learn the new opcode, sizing descriptors by QUERY_AGGREGATED_MAX_SIZE. Signed-off-by: Hyeoncheol Jeong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260728092741epcms2p8c53432ef3c2f0d6a63dd980ad5ef9f00@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle) commit dca46c4ff2cd5be17039a99613b6b4bb0923fe9a Author: Hyeoncheol Jeong Date: Tue Jul 28 18:24:34 2026 +0900 scsi: ufs: Use unsigned types for the BSG query The UPIU query length field is an unsigned 16-bit value per the UFS standard, but ufs_bsg carried it around in signed int. Switch the descriptor length and buffer pointer to u16/u8, fold the trivial ufs_bsg_get_query_desc_size() helper into its only caller, and replace min_t(int, ...) with min(). No functional change intended. Signed-off-by: Hyeoncheol Jeong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260728092434epcms2p56b013ab7a2df90d3df9186322de54340@epcms2p5 Signed-off-by: Martin K. Petersen (Oracle) commit 654fdae895253ef4ce5bf0cfa261d0e1547347c2 Author: Colin Ian King Date: Thu Jul 30 23:29:51 2026 +0100 scsi: ibmvfc: Fix spelling mistake "Deleteing" -> "Deleting" There is a spelling mistake in a tgt_dbg message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260730222951.352872-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 872f486259ae0bc6b73ca4735a15d013241f73e9 Author: Hongjie Fang Date: Wed Jul 29 19:16:14 2026 +0800 scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) commit 0aafdcac9d5ef27bb6549d005b9e57673bb1a5dd Author: Nilesh Javali Date: Thu Jul 30 21:28:38 2026 +0530 scsi: qla2xxx: Update version to 12.00.00.2607b2 Update version to 12.00.00.2607b2 Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-34-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59 Author: Nilesh Javali Date: Thu Jul 30 21:28:37 2026 +0530 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers struct qla_i2c_access carries a 16-bit length field alongside a fixed 64-byte buffer: struct qla_i2c_access { uint16_t device, offset, option, length; uint8_t buffer[0x40]; } __packed; qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. i2c is overlaid on a 256-byte on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to 65535 overruns both: - write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs i2c->length bytes out of the 256-byte buffer. - read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp, then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte buffer inside the on-stack array. A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the kernel stack. Reject requests whose length exceeds the buffer before any copy or DMA transfer in both handlers. Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-33-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc Author: Nilesh Javali Date: Thu Jul 30 21:28:36 2026 +0530 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE (256-byte) bounce buffer obtained from dma_pool_alloc(), which does not zero the allocation. They initialize only a few leading bytes before handing the buffer to qla2x00_write_sfp(). qla2x00_write_sfp() can override the transfer length with a user-supplied value: if (len == 1) opt |= BIT_0; if (opt & BIT_0) len = *sfp; *sfp is the first byte of the (user-controlled) payload, so len can grow up to 255. The device then DMA-reads len bytes from the 256-byte pool buffer. Since only a small prefix was written (e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU status register), the hardware reads past the initialized region and writes up to ~219 bytes of stale DMA-pool heap memory to the device flash. Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers so any bytes beyond the initialized data are zero rather than stale heap contents. Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.") Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-32-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 4cf38dd9465736141263ebb63375868311a0ec81 Author: Nilesh Javali Date: Thu Jul 30 21:28:35 2026 +0530 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] The FC BSG transport allocates job->request via memdup_user() using the exact user-supplied request_len. For FC_BSG_HST_VENDOR, fc_bsg_host_dispatch() only guarantees request_len covers msgcode and vendor_id; it does not account for the vendor_cmd[] flexible array. qla2xxx then reads the command selector vendor_cmd[0] and, in several sub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor command area without verifying request_len. A caller holding CAP_SYS_RAWIO can submit a short request whose vendor_id matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic). Add a central guard in qla2x00_process_vendor_specific() so the selector is always in bounds, restrict the early vendor_cmd[0] read in qla24xx_bsg_request() to sufficiently long vendor messages, and add request_len checks to the sub-handlers that read further: qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(), qla2x00_update_optrom(), qlafx00_mgmt_cmd() and qla28xx_validate_flash_image(). Fixes: 01e0e15c8b3b ("scsi: don't use fc_bsg_job::request and fc_bsg_job::reply directly") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-31-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit b93d3bb3afe1b44489927de1eb4e66e8536a5935 Author: Nilesh Javali Date: Thu Jul 30 21:28:34 2026 +0530 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) and fill it via sg_copy_to_buffer(), which only copies as many bytes as the user-supplied request payload. When the request is shorter than the structure, the remainder of the buffer is left holding stale stack data. qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full structure back to the reply payload with sg_copy_from_buffer(), leaking the uninitialized stack bytes to user space. The write/update paths do not copy the buffer back, but can feed uninitialized fields to the device. Zero the stack buffer at declaration in all five handlers, mirroring the heap kzalloc() approach, so short requests can no longer expose stale memory. Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.") Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-30-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 7c4f3f50d83af4545efaa99b3d0d46fb8d52031e Author: Nilesh Javali Date: Thu Jul 30 21:28:33 2026 +0530 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics qla26xx_dport_diagnostics() streaming-maps the caller's result buffer with dma_map_single(). The bsg path passes &dd->buf from the __packed struct qla_dport_diag, where buf lands at a 2-byte offset and shares cachelines with the surrounding options/unused fields. Mapping such a misaligned sub-buffer violates the DMA API requirement that streaming buffers be cacheline aligned and not share a cacheline with other data, and can corrupt data on non-DMA-coherent architectures. Allocate a dedicated DMA-coherent buffer inside qla26xx_dport_diagnostics() for the mailbox command and copy the result back into the caller's buffer. This removes the streaming map of the misaligned sub-buffer entirely; the caller's buffer is now only a plain CPU buffer, so its packing no longer matters. Fixes: ec89146215d1 ("qla2xxx: Add bsg interface to support D_Port Diagnostics.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-29-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 76da0c43c63eb0496649e372ac64466364d0fe7d Author: Nilesh Javali Date: Thu Jul 30 21:28:32 2026 +0530 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers. Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-28-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd Author: Nilesh Javali Date: Thu Jul 30 21:28:31 2026 +0530 scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic. Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-27-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f7e46ebffc5781aab3f1f5a5d4350addbb5833f4 Author: Nilesh Javali Date: Thu Jul 30 21:28:30 2026 +0530 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qla_nvme_xmt_ls_rsp() bails out to the out: label when firmware is not started (!ha->flags.fw_started), but the out: path unconditionally calls qla_nvme_ls_reject_iocb(), which ends in qla2x00_start_iocbs() and an unconditional doorbell write to the request queue in-pointer register. This rings the firmware doorbell and queues an IOCB that stopped or resetting firmware cannot consume, and touches MMIO during the reset/EEH window where fw_started is also clear. Only emit the LS reject IOCB (and ring the doorbell) when fw_started is set; otherwise just clean up and return. The post-allocation failure cases (SRB alloc / qla2x00_start_sp() failure) run with firmware started and still send the reject. Apply the same guard to the reject emission in qla2xxx_process_purls_pkt(). Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-26-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 06b5b2a5d499323f1c3256ead35798e8e3d15e60 Author: Nilesh Javali Date: Thu Jul 30 21:28:29 2026 +0530 scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort qla_nvme_ls_abort() and qla_nvme_fcp_abort() take a command reference with kref_get_unless_zero() and then call schedule_work() on priv->abort_work, ignoring its return value. qla_nvme_abort_work() runs once and drops exactly one reference via kref_put(&sp->cmd_kref, sp->put_fn). Since the per-abort INIT_WORK() was moved to submission time, schedule_work() now returns false when the work is already pending, for example on a concurrent transport teardown and timeout-driven abort of the same command. In that case the reference taken for the second abort is never released because the work still executes only once, leaking a reference. The command is then never returned to the NVMe-FC transport, which can hang the port. Drop the reference when schedule_work() returns false, so each kref_get_unless_zero() is balanced regardless of whether the work was newly queued. The held reference keeps priv->sp valid for the put. Fixes: 7e85f6dbc856 ("scsi: qla2xxx: Initialize NVMe abort_work once at submission") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-25-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 7944039ba9cb5c3a935d17c91004e3b8649ff58e Author: Nilesh Javali Date: Thu Jul 30 21:28:28 2026 +0530 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition qla24xx_report_id_acquisition() format-1 handling drops vport_slock after taking the vport reference and then calls qla_update_host_map() without the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32()/btree_update32()/btree_remove32() and is documented to require vport_slock to be held by the caller. Running it unlocked can race concurrent host_map updates and corrupt the btree. The format-2 path in the same function already wraps its host_map update (SET_AL_PA) in vport_slock; the format-1 path is the lone outlier. Hold vport_slock across the format-1 qla_update_host_map() call to honor the documented locking contract. The vref_count taken in the loop keeps the vport valid, so this only adds the missing host_map serialization. Fixes: 430eef03a763 ("scsi: qla2xxx: Relocate/rename vp map") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-24-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 1154b16439ffc562f9461494c4508c63446eb684 Author: Nilesh Javali Date: Thu Jul 30 21:28:27 2026 +0530 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition qla24xx_report_id_acquisition() format-1 handling takes the vport reference under vport_slock but drops it outside the lock, after setting vp->vp_flags and vp->dpc_flags: set_bit(VP_IDX_ACQUIRED, &vp->vp_flags); set_bit(REGISTER_FC4_NEEDED, &vp->dpc_flags); set_bit(REGISTER_FDMI_NEEDED, &vp->dpc_flags); atomic_dec(&vp->vref_count); Neither set_bit() nor atomic_dec() imply a memory barrier, so on a weakly ordered architecture the decrement can become visible before the flag stores. qla24xx_deallocate_vp_id() polls vref_count under vport_slock and unlinks the vport once it reads zero, after which qla24xx_vport_delete() frees it via scsi_host_put(). The poller could therefore observe vref_count == 0 early and tear the vport down while the pending vp_flags/ dpc_flags stores land on freed memory. Drop the reference under vport_slock, as is done for the matching increment and by every other vref_count user. The unlock release pairs with the deallocate poller's lock acquire so the flag stores are ordered before vref_count == 0 can be observed. Fixes: 793cedee296f ("scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-23-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 23582731afa35031c94fadb71a4f3b4afd094649 Author: Nilesh Javali Date: Thu Jul 30 21:28:26 2026 +0530 scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps(). Fixes: 41dc529a4602 ("qla2xxx: Improve RSCN handling in driver") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-22-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8 Author: Nilesh Javali Date: Thu Jul 30 21:28:25 2026 +0530 scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When qla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the SRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then call sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking whether the SRB was actually found and removed. If the response ISR completes the same handle first, it removes the SRB under qp_lock_ptr and runs sp->done() -> complete(sp->comp). The submitter qla24xx_control_vp() wakes from wait_for_completion(), clears sp->comp, drops its reference and returns, reclaiming the on-stack completion. The timer reference keeps the SRB alive across the timeout handler, but not the submitter's stack. The timeout then issues a second sp->done() -> qla_ctrlvp_sp_done(), which evaluates "if (sp->comp) complete(sp->comp)"; with the pointer loaded before the submitter's NULL store, complete() writes into the freed stack frame, a use-after-free. Track whether this path removed the SRB from outstanding_cmds and only call sp->done() when it did, so the command is completed exactly once by whichever path owns it. This mirrors the sp_found guard already used in qla24xx_abort_iocb_timeout(). Fixes: f6145e86d21f ("scsi: qla2xxx: Fix race between switch cmd completion and timeout") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-21-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 2ac6a829843cf3df522d19e091276109b94c4c7a Author: Nilesh Javali Date: Thu Jul 30 21:28:24 2026 +0530 scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity ha->max_npiv_vports is taken from firmware (mcp->mb[11]) and only constrained so that (max_npiv_vports + 1) is a multiple of MIN_MULTI_ID_FABRIC, which permits values of 63, 127, 191 and 255. NPIV vports are then allocated up to that count. VP enable uses the VP_CONFIG IOCB, which addresses a vport through a plain vp_index byte, so a vp_index beyond 128 is enabled without issue. VP disable, however, uses the VP_CTRL IOCB, which selects target vports through the fixed 128-bit vp_idx_map bitmap. qla24xx_control_vp() rejects a vp_index past that bitmap and the IOCB builder cannot set a bit beyond 127, yet qla24xx_vport_delete() frees the local state regardless. A vport with vp_index > 128 can therefore be created and enabled but never disabled, leaving it permanently active in firmware: a resource leak. Cap ha->max_npiv_vports at init to the vp_idx_map capacity so such vports are never created. This collapses 191/255 to 127 (still modulo-valid) and leaves the real-world 63/127 cases unaffected. Fixes: 4d0ea24769c8 ("[SCSI] qla2xxx: Retrieve max-NPIV support capabilities from FW.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-20-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 0f41d07d72f2245208c45374ca8d0a1846cad667 Author: Nilesh Javali Date: Thu Jul 30 21:28:23 2026 +0530 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler. Fixes: dd30706e73b7 ("scsi: qla2xxx: edif: Add key update") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-19-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 505753ec2594c6af09a601f0dd60be7d840c1d2d Author: Nilesh Javali Date: Thu Jul 30 21:28:22 2026 +0530 scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxx_delete_qpair() deletes the request queue before the response queue. qla25xx_delete_req_que() frees the request queue memory (kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is only released later, in qla25xx_free_rsp_que(). In that window the response interrupt can still fire, qla2xxx_msix_rsp_q() queues qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue() dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path), a use-after-free. The cancel_work_sync() added for the qpair teardown lives in the response free path, which runs after the request queue is already freed, so it does not protect rsp->req. Release the response-queue interrupt and flush qpair->q_work before deleting the request queue, so no late completion can reach the freed request queue. Clearing have_irq makes the subsequent qla25xx_free_rsp_que() skip its free_irq(), and the firmware queue-delete order (request then response) is preserved; the request-delete mailbox completes on the default vector and is unaffected by dropping the qpair response interrupt early. Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-18-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit deb8abde83a799d2501f3977f6d6051000253f5e Author: Nilesh Javali Date: Thu Jul 30 21:28:21 2026 +0530 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference. Fixes: a6fe35c052c4 ("[SCSI] qla2xxx: Avoid invalid request queue dereference for bad response packets.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-17-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit ca6d880d6c70cb7946e7b3e05d7285f271b6d99e Author: Nilesh Javali Date: Thu Jul 30 21:28:20 2026 +0530 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPABLE(ha)) { sense_data += rsp_info_len; par_sense_len -= rsp_info_len; } rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds. The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense(): if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len); so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer. Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites. Fixes: 5544213be7b4 ("[SCSI] qla2xxx: Correct extended sense-data handling.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-16-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit d7e3fa7d06bf7fcaac186d3c4d635caac166d36c Author: Nilesh Javali Date: Thu Jul 30 21:28:19 2026 +0530 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide whether the next continuation IOCB has arrived, spinning on cpu_relax() without advancing the ring or decrementing the entry count while it has not. response_t::signature lives at byte offset 60, but a continuation IOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame payload at that offset (data[56..59]). A received frame whose payload bytes happen to equal 0xDEADDEAD is therefore misread as "not yet arrived", and the loop spins forever in interrupt/DPC context, causing a CPU soft lockup. The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt() (PT_LS4_UNSOL and the NVMe purls path) already gate on qla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are present before copying begins. The sibling helper __qla_copy_purex_to_buffer() already drops the signature poll and relies on the entry_type == STATUS_CONT_TYPE guard instead. Remove the signature busy-wait from both helpers, keeping the entry_type guard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers and re-processes on the next interrupt once all continuation IOCBs have arrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the signature field is never read on a continuation IOCB, eliminating the payload-aliasing lockup. Fixes: 9f2475fe7406 ("scsi: qla2xxx: SAN congestion management implementation") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-15-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 3ba019bdd89d931499d9476456b5d9c7ab7fa753 Author: Nilesh Javali Date: Thu Jul 30 21:28:18 2026 +0530 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() qla24xx_process_response_queue() advances ring_ptr past the head IOCB before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr already points at the first continuation IOCB. The function however looped purex->entry_count times starting at ring_ptr. As entry_count includes the head, this consumed one entry too many: it stamped RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring past it, silently dropping a legitimate firmware response. The head IOCB's signature was also never marked. Mark the head processed and account for it, then consume only the entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer(). Fixes: fac2807946c1 ("scsi: qla2xxx: edif: Add extraction of auth_els from the wire") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-14-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 6d90f0feb929f6c0f3010f9af4747c7230b75993 Author: Nilesh Javali Date: Thu Jul 30 21:28:17 2026 +0530 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them. Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-13-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 626e44f3d8a924a97a3848a9fd45833947e081e9 Author: Nilesh Javali Date: Thu Jul 30 21:28:16 2026 +0530 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory (ha->iobase + req_que_off), not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through memcpy_toio() and the wrt_reg_* helpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a plain memset(). On architectures such as ARM64 a regular memset() may emit unaligned or block-zeroing instructions (e.g. DC ZVA) that are invalid on Device memory, leading to a synchronous external abort. Use memset_io() to clear the slot for QLAFX00, matching the I/O accessors used elsewhere on this ring. Other adapters keep the plain memset() on their DMA-coherent rings. The zero-fill is retained for FX00 because its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of the entry and rely on the unused tail being pre-zeroed. Fixes: 8ae6d9c7eb10 ("[SCSI] qla2xxx: Enhancements to support ISPFx00.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-12-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 53298efcbbb0f0438366d45cb7ed7e6d93dd5531 Author: Nilesh Javali Date: Thu Jul 30 21:28:15 2026 +0530 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free. Unpublish ha->fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha->fce == NULL and skips it. Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-11-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit b7368687e3d11f51392d3c4774ec0263d5fbf31f Author: Nilesh Javali Date: Thu Jul 30 21:28:14 2026 +0530 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value (0 on success, negative errno on failure) was assigned to the unsigned long enable flag, inverting the intended logic: a valid number was treated as "disable" while a parse failure enabled FCE. Parse the value into enable and propagate parse errors to userspace. Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-10-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 9efaa782845b4d5fb3e01242be0d06ebc7428d8f Author: Nilesh Javali Date: Thu Jul 30 21:28:13 2026 +0530 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents. Fixes: 4d4df1932b6b ("[SCSI] qla2xxx: Add ISP84XX support.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-9-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit e0cebe20dcffbed9c078fe30e2d18cd5046d9eff Author: Nilesh Javali Date: Thu Jul 30 21:28:12 2026 +0530 scsi: qla2xxx: Don't query firmware state while chip is down qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt. Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy. Fixes: b6faaaf796d7 ("scsi: qla2xxx: Serialize mailbox request") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-8-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 33d102102d925357c5fd172dd6672a27d74b3215 Author: Nilesh Javali Date: Thu Jul 30 21:28:11 2026 +0530 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free. Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed. Fixes: fe1b806f4f71 ("[SCSI] qla2xxx: Refactor shutdown code so some functionality can be reused.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-7-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f20e00e0a1965a06055ce8043f3a2bd2ed4d8c72 Author: Nilesh Javali Date: Thu Jul 30 21:28:10 2026 +0530 scsi: qla2xxx: Clarify MPI optrom address/length units The kdoc for qla29xx_mpi_optrom_data() described @offset as an "Offset into the device memory", which reads like a byte address and invites confusion with the per-chunk word-granular address advance in the transfer loop. MBC_LOAD_DUMP_MPI_RAM is word-addressed: @offset is an MPI RAM address in 32-bit words, and @length is a byte count that is converted internally to a word count. Document this to reflect the existing behavior. No functional change. Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-6-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 19788a55cab61d78e33e0914a5a31d27843e8a4a Author: Nilesh Javali Date: Thu Jul 30 21:28:09 2026 +0530 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct. Fixes: 68ca949cdb04 ("[SCSI] qla2xxx: Add CPU affinity support.") Reported-by: Sashiko Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-5-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f606ed93de0c4f1e7e3618779e9fad731455314a Author: Nilesh Javali Date: Thu Jul 30 21:28:08 2026 +0530 scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation (0x20261) calls get_flash_version(), which reads hardware flash registers, without holding ha->optrom_mutex. The VPD update path serializes the same call under optrom_mutex, so this reset path can interleave its flash register accesses with a concurrent VPD or optrom flash operation and corrupt the reads. Hold ha->optrom_mutex across the get_flash_version() call to match the VPD update path. Fixes: 8c2cf7d4e387 ("[SCSI] qla2xxx: Add a new interface to update versions.") Reported-by: Sashiko Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-4-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit ce4f9a383d0af66c8aeaa53b8cb57b5acc531f7a Author: Quinn Tran Date: Thu Jul 30 21:28:07 2026 +0530 scsi: qla2xxx: Improve firmware dump data capture Capture as much firmware dump data as possible. Save the mailbox registers at start-of-day, before firmware execution, so they are available in the dump, and allocate a guestimate dump buffer early during driver load to capture failures that happen before the final dump buffer is sized. Make template entry processing more robust: skip over any entry that fails to capture and continue with the next one, and skip entries that time out instead of aborting the whole dump. Notify udev once sysfs nodes are available in case a dump was captured before they existed. Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-3-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit ebfd35c64433821bd5619a6d07ccc2df8b5b1de3 Author: Nilesh Javali Date: Thu Jul 30 21:28:06 2026 +0530 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and ha->max_qpairs are u8. Deriving the queue count as "ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board (or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X count of 1 zeroes it as well, and in target mode the subsequent "ha->max_req_queues--" then underflows 0 to 255. When the count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is not NULL, so the allocation check passes and the following "ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory or crashing the kernel. Add qla_calc_queue_count() to clamp the derived value into [1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and use it at all three derivation sites (qla25xx_iospace_config(), qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the target-mode decrement so it cannot reintroduce a zero (which would in turn underflow max_qpairs). Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260730155838.2119230-2-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 34ea7691e50abab7d30d1be0636e6be9b1f9756e Author: Nilesh Javali Date: Thu Jul 23 10:34:13 2026 +0530 scsi: qla2xxx: Update version to 12.00.00.2607b1 Update version to 12.00.00.2607b1. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-57-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit de62cf265dbe309f34f144a6cdbca9240317727e Author: Nilesh Javali Date: Thu Jul 23 10:34:12 2026 +0530 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer. Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-56-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 0fb52cc632464b0cd07f970341330466d772efe1 Author: Nilesh Javali Date: Thu Jul 23 10:34:11 2026 +0530 scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally, telling the FC BSG transport (fc_bsg_host_dispatch()) that the driver owns and will complete the request. But bsg_job_done() is guarded by "if (!rval)", so on the error path (rval == -EINVAL) neither the driver nor the transport completes the job. The request dangles until it times out, leaking block layer resources. Commit c2c68225b145 ("scsi: qla2xxx: Fix bsg_done() causing double free") added the "if (!rval)" guard to a batch of BSG handlers. That is correct for handlers that also return the error code (the transport then completes the job once via fail_host_msg), but this function returns QLA_SUCCESS unconditionally, so the guard turned a correct single completion into a leak. Always call bsg_job_done(): bsg_reply->result is DID_OK and the error is reported in vendor_rsp[0], and since the function returns 0 the transport will not complete the job a second time. Fixes: c2c68225b145 ("scsi: qla2xxx: Fix bsg_done() causing double free") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-55-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit a152edab3854f01dd2daf3eaf8f32cbabdb3834e Author: Nilesh Javali Date: Thu Jul 23 10:34:10 2026 +0530 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space. Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2(). Fixes: ec89146215d1 ("qla2xxx: Add bsg interface to support D_Port Diagnostics.") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-54-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f743488e4a203049f27ec5d8cd0caccc483af01e Author: Nilesh Javali Date: Thu Jul 23 10:34:09 2026 +0530 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qla_nvme_ls_reject_iocb() allocates from and advances the request ring through __qla2x00_alloc_iocbs() (which assumes the hardware_lock is held) and qla2x00_start_iocbs() (which advances the ring and rings the request-in doorbell), but takes no lock itself. Two of its callers invoke it without the producer lock held: - qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on its error path, and - qla2xxx_process_purls_pkt(), run from the purex work/DPC context. Both use ha->base_qpair, whose qp_lock_ptr is hardware_lock, so they can run concurrently with normal I/O submission on the base ring and corrupt the ring producer state, leading to duplicated or dropped commands. The third caller, qla2xxx_process_purls_iocb(), runs inside qla24xx_process_response_queue() with the qpair lock already held and is safe; that is also why the lock cannot be taken inside the helper itself (it would recursively re-acquire hardware_lock on the response path). Take qp_lock_ptr around the two unlocked callers and document the helper as caller-locked. Both run in process context, so spin_lock_irqsave() is used and nothing in the locked region sleeps. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-53-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 7e85f6dbc85616de2172bce8eaf84b387a723cd1 Author: Nilesh Javali Date: Thu Jul 23 10:34:08 2026 +0530 scsi: qla2xxx: Initialize NVMe abort_work once at submission qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on priv->abort_work immediately before schedule_work(). INIT_WORK() reinitializes the work_struct, resetting its list head and clearing the pending bit. If an abort is issued more than once for the same command (for example, concurrent transport teardown and a timeout-driven abort), the second INIT_WORK() reinitializes a work item that is already queued, which can corrupt the workqueue list and lead to crashes or a looping worker. Initialize priv->abort_work once at command submission, next to the existing per-command spin_lock_init(&priv->cmd_lock), and leave only schedule_work() in the abort paths. schedule_work() already does nothing when the work item is still pending, so a repeated abort no longer disturbs an in-flight work item. The command is not returned to the transport until the final kref_put()/release callback runs after abort_work has completed, so the work item is idle before priv is reused and the single submission-time INIT_WORK() is safe. Fixes: e473b3074104 ("scsi: qla2xxx: Add FC-NVMe abort processing") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-52-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 793cedee296fd819bfadc2a7ec4d52faf9c09a0a Author: Nilesh Javali Date: Thu Jul 23 10:34:07 2026 +0530 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before vp is used: qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/ REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport down and free it, leading to a use-after-free. Take a vport reference (vref_count) under vport_slock when the matching vp is found, and drop it after the last use of vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before unlinking and freeing the vport, so the pointer stays valid. This matches the reference idiom already used by the other ha->vp_list traversals. Fixes: 2c3dfe3f6ad8 ("[SCSI] qla2xxx: add support for NPIV") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-51-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 9101c51649f5b6773a97bf5271785c948589ea1d Author: Nilesh Javali Date: Thu Jul 23 10:34:06 2026 +0530 scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() The Modify VP Config completion handler labelled its first error branch "error status" but tested vpmod->comp_status instead of vpmod->entry_status. Because CS_COMPLETE is 0, the following "comp_status != CS_COMPLETE" branch duplicated that test and was dead code, and entry_status was never examined at all. When firmware rejects the IOCB early it sets entry_status while leaving comp_status zero. As the IOCB is allocated with dma_pool_zalloc(), both comp_status branches evaluate false and the handler falls through to the success path, calling fc_vport_set_state(FC_VPORT_INITIALIZING) for a configuration the firmware never accepted. This can leave the virtual port enabled on top of an invalid config and surface later as login timeouts or follow-on firmware errors. Test entry_status in the first branch, matching qla_ctrlvp_completed() and the login/logout/abort/reset IOCB handlers; the comp_status branch then becomes the live completion-status check. Fixes: 2c3dfe3f6ad8 ("[SCSI] qla2xxx: add support for NPIV") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-50-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 878613ecb5a36db26859c4fd83daf9283a334fa2 Author: Nilesh Javali Date: Thu Jul 23 10:34:05 2026 +0530 scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vp_idx_map, a fixed 16-byte (128-bit) array in both vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb() computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map] without checking that map stays within the array. max_npiv_vports is taken from firmware and only sanitized to a MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports. A vp_index above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout). Reject a vp_index that cannot be represented in the IOCB bitmap in qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected. Fixes: 2853192e154b ("scsi: qla2xxx: Use IOCB path to submit Control VP MBX command") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-49-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit eb137255fd7aa834c4d639ae7b5e9e8ecf3a4fb2 Author: Nilesh Javali Date: Thu Jul 23 10:34:04 2026 +0530 scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters In the CS_PORT_LOGGED_OUT case of qla2x00_chk_ms_status(), the FWI2-capable branch compared ms_pkt->loop_id.extended against NPH_SNS to decide whether the Name Server had logged out. On FWI2 and later adapters the response is a ct_entry_24xx / ct_entry_24xx_ext, where loop_id.extended (via the legacy ms_iocb_entry_t view) aliases offset 8, which is comp_status, not nport_handle (offset 10). As this code runs under CS_PORT_LOGGED_OUT, the field read back 0x29 (CS_PORT_LOGGED_OUT) and the comparison against NPH_SNS (0x7fc) was always false. As a result the driver never recognized a Name Server logout on FWI2/ 29xx adapters: it returned the generic QLA_FUNCTION_FAILED instead of QLA_NOT_LOGGED_IN and skipped setting LOOP_RESYNC_NEEDED / LOCAL_LOOP_UPDATE, so the fabric rediscovery triggered by an SNS logout did not happen. Read nport_handle from the ct_entry_24xx layout (offset 10) instead. nport_handle is at the same offset in ct_entry_24xx and ct_entry_24xx_ext, so a single cast covers 24xx-class and 29xx. The non-FWI2 branch keeps using loop_id.extended, which is correct for the ms_iocb_entry_t response on those adapters. Fixes: b98ae0d748db ("scsi: qla2xxx: Fix name server relogin") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-48-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit c20ee380ca59c5a8646750c4849969a815924e2e Author: Nilesh Javali Date: Thu Jul 23 10:34:03 2026 +0530 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context. Return early when cmd is NULL, before touching cmd->sc_data_direction. Fixes: dd30706e73b7 ("scsi: qla2xxx: edif: Add key update") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-47-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 52fba32317ee631faa878725b2f7cd5c08acacd3 Author: Nilesh Javali Date: Thu Jul 23 10:34:02 2026 +0530 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate qla2x00_get_data_rate() skips updating ha->link_data_rate when the firmware returns mcp->mb[1] == 0x7. That value was a legacy sentinel from before 64G hardware existed, but PORT_SPEED_64GB is now defined as 0x07 and ha->link_data_rate is decoded with the PORT_SPEED_* encoding. On a 64G-capable adapter a genuine 64G link is therefore dropped, and the port speed is misreported (port_speed sysfs, fc_host speed, FDMI). Only 28xx and 29xx support 64G, so accept 0x07 on those adapters while keeping the legacy filter for older ones. Also drop the duplicate copy of the check at the end of the success branch; it repeated the first assignment with no intervening change. Fixes: ecc89f25e225 ("scsi: qla2xxx: Add Device ID for ISP28XX") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-46-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f6e384eb8c8404f8c6c7713982f6ae12864f09d7 Author: Nilesh Javali Date: Thu Jul 23 10:34:01 2026 +0530 scsi: qla2xxx: Add 64G/128G port speed setting support The port speed setting paths topped out at 32G: qla2x00_port_speed_store() only mapped sysfs inputs up to 32 (and their no-loss-of-sync forms up to 320), and qla2x00_set_data_rate() only accepted PORT_SPEED_AUTO/4/8/16/32 in its switch. A user request for 64G or 128G therefore hit the default arm and was silently downgraded to auto-negotiation. Map the 64 and 128 sysfs inputs (and their /10 no-loss-of-sync forms 640 and 1280) to PORT_SPEED_64GB and PORT_SPEED_128GB, and accept those values in qla2x00_set_data_rate(). The firmware validates the requested rate against the adapter's actual capability. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-45-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 8ac3f225f9f2695377bca53b8d87e0db5c6546bf Author: Nilesh Javali Date: Thu Jul 23 10:34:00 2026 +0530 scsi: qla2xxx: Use 64-bit FPM word counters for 29xx host stats 29xx provides the 64-bit FPM transmit/receive word counters in the link statistics block, like 83xx/27xx/28xx. qla2x00_get_fc_host_stats() only consumed those counters for the older families and fell back to the software approximation (input/output bytes >> 2) on 29xx, reporting less accurate rx_words/tx_words. Add IS_QLA29XX() to the high-speed branch so 29xx reports the hardware word counters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-44-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 53fc489ad3356bb9ef346e6c309f84a4419783d0 Author: Nilesh Javali Date: Thu Jul 23 10:33:59 2026 +0530 scsi: qla2xxx: Fix endianness annotations in vp_rpt_id_entry structures The vp_rpt_id_entry_24xx and vp_rpt_id_entry_24xx_ext DMA structures use plain uint16_t for fip_flags and bbcr fields that the firmware writes in little-endian format. On big-endian hosts, reading bbcr without le16_to_cpu() produces an incorrect value, breaking the buffer-to-buffer credit enable detection. Additionally, the 29xx ext struct uses __le16 bitfields for vp_idx:9/vp_status:7 which suffer from architecture-dependent bit packing order (same class of bug fixed in the ELS/ABTS extended IOCBs). Fix by: - Changing uint16_t fip_flags/bbcr to __le16 in both qla_fw.h and qla_fw29.h (enables Sparse endianness checking) - Replacing the __le16 bitfields with a scalar __le16 vp_idx_status and defined shift/mask constants - Adding le16_to_cpu() at the bbcr and vp_idx_status access sites in qla_mbx.c Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-43-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 3cfd2f74b1991f726aaef6b453dd2f37e27a0565 Author: Nilesh Javali Date: Thu Jul 23 10:33:58 2026 +0530 scsi: qla2xxx: Replace __le16 bitfields with scalar and accessors C bitfield packing order is implementation-defined: GCC packs LSB-first on little-endian targets and MSB-first on big-endian targets. The __le16 bitfield declarations for vp_index/sof_type in the 29xx extended IOCB structures produce incorrect bit positions on big-endian hosts, and Sparse cannot enforce endianness checks on bitfield members. Replace the three sets of __le16 bitfields (in els_entry_24xx_ext, els_sts_entry_24xx_ext, and abts_entry_24xx_ext) with a single __le16 scalar field and provide inline accessor functions that use proper le16_to_cpu()/cpu_to_le16() with shift-and-mask operations. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-42-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 34a40e0dff940ac5eba494a69b553ea571e24873 Author: Nilesh Javali Date: Thu Jul 23 10:33:57 2026 +0530 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 0267b4fbaba17664afd9239f52cf26168e70b230 Author: Manish Rangankar Date: Thu Jul 23 10:33:56 2026 +0530 scsi: qla2xxx: Adjust feature gating in BSG paths for 29xx support Extend qla2xxx BSG command handling to recognize QLA29xx adapters and align feature availability with hardware capabilities. Allow QLA29xx in paths previously restricted to QLA27xx/28xx: - Flash update capability queries (get/set) - BBCR data retrieval - D-port diagnostics - MPI and PEP version sysfs attributes Restrict unsupported operations on QLA29xx: - Reject flash image status query (no active image tracking) - Block qla28xx_validate_flash_image() Guard the qla27xx_get_active_image() call with an explicit IS_QLA27XX || IS_QLA28XX check so it is not reached from adapters that lack the legacy active-image layout. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-40-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 33c37242b8128fe6de92af26f9f9b48a9de1d568 Author: Manish Rangankar Date: Thu Jul 23 10:33:55 2026 +0530 scsi: qla2xxx: Add LS4 pass-through IOCB handling for 29xx series Extend the LS4 pass-through IOCB handling to support the 128-byte pt_ls4_request_ext layout used by 29xx series adapters. The extension grows inline DSD capacity from 2 to 5 entries. Function signatures are widened to void * so both layouts can be passed without casts. pt_ls4_request_ext overlays pt_ls4_request through exchange_address (offsets 0-27 are byte-identical), so common-header writes go through a single struct pt_ls4_request * view; only the divergent fields (vp_index width, tx_/rx_byte_count offset, dsd[] base) are branched. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-39-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit d7c8aacca8bb59bac3c328b3ad51bef64531f675 Author: Nilesh Javali Date: Thu Jul 23 10:33:54 2026 +0530 scsi: qla2xxx: Add size check for extended VP report ID entry Add reserved_end[64] padding to bring the struct to 128 bytes, matching the hardware IOCB stride. Change qla24xx_report_id_acquisition() to accept a void pointer and extract vp_idx and vp_status from the extended structure on 29xx series adapters, maintaining data integrity for the larger IOCB format. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-38-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 12df4a4ca03a5dc60c458e4be504417e33aedc87 Author: Nilesh Javali Date: Thu Jul 23 10:33:53 2026 +0530 scsi: qla2xxx: Add build-time size check for VP config IOCB layout Add a BUILD_BUG_ON for struct vp_config_entry_24xx_ext to verify its 128-byte size at compile time alongside the existing 64-byte check for struct vp_config_entry_24xx. Document in qla24xx_modify_vp_config() that the ext variant overlays the base 24xx layout for the first 64 bytes (all fields this helper reads and writes), so the IOCB can be built through a single struct vp_config_entry_24xx pointer regardless of the adapter's IOCB stride. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-37-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit d681a3315dffe87513ed87e11456b33e21dcfd65 Author: Nilesh Javali Date: Thu Jul 23 10:33:52 2026 +0530 scsi: qla2xxx: Update VP control IOCB handling for 29xx series Update VP control IOCB command and response handling to support the 29xx series adapters, which use the 128-byte vp_ctrl_entry_24xx_ext layout. Change the qla25xx_ctrlvp_iocb() and qla_ctrlvp_completed() function signatures from typed struct pointers to void *, since callers already pass a generic ring-slot pointer. Both the standard 64-byte vp_ctrl_entry_24xx and the 128-byte vp_ctrl_entry_24xx_ext are layout-identical for every field touched in these helpers (entry_type, handle, entry_count, command, vp_count, vp_idx_map, entry_status, comp_status, vp_idx_failed), so a single struct vp_ctrl_entry_24xx * view handles both adapter families without an IS_QLA29XX() branch. Add a BUILD_BUG_ON size check for the extended structure. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-36-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 3e8294e91dfe0480bfb42592b743ad17e38d4921 Author: Nilesh Javali Date: Thu Jul 23 10:33:51 2026 +0530 scsi: qla2xxx: Enhance ABTS processing for 29xx series Use extended ABTS entry structures (abts_entry_24xx_ext) for 29xx series adapters to properly handle the larger 128-byte IOCB format. Introduce type-generic macros (QLA_LOG_ABTS_RCV, QLA_BUILD_ABTS_BA_ACC, QLA_LOG_ISSUE_ABTS_RSP) that leverage the shared field names between abts_entry_24xx and abts_entry_24xx_ext to avoid code duplication. Branch on IS_QLA29XX() for receive logging, exchange termination, and BA_ACC response construction, with each path passing the correctly typed pointer to the shared macros. The sof_type handling difference (direct for 29xx bitfield vs & 0xf0 mask for legacy) is parameterized through the sof_val macro argument. Add BUILD_BUG_ON size check for struct abts_entry_24xx_ext. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-35-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit b4126180f73e45ef93f609886185b3d0aa5aecbf Author: Nilesh Javali Date: Thu Jul 23 10:33:50 2026 +0530 scsi: qla2xxx: Add abort command handling for 29xx series Extend the abort-IOCB code path to support the 29xx extended abort_entry_24xx_ext structure alongside the existing abort_entry_24xx. The two layouts overlay byte-for-byte through req_que_no (offsets 0-17): entry_status (offset 3), the nport_handle/comp_status union (offset 8), and options (offset 10) sit at identical positions in both. After that they diverge: the 24xx variant carries reserved_1[30], port_id[3], and a u8 vp_index at offsets 48-51, while the ext variant places a __le16 vp_index at offset 18 and drops port_id. The drv / fw unions live at offset 56 in the 24xx layout but offset 24 in ext. Leverage this overlap by using a single struct abort_entry_24xx * view for the common header writes (entry_type, count, handle, nport_handle, handle_to_abort, req_que_no) and completion-status reads (entry_status, comp_status), branching on IS_QLA29XX() only where the layouts genuinely diverge: - port_id (24xx-only) and vp_index width on the issue path (qla24xx_abort_iocb in qla_iocb.c, qla24xx_abort_command in qla_mbx.c); - drv / fw union access in qla_nvme_abort_set_option / qla_nvme_abort_process_comp_status (qla_nvme.c); - completion comp_status read in qla24xx_abort_iocb_entry (qla_isr.c) is stride-agnostic -- no IS_QLA29XX dispatch needed. Function signatures in qla_nvme_abort_set_option(), qla_nvme_abort_process_comp_status(), qla24xx_abort_iocb(), and qla24xx_abort_iocb_entry() are widened to accept void * so both struct variants can be passed through. memset() uses qla_req_entry_size(ha) to match the ring-slot size. Response status checking now reads comp_status instead of nport_handle. A BUILD_BUG_ON verifies abort_entry_24xx_ext is 128 bytes. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-34-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 67aff6b6fe8f678bb8b3ce4778dedd673db3c688 Author: Nilesh Javali Date: Thu Jul 23 10:33:49 2026 +0530 scsi: qla2xxx: Enhance task management IOCB handling for 29xx series Update qla24xx_tm_iocb() and __qla24xx_issue_tmf() to support the extended task management structure (tsk_mgmt_entry_ext) for 29xx adapters. tsk_mgmt_entry_ext overlays tsk_mgmt_entry through control_flags (offsets 0-27 are byte-identical): entry_type, entry_count, handle, nport_handle, timeout, lun and control_flags sit at the same offsets and widths. The layouts diverge only after that point: - the 24xx layout has port_id[3] + u8 vp_index; - the ext layout has __le16 vp_index and no port_id. Factor the common IOCB header writes through a single tsk_mgmt_entry * view and branch on IS_QLA29XX() only for the diverging port_id / vp_index assignments. Change qla24xx_tm_iocb() to accept void *pkt to allow casting to either structure type. Add tsk_ext member to the tsk_mgmt_cmd union and a BUILD_BUG_ON size check for the 128-byte extended structure. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-33-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit df8be1c1c7e36c98ea1954bce0d085975d1193cd Author: Nilesh Javali Date: Thu Jul 23 10:33:48 2026 +0530 scsi: qla2xxx: Add 29xx extended logio IOCB support The 29xx series uses a wider IOCB stride (128 bytes vs 64 bytes). The logio_entry_24xx_ext layout extends logio_entry_24xx with a wider vp_index field (__le16 vs u8) while keeping all other read-side fields (comp_status, io_parameter[0..10], entry_status) at identical offsets and widths. Update the logio IOCB builder functions (qla24xx_login_iocb, qla24xx_logout_iocb, qla24xx_prli_iocb, qla24xx_prlo_iocb, qla24xx_adisc_iocb) to accept a void pointer and dispatch the vp_index write through IS_QLA29XX(), using an inline cast to the extended layout at the single write site. In the completion handler qla24xx_logio_entry(), accept a void pointer and read through a single logio_entry_24xx view since all accessed fields sit at the same offsets in both layouts. Use the qla_req_entry_size() helper for the dump buffer size. In qla24xx_login_fabric() and qla24xx_fabric_logout(), allocate through a void pointer from the DMA pool and dispatch vp_index via the same inline-cast pattern. Add a BUILD_BUG_ON for logio_entry_24xx_ext to enforce the 128-byte size invariant at compile time. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-32-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 9b58a62f078078e068c40609fc4d3a775e4767d9 Author: Nilesh Javali Date: Thu Jul 23 10:33:47 2026 +0530 scsi: qla2xxx: Add size check for ELS status entry layout on 29xx Add a BUILD_BUG_ON in qla2x00_module_init() to validate that struct els_sts_entry_24xx_ext is 128 bytes, matching the 29xx firmware IOCB size. The extended layout (29xx) overlays the base els_sts_entry_24xx for every field read in qla24xx_els_ct_entry(): comp_status, total_byte_count, error_subcode_1/2, d_id[], s_id[], and control_flags all sit at byte-identical offsets in both structs. Only vp_index/sof_type at offset 14-15 differs (bit-packed differently in the ext variant), but that field is write-only on the issue path and never read in this completion handler. Add a docblock at the top of qla24xx_els_ct_entry() documenting this layout property. Improve a few log messages for clarity. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-31-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 87a42b53f43e6368ac38fd802501d0eaa673b7bc Author: Nilesh Javali Date: Thu Jul 23 10:33:46 2026 +0530 scsi: qla2xxx: Update handling of ELS IOCBs for 29xx series Update ELS IOCB handling to support the extended 128-byte els_entry_24xx_ext structure used by 29xx series adapters. Change the signatures of qla24xx_els_logo_iocb(), qla_els_pt_iocb(), and qla24xx_els_iocb() to accept a generic void pointer, enabling differentiation between standard and extended ELS structures at runtime. Introduce a static inline helper qla_els_set_vp_sof() in qla_inline.h that centralises the 24xx-vs-29xx vp_index/sof_type encoding: the 24xx layout uses separate u8 vp_index + u8 sof_type (EST_SOFI3), while 29xx uses a __le16 with bitfields (vp_index:9 / sof_type:4 / ELS_EXT_EST_SOFI3). All ELS issue paths now call this helper instead of open-coding the branch, including the RDP response path in qla_os.c. In qla2x00_start_sp(), collapse the IS_QLA29XX() branch for the handle assignment in SRB_ELS_CMD_HST_NOLOGIN: els_entry_24xx::handle and els_entry_24xx_ext::handle are both u32 at offset 4, so a single 24xx-view write is layout-compatible with both strides. DMA allocations in qla24xx_process_abts() and qla24xx_process_purex_rdp() are updated to use the correct size for the adapter type. A BUILD_BUG_ON is added to verify the extended structure size. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-30-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 7db93e3c580d4176bf99c4820d0232d8cc02f2c8 Author: Nilesh Javali Date: Thu Jul 23 10:33:45 2026 +0530 scsi: qla2xxx: Enhance purex_entry handling for 29xx series Update function signatures and internal logic across qla_edif.c, qla_isr.c, and qla_os.c to accept a generic pointer for packet data and differentiate between standard purex_entry_24xx and the extended purex_entry_24xx_ext structures based on IS_QLA29XX(). This ensures proper initialization and processing of command and response data for both 64-byte and 128-byte PUREX IOCBs across all ELS paths including auth_els, RDP, copy_std_pkt, copy_multiple_pkt, consume_iocb, and copy_purex_to_buffer. Where the two layouts overlap at byte-identical offsets (entry_count, frame_size, nport_handle, rx_xchg_addr, ox_id, status_flags, trunc_frame_size, s_id, d_id, els_frame_payload base, and response_t::signature), use a single struct purex_entry_24xx * view to avoid duplicating read paths. Branch only where field encoding differs: vp_idx (u8 at offset 6 in 24xx vs __le16 at offsets 6-7 in 29xx) and els_frame_payload[] array length (20 vs 84 bytes, handled via a sizeof_field()-based payload_size local). Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-29-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit c454800348a4e0c70503bd3d4c2dcc27dfdb19e6 Author: Nilesh Javali Date: Thu Jul 23 10:33:44 2026 +0530 scsi: qla2xxx: Enhance ct_entry_24xx_ext iocb handling for 29xx series Refine the handling of I/O control blocks (IOCBs) for the 29xx series by introducing support for the extended structure ct_entry_24xx_ext. Update function signatures to accept a generic pointer for IOCB packets, differentiating between standard and extended structures, and ensuring proper initialization and processing of command and response data. Additionally, the size check for the extended structure is added to maintain integrity. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-28-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 4cff96e29e3f911cf40e6e31970694bc2d248aac Author: Nilesh Javali Date: Thu Jul 23 10:33:43 2026 +0530 scsi: qla2xxx: Update handling of status entries for 29xx series Modify the handling of status entries in the qla2xxx driver to accommodate the extended structure for the 29xx series. Changes include updating function signatures to accept a generic pointer for status packets, and adjusting the logic to differentiate between the standard and extended status entries. This ensures proper processing of completion statuses and error handling for the new hardware capabilities. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-27-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 2eba3833a1c3ba16a255967528afb2fa6b183f46 Author: Nilesh Javali Date: Thu Jul 23 10:33:42 2026 +0530 scsi: qla2xxx: Handle sts_cont_entry_ext_t for 29xx adapters 29xx adapters use 128-byte response queue entries (sts_cont_entry_ext_t) instead of 64-byte (sts_cont_entry_t). Update all status continuation IOCB processing paths to branch on IS_QLA29XX() and use the correct entry type and data payload size. The affected functions are __qla_copy_purex_to_buffer(), qla27xx_copy_multiple_pkt(), qla2x00_status_cont_entry(), and their call sites in qla2x00_process_response_entry() and qla24xx_process_response_queue(). Change qla2x00_status_cont_entry() to accept void * so callers no longer need an explicit cast and the function can internally select the right structure based on the adapter type. Add BUILD_BUG_ON for sts_cont_entry_ext_t size (128 bytes). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202607142020.gqDaApes-lkp@intel.com/ Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-26-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 71037e82d22b50175338efd9ca8c0885963a57a5 Author: Nilesh Javali Date: Thu Jul 23 10:33:41 2026 +0530 scsi: qla2xxx: Add support for QLA29XX in memory allocation Enhance the qla2x00_mem_alloc function to include checks for QLA29XX adapters. This modification updates the conditions for memory allocation and cleanup, ensuring proper handling of the new adapter series alongside existing QLA27XX and QLA28XX checks. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-25-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 7e51b6d2d8f6b7f48d9cef1cf87471b55b12f6de Author: Nilesh Javali Date: Thu Jul 23 10:33:40 2026 +0530 scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs __qla2x00_alloc_iocbs() open-codes ring pointer selection and entry size based on IS_QLA29XX(ha): 29xx reaches the slot via ring_ext_ptr and zeroes REQUEST_ENTRY_SIZE_EXT bytes, while other adapters use ring_ptr with REQUEST_ENTRY_SIZE bytes. Replace the two branches with the qla_req_ring_slot() and qla_req_entry_size() helpers, and initialise pkt at declaration. The IS_QLAFX00 register-mapped writes remain guarded because IS_QLAFX00 and IS_QLA29XX cannot be true simultaneously. No functional change: the bytes written to the firmware-visible IOCB are identical. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-24-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 15801ba76cd06914646a3614af0b3bdf707b4c9b Author: Nilesh Javali Date: Thu Jul 23 10:33:39 2026 +0530 scsi: qla2xxx: Enable qla2x00_shutdown for 29xx Enable qla2x00_shutdown for 29xx adapter by adding IS_QLA29XX check to the shutdown path that performs firmware abort cleanup. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-23-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 1e58589e619a8ff113119b1fc63b29846b40226b Author: Nilesh Javali Date: Thu Jul 23 10:33:38 2026 +0530 scsi: qla2xxx: Add support for QLA29XX in data rate functions Enhance the qla2x00_set_data_rate and qla2x00_get_data_rate functions to include checks for the QLA29XX series adapters. This modification ensures that the mailbox commands are correctly configured for the 29xx series, improving functionality and compatibility. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-22-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 9cef67b0b20f26fe3b24ce0b3fc18163c70ce587 Author: Nilesh Javali Date: Thu Jul 23 10:33:37 2026 +0530 scsi: qla2xxx: Enable set_els_cmds and echo_test for 29xx Add IS_QLA29XX() checks to qla25xx_set_els_cmds_supported() and qla2x00_echo_test() so that ELS command support and echo test diagnostics are available on 29xx series adapters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-21-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 2c708e15b893b567c2f429e6ca1a06543b35c333 Author: Nilesh Javali Date: Thu Jul 23 10:33:36 2026 +0530 scsi: qla2xxx: Enable serdes, resource count and FCE trace for 29xx The 29xx adapters share the diagnostic and management interfaces already supported on ISP27xx/28xx, but several family capability gates still omitted IS_QLA29XX(), leaving these paths unreachable on 29xx. Add IS_QLA29XX() to the relevant checks so the following work on 29xx adapters: - Read/write SerDes word mailbox commands for PHY register access. - get_resource_cnts requests MBX_12 to report the extended firmware resource counts. - FCE trace: the enable-FCE mailbox command, the "fce" and "fw_resource_count" debugfs nodes in qla2x00_dfs_setup(), the debugfs enable write in qla2x00_dfs_fce_write(), and the FCE DMA buffer allocation in qla2x00_alloc_fce_trace(). Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-20-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 94167fcf21422c8a7858a57b244f24bc4909e3c0 Author: Nilesh Javali Date: Thu Jul 23 10:33:35 2026 +0530 scsi: qla2xxx: Enable get_firmware_state for 29xx Enable get_firmware_state mailbox command for 29xx adapters by adding IS_QLA29XX() checks alongside existing IS_QLA27XX/IS_QLA28XX checks. This ensures MBX_12 (MPI state) is properly set up and reported for 29xx adapters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-19-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit d0a0b58c580f5970820c53d5d073c12cd6a0ca2b Author: Nilesh Javali Date: Thu Jul 23 10:33:34 2026 +0530 scsi: qla2xxx: Enable init_firmware mailbox for 29xx The init_firmware mailbox command needs 29xx adapter support for reading back SFP information via mb3 and for validating SFP status on successful firmware initialization. Add IS_QLA29XX() checks alongside the existing 27xx/28xx checks. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-18-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit f19bfabc88d7ffb544e50c5004e456e669bd6859 Author: Nilesh Javali Date: Thu Jul 23 10:33:33 2026 +0530 scsi: qla2xxx: Enable get_adapter_id mailbox for 29xx Add IS_QLA29XX() alongside the existing 27xx/28xx checks in qla2x00_get_adapter_id() so that the additional mailbox registers (buffer-to-buffer credit, SCM/EDC status) are read on 29xx adapters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-17-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit c1c1cf13c4a429f6e59c8768a229d3d039973588 Author: Nilesh Javali Date: Thu Jul 23 10:33:32 2026 +0530 scsi: qla2xxx: Extend execute_fw mailbox to include 29xx Add IS_QLA29XX() to the BPM capability macros and to the execute-firmware mailbox command so that NVMe enable, minimum speed negotiation, 128 Gbps speed reporting, EDIF hardware detection, and FW-semaphore retry logic all apply to 29xx adapters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-16-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 33835422f1cf36567620035f70d729b4d709f454 Author: Nilesh Javali Date: Thu Jul 23 10:33:31 2026 +0530 scsi: qla2xxx: Enable get_fw_version mailbox for 29xx The serdes_version and several firmware capability fields were not populated for 29xx because the get_fw_version mailbox path excluded it from the 27xx/28xx checks. Add IS_QLA29XX() to the relevant conditionals so that firmware version, EDIF, and serdes information are correctly retrieved on 29xx adapters. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-15-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit a27dd7151dee8aa11d1519ff1f5a8cbdcaa26953 Author: Nilesh Javali Date: Thu Jul 23 10:33:30 2026 +0530 scsi: qla2xxx: Skip unsupported sysfs attributes for 29xx Not all sysfs attributes are applicable to the 29xx adapter. Return -EPERM for attributes that are meaningless on 29xx (gold firmware version, 84xx firmware version, flash block size, VLAN ID, VN-port MAC address, and CNA firmware dump toggle) so that userspace tools do not see stale or undefined values. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-14-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit e65a475117dfdd09dc94b429554c93980f2e2e02 Author: Nilesh Javali Date: Thu Jul 23 10:33:29 2026 +0530 scsi: qla2xxx: Skip image-set-valid attribute for 29xx The 29xx adapter does not support the QLA_IMG_SET_VALID_SUPPORT driver attribute. Gate the attribute behind an IS_QLA29XX() check so that userspace applications querying driver capabilities via BSG receive accurate information. Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-13-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit b6781d71a41450418a1486122978ad5bb429136b Author: Anil Gurumurthy Date: Thu Jul 23 10:33:28 2026 +0530 scsi: qla2xxx: Update IO path to use 128-byte IOCBs for 29xx Wire the 128-byte extended IOCB structures into the IO submission, completion, and queue-management paths. On 29xx adapters the driver now builds cmd_type_6_ext / cmd_type_7_ext command IOCBs and processes the corresponding extended status entries, while falling back to the existing 64-byte IOCBs for earlier adapters. Ring entry-size selection uses the qla_req_entry_size() / qla_rsp_entry_size() helpers and ring slot advancement uses qla_req_ring_advance() rather than open-coding IS_QLA29XX() branches at every call site. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202607141827.R9mpeMZx-lkp@intel.com/ Signed-off-by: Anil Gurumurthy Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/oe-kbuild-all/202607141827.R9mpeMZx-lkp@intel.com/ Link: https://patch.msgid.link/20260723050413.3897522-12-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 105370bf4cb35914f409b16edb6ae15fdcaffd4a Author: Anil Gurumurthy Date: Thu Jul 23 10:33:27 2026 +0530 scsi: qla2xxx: Add extended status continuation and marker IOCBs Add the 128-byte sts_cont_entry_ext_t and mrk_entry_ext_t structures required by 29xx firmware. Include the qla_fw29.h header from qla_def.h so the new types are available throughout the driver. Signed-off-by: Anil Gurumurthy Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-11-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 204d237aaf9d4913be06d3bf11dafb0808d22789 Author: Anil Gurumurthy Date: Thu Jul 23 10:33:26 2026 +0530 scsi: qla2xxx: Add 128-byte IOCB definitions for 29xx The 29xx series uses 128-byte IOCBs instead of the 64-byte IOCBs used by earlier adapters. Add a new header (qla_fw29.h) with the extended IOCB structure definitions that match the 29xx firmware interface. Signed-off-by: Anil Gurumurthy Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-10-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 514664aa303d7c65c48cae49568ed0017dbec7db Author: Manish Rangankar Date: Thu Jul 23 10:33:25 2026 +0530 scsi: qla2xxx: Add BSG MPI firmware load/dump for 29xx Add BSG vendor commands for loading and dumping MPI firmware on 29xx adapters. This extends the existing BSG infrastructure with the necessary mailbox wrappers and flash helpers for MPI operations. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-9-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 2efa08b894c6bf2221acdac428c4bfac3c300f9e Author: Manish Rangankar Date: Thu Jul 23 10:33:24 2026 +0530 scsi: qla2xxx: Add flash block read/write BSG support for 29xx Introduce QL_VND_READ_FLASH_BLOCK and QL_VND_WRITE_FLASH_BLOCK BSG vendor commands so that userspace tools can perform flash block-level operations on 29xx adapters via the isp_ops interface. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-8-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 5cbc49d5c4cd20c18041e86958103045216d2190 Author: Manish Rangankar Date: Thu Jul 23 10:33:23 2026 +0530 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call. Fixes: 5fa8774c7f38 ("scsi: qla2xxx: Add 28xx flash primary/secondary status/image mechanism") Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-7-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit c3930ec119cb916be879c017ea1e389e05dbe1aa Author: Manish Rangankar Date: Thu Jul 23 10:33:22 2026 +0530 scsi: qla2xxx: Add FC operational firmware load for 29xx Add support to load the 29xx FC operational firmware from the filesystem and to set up the corresponding firmware dump template. This follows the same request_firmware / segment-load pattern used by earlier adapters. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-6-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit c8944d20a3f6925258012ff92ea932167b5c5cc3 Author: Manish Rangankar Date: Thu Jul 23 10:33:21 2026 +0530 scsi: qla2xxx: Add 29xx support in queue initialisation path Extend the queue initialisation and multi-queue management mailbox commands to include IS_QLA29XX() checks, following the same mailbox interface as 27xx/28xx. Unlike earlier adapters that use 64-byte request/response ring entries (request_t / response_t), 29xx uses 128-byte entries. Add struct request_ext and struct response_ext, which extend the legacy 64-byte layout with a 64-byte reserved area. The first 64 bytes are layout-compatible with the legacy structures, so common header accesses remain valid. The enlarged entry stride doubles the DMA ring memory allocated for both request and response queues on 29xx, and all ring pointer arithmetic must account for the wider entries (handled by later patches in this series). Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-5-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 5b5a8cc2a74e34a79141c1d60324d5312298c9f7 Author: Manish Rangankar Date: Thu Jul 23 10:33:20 2026 +0530 scsi: qla2xxx: Add NVRAM config support for 29xx adapters Extend the NVRAM read and configuration-apply paths to handle the 29xx series. The 29xx NVRAM layout is similar to the 81xx family, so reuse the existing nvram_81xx parsing while adding 29xx-specific fields and init-sequence integration. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202607141733.w1IF5m43-lkp@intel.com/ Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-4-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 3d2e901768c763bc6372b8e272f81f8a56595988 Author: Manish Rangankar Date: Thu Jul 23 10:33:19 2026 +0530 scsi: qla2xxx: Add flash read/write interface for 29xx The 29xx series uses a different flash access mechanism than earlier adapters. Add the mailbox wrappers and qla_sup helpers needed for flash read and write operations, including the necessary hooks in isp_ops so that the existing flash infrastructure can drive the new hardware. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202607141520.k9T31Dpp-lkp@intel.com/ Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/oe-kbuild-all/202607141520.k9T31Dpp-lkp@intel.com/ Link: https://patch.msgid.link/20260723050413.3897522-3-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit af711d68e61b992f4e86942dab59fe01938a11c9 Author: Manish Rangankar Date: Thu Jul 23 10:33:18 2026 +0530 scsi: qla2xxx: Add 29xx series PCI device ID support The QLA29xx is a new generation FC HBA that shares much of its architecture with the 27xx/28xx family. Register the new PCI device IDs, wire up IS_QLA29XX() capability checks in the probe and ISP-flags paths, and extend speed-capability logic so the driver correctly recognises and initialises 29xx adapters. Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260723050413.3897522-2-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 610bece660b59a297ab3d4bd7c02685d7dc9a49b Author: John Garry Date: Wed Aug 5 14:59:06 2026 +0000 scsi: alua: Use access state macros Use the SCSI access state macros in alua_rtpg(), which is better than hardcoding. Signed-off-by: John Garry Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260805145906.2825553-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) commit d756863c9bdf7a85a3fa7fc2886aa32023fe7f76 Author: Piotr Zarycki Date: Mon Jun 29 08:22:57 2026 +0200 scsi: isci: Remove unused macros from scu_task_context.h Remove three accessor macros that are defined but never used: - scu_get_command_request_subtype() - scu_get_command_request_full_type() - scu_get_command_protocl_engine_group() Also remove SCU_CONTEXT_COMMAND_REQUEST_FULLTYPE_MASK and SCU_CONTEXT_COMMAND_PROTOCOL_ENGINE_GROUP_MASK which were only referenced by the removed macros. Signed-off-by: Piotr Zarycki Link: https://patch.msgid.link/20260629062257.986945-1-piotr.zarycki@gmail.com Signed-off-by: Martin K. Petersen commit 2ad156d5300a24f21059432649dc0b726bcdbaa2 Author: Kai Mäkisara Date: Fri Jul 24 08:59:23 2026 +0300 scsi: MAINTAINERS: Orphan the SCSI tape driver Time to retire from the role of maintainer. Signed-off-by: Kai Mäkisara Link: https://patch.msgid.link/20260724055923.4793-1-Kai.Makisara@kolumbus.fi Signed-off-by: Martin K. Petersen commit c79f9bf2d87f34904d9ae38f198929be2b4313e2 Author: Sang-Heon Jeon Date: Fri Jul 24 03:45:32 2026 +0900 scsi: mpt3sas: Remove conditional return with no effect Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon Link: https://patch.msgid.link/20260723184538.3888637-31-ekffu200098@gmail.com Signed-off-by: Martin K. Petersen commit 0279fd451a9971c0d5b959fc59f3e11b55e1694e Author: Ao Sun Date: Thu Jul 23 03:45:30 2026 +0000 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Co-developed-by: Jiazi Li Signed-off-by: Jiazi Li Signed-off-by: Ao Sun Reviewed-by: Bean Huo Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com Signed-off-by: Martin K. Petersen commit 2265541d221dc550dc89b52e49e9d9eb2f824996 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:11 2026 -0700 scsi: fnic: Bump up version number Bump up version number to 1.9.0.0. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Tested-by: Karan Tilak Kumar Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-14-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 8ef412ce8bb3fa984d01f6960a3a3408c2843c33 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:10 2026 -0700 scsi: fnic: Expose NVMe transport state in debugfs Create an NVMe debugfs directory with a per-host nvmef_info file. Report local-port and target-port identifiers for NVMe initiator instances, and initialize and remove the debugfs entries with the NVMe probe and teardown paths. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-13-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit d25a557d344f477ccdc6b711ace77c4d5484a370 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:09 2026 -0700 scsi: fnic: Track NVMe transport statistics Add counters for NVMe requests, responses, LS handling, aborts, and wait-queue activity. Update NVMe I/O, completion, LS response, LS abort, and abort paths to maintain the new counters. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280519.Jd4fmgAZ-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-12-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit f06ee33d72f5baabcc27c60be6fed95d164a06c1 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:08 2026 -0700 scsi: fnic: Abort timed-out NVMe LS requests Add an FDLS helper that sends ABTS frames for outstanding NVMe LS requests. Use the active LS request OXID when building the ABTS frame, send it through the FCoE transmit path, and call it from LS timeout and abort handling. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-11-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 39bf075599bd1eb533c2c7414c79a39dd36de063 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:07 2026 -0700 scsi: fnic: Send NVMe LS requests through FDLS Add the FC frame wrapper for NVMe LS requests and build LS request frames from the NVMe-FC transport callback. Allocate OXIDs, track outstanding LS requests on the target port, arm request timers, and register the LS request callback in the NVMe FC port template. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-10-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 021db11aba3b24525845a2b72981e3d21a591da9 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:06 2026 -0700 scsi: fnic: Handle NVMe LS frames in FDLS Classify NVMe LS request OXIDs, route NVMe LS responses and ABTS frames through the FCS receive path, and reset NVMe exchanges when FDLS tears down target ports. Extend FDLS link-down and frame-processing paths so NVMe LS traffic follows the same discovery and cleanup state machine as FCP traffic. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-9-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit b3f4bc0a7aec4ff48780564f955aa4ee141864e9 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:05 2026 -0700 scsi: fnic: Route completions and resets by initiator role Dispatch FCPIO command, response, and ITMF completions to the FCP or NVMe handlers based on the configured role. Read the NVMe queue-depth and timeout retry fields from firmware config, clean up NVMe I/O on firmware reset, and skip SCSI-only cleanup for initiator roles that already reset firmware-owned requests. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-8-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 5efdd5cf928188023080a01312323bb38e02656e Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:04 2026 -0700 scsi: fnic: Add the NVMe/FC transport path Build fnic_nvme.c and fnic_nvme.h into the driver. Add NVMe local-port and remote-port registration, I/O submission, DMA mapping, tag management, completion and abort handling, LS response handling, and tport/lport cleanup. Update shared fnic structures, FCPIO descriptors, FDLS state, and device-command definitions needed by the NVMe transport path. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280430.wTYAqI3A-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280519.Jd4fmgAZ-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-7-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 188dfadf025a172142cca34ed5009f3dfcf2d0ad Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:03 2026 -0700 scsi: fnic: Add FDLS role handling for NVMe initiators Modify FDLS registration and discovery flows to use NVMe FC-4 type, features, PRLI service parameters, and FDMI attributes when the adapter runs as an NVMe initiator. Limit SCSI host setup, teardown, rport reset, and FC host notifications to FCP initiators while keeping target-port events available to both FCP and NVMe roles. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-6-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 20b991c3022904b7c2fd38c49ecfdaf17bc1d2f0 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:02 2026 -0700 scsi: fnic: Advertise NVMe initiator service parameters Set FC service parameters according to the selected initiator role. Keep FCP retry and confirmation bits for FCP initiators, and advertise NVMe initiator and SLER bits for NVMe initiators. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-5-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 12bd1b29128e31ae647802452b8104acf5f66741 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:01 2026 -0700 scsi: fnic: Decode firmware role configuration Add FNIC_ROLE_CONFIG_MASK and use it to decode firmware role bits when reading vNIC configuration and probing the PCI device. Accept FCP and NVMe initiator roles, report FC target and FC-NVMe target roles explicitly as unsupported, and keep truly undefined role settings on the existing FC initiator default path. Log the configured role flags and expose role names for trace output. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-4-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 6128fec9417313690057e55d9313f4148941b9da Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:00 2026 -0700 scsi: fnic: Use fnic_num for non-SCSI identifiers Use SCSI host numbers only for FCP initiator paths. Name NVMe-facing FDMI and debugfs entries with fnic_num, and record trace events with the driver instance number. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-3-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit b93c38a9f2ce5441c90de55776f8df97679cf8a2 Author: Karan Tilak Kumar Date: Fri Jul 24 10:47:59 2026 -0700 scsi: fnic: Make debug logging protocol independent Make the fnic debug macros take struct fnic instead of struct Scsi_Host so FCP and NVMe initiator roles can share the same logging interface. Add fnic_printk() to route FCP initiator messages through shost_printk() and non-SCSI role messages through printk(). Add role and non-SCSI role messages through printk(). Add role predicates and separate FDLS, FIP, and NVMe logging masks. Convert FCS, FIP, SCSI, ISR, and main debug call sites to pass the fnic instance directly, and keep FIP VLAN MAC descriptors skipped while reporting unexpected descriptor types. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-2-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit dff03860a722e7f1d0a10bb22628d7896bd4b5ec Author: Chinmaya Kajagar Date: Tue Jul 28 06:48:57 2026 +0200 scsi: zfcp: Trace return values of sysfs unit add store sysfs unit add failures are seen during FCP devices manual SCSI LUN scans, indicating the kernel cannot add a LUN, usually because the device is offline, already exists, no memory or the target port is incorrectly configured. Add a new trace to debug zfcp sysfs unit add failures with tag id ZFCP_DBF_HBA_UAS. This traces wwpn, fcp lun id, return value (error condition) and associated hba of the device. Typical unit add store failures as seen below example syslog messages, Feb 2 10:47:25 systemd-udevd[823]: rport-1:0-2: /etc/udev/ rules.d/41-zfcp-lun-0.0.50c0:0x500507680b26c449:0x01d2000000000000.rules:10 Failed to write ATTR{/sys/devices/css0/0.0.0015/0.0.50c0/0x500507680b26c449 /unit_add}, ignoring: File exists Feb 2 10:50:03 systemd-udevd[801]: rport-2:0-3: /etc/udev/ rules.d/41-zfcp-lun-0.0.50c0:0x500507680b26c448:0x01d2000000000000.rules:10 Failed to write ATTR{/sys/devices/css0/0.0.0015/0.0.50c0/0x500507680b26c448 /unit_add}, ignoring: Cannot allocate memory Example zfcpdbf traces for both the errors: Timestamp : 2026-03-05-07:28:34:029797 Area : HBA Subarea : 00 Level : 3 Exception : - CPU ID : 0002 Caller : 0x000001fe345e6d0e Record ID : 6 Tag : syuast2 Description : syuast2 HBA, unit add, failed, unable to add unit Request ID : 0x00000000ffffffff Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff WWPN : 0x500507680b25c448 LUN : 0x01d3000000000000 Return Value : 0xfffffff4 Timestamp : 2026-03-05-07:33:04:151807 <== the last record Area : HBA Subarea : 00 Level : 3 Exception : - CPU ID : 0002 Caller : 0x000001fe345e6d0e Record ID : 6 Tag : syuast2 Description : syuast2 HBA, unit add, failed, unable to add unit Request ID : 0x00000000ffffffff Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff WWPN : 0x500507680b25c449 LUN : 0x01d0000000000000 Return Value : 0xfffffff4 Link: https://patch.msgid.link/20260728044857.2532646-4-niharp@linux.ibm.com Signed-off-by: Chinmaya Kajagar Signed-off-by: Martin K. Petersen commit 3efec904df6f7b0ca9e6267e9aea543402f01886 Author: Steffen Maier Date: Tue Jul 28 06:48:56 2026 +0200 scsi: zfcp: Trace PLOGI and PRLI within open port response as payload The FCP channel optionally returns the content of PLOGI and PRLI within open port response. This information is needed to debug unexpected open port responses. Pack both PLOGI and PRLI information back-to-back into a PAYload trace record of type "fsf_els" within existing HBA trace record. The length of both parts, and thus also the offset of the second part, are added to the corresponding HBA trace record. Be extra careful regarding bounds checking. Since auto port scan in multi-initiator zoning environments can cause a lot of failed open port responses and trace is enabled by default in the HBA trace area, chose a trace level 4 above the default of 3 for the corresponding PAYload trace record to contain PLOGI/PRLI data. This way, it avoids flooding the PAY area by default. In the spirit of commit 35f040df97fa ("zfcp: retain trace level for SCSI and HBA FSF response records"), pass the level here. For this, introduce an additional argument 'level' for zfcp_dbf_pl_write(). zfcpdbf tool partial trace example with PLOGI/PRLI log info after changes: PLOGI length : 116 PRLI length : 20 Payload time : 2026-01-29-06:19:15:626629 PLOGI/PRLIinfo : 02000000 00000000 80000800 000a0002 00000000 2002000e 1115c62f 2001000e 1115c62f 00000000 00000000 00000000 00000000 80000000 00000000 00000000 00000000 80000000 00000000 000a0000 00010000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 02100014 08002100 00000000 00000000 00000112 Reviewed-by: M Nikhil Reviewed-by: Nihar Panda Signed-off-by: Steffen Maier Co-developed-by: Chinmaya Kajagar Signed-off-by: Chinmaya Kajagar Link: https://patch.msgid.link/20260728044857.2532646-3-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5994844195e9a2ead1d1f5ba65b653debb9f1e35 Author: Chinmaya Kajagar Date: Tue Jul 28 06:48:55 2026 +0200 scsi: zfcp: Enhance fsf status read buffer tracing SRB trace records are logged through hba trace event zfcp_dbf_hba_fsf_uss. Presently, this trace event has few missing fields in fsf status read buffer trace records. To fully trace incoming fsf status read buffer (SRB), the remaining fields are needed to be added to zfcp_dbf_hba_uss structure. Append all the remaining SRB fields to the existing unsolicited status trace records. Extend driver to get 3 bytes source id s_id value from fsf status read buffer's existing reserved field res3. To display this change, we also change the external tool `zfcpdbf` in the s390-tools package. zfcpdbf tool trace example for HBA area after changes: Timestamp : 2025-08-22-05:52:04:171750 Area : HBA Subarea : 00 Level : 2 Exception : - CPU ID : 0003 Caller : 0x0000021e278c07c8 Record ID : 2 Tag : fssrh_4 Description : fssrh_4 HBA, FSF unsolicited status Request ID : 0x0000000000004bfc Request status : 0x00000000 FSF cmnd : 0x00006305 FSF sequence no: 0x00000000 SRB stat type : 0x00000002 SRB stat sub : 0x00000000 SRB D_ID : 0x00fffffd SRB LUN : 0x0000000000000000 SRB q-design. : 0x0000000000000000 SRB length : 0x0000004c SRB res1 : 00000000 SRB res2 : 00 SRB class : 0x00000000 SRB res3 : 00 SRB S_ID : 0x0033c048 SRB res4 : 00000000 00000000 00000000 00000000 00000000 SRB pay length : 12 Payload time : 2025-08-22-05:52:04:171743 SRB info : 6104000c 0033c024 0033c02e Reviewed-by: Benjamin Block Signed-off-by: Chinmaya Kajagar Link: https://patch.msgid.link/20260728044857.2532646-2-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit ccff8c92571500fcfed21281e33daaf645bf692f Author: Chandrakanth Patil Date: Fri Jul 24 23:22:31 2026 +0530 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations here, both the local kzalloc_obj() and the ones inside kobject_uevent_env() itself, can trigger reclaim that waits on that blocked I/O and deadlock. Use memalloc_noio_save()/restore() to cover the whole call instead of just the local allocation. Fixes: ec54b348f274 ("scsi: mpi3mr: Record and report controller firmware faults") Reported-by: sashiko-bot Closes: https://sashiko.dev/#/patchset/20260724164630.924288-1-chandrakanth.patil%40broadcom.com Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260724175231.935192-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 913337c48e6aad5f8fac2f9d1a7b3a345b03b963 Author: David Strahan Date: Wed Jul 22 17:04:01 2026 -0500 scsi: smartpqi: Update version to 2.1.42-011 Update driver version to 2.1.42-011. Signed-off-by: David Strahan Reviewed-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-5-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit 1a220e6e87a31c2572cd07ff47023e5cd92ac80f Author: David Strahan Date: Wed Jul 22 17:04:00 2026 -0500 scsi: smartpqi: Add new PCI device-ids All PCI ID entries in Hex. Add PCI IDs for Hurray Data controllers: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 207d / 4246 9005 / 028f / 207d / 4256 9005 / 028f / 207d / 4356 9005 / 028f / 207d / 4940 9005 / 028f / 207d / 4a46 Add PCI IDs for ZTE controllers: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 1cf2 / 5451 9005 / 028f / 1cf2 / 5452 9005 / 028f / 1cf2 / 5453 Add PCI ID for Ramaxel controller: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 1f3f / 0670 Signed-off-by: David Strahan Reviewed-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-4-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit c64b2ab2ff516a94109020e8caea605ae09ea6d9 Author: David Strahan Date: Wed Jul 22 17:03:59 2026 -0500 scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl Add pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl requests. The existing passthru ioctl uses a 16-bit integer for the I/O buffer size, limiting transfers to 64KB. The big passthru ioctl uses BIG_IOCTL_Command_struct which stores the buffer size as a 32-bit integer, allowing larger transfers required by some management utilities. Add CCISS_BIG_PASSTHRU_SUPPORTED to uapi/linux/cciss_ioctl.h and return 0 from pqi_ioctl() to advertise driver support. Userspace tools can send this ioctl to probe whether the driver supports CCISS_BIG_PASSTHRU before issuing it. Co-developed-by: Mike McGowen Signed-off-by: Mike McGowen Signed-off-by: David Strahan Acked-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-3-david.strahan@microchip.com/ Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-3-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit 225548863f0a2350c6f34231ca56710c3dd1a5d5 Author: David Strahan Date: Wed Jul 22 17:03:58 2026 -0500 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. On recent Linux kernels the driver can enter a retry loop on the AIO fast path when a request is retried, looping until timeout. A diagnostic path that takes a physical drive offline on AIO-bypass failure is also never entered on affected kernels. Register a per-command initialization callback with the SCSI core. Its presence causes the core to skip the per-dispatch clear, so the retry marker now survives across the requeue and the AIO-to-RAID fallback proceeds as intended. The driver takes over the marker's lifetime: it is zeroed at tag allocation, preserved across the retry requeue so the error path can act on it, and cleared on terminal completion so the tag starts clean on its next use. Fixes: dce5c4afd035 ("scsi: core: Clear driver private data when retrying request") Co-developed-by: Mike McGowen Signed-off-by: Mike McGowen Acked-by: Don Brace Signed-off-by: David Strahan Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-2-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit a8ddfd2425bbbafadae8700d63ed8a61a4109878 Author: Leon Romanovsky Date: Wed Jul 22 09:30:10 2026 +0300 scsi: target: Clear cmd_cnt when initial counter enrollment fails When target_get_sess_cmd() fails during session shutdown because percpu_ref_tryget_live() returns false, the command keeps the se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier without owning a reference. Final release through target_release_cmd_kref() then issues an unmatched percpu_ref_put(). Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup") moved the cmd_cnt assignment ahead of the reference acquisition. Clear se_cmd->cmd_cnt whenever the initial target_get_sess_cmd() fails in target_init_cmd() and target_submit_tmr(), so release performs exactly one matching put per acquired reference. Fixes: 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup") Signed-off-by: Leon Romanovsky Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260722-reference-count-underflow-in-target-v1-1-63ab664f12fd@nvidia.com Signed-off-by: Martin K. Petersen commit b601fa590e667bd9643feed8c869b6b3e418480d Author: Benjamin Block Date: Mon Jul 20 09:27:36 2026 +0200 scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req When releasing an adapter we don't free the mempool 'gid_pn_req' that is allocated during the enqueue. This leaks memory: unreferenced object 0xd8d29297de700 (size 256): comm "(udev-worker)", pid 2105, jiffies 4294945794 hex dump (first 32 bytes): 00 00 00 00 de ad 4e ad ff ff ff ff 00 00 00 00 ......N......... ff ff ff ff ff ff ff ff 00 0d c4 5f 67 9d 99 e0 ..........._g... backtrace (crc 4a5b5da2): [<000dc45f64da418c>] kmemleak_alloc+0x6c/0xa0 [<000dc45f62b430aa>] __kmalloc_cache_node_noprof+0x36a/0x4d0 [<000dc45f629a535a>] mempool_create_node_noprof+0xaa/0x150 [<000dc45ee2c065e6>] zfcp_allocate_low_mem_buffers+0x96/0x370 [zfcp] [<000dc45ee2c070f8>] zfcp_adapter_enqueue+0x598/0xd40 [zfcp] [<000dc45ee2c08eb0>] zfcp_ccw_set_online+0x160/0x210 [zfcp] [<000dc45f643d4762>] ccw_device_set_online+0x232/0xd80 [<000dc45f643d53d4>] online_store_recog_and_online+0x124/0x390 [<000dc45f643d8238>] online_store+0x298/0x5b0 [<000dc45f62eb0a04>] kernfs_fop_write_iter+0x2c4/0x480 [<000dc45f62c81150>] new_sync_write+0x370/0x4b0 [<000dc45f62c87abe>] vfs_write+0x43e/0x5b0 [<000dc45f62c87ff4>] ksys_write+0x114/0x1f0 [<000dc45f621c4a16>] do_syscall+0x2f6/0x430 [<000dc45f64d9d5d8>] __do_syscall+0xc8/0x1c0 [<000dc45f64dc2224>] system_call+0x74/0xa0 Fix this by destroying the mempool during the adapter's release. Fixes: 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") Signed-off-by: Benjamin Block Tested-by: M Nikhil Acked-by: M Nikhil Reviewed-by: Chinmaya Kajagar Reviewed-by: Nihar Panda Link: https://patch.msgid.link/20260720072736.3381816-2-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit 8a309036f557d3ff4efb2beea5132ba91172d934 Author: Bart Van Assche Date: Wed Jul 15 10:12:28 2026 -0700 scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" There have been multiple reports of performance regressions caused by commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler"). Hence this revert. This patch reverts most of the following commits: * 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") * 6475cfb81fc4 ("scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command") This patch preserves the following commits: * 034d319c8899 ("scsi: ufs: core: Fix interrupt handling for MCQ Mode") * eabcac808ca3 ("scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock") Cc: Neil Armstrong Cc: 孙魁 (Kui Sun) Cc: André Draszik Cc: Gregory CLEMENT Cc: Sebastian Andrzej Siewior Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") Signed-off-by: Bart Van Assche Reviewed-by: Sebastian Andrzej Siewior Tested-by: André Draszik # on Pixel 6 Reviewed-by: André Draszik Link: https://patch.msgid.link/b70eb60a01f971bed68c42c5b555929db5f835df.1784135511.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f71b4a30983b846b4075bf544e835121e70e6a43 Author: Guangshuo Li Date: Wed Jul 15 01:27:26 2026 +0800 scsi: ufs: core: Cancel RTC work in active-active suspend UFS RTC support schedules ufs_rtc_update_work to periodically update the device RTC. The work can issue query commands and access the UFS host controller. A previous change moved the RTC work cancellation before the PRE_CHANGE vendor suspend callback to close a race in the common suspend path. However, the active-active path jumps directly to vops_suspend after flushing exception handling work and therefore bypasses the cancellation. If the RTC work runs while the vendor suspend callback is gating or otherwise changing hardware state, it can access the controller during suspend and trigger an SError. Cancel the RTC work before entering the vendor suspend callback in the active-active path. Since this path now cancels the work, move the RTC work scheduling outside the device and link state restoration block in the resume path. This restarts RTC updates after an active-active suspend and resume cycle. Fixes: b0bd84c39289 ("scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend") Signed-off-by: Guangshuo Li Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260714172726.1736967-1-lgs201920130244@gmail.com Signed-off-by: Martin K. Petersen commit 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 Author: Ibrahim Hashimov Date: Sun Jul 12 20:37:39 2026 +0200 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000. Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command") Suggested-by: Damien Le Moal Cc: stable@vger.kernel.org Signed-off-by: Ibrahim Hashimov Assisted-by: AuditCode-AI:2026.07 Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai Signed-off-by: Martin K. Petersen commit 9c33222bd387312874fbe36ca8002e5c945b9653 Author: TanZheng Date: Fri Jul 24 15:58:50 2026 +0800 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer. Check whether the hooks that need to be called are supported. Fixes: 394f81184882 ("scsi: target: Add block PR support to iblock") Signed-off-by: TanZheng Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260724075850.280699-1-kensanya@163.com Signed-off-by: Martin K. Petersen commit 6e468644fc17a8528f3494a28d31c9d2e7353fb6 Author: John Garry Date: Mon Jun 29 08:53:10 2026 +0000 scsi: core: Drop dev->dma_mask check in evaluating max_sectors When evaluating shost->max_sectors, we currently check dma_dev->dma_mask is non-NULL, as dma_max_mapping_size(dma_dev) could previously not handle unset dma_dev->dma_mask - this is no longer the case. Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260629085310.2298552-3-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen commit 81d273096f122ebb27640fcf1ff0637f8c959f88 Author: John Garry Date: Mon Jun 29 08:53:09 2026 +0000 scsi: dma-mapping: Make dma_max_mapping_size() return 0 for no DMA capability For when a device is not DMA capable, the max mapping size would be 0, so make dma_max_mapping_size() reflect that. Signed-off-by: John Garry Reviewed-by: Robin Murphy Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260629085310.2298552-2-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen commit 98575b9ffc3ac3b4de8b997eb1c4243a287b8e82 Author: Randy Dunlap Date: Sun Jul 19 18:37:59 2026 -0700 scsi: ufs: ufshcd: Fix all kernel-doc warnings - Use the correct name for a struct in kernel-doc - Add kernel-doc for missing struct members or correct the name Warning: ./include/ufs/ufshcd.h:201 Excess struct member 'task_tag' description in 'ufshcd_lrb' Warning: ./include/ufs/ufshcd.h:220 expecting prototype for struct ufs_query_resp. Prototype was for struct ufs_query_res instead Warning: ./include/ufs/ufshcd.h:577 struct member 'suspend_on_no_request' not described in 'ufs_clk_scaling' Warning: ./include/ufs/ufshcd.h:1269 struct member 'nortt' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'trigger_eh_attr' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'timeout_attr' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'lsdb_sup' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'vcc_off_delay_us' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'desc_size' description in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'res' description in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1309 struct member 'sq_tail_slot' not described in 'ufs_hw_queue' Warning: ./include/ufs/ufshcd.h:1309 Excess struct member 'sq_tp_slot' description in 'ufs_hw_queue' Signed-off-by: Randy Dunlap Reviewed-by: Alim Akhtar Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260720013759.2979593-1-rdunlap@infradead.org Signed-off-by: Martin K. Petersen commit e0329beb37abc50da5f1ef1d9f6f160fcda75c1f Author: Nitin Rawat Date: Mon Jul 20 01:28:33 2026 +0530 scsi: ufs: dt-bindings: Document the Maili UFS Controller Document the UFS Controller on Maili SoC. Signed-off-by: Nitin Rawat Reviewed-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260719195833.136543-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 4857949b58cdb61f8cd41ca4ffc674b85896ef61 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:49 2026 -0700 scsi: ibmvfc: fail nvme-fc fcp-io and ls requests during transport reset The current purge code for flushing outstanding commands during a transport reset only deals with SCSI commands. Rename the ibmvfc_scsi_eh_done completion handler to ibmvfc_vfc_eh_done and wire it to correctly complete nvme fcp and ls commands when flushing the inflight command list during a reset. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-34-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4e70b8795ee3ac9aa24d55bff6c11674af2e7fcf Author: Tyrel Datwyler Date: Wed Jul 22 17:01:48 2026 -0700 scsi: ibmvfc: implement nvme-fc FCP abort callback Implement the NVMe-FC FCP abort callback by issuing an NVMF cancel MAD on the same submission queue used by the original FCP request. Use the original request event stored in abort_req->private to recover the associated ibmvfc queue, then allocate a new event from that queue so the cancel is sent on the matching nvme_scrq. Factor the TMF setup into a dedicated helper, mirroring the LS abort path, and populate the cancel key, task tag, target WWPN, and association ID needed for the VIOS NVMF abort request. The abort path sends the cancel synchronously, waits for completion, frees the temporary event, and logs non-zero MAD status values for debugging. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-33-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 20bec08f0208fa6e94ef81ecc44a126cca6ab50f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:47 2026 -0700 scsi: ibmvfc: implement nvme-fc LS abort handling callback Implement the NVMe FC-LS abort callback by issuing an ibmvfc cancel MAD to the VIOS for the outstanding link-service request. Use the saved event pointer from the original FC-LS request to identify the command to cancel, submit the cancel operation, and complete the abort request based on the returned status. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-32-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 73c13e30c56f92b7050cc3cd45b901f861b0c588 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:46 2026 -0700 scsi: ibmvfc: implement nvme-fc IO command submission callback Add helpers to initialize an ibmvfc command from an nvmefc_fcp_req, map request scatterlists into either an inline descriptor or an external DMA pool list, and submit the request on the selected NVMe hardware queue. On completion, translate ibmvfc status into the NVMe-FC response format, including transferred length and CQE handling for no-DMA responses. Also store the NVMe request pointer in struct ibmvfc_event so the completion path can finish the original request. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-31-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 7088e1c8b665eaa50c80f364821e0b19832858c5 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:45 2026 -0700 scsi: ibmvfc: implement nvme-fc LS submission transport callback NVMe FC Link Service commands are required to use the ibmvfc_passthru MAD. Initialize a pssthru mad for the target port including the DMA addresses for the FC4_LS request and response as well as the max length of each IU as provided in the nvmefc_ls_req struct. FC4_LS commands are sent via the primary CRQ. Further, store the assoc_id during a create association request as this is a required field in our vfc_cmd struct for nvme_fcp_io commands. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-30-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 86e4953580964323a727fc8eb8efb21e47cce1b0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:44 2026 -0700 scsi: ibmvfc: implement LLDD callbacks for mapping nvme-fc queues Implement the NVMe-FC queue create and delete callbacks and map NVMe controller queues onto ibmvfc hardware queues. Use qidx of NVMe controller queue to map onto a ibmvfc_queue channel. The Admin queue is always qidx 0 and general practice among other drivers is to map both the Admin queue and first IO queue to the same HW queue. Add a new ibmvfc_nvme_qhandle struct that will be used as the opaque queue handle by the NVMe-FC layer when issuing fcp IO. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-29-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 6fac8df932d8814e8a49736216614c26f51f83a0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:43 2026 -0700 scsi: ibmvfc: declare global function definitions Some common functions will require visibility by both SCSI and NVMe protocols. Make common ibmvfc helper routines available to the NVMe support code. Remove static from the core event allocation, event initialization, event free, target release, command error, and event send helpers, and declare them in ibmvfc.h. This allows ibmvfc-nvme.c to reuse the existing event and target infrastructure. No functional change is intended. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-28-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 28ec8670892c738cac121beb68d38e6c735a001c Author: Tyrel Datwyler Date: Wed Jul 22 17:01:42 2026 -0700 scsi: ibmvfc: extend ibmvfc_debug visibility to ibmvfc-nvme.h Export ibmvfc_debug so the NVMe support code can use the existing ibmvfc_dbg logging macro. The debug control variable is currently file-local to the core driver, which prevents protocol-specific code in ibmvfc-nvme.c from using the shared debug infrastructure. Make the variable global within the module and declare it in ibmvfc-nvme.h. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-27-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 696d1cc2aaa2d7041b64ea714a7460e2d365235c Author: Tyrel Datwyler Date: Wed Jul 22 17:01:41 2026 -0700 scsi: ibmvfc: process NVMe/FC rports in work thread Add an NVMe-specific remote-port add helper and update the rport worker thread to walk the NVMe target list, register new NVMe remote ports, and rescan existing ones through the NVMe-FC midlayer. Also handle delete and delete-with-logout transitions for NVMe remote ports in the same worker context used for SCSI rports. This keeps remote-port registration serialized in the existing worker model while allowing NVMe targets to participate in the common target state machine. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-26-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 3831863f9f5663680e002d8dc3e85e57ef15bb47 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:40 2026 -0700 scsi: ibmvfc: register local nvme fc port after fabric login Register the local NVMe/FC port only after fabric login has completed. The VIOS returns the client port ID in the fabric login response, and that port ID is required to populate the local-port information passed to the NVMe-FC midlayer. Delay local-port registration until that data is available and update the registration helper accordingly. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-25-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 13b7fdf3274c2e7445e442cf83a80c9252fba702 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:39 2026 -0700 scsi: ibmvfc: implement NVMe/FC stubs for local/remote port registration Implement the initial NVMe/FC local-port and remote-port registration functions that notify the NVMe-FC midlayr of port discovery and loss. Register the local port with the NVMe-FC transport, register discovered remote ports against that local port, and add matching unregister paths that wait for the NVMe-FC core to complete asynchronous deletion before dropping driver references. Also store driver-private host and target pointers in the registered NVMe-FC port objects. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-24-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0a3ab63e43b8eeb19a454e5eedca3e99cd737a94 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:38 2026 -0700 scsi: ibmvfc: update state machine to process NVMe/FC targets Update the host work loop and target state-machine helpers to process NVMe targets in addition to SCSI targets. Check both protocol-specific target lists when determining whether there is initialization or logout work pending, and extend the query, target init, and target delete phases to dispatch work for NVMe targets using the same common state-machine callbacks. This allows the existing discovery and login state machine to drive NVMe/FC targets through query, login, and deletion without duplicating the control flow. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-23-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit e0fca728a89f14c2edd3e9f5343d0f019d8f50dd Author: Tyrel Datwyler Date: Wed Jul 22 17:01:37 2026 -0700 scsi: ibmvfc: delete NVMe/FC targets as well as SCSI Extend target deletion paths to process NVMe targets as well as SCSI targets. Update link-down, and host reinitialization flows to walk both the SCSI and NVMe target lists when marking targets for deletion. This ensures that protocol-specific target state stays consistent across adapter resets and fabric events. Rename ibmvfc_relogin to ibmvfc_scsi_relogin as it acts on a scsi command. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-22-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 249313b3f7b5dbbf1aed31feff339ab48937a6fc Author: Tyrel Datwyler Date: Wed Jul 22 17:01:36 2026 -0700 scsi: ibmvfc: allocate targets based on protocol Allocate discovered targets onto the channel-group list that matches their protocol. When a target is created, use the discovered protocol type to decide which list it belongs on. This keeps protocol-specific discovery results isolated and allows later state-machine and remote-port code to walk the correct target set. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-21-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5bdeab3c146786939e980cb5b040a3372aadc28f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:35 2026 -0700 scsi: ibmvfc: add NVMe/FC Query Target support Add protocol-specific query-target support for NVMe/FC targets. Use the NVMe query-target specific MAD when querying an NVMe target and update the associated debug and error logging to include the target protocol. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-20-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit d11c05ddc2b69543353952b569f26d3f791ff339 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:34 2026 -0700 scsi: ibmvfc: add NVMe/FC Process Login support Extend PRLI handling code to support NVMe/FC targets. When the target protocol is NVMe/FC, issue the NVMe process login MAD, set the NVMe FC-4 type, and populate NVMe-specific service parameters. On completion, decode the returned PRLI service parameters and derive the appropriate remote-port roles for NVMe initiator, target, and discovery ports. Keep the existing SCSI PRLI flow unchanged while allowing the common target state machine to complete login for NVMe/FC targets. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-19-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4bc896bf09592758756a451852af095c0dbc7c0e Author: Tyrel Datwyler Date: Wed Jul 22 17:01:33 2026 -0700 scsi: ibmvfc: add NVMe/FC Port Login support Expand the target login path to issue the NVMe/FC-specific port login MAD for NVMe targets. Select the correct PLOGI MAD opcode based on the target protocol and include the protocol name in success and failure logging. The rest of the target login flow remains shared with the existing SCSI implementation. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-18-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 577608a2001977e54589b4357b277cba88dbab83 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:32 2026 -0700 scsi: ibmvfc: add NVMe/FC Implicit Logout and Move Login support Add protocol-specific handling for implicit logout and move-login operations on NVMe/FC targets. Select the NVMe/FC-specific implicit logout opcode when operating on an NVMe target and update the associated logging so protocol-specific operations are visible in debug output. This extends the existing target relogin and migration-related flows to work with NVMe targets as well as SCSI targets. These changes are needed so target reauthentication and target movement continue to work once NVMe/FC targets are added to the driver's state machine. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-17-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5e9dd03726ad4d7a8fb57f1c4921fc3dc955c47f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:31 2026 -0700 scsi: ibmvfc: send NVMe target discovery MAD Extend target discovery to send protocol-specific discover-target MADs for NVMe/FC. Use the protocol-aware discovery helper to build an NVMe discover-target request, submit it when NVMe/FC support is active, and process the returned target count using the NVMe channel group's discovery buffer. This allows the driver to discover NVMe/FC targets in parallel with the existing SCSI discovery flow while keeping protocol-specific target data separate. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-16-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit fe150862d5b9bef1f0ccc4e2443677dc91c8a332 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:30 2026 -0700 scsi: ibmvfc: allocate and free NVMe channel group discover buffer Allocate a discovery buffer for the NVMe channel group and free it on all teardown and error paths. The existing discovery-buffer allocation only covered the SCSI channel group. This patch is prepratory for sending NVMe/FC target discovery MAD. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-15-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 8acacfa8b0f8b17e740730b3e96f99ff726065b2 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:29 2026 -0700 scsi: ibmvfc: add helper to check NVMe/FC support with active channels It can be the case that NVMeoF is enabled on both the client and VIOS, but no queues are configured making the need to do NVMe target discovery pointless. Add a helper to short hand the capabilities check and active NVMe queue check. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-14-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit a29ee1473ab5b5c85726efdc2f36c78d1a45ab41 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:28 2026 -0700 scsi: ibmvfc: add helper for creating protocol specific discovery event Refactor discover-target event creation so it can be shared by both SCSI and NVMe/FC discovery. Introduce a helper that takes a protocol-specific channel group, selects the correct discover-target opcode, and maps the corresponding discovery buffer into the MAD. This is a preparatory cleanup for issuing protocol-specific discovery MADs in later patches. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-13-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit c34ca34f1dbdf40c368eed42efe273561c3800ba Author: Tyrel Datwyler Date: Wed Jul 22 17:01:27 2026 -0700 scsi: ibmvfc: add wrapper to get vhost associated with a channel struct Add ibmvfc_channels_to_vhost() to recover the parent struct ibmvfc_host from a protocol-specific struct ibmvfc_channels. Later patches need to operate on either the SCSI or NVMe channel group and still access host-wide state such as the primary CRQ, device, and logging context. Centralize that mapping in a helper instead of open- coding container lookups at each call site. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-12-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit ecc03d958e371881cff4d8e5ebaa4ec760ab65ec Author: Tyrel Datwyler Date: Wed Jul 22 17:01:26 2026 -0700 scsi: ibmvfc: add logic for protocol specific fabric logins Add support for the protocol-specific fabric login flow introduced by the updated client/VIOS interface. After NPIV login, a VIOS that advertises protocol-specific support requires separate fabric login MADs for SCSI and NVMe/FC. Track whether SCSI and NVMe/FC fabric login are needed, extend channel enquiry/setup handling to negotiate both SCSI and NVMe queue counts, and issue the appropriate fabric login MADs before target discovery begins. Also update command layout selection so the driver uses the v3 command format when the VIOS advertises NVMe/FC-capable framing. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-11-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 319f6545a2d44e1f18c0b3cc0445c74daf381651 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:25 2026 -0700 scsi: ibmvfc: alloc/dealloc sub-queues for nvme channels Allocate, register, deregister, and release NVMe subordinate CRQs alongside the existing SCSI sub-CRQs. Update the CRQ reset and re-enable paths to tear down and recreate NVMe sub-queues, extend sub-CRQ initialization to allocate NVMe channels when enabled, and release NVMe channel resources during adapter teardown. This keeps the NVMe queue lifecycle aligned with the existing SCSI queue lifecycle so both protocols are reset consistently across probe, remove, and connection recovery. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-10-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 018fc39652914c403d660da03234c8276e388dc0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:24 2026 -0700 scsi: ibmvfc: initialize NVMe channel configuration during driver probe Initialize the host's NVMe channel-group state during probe. Set up the NVMe channel list head, desired queue count, maximum queue count, protocol identifier, and enablement state alongside the existing SCSI channel-group initialization in ibmvfc_probe(). This prepares the driver with a NVMe/FC channel group that can will be used by later patches for NVMe queue allocation, discovery buffers, target management, and IO submission. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-9-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 848c70852e3fb82d881ea6b917436c4b1046fdc7 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:23 2026 -0700 scsi: ibmvfc: split NVMe support into separate source file and add transport stubs Rename ibmvfc.c to ibmvfc-core.c as first step in decoupling each protocol from the core driver logic. Add ibmvfc-nvme.[ch] files, and register an nvme_fc_port_template with empty callback stubs. Add empty registration functions definitions for local and remote ports. No functional NVMe/FC support is added yet. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-8-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4991c8f57b61480c83736f3224952a5f55e324df Author: Tyrel Datwyler Date: Wed Jul 22 17:01:22 2026 -0700 scsi: ibmvfc: add NVMe/FC protocol interface definitions Add the protocol definitions for client-VIOS interface updates needed to support NVMe/FC over the ibmvfc NPIV transport. Extend the ibmvfc interface with: - NVMe/FC-specific capability bits and opcodes - protocol-specific channel and queue definitions - updated channel enquiry/setup fields for NVMe queues - v3 command layout support for protocol-specific payloads These changes provide the common header and interface plumbing needed by later patches that add NVMe/FC login, discovery, remote-port handling, and I/O submission. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-7-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit de7ac0f3f08b1b411adcc48835e90f36e242f0c3 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:21 2026 -0700 scsi: ibmvfc: move target list from host to protocol specific channel groups Prepare the driver for protocol-specific target management by moving the target list and target count out of struct ibmvfc_host and into struct ibmvfc_channels. Today the driver only maintains a single SCSI target list, but NVMe/FC support will require separate target tracking for each protocol-specific channel group. Update the existing target iteration, allocation, and discovery paths to use the SCSI channel group's target list instead of a host-wide list. This is a preparatory refactoring only. No functional change is intended for existing SCSI operation. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-6-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 99143433f7f14139ac373c553ec8e1317d0ae58a Author: Tyrel Datwyler Date: Wed Jul 22 17:01:20 2026 -0700 scsi: ibmvfc: free ibmvfc_target allocations with mempool_free The ibmvfc_target *tgt structures for discovery are allocated using mempool_alloc but in turn free'd via kfree in ibmvfc_release_target breaking pool guarentees. Fixup ibmvfc_release_target to call mempool_free instead so that memory is properly returned to the mempool instead of the general allocator. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-5-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0122eab60b151d7815f420a91c7315944a037714 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:19 2026 -0700 scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete path Unlike ibmvfc_tgt_implicit_logout the ibmvfc_tgt_implicit_logout_and_del path fails to check for a NULL evt returned from ibmvfc_get_reserved_event and passes that directly to ibmvfc_send_event which will unconditionally derefence the evt. Check for a NULL evt and perform same escalation as ibmvfc_implicit_logout. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-4-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 7e35396ec853983e7a85de9c4e5ad5b3c090c018 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:18 2026 -0700 scsi: ibmvfc: flush rport_add_work_q during driver teardown INIT_WORK is called on rport_add_work_q during driver probe. When the adapter is removed, ibmvfc_remove() stops the work thread and proceeds to tear down the FC host, but any work item queued via schedule_work() that raced the teardown could still be running or pending in the system workqueue. Add a flush_work() call after kthread_stop() and before fc_remove_host() to drain any outstanding rport add work before the FC host and its rports are torn down. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-3-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 9c2aa65000f6f99e543500cabe4c67ff758d3ff6 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:17 2026 -0700 scsi: ibmvfc: don't call locked done variant for MADs on send failure MADs are processed with the requirement that the host_lock is held for MAD sends and completions. When a MAD job step is called the host lock is already held and there is an unlikely scenario where h_send_crq fails with something other than H_CLOSED. If this happens there is a special done handler for MADs that tries to take the host lock. In this failure scenario fall back to the saved evt->_done unlocked completion handler. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-2-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0cad7bd51301678ad5c9aad701be29eab2ab4e7a Author: Pan Chuang Date: Fri Jul 17 11:50:13 2026 +0800 scsi: ufs: host: Remove redundant dev_err() Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260717035013.563791-1-panchuang@vivo.com Signed-off-by: Martin K. Petersen commit abd26e6b53c4169122d61fdd4cabe09bdd916aac Author: Li Qiang Date: Fri Jul 17 23:39:13 2026 +0800 scsi: ufs: debugfs: Reserve space for a string terminator ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL. Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggering the UFS EH") Signed-off-by: Li Qiang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260717153914.26321-7-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit 2f434f815ee2e051f9ccadfbe5db531e6fbe34ad Author: Li Qiang Date: Fri Jul 17 23:39:12 2026 +0800 scsi: ufs: rpmb: Use unaligned accessors for RPMB frames RPMB frame buffers are passed as u8 pointers and do not have an alignment guarantee. Use unaligned accessors for the req_resp field. Signed-off-by: Li Qiang Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260717153914.26321-6-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit a947b8edbdcec8415a80ca55e9f38801322ffdd3 Author: Li Qiang Date: Fri Jul 17 23:39:11 2026 +0800 scsi: ufs: rpmb: Validate request frame length before parsing The RPMB core only verifies that request and response buffers are nonempty. This callback reads req_resp at the end of the first request frame before validating the request length. Require a complete frame before that access. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Signed-off-by: Li Qiang Reviewed-by: Peter Wang Reviewed-by: Bean Huo Link: https://patch.msgid.link/20260717153914.26321-5-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit 9e6dd452f1affb5c412ca64bf5809ce9fde3174d Author: Li Qiang Date: Fri Jul 17 23:39:10 2026 +0800 scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated. Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Signed-off-by: Li Qiang Link: https://patch.msgid.link/20260717153914.26321-4-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit 331bda797e6afc143127ce72b1469d73316f49b4 Author: Li Qiang Date: Fri Jul 17 23:39:09 2026 +0800 scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning. Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Li Qiang Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260717153914.26321-3-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit d96e83d028d7d8762e424e49c671d49ac2ecf14f Author: Li Qiang Date: Fri Jul 17 23:39:08 2026 +0800 scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread. Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading") Fixes: d794b499f948 ("scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()") Signed-off-by: Li Qiang Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260717153914.26321-2-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen commit 4d5282c06ca198319c2de41b10511ddcb8068f42 Author: Shawn Guo Date: Mon Jul 20 10:35:52 2026 +0800 scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc Qualcomm UFS controller found on SoCs SA8255P/SA8797P has a MCQ I/O address space. It should be defined in the bindings even though Linux driver currently doesn't utilize it. Fix the binding before it gets adopted by DTS. Fixes: e2725ed2a7fb ("scsi: ufs: dt-bindings: Document bindings for SA8255P UFS Host Controller") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260720023552.2667237-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Author: Xingui Yang Date: Thu Jul 16 16:11:45 2026 +0800 scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock: the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue, calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI devices and waits for the host to become runtime-active. But the host cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the drain is blocked on that very handler. However skipping the drain reintroduces a race: hisi_sas returns from resume before all PHY UP work and libsas discovery work finish. The controller may then autosuspend while disks are still waking up. The disks issue IO to a suspended controller, the IO fails, and the disks get disabled. Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT notification to after sas_drain_work(). By then the host resume is about to complete, so device removal through device_link no longer blocks on the resume and the cycle is broken. With the deadlock gone, restore sas_resume_ha() (the draining variant) in hisi_sas and remove sas_resume_ha_no_sync(). The reorder is safe for the other libsas consumers (isci, pm8001, aic94xx, mvsas). During suspend, sas_suspend_devices() calls sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a timed-out phy's disk is immediately rejected by the LLDD before reaching hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET), and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both complete directly via scsi_done() without entering SCSI EH. This is identical in both the old and new ordering since lldd_dev_gone runs during suspend, before resume. The reorder only affects when the PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work() vs. asynchronous after resume returns), not whether I/O can reach the device. aic94xx and mvsas do not register any PM ops and never reach this code path. Fixes: fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") Signed-off-by: Xingui Yang Reviewed-by: John Garry Link: https://patch.msgid.link/20260716081145.3950172-1-yangxingui@huawei.com Signed-off-by: Martin K. Petersen commit c1dea15f819cded9b3faf58f8bec72323568b6e6 Author: HyeongJun An Date: Thu Jul 16 15:58:48 2026 +0900 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Suggested-by: Chris Leech Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260716065848.1653431-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen commit 9b61402740eb993fc2cb6c2c2d5e74f6be15ddca Author: Colin Ian King Date: Tue Jul 14 08:35:10 2026 +0100 scsi: dc395x: Remove unused variable 'fact' The variable 'fact' was used for debug but this was removed in commit 62b434b0db2c ("scsi: dc395x: Remove DEBUG conditional compilation"). The variable is now redundant and can be removed. Cleans up clang scan build warning: drivers/scsi/dc395x.c: In function ‘msgin_set_sync’: drivers/scsi/dc395x.c:2185:13: warning: variable ‘fact’ set but not used [-Wunused-but-set-variable] 2185 | int fact; Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260714073510.43289-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit 98b87885de4b7f605533a2860685f5689fce8e82 Author: HyeongJun An Date: Tue Jul 14 19:49:34 2026 +0900 scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen commit 0617678ca22cece6e3853e28f7fec6b0c6472df5 Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:33 2026 +0200 scsi: zorro7xx: Make use of struct zorro_device_id::driver_data_ptr Usage of .driver_data_ptr allows to drop several casts. A nice upside of that is that now the constness of the linked structures is kept and the compiler warns about zdd missing a const. So add this missing const, too. While touching the zorro_device_id array, drop an unneeded explicit zero in the list terminator. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/b7f3b4bfa5daabf8a3043177341b8dbb4e4d980e.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 841970b2f6cbbfd57647b9e8799f6ed55e47e04f Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:32 2026 +0200 scsi: zorro: Simplify storing pointers in device id struct Technically it is fine (on all current Linux architectures) to store a pointer in an unsigned long variable. However this needs explicit casting which is an easy source for type mismatches. By replacing the plain unsigned long .driver_data in struct zorro_device_id by an anonymous union, most of the casting can be dropped. There is still some implicit casting involved (between a void * and a driver specific pointer type), but that's better than the approach to store a pointer in an unsigned long variable as this doesn't lose the information that the data being pointed to is const. All users of struct zorro_device_id are initialized in a way that is compatible with the new definition, so no adaptions are needed there. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Reviewed-by: Max Staudt Acked-by: Helge Deller Link: https://patch.msgid.link/49576a7501128c93ef318566ed7faefce163f1fd.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 108e48a9a405be611e6812f105b4d376de5640b8 Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:28 2026 +0200 scsi: zorro: a2091: gvp11: Use named initializer for zorro_device_id Using named initializers is more explicit and thus easier to parse for a human. It's also more robust to changes in the struct definition. This robustness is relevant for a planned change to struct zorro_device_id that replaces .driver_data by an anonymous union. While touching these arrays, drop explicit zeros from the list terminator. This change doesn't introduce changes to the compiled zorro_device_id arrays. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/9602004a447b474b15ca1e110d6d3c277f669e20.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 81117c076f79fe982bca0c3009538a04694e1045 Author: Uwe Kleine-König (The Capable Hub) Date: Wed Jun 10 16:36:28 2026 +0200 scsi: NCR5380: Improve style of pnp_device_id array terminator To match how device-id array terminators look like for other device types drop '.id = ""' from it and let the compiler care for zeroing the entry. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 85666bde770cbbfa59f25e2d704776e56466ff52 Author: Uwe Kleine-König (The Capable Hub) Date: Wed Jun 10 16:36:28 2026 +0200 scsi: aha1542: Improve style of pnp_device_id array terminator To match how device-id array terminators look like for other device types drop '.id = ""' from it and let the compiler care for zeroing the entry. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 18ae351fec146e77a454449a47f3268db591ff7f Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:27 2026 +0200 scsi: ata: pata_budda: Use named initializer for zorro_device_id Using named initializers is more explicit and thus easier to parse for a human. It's also more robust to changes in the struct definition. This robustness is relevant for a planned change to struct zorro_device_id that replaces .driver_data by an anonymous union. This change doesn't introduce changes to the compiled zorro_device_id array. Signed-off-by: Uwe Kleine-König (The Capable Hub) Acked-by: Niklas Cassel Acked-by: Damien Le Moal Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/a20f52aeee9dfcacfaea43ff280fa1867878cbbe.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 7268e509b43ac1734e1bdb7d18553f7e1080dfb4 Author: Shivaprasad G Bhat Date: Fri May 15 13:45:18 2026 +0000 scsi: qla2xxx: Handle INTx not connected while passing through The PCI_INTERRUPT_PIN reports if the device supports the INTx. However, when the device is assigned to a guest via vfio, the PCI_INTERRUPT_PIN is set to 0 (i.e none) if the line is not connected and/or the platform cannot route the interrupt. In such cases, the guest PCI_INTERRUPT_PIN is 0 and the port number becomes -1 (255, uint8_t underflow) for qla[25|27|28]xx and qla2031 devices. The flt_region_nvram is never set, and subsequently the LUN detection fails. Below warnings show the NVRAM configuration failure: []-0073:1: Inconsistent NVRAM checksum=0xffffffc0 id=HCAM version=0x100. []-0074:1: Falling back to functioning (yet invalid -- WWPN) defaults. []-0076:1: NVRAM configuration failed. Handle this case and set the port_no to devfn like its done everywhere else. Reference: commit 2bd42b03ab6b ("vfio/pci: Virtualize zero INTx PIN if no pdev->irq") Signed-off-by: Shivaprasad G Bhat Reviewed-by: Kyle Mahlkuch Link: https://patch.msgid.link/177885270578.1573.14283751510936407585.stgit@linux.ibm.com Signed-off-by: Martin K. Petersen commit c6cee609f614b790a72cb34d6d28b3635c874ddf Author: Neil Armstrong Date: Thu Jun 18 09:52:09 2026 +0200 scsi: ufs: Switch WriteBooster missing free space message as warn_once Once the UFS WriteBooster fails to allocate memory, the situation will stay until fstrim or equivalent is ran. Mark is as a warning since it impacts the performance but only print it once for the lifetime of the kernel since it's not fatal. Otherwise it will be printed each time the device is resumed: [ 31.666880] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 52.655594] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 62.890469] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available ... Signed-off-by: Neil Armstrong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260618-topic-ufs-wb-empty-warn-v1-1-ec744a153e0e@linaro.org Signed-off-by: Martin K. Petersen commit f13faec1d4c16b3705d1eccffb8ba6723f1102ff Author: Can Guo Date: Thu Jun 25 05:13:05 2026 -0700 scsi: ufs: core: Always run tx_eqtr POST_CHANGE notify ufshcd_tx_eqtr() skips POST_CHANGE notify when __ufshcd_tx_eqtr() fails. That can leave variant cleanup incomplete when PRE_CHANGE saved temporary state that POST_CHANGE is expected to restore. Always call POST_CHANGE once PRE_CHANGE has succeeded. Keep the TX EQTR result as the primary return value, and only propagate POST_CHANGE failure when TX EQTR itself succeeded. Log PRE_CHANGE and POST_CHANGE notify failures to make variant callback failures visible in TX EQTR error paths. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 4bd0875b7e571eeeed45fdab52672b850c1845a5 Author: Can Guo Date: Thu Jun 25 05:13:04 2026 -0700 scsi: ufs: core: Tolerate RX_FOM read failures in TX EQTR ufshcd_get_rx_fom() aborted TX EQTR when a per-lane RX_FOM DME read failed. That makes the whole training flow fragile even though these reads can be treated as best effort. Keep TX EQTR running by logging RX_FOM read failures and continuing. Make failed lanes deterministic by initializing each lane FOM to 0 before reading and only updating it when the DME read succeeds. This avoids propagating stale or uninitialized values into EQTR evaluation. Also update the kerneldoc return description to match behavior: RX_FOM DME read failures are handled as warnings, while get_rx_fom() vops failures are still propagated to the caller. Signed-off-by: Can Guo Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 890b10e76e6cca5a3b4fa48a994eb3cdc566dec3 Author: Can Guo Date: Thu Jun 25 05:13:03 2026 -0700 scsi: ufs: ufs-qcom: Restore TX Equalization settings on FOM failure ufs_qcom_get_rx_fom() applies temporary device TX Equalization values before forcing HS mode and running the EOM-based SW FOM scan. When one of these steps fails, the function can bypass the shared cleanup path and leave temporary TX Equalization settings programmed. Route those failures through the cleanup label so the original TX EQ settings are restored and link recovery runs before exit. This path also reuses ret for cleanup, so it may overwrite the original error. Keep that on purpose: if cleanup succeeds, the caller can proceed with the FOM result for the current iteration. Signed-off-by: Can Guo Reviewed-by: Bean Huo Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 760fc6f0e25a72832c2fcf37ecf5f1b770ec8374 Author: Can Guo Date: Thu Jun 18 07:09:29 2026 -0700 scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart] Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2 Signed-off-by: Can Guo Reviewed-by: Ziqi Chen Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 78f638ff3bc19d8faeac109b50dd0bab87871ff4 Author: Himanshu Batra Date: Tue Jun 16 15:31:21 2026 +0530 scsi: ufs: sysfs: Add HS_GEAR6 string in power_info/gear sysfs output In power_info/gear sysfs, currently it supports output only till gear 5. If operating mode is gear 6, it outputs "UNKNOWN". Add support for HS_GEAR6 string in sysfs output when operating mode is gear 6. Signed-off-by: Himanshu Batra Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com Signed-off-by: Martin K. Petersen commit 53b056ef7f7c0dfda981701f0236ca8704a787c9 Author: Yihang Li Date: Tue Jun 16 11:20:51 2026 +0800 scsi: MAINTAINERS: Update HiSilicon hisi_sas driver maintainer to Xingui Yang Replace myself with Xingui Yang who is very familiar with the HiSilicon hisi_sas drivers. Signed-off-by: Yihang Li Reviewed-by: Jason Yan Link: https://patch.msgid.link/20260616032051.1268608-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit e166bafc483e927150cb9b5f286c9191ea0df84e Author: Haoxiang Li Date: Tue Jun 23 00:00:28 2026 +0800 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping the SCSI command, and dropping the outstanding IOACCEL command count before returning. Fixes: c5dfd106414f ("scsi: hpsa: correct device resets") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Acked-by: Don Brace Link: https://patch.msgid.link/20260622160028.1240496-1-haoxiang_li2024@163.com Signed-off-by: Martin K. Petersen commit 2c007acf7b31c39c08ce4959451ad00b19be4c1f Author: WenTao Liang Date: Thu Jun 11 13:30:37 2026 +0800 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below. Cc: stable@vger.kernel.org Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization") Signed-off-by: WenTao Liang Reviewed-by: Daniel Wagner Link: https://patch.msgid.link/20260611053037.63756-1-vulab@iscas.ac.cn Signed-off-by: Martin K. Petersen commit 9cb2d5291dbfe7bed565ead3337047dee9ed1064 Author: Haoxiang Li Date: Mon Jun 22 15:58:44 2026 +0800 scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct_dispatch_fcp_cmd() allocates an efct_io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before handing the IO to the SCSI layer. Free the allocated IO before returning from this error path. Fixes: f45ae6aac0a0 ("scsi: elx: efct: Unsolicited FC frame processing routines") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Daniel Wagner Link: https://patch.msgid.link/20260622075844.832871-1-haoxiang_li2024@163.com Signed-off-by: Martin K. Petersen commit dccf3b1798b70f94e958b3d00b83010399e6fb05 Author: David Jeffery Date: Mon Jun 15 13:46:30 2026 -0400 scsi: core: wake eh reliably when using scsi_schedule_eh Drivers which use the scsi_schedule_eh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There is no enforced memory order between setting the host into error recovery state and counting busy commands. This can result in a race with scsi_dec_host_busy where neither CPU sees both conditions of all commands inactive and the host error state to request waking the error handler. To fix this, run the scsi_schedule_eh's scsi_eh_wakeup from a new work item which will use rcu to ensure scsi_schedule_eh's call to scsi_host_busy will occur after the error state is globally visible and will be seen by any current scsi_dec_host_busy callers. Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq") Signed-off-by: David Jeffery Link: https://patch.msgid.link/20260615174630.11492-1-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit fda6a1f3c3d7047b5ce5654487649c2daa738bfc Author: Bryam Vargas Date: Wed Jun 10 04:22:48 2026 +0000 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged. Fixes: 4949314c7283 ("target: Allow control CDBs with data > 1 page") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: John Garry Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20260610042245.35473-1-hexlabsecurity@proton.me Signed-off-by: Martin K. Petersen commit d04a179085c262c9ed577d0a4cbc6482ff1fd9a3 Author: Bryam Vargas Date: Thu Jun 11 13:42:26 2026 -0500 scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling it how many bytes are valid. For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with an unbounded strstr() (and on the error path prints the name with a further unbounded "%s"). An initiator can submit a TransportID whose iSCSI name contains neither a ",i,0x" substring nor a NUL terminator, filling the parameter list to its end, so the scan runs off the end of the buffer. When the parameter list spans more than one page the buffer is a multi-page vmap (transport_kmap_data_sg()), so the over-read walks into the trailing vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It is reachable by any fabric that delivers a PR OUT to a device exported through an iSCSI TPG, including a guest via vhost-scsi. Pass the number of received bytes down to the parser and validate the iSCSI TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up front: reject it if it is below the spc4r17 minimum or larger than the received buffer, then bound the separator search, the ISID walk and the name copy by that length. This is the length check the callers already perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len against tpdl, core_scsi3_emulate_register_and_move() validates it against data_length), moved ahead of the scan. Also drop the unbounded "%s" of the unterminated name. Add per-format explicit name-length checks before copying into i_str, rather than silently truncating with min_t: for FORMAT CODE 00b reject if the descriptor body (tid_len - 4 bytes) cannot fit in i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion (from &buf[4] up to the separator) cannot fit. Both checks make the bounds intent explicit at each format branch. While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x" separator sits at the very end of the descriptor: that leaves an empty ISID and points the returned port nexus pointer at buf + tid_len, one past the descriptor, which the registration code (__core_scsi3_locate_pr_reg(), __core_scsi3_alloc_registration()) then dereferences as the ISID string -- the same over-read of the parameter buffer for a malformed descriptor. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: John Garry Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20260611-b4-disp-9f20739e-v6-1-f6630e2aae44@proton.me Signed-off-by: Martin K. Petersen commit 8cbaf7b1ab4dd9ced322b6ebf60b079cc3a3d8d2 Author: Louis Sautier Date: Wed Jul 1 00:49:22 2026 +0200 scsi: mpt3sas: Add hwmon support Expose the IOC and board temperature sensors of LSI / Broadcom SAS HBAs through hwmon. Readings come from MPI IO Unit Page 7 via the accessor added in the preceding patch. The same fields are exposed by Broadcom's userspace tooling through the /dev/mpt[23]ctl ioctl path (typically root-only): IOCTemperature and BoardTemperature in lsiutil; ROC and Controller in storcli. With this driver, sensors(1) shows them unprivileged: $ sensors mpt3sas-pci-0200 mpt3sas-pci-0200 Adapter: PCI adapter IOC: +42.0°C Each channel is gated independently by its *TemperatureUnits field through is_visible(); cards that populate only one sensor expose only one input file, and cards that populate neither do not register an hwmon device. The hwmon code is gated directly on CONFIG_HWMON. IS_REACHABLE() is used rather than IS_ENABLED() so that SCSI_MPT3SAS=y with HWMON=m still builds; in that configuration, the sensors are not exposed (same pattern as i915 and xe). Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Louis Sautier Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260630224922.2543096-3-sautier.louis@gmail.com Signed-off-by: Martin K. Petersen commit 26018997054dabe5d8f17495f2d75f211d01884b Author: Louis Sautier Date: Wed Jul 1 00:49:21 2026 +0200 scsi: mpt3sas: Add IO Unit Page 7 config accessor Add mpt3sas_config_get_iounit_pg7(), mirroring the existing iounit page accessors. Used by the hwmon driver added in the following patch to read the IOC and board temperatures. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Louis Sautier Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260630224922.2543096-2-sautier.louis@gmail.com Signed-off-by: Martin K. Petersen commit 7ebadbae3dd793663f313e4046c1c20e12351769 Author: Ed Tsai Date: Mon Jun 15 13:57:17 2026 +0800 scsi: ufs: core: Remove max_num_rtt field from ufs_hba_variant_ops Remove the max_num_rtt field from ufs_hba_variant_ops as it has been replaced by the get_hba_nortt() callback which provides more flexible platform-specific RTT capability handling. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-4-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit 75f529a7bcd4aaac7cf73dc885041d7f66403570 Author: Ed Tsai Date: Mon Jun 15 13:57:16 2026 +0800 scsi: ufs: mediatek: Implement get_hba_nortt callback for RTT capability Implement the get_hba_nortt callback to handle platform-specific RTT capability differences: - For legacy platforms and IP versions before MT6995 B0, the RTT capability from host controller register is problematic, so limit it to 2 (MTK_MAX_NUM_RTT_LEGACY). - For MT6995 B0 and later platforms, the issue is fixed and the value from host controller capability register can be used directly. This replaces the previous max_num_rtt field in ufs_hba_variant_ops with dynamic platform-specific logic. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-3-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit e7896d02cb4d0e6b4e97c62af669109ab809c0ca Author: Ed Tsai Date: Mon Jun 15 13:57:15 2026 +0800 scsi: ufs: core: Add get_hba_nortt callback for vendor-specific RTT capability The number of outstanding RTTs read from host controller capability register is problematic on some platforms. Add a new vendor callback get_hba_nortt() to allow platform vendors to override the default RTT capability value with platform-specific handling. This patch keeps max_num_rtt field for bisectability and will be removed in a later patch once all platforms are migrated. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-2-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit ecb8d6da1356abc3168e530fc328b3d461107d0f Author: Can Guo Date: Tue Jun 16 04:33:48 2026 -0700 scsi: ufs: core: Add support for static TX Equalization settings Parse board-specific static TX Equalization settings from Device Tree for each HS gear and store them in hba->tx_eq_params. Parse txeq-preshoot-g[1-6] and txeq-deemphasis-g[1-6] as per-lane tuples: , []. For HS-G6, parse optional tx-precode-enable-g6 using the same per-lane Host/Device tuple format. If provided, it must contain values for all active lanes, and each value must be 0 or 1. Introduce from_dt in struct ufshcd_tx_eq_params to track whether TX EQ values came from static Device Tree data. When adaptive TX Equalization is used, these static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static Device Tree settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static Device Tree settings. So static Device Tree settings are a fallback for cases where adaptive TX Equalization is not enabled or not used. Adaptive TX Equalization remains the primary path when enabled. No behavior changes for platforms that do not provide these properties. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260616113348.1168248-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit ce36dbeb2951607304cc5451a33ddcf06880d726 Author: Can Guo Date: Tue Jun 16 04:33:47 2026 -0700 scsi: ufs: dt-bindings: Document static TX Equalization settings properties UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0 and M-PHY v6.0. These specs define TX Equalization for all High-Speed Gears (not only HS-G6) to compensate channel loss and improve signal integrity at high speed. For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be required depending on channel characteristics. Document vendor-neutral properties in ufs-common.yaml: - txeq-preshoot-g[1-6] - txeq-deemphasis-g[1-6] - tx-precode-enable-g6 Values are per-lane Host/Device tuples (2 values for x1, 4 values for x2). PreShoot/DeEmphasis range from 0..7, and Precode is 0/1. These are board-specific signal-integrity tuning values. They depend on channel SI/PHY characterization and validation (host PHY, device PHY, package, and board routing), and are determined by HW/PHY designers. Although UFSHCI v5.0 supports TX Equalization Training via UniPro v3.0, which allows host software to determine optimal TX Equalization at runtime, static board-specific TX Equalization settings in the Device Tree are still necessary because: - TX Equalization Training is not supported for HS-G3 and below - TX Equalization Training is disabled on some platforms Reviewed-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Link: https://patch.msgid.link/20260616113348.1168248-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 1bd28625e25be549ee7c47532e7c3ef91c682410 Author: Abdun Nihaal Date: Tue Jul 7 12:23:02 2026 +0530 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() The memory allocated for mboxq using mempool_alloc() is not freed in some of the early exit error paths. Fix that by moving the mempool_free() call to an earlier point after last use. Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Reviewed-by: Justin Tee Link: https://patch.msgid.link/20260707065304.949135-1-nihaal@cse.iitm.ac.in Signed-off-by: Martin K. Petersen commit 1d3a742afeb761eaead774691bde1ced699e9a5d Author: Xu Rao Date: Tue Jul 7 11:08:45 2026 +0800 scsi: sg: Report request-table problems when any status is set SG_GET_REQUEST_TABLE reports per-request diagnostic state through sg_req_info::problem. The field is meant to indicate whether there is an error to report for a completed request. sg_fill_request_table() currently combines masked_status, host_status and driver_status with bitwise AND. This only reports a problem when all three status fields are non-zero at the same time. A normal target check condition, for example, has masked_status set while host_status and driver_status may both be zero, so the request is incorrectly reported as clean. Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when any of the three status fields is non-zero. Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/54B60C19F7DB8889+20260707030845.970018-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen commit 46aea2c64e110ed1878fa5363f86ddc8fd79c9c4 Author: Steven Rostedt Date: Tue Jun 30 18:54:12 2026 -0400 scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: 583e518e7100 ("scsi: ufs: core: Add hba parameter to trace events") Signed-off-by: Steven Rostedt Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260630185412.283c26c5@gandalf.local.home Signed-off-by: Martin K. Petersen commit 1e9036e7580bd3eda6849ca64b07223ed80dc440 Author: Ben Dooks Date: Tue Jun 23 14:24:27 2026 +0100 scsi: virtio_scsi: Fix up endian conversions for warning messages There are several places where printing functions are being passed parameters that have not been through endian conversion functions. Use virtio32_to_cpu() to fix the warnings. Fixes the following warnings from (prototype) sparse: drivers/scsi/virtio_scsi.c:126:9: warning: incorrect type in argument 7 (different base types) drivers/scsi/virtio_scsi.c:126:9: expected unsigned int drivers/scsi/virtio_scsi.c:126:9: got restricted __virtio32 [usertype] sense_len drivers/scsi/virtio_scsi.c:312:17: warning: incorrect type in argument 2 (different base types) drivers/scsi/virtio_scsi.c:312:17: expected unsigned int drivers/scsi/virtio_scsi.c:312:17: got restricted __virtio32 [usertype] reason drivers/scsi/virtio_scsi.c:412:17: warning: incorrect type in argument 2 (different base types) drivers/scsi/virtio_scsi.c:412:17: expected unsigned int drivers/scsi/virtio_scsi.c:412:17: got restricted __virtio32 [usertype] event Signed-off-by: Ben Dooks Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20260623132427.838900-1-ben.dooks@codethink.co.uk Signed-off-by: Martin K. Petersen commit 57a6ed0b41677ccc5e28cc0976e495c1dfa33747 Author: Arnd Bergmann Date: Thu Jun 11 14:55:56 2026 +0200 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() bfa_fcs_fdmi_get_portattr() gets inlined into multiple places and has two fairly large variables on the stack, to the point of causing a warning in some randconfig builds: drivers/scsi/bfa/bfa_fcs_lport.c:2198:1: error: stack frame size (1560) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_portattr_block' [-Werror,-Wframe-larger-than] 2198 | bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi, | ^ drivers/scsi/bfa/bfa_fcs_lport.c:1856:1: error: stack frame size (1600) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_rhba_pyld' [-Werror,-Wframe-larger-than] 1856 | bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld) | ^ Mark the inner function as noinline_for_stack to keep it separate from the other variables and prevent multiple copies of the same variable to get inlined here. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260611125601.3385418-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit 66aefc277ebb796ec285d550305535dc3fc0179f Author: Michael Bommarito Date: Thu Jun 11 08:30:46 2026 -0400 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsiback_device_action() obtains a command tag in scsiback_get_pend_req() and submits a task-management request with target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and scsiback jumps to the err: label, which sends a response but frees nothing, leaking the tag. Impact: a pvSCSI guest can leak the command tags of a LUN's session, stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests whenever target_submit_tmr() fails. transport_generic_free_cmd() cannot be used here. By the time target_submit_tmr() returns an error it has already run __target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the pointer dangling. Letting the command release run target_free_cmd_mem() would then double-free se_tmr_req. Use the same helper, which returns just the tag, on this path too. Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260611123046.2323342-3-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit ca978f8a93d4d36841839bf2847d29b88c2591d6 Author: Michael Bommarito Date: Thu Jun 11 08:30:45 2026 -0400 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0; the se_cmd is initialised (kref_init() via target_init_cmd()) only later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB path. The two error paths in scsiback_do_cmd_fn() taken before the command is submitted -- a failed scsiback_gnttab_data_map() and an unknown ring_req.act -- call transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a refcount of 0. That underflows it ("refcount_t: underflow; use-after-free") and, as the release function is not run, leaks the command tag. Impact: a pvSCSI guest can leak every command tag of a LUN's session, stopping the LUN, by submitting requests with a bad grant reference or an unknown request type; under panic_on_warn the refcount underflow panics the host. Add a helper that just returns the tag with target_free_tag() and sends the error response. It frees the tag while the v2p reference still pins the session, and snapshots the response fields beforehand because freeing the tag can let another ring reuse the pending_req slot. Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260611123046.2323342-2-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit e81f1079f9000892cf54b23a9572ad5d86036fca Author: Catalin Iacob Date: Mon Jun 8 17:29:16 2026 +0300 scsi: core: Remove export for scsi_device_from_queue() Commit 1cea5180f2f8 ("block: remove pktcdvd driver") left behind an export that is now dead code. Remove it and move the declaration of scsi_device_from_queue() to drivers/scsi/scsi_priv.h. Signed-off-by: Catalin Iacob Link: https://patch.msgid.link/20260608-remove-pktcdvd-references-v4-1-72f88b04cc87@gmail.com Signed-off-by: Martin K. Petersen