commit c4f6916a99cf105c3ff340b6210fcbba3fa66b35 Author: Xu Rao Date: Mon Aug 3 17:53:28 2026 +0800 scsi: scsi_debug: Negate wrapped memcmp() result comp_write_worker() returns true when the compared data matches. memcmp() returns zero for equal data and non-zero for different data, so its result must be negated before it is stored in a bool. The first segment already uses !memcmp(), but the wrapped segment uses memcmp() directly, reversing the match result. Use !memcmp() there as well. Fixes: 38d5c8336e60 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: John Garry Link: https://patch.msgid.link/E5AD42E9C0E18633+20260803095328.3445311-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen (Oracle) commit 732cb6bb37fd26863d5786522fb1997e7f5865b4 Author: Zizhi Wo Date: Thu Jul 23 12:12:38 2026 +0800 scsi: core: Do not block on tag allocation in scsi_eh_lock_door() scsi_eh_lock_door() is called from scsi_restart_operations() while the host is still in the SHOST_RECOVERY state, i.e. before the host is switched back to SHOST_RUNNING and scsi_run_host_queues() restarts the queues. It allocates a request via scsi_alloc_request() with no flags, so blk_mq_get_tag() may block waiting for a free sched tag when all tags are already in use. Those tags can be held by commands that were just requeued by scsi_eh_flush_done_q() during error handling. Such commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called - which only happens *after* scsi_eh_lock_door() returns. This forms a circular dependency: - scsi_eh_lock_door(), running in the SCSI error handler thread, waits for a sched tag held by a requeued command; - the requeued command cannot complete and release its sched tag until the error handler thread leaves scsi_restart_operations() and restart the queues. For devices with a single driver tag (e.g. USB storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been reproduced in our environment. Locking the door is a best-effort operation, and scsi_eh_lock_door() already returns silently when the request allocation fails. Pass BLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency and allows the error handler to finish restarting the queues, after which the pending commands are dispatched normally. Signed-off-by: Zizhi Wo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260723041238.1584632-1-wozizhi@huaweicloud.com Signed-off-by: Martin K. Petersen (Oracle) commit 872f486259ae0bc6b73ca4735a15d013241f73e9 Author: Hongjie Fang Date: Wed Jul 29 19:16:14 2026 +0800 scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) commit d756863c9bdf7a85a3fa7fc2886aa32023fe7f76 Author: Piotr Zarycki Date: Mon Jun 29 08:22:57 2026 +0200 scsi: isci: Remove unused macros from scu_task_context.h Remove three accessor macros that are defined but never used: - scu_get_command_request_subtype() - scu_get_command_request_full_type() - scu_get_command_protocl_engine_group() Also remove SCU_CONTEXT_COMMAND_REQUEST_FULLTYPE_MASK and SCU_CONTEXT_COMMAND_PROTOCOL_ENGINE_GROUP_MASK which were only referenced by the removed macros. Signed-off-by: Piotr Zarycki Link: https://patch.msgid.link/20260629062257.986945-1-piotr.zarycki@gmail.com Signed-off-by: Martin K. Petersen commit 2ad156d5300a24f21059432649dc0b726bcdbaa2 Author: Kai Mäkisara Date: Fri Jul 24 08:59:23 2026 +0300 scsi: MAINTAINERS: Orphan the SCSI tape driver Time to retire from the role of maintainer. Signed-off-by: Kai Mäkisara Link: https://patch.msgid.link/20260724055923.4793-1-Kai.Makisara@kolumbus.fi Signed-off-by: Martin K. Petersen commit c79f9bf2d87f34904d9ae38f198929be2b4313e2 Author: Sang-Heon Jeon Date: Fri Jul 24 03:45:32 2026 +0900 scsi: mpt3sas: Remove conditional return with no effect Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon Link: https://patch.msgid.link/20260723184538.3888637-31-ekffu200098@gmail.com Signed-off-by: Martin K. Petersen commit 0279fd451a9971c0d5b959fc59f3e11b55e1694e Author: Ao Sun Date: Thu Jul 23 03:45:30 2026 +0000 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Co-developed-by: Jiazi Li Signed-off-by: Jiazi Li Signed-off-by: Ao Sun Reviewed-by: Bean Huo Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com Signed-off-by: Martin K. Petersen commit 2265541d221dc550dc89b52e49e9d9eb2f824996 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:11 2026 -0700 scsi: fnic: Bump up version number Bump up version number to 1.9.0.0. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Tested-by: Karan Tilak Kumar Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-14-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 8ef412ce8bb3fa984d01f6960a3a3408c2843c33 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:10 2026 -0700 scsi: fnic: Expose NVMe transport state in debugfs Create an NVMe debugfs directory with a per-host nvmef_info file. Report local-port and target-port identifiers for NVMe initiator instances, and initialize and remove the debugfs entries with the NVMe probe and teardown paths. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-13-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit d25a557d344f477ccdc6b711ace77c4d5484a370 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:09 2026 -0700 scsi: fnic: Track NVMe transport statistics Add counters for NVMe requests, responses, LS handling, aborts, and wait-queue activity. Update NVMe I/O, completion, LS response, LS abort, and abort paths to maintain the new counters. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280519.Jd4fmgAZ-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-12-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit f06ee33d72f5baabcc27c60be6fed95d164a06c1 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:08 2026 -0700 scsi: fnic: Abort timed-out NVMe LS requests Add an FDLS helper that sends ABTS frames for outstanding NVMe LS requests. Use the active LS request OXID when building the ABTS frame, send it through the FCoE transmit path, and call it from LS timeout and abort handling. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-11-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 39bf075599bd1eb533c2c7414c79a39dd36de063 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:07 2026 -0700 scsi: fnic: Send NVMe LS requests through FDLS Add the FC frame wrapper for NVMe LS requests and build LS request frames from the NVMe-FC transport callback. Allocate OXIDs, track outstanding LS requests on the target port, arm request timers, and register the LS request callback in the NVMe FC port template. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-10-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 021db11aba3b24525845a2b72981e3d21a591da9 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:06 2026 -0700 scsi: fnic: Handle NVMe LS frames in FDLS Classify NVMe LS request OXIDs, route NVMe LS responses and ABTS frames through the FCS receive path, and reset NVMe exchanges when FDLS tears down target ports. Extend FDLS link-down and frame-processing paths so NVMe LS traffic follows the same discovery and cleanup state machine as FCP traffic. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-9-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit b3f4bc0a7aec4ff48780564f955aa4ee141864e9 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:05 2026 -0700 scsi: fnic: Route completions and resets by initiator role Dispatch FCPIO command, response, and ITMF completions to the FCP or NVMe handlers based on the configured role. Read the NVMe queue-depth and timeout retry fields from firmware config, clean up NVMe I/O on firmware reset, and skip SCSI-only cleanup for initiator roles that already reset firmware-owned requests. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-8-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 5efdd5cf928188023080a01312323bb38e02656e Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:04 2026 -0700 scsi: fnic: Add the NVMe/FC transport path Build fnic_nvme.c and fnic_nvme.h into the driver. Add NVMe local-port and remote-port registration, I/O submission, DMA mapping, tag management, completion and abort handling, LS response handling, and tport/lport cleanup. Update shared fnic structures, FCPIO descriptors, FDLS state, and device-command definitions needed by the NVMe transport path. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605280430.wTYAqI3A-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280619.pmobiDWp-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605280519.Jd4fmgAZ-lkp@intel.com/ Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-7-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 188dfadf025a172142cca34ed5009f3dfcf2d0ad Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:03 2026 -0700 scsi: fnic: Add FDLS role handling for NVMe initiators Modify FDLS registration and discovery flows to use NVMe FC-4 type, features, PRLI service parameters, and FDMI attributes when the adapter runs as an NVMe initiator. Limit SCSI host setup, teardown, rport reset, and FC host notifications to FCP initiators while keeping target-port events available to both FCP and NVMe roles. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-6-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 20b991c3022904b7c2fd38c49ecfdaf17bc1d2f0 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:02 2026 -0700 scsi: fnic: Advertise NVMe initiator service parameters Set FC service parameters according to the selected initiator role. Keep FCP retry and confirmation bits for FCP initiators, and advertise NVMe initiator and SLER bits for NVMe initiators. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-5-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 12bd1b29128e31ae647802452b8104acf5f66741 Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:01 2026 -0700 scsi: fnic: Decode firmware role configuration Add FNIC_ROLE_CONFIG_MASK and use it to decode firmware role bits when reading vNIC configuration and probing the PCI device. Accept FCP and NVMe initiator roles, report FC target and FC-NVMe target roles explicitly as unsupported, and keep truly undefined role settings on the existing FC initiator default path. Log the configured role flags and expose role names for trace output. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-4-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 6128fec9417313690057e55d9313f4148941b9da Author: Karan Tilak Kumar Date: Fri Jul 24 10:48:00 2026 -0700 scsi: fnic: Use fnic_num for non-SCSI identifiers Use SCSI host numbers only for FCP initiator paths. Name NVMe-facing FDMI and debugfs entries with fnic_num, and record trace events with the driver instance number. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-3-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit b93c38a9f2ce5441c90de55776f8df97679cf8a2 Author: Karan Tilak Kumar Date: Fri Jul 24 10:47:59 2026 -0700 scsi: fnic: Make debug logging protocol independent Make the fnic debug macros take struct fnic instead of struct Scsi_Host so FCP and NVMe initiator roles can share the same logging interface. Add fnic_printk() to route FCP initiator messages through shost_printk() and non-SCSI role messages through printk(). Add role and non-SCSI role messages through printk(). Add role predicates and separate FDLS, FIP, and NVMe logging masks. Convert FCS, FIP, SCSI, ISR, and main debug call sites to pass the fnic instance directly, and keep FIP VLAN MAC descriptors skipped while reporting unexpected descriptor types. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260724174811.5118-2-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit dff03860a722e7f1d0a10bb22628d7896bd4b5ec Author: Chinmaya Kajagar Date: Tue Jul 28 06:48:57 2026 +0200 scsi: zfcp: Trace return values of sysfs unit add store sysfs unit add failures are seen during FCP devices manual SCSI LUN scans, indicating the kernel cannot add a LUN, usually because the device is offline, already exists, no memory or the target port is incorrectly configured. Add a new trace to debug zfcp sysfs unit add failures with tag id ZFCP_DBF_HBA_UAS. This traces wwpn, fcp lun id, return value (error condition) and associated hba of the device. Typical unit add store failures as seen below example syslog messages, Feb 2 10:47:25 systemd-udevd[823]: rport-1:0-2: /etc/udev/ rules.d/41-zfcp-lun-0.0.50c0:0x500507680b26c449:0x01d2000000000000.rules:10 Failed to write ATTR{/sys/devices/css0/0.0.0015/0.0.50c0/0x500507680b26c449 /unit_add}, ignoring: File exists Feb 2 10:50:03 systemd-udevd[801]: rport-2:0-3: /etc/udev/ rules.d/41-zfcp-lun-0.0.50c0:0x500507680b26c448:0x01d2000000000000.rules:10 Failed to write ATTR{/sys/devices/css0/0.0.0015/0.0.50c0/0x500507680b26c448 /unit_add}, ignoring: Cannot allocate memory Example zfcpdbf traces for both the errors: Timestamp : 2026-03-05-07:28:34:029797 Area : HBA Subarea : 00 Level : 3 Exception : - CPU ID : 0002 Caller : 0x000001fe345e6d0e Record ID : 6 Tag : syuast2 Description : syuast2 HBA, unit add, failed, unable to add unit Request ID : 0x00000000ffffffff Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff WWPN : 0x500507680b25c448 LUN : 0x01d3000000000000 Return Value : 0xfffffff4 Timestamp : 2026-03-05-07:33:04:151807 <== the last record Area : HBA Subarea : 00 Level : 3 Exception : - CPU ID : 0002 Caller : 0x000001fe345e6d0e Record ID : 6 Tag : syuast2 Description : syuast2 HBA, unit add, failed, unable to add unit Request ID : 0x00000000ffffffff Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff WWPN : 0x500507680b25c449 LUN : 0x01d0000000000000 Return Value : 0xfffffff4 Link: https://patch.msgid.link/20260728044857.2532646-4-niharp@linux.ibm.com Signed-off-by: Chinmaya Kajagar Signed-off-by: Martin K. Petersen commit 3efec904df6f7b0ca9e6267e9aea543402f01886 Author: Steffen Maier Date: Tue Jul 28 06:48:56 2026 +0200 scsi: zfcp: Trace PLOGI and PRLI within open port response as payload The FCP channel optionally returns the content of PLOGI and PRLI within open port response. This information is needed to debug unexpected open port responses. Pack both PLOGI and PRLI information back-to-back into a PAYload trace record of type "fsf_els" within existing HBA trace record. The length of both parts, and thus also the offset of the second part, are added to the corresponding HBA trace record. Be extra careful regarding bounds checking. Since auto port scan in multi-initiator zoning environments can cause a lot of failed open port responses and trace is enabled by default in the HBA trace area, chose a trace level 4 above the default of 3 for the corresponding PAYload trace record to contain PLOGI/PRLI data. This way, it avoids flooding the PAY area by default. In the spirit of commit 35f040df97fa ("zfcp: retain trace level for SCSI and HBA FSF response records"), pass the level here. For this, introduce an additional argument 'level' for zfcp_dbf_pl_write(). zfcpdbf tool partial trace example with PLOGI/PRLI log info after changes: PLOGI length : 116 PRLI length : 20 Payload time : 2026-01-29-06:19:15:626629 PLOGI/PRLIinfo : 02000000 00000000 80000800 000a0002 00000000 2002000e 1115c62f 2001000e 1115c62f 00000000 00000000 00000000 00000000 80000000 00000000 00000000 00000000 80000000 00000000 000a0000 00010000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 02100014 08002100 00000000 00000000 00000112 Reviewed-by: M Nikhil Reviewed-by: Nihar Panda Signed-off-by: Steffen Maier Co-developed-by: Chinmaya Kajagar Signed-off-by: Chinmaya Kajagar Link: https://patch.msgid.link/20260728044857.2532646-3-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5994844195e9a2ead1d1f5ba65b653debb9f1e35 Author: Chinmaya Kajagar Date: Tue Jul 28 06:48:55 2026 +0200 scsi: zfcp: Enhance fsf status read buffer tracing SRB trace records are logged through hba trace event zfcp_dbf_hba_fsf_uss. Presently, this trace event has few missing fields in fsf status read buffer trace records. To fully trace incoming fsf status read buffer (SRB), the remaining fields are needed to be added to zfcp_dbf_hba_uss structure. Append all the remaining SRB fields to the existing unsolicited status trace records. Extend driver to get 3 bytes source id s_id value from fsf status read buffer's existing reserved field res3. To display this change, we also change the external tool `zfcpdbf` in the s390-tools package. zfcpdbf tool trace example for HBA area after changes: Timestamp : 2025-08-22-05:52:04:171750 Area : HBA Subarea : 00 Level : 2 Exception : - CPU ID : 0003 Caller : 0x0000021e278c07c8 Record ID : 2 Tag : fssrh_4 Description : fssrh_4 HBA, FSF unsolicited status Request ID : 0x0000000000004bfc Request status : 0x00000000 FSF cmnd : 0x00006305 FSF sequence no: 0x00000000 SRB stat type : 0x00000002 SRB stat sub : 0x00000000 SRB D_ID : 0x00fffffd SRB LUN : 0x0000000000000000 SRB q-design. : 0x0000000000000000 SRB length : 0x0000004c SRB res1 : 00000000 SRB res2 : 00 SRB class : 0x00000000 SRB res3 : 00 SRB S_ID : 0x0033c048 SRB res4 : 00000000 00000000 00000000 00000000 00000000 SRB pay length : 12 Payload time : 2025-08-22-05:52:04:171743 SRB info : 6104000c 0033c024 0033c02e Reviewed-by: Benjamin Block Signed-off-by: Chinmaya Kajagar Link: https://patch.msgid.link/20260728044857.2532646-2-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit ccff8c92571500fcfed21281e33daaf645bf692f Author: Chandrakanth Patil Date: Fri Jul 24 23:22:31 2026 +0530 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations here, both the local kzalloc_obj() and the ones inside kobject_uevent_env() itself, can trigger reclaim that waits on that blocked I/O and deadlock. Use memalloc_noio_save()/restore() to cover the whole call instead of just the local allocation. Fixes: ec54b348f274 ("scsi: mpi3mr: Record and report controller firmware faults") Reported-by: sashiko-bot Closes: https://sashiko.dev/#/patchset/20260724164630.924288-1-chandrakanth.patil%40broadcom.com Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260724175231.935192-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 913337c48e6aad5f8fac2f9d1a7b3a345b03b963 Author: David Strahan Date: Wed Jul 22 17:04:01 2026 -0500 scsi: smartpqi: Update version to 2.1.42-011 Update driver version to 2.1.42-011. Signed-off-by: David Strahan Reviewed-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-5-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit 1a220e6e87a31c2572cd07ff47023e5cd92ac80f Author: David Strahan Date: Wed Jul 22 17:04:00 2026 -0500 scsi: smartpqi: Add new PCI device-ids All PCI ID entries in Hex. Add PCI IDs for Hurray Data controllers: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 207d / 4246 9005 / 028f / 207d / 4256 9005 / 028f / 207d / 4356 9005 / 028f / 207d / 4940 9005 / 028f / 207d / 4a46 Add PCI IDs for ZTE controllers: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 1cf2 / 5451 9005 / 028f / 1cf2 / 5452 9005 / 028f / 1cf2 / 5453 Add PCI ID for Ramaxel controller: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 / 028f / 1f3f / 0670 Signed-off-by: David Strahan Reviewed-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-4-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit c64b2ab2ff516a94109020e8caea605ae09ea6d9 Author: David Strahan Date: Wed Jul 22 17:03:59 2026 -0500 scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl Add pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl requests. The existing passthru ioctl uses a 16-bit integer for the I/O buffer size, limiting transfers to 64KB. The big passthru ioctl uses BIG_IOCTL_Command_struct which stores the buffer size as a 32-bit integer, allowing larger transfers required by some management utilities. Add CCISS_BIG_PASSTHRU_SUPPORTED to uapi/linux/cciss_ioctl.h and return 0 from pqi_ioctl() to advertise driver support. Userspace tools can send this ioctl to probe whether the driver supports CCISS_BIG_PASSTHRU before issuing it. Co-developed-by: Mike McGowen Signed-off-by: Mike McGowen Signed-off-by: David Strahan Acked-by: Don Brace Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-3-david.strahan@microchip.com/ Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-3-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit 225548863f0a2350c6f34231ca56710c3dd1a5d5 Author: David Strahan Date: Wed Jul 22 17:03:58 2026 -0500 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. On recent Linux kernels the driver can enter a retry loop on the AIO fast path when a request is retried, looping until timeout. A diagnostic path that takes a physical drive offline on AIO-bypass failure is also never entered on affected kernels. Register a per-command initialization callback with the SCSI core. Its presence causes the core to skip the per-dispatch clear, so the retry marker now survives across the requeue and the AIO-to-RAID fallback proceeds as intended. The driver takes over the marker's lifetime: it is zeroed at tag allocation, preserved across the retry requeue so the error path can act on it, and cleared on terminal completion so the tag starts clean on its next use. Fixes: dce5c4afd035 ("scsi: core: Clear driver private data when retrying request") Co-developed-by: Mike McGowen Signed-off-by: Mike McGowen Acked-by: Don Brace Signed-off-by: David Strahan Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-2-david.strahan@microchip.com Signed-off-by: Martin K. Petersen commit a8ddfd2425bbbafadae8700d63ed8a61a4109878 Author: Leon Romanovsky Date: Wed Jul 22 09:30:10 2026 +0300 scsi: target: Clear cmd_cnt when initial counter enrollment fails When target_get_sess_cmd() fails during session shutdown because percpu_ref_tryget_live() returns false, the command keeps the se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier without owning a reference. Final release through target_release_cmd_kref() then issues an unmatched percpu_ref_put(). Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup") moved the cmd_cnt assignment ahead of the reference acquisition. Clear se_cmd->cmd_cnt whenever the initial target_get_sess_cmd() fails in target_init_cmd() and target_submit_tmr(), so release performs exactly one matching put per acquired reference. Fixes: 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup") Signed-off-by: Leon Romanovsky Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260722-reference-count-underflow-in-target-v1-1-63ab664f12fd@nvidia.com Signed-off-by: Martin K. Petersen commit b601fa590e667bd9643feed8c869b6b3e418480d Author: Benjamin Block Date: Mon Jul 20 09:27:36 2026 +0200 scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req When releasing an adapter we don't free the mempool 'gid_pn_req' that is allocated during the enqueue. This leaks memory: unreferenced object 0xd8d29297de700 (size 256): comm "(udev-worker)", pid 2105, jiffies 4294945794 hex dump (first 32 bytes): 00 00 00 00 de ad 4e ad ff ff ff ff 00 00 00 00 ......N......... ff ff ff ff ff ff ff ff 00 0d c4 5f 67 9d 99 e0 ..........._g... backtrace (crc 4a5b5da2): [<000dc45f64da418c>] kmemleak_alloc+0x6c/0xa0 [<000dc45f62b430aa>] __kmalloc_cache_node_noprof+0x36a/0x4d0 [<000dc45f629a535a>] mempool_create_node_noprof+0xaa/0x150 [<000dc45ee2c065e6>] zfcp_allocate_low_mem_buffers+0x96/0x370 [zfcp] [<000dc45ee2c070f8>] zfcp_adapter_enqueue+0x598/0xd40 [zfcp] [<000dc45ee2c08eb0>] zfcp_ccw_set_online+0x160/0x210 [zfcp] [<000dc45f643d4762>] ccw_device_set_online+0x232/0xd80 [<000dc45f643d53d4>] online_store_recog_and_online+0x124/0x390 [<000dc45f643d8238>] online_store+0x298/0x5b0 [<000dc45f62eb0a04>] kernfs_fop_write_iter+0x2c4/0x480 [<000dc45f62c81150>] new_sync_write+0x370/0x4b0 [<000dc45f62c87abe>] vfs_write+0x43e/0x5b0 [<000dc45f62c87ff4>] ksys_write+0x114/0x1f0 [<000dc45f621c4a16>] do_syscall+0x2f6/0x430 [<000dc45f64d9d5d8>] __do_syscall+0xc8/0x1c0 [<000dc45f64dc2224>] system_call+0x74/0xa0 Fix this by destroying the mempool during the adapter's release. Fixes: 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") Signed-off-by: Benjamin Block Tested-by: M Nikhil Acked-by: M Nikhil Reviewed-by: Chinmaya Kajagar Reviewed-by: Nihar Panda Link: https://patch.msgid.link/20260720072736.3381816-2-niharp@linux.ibm.com Signed-off-by: Martin K. Petersen commit 8a309036f557d3ff4efb2beea5132ba91172d934 Author: Bart Van Assche Date: Wed Jul 15 10:12:28 2026 -0700 scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" There have been multiple reports of performance regressions caused by commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler"). Hence this revert. This patch reverts most of the following commits: * 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") * 6475cfb81fc4 ("scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command") This patch preserves the following commits: * 034d319c8899 ("scsi: ufs: core: Fix interrupt handling for MCQ Mode") * eabcac808ca3 ("scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock") Cc: Neil Armstrong Cc: 孙魁 (Kui Sun) Cc: André Draszik Cc: Gregory CLEMENT Cc: Sebastian Andrzej Siewior Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") Signed-off-by: Bart Van Assche Reviewed-by: Sebastian Andrzej Siewior Tested-by: André Draszik # on Pixel 6 Reviewed-by: André Draszik Link: https://patch.msgid.link/b70eb60a01f971bed68c42c5b555929db5f835df.1784135511.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f71b4a30983b846b4075bf544e835121e70e6a43 Author: Guangshuo Li Date: Wed Jul 15 01:27:26 2026 +0800 scsi: ufs: core: Cancel RTC work in active-active suspend UFS RTC support schedules ufs_rtc_update_work to periodically update the device RTC. The work can issue query commands and access the UFS host controller. A previous change moved the RTC work cancellation before the PRE_CHANGE vendor suspend callback to close a race in the common suspend path. However, the active-active path jumps directly to vops_suspend after flushing exception handling work and therefore bypasses the cancellation. If the RTC work runs while the vendor suspend callback is gating or otherwise changing hardware state, it can access the controller during suspend and trigger an SError. Cancel the RTC work before entering the vendor suspend callback in the active-active path. Since this path now cancels the work, move the RTC work scheduling outside the device and link state restoration block in the resume path. This restarts RTC updates after an active-active suspend and resume cycle. Fixes: b0bd84c39289 ("scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend") Signed-off-by: Guangshuo Li Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260714172726.1736967-1-lgs201920130244@gmail.com Signed-off-by: Martin K. Petersen commit 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 Author: Ibrahim Hashimov Date: Sun Jul 12 20:37:39 2026 +0200 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000. Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command") Suggested-by: Damien Le Moal Cc: stable@vger.kernel.org Signed-off-by: Ibrahim Hashimov Assisted-by: AuditCode-AI:2026.07 Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai Signed-off-by: Martin K. Petersen commit 9c33222bd387312874fbe36ca8002e5c945b9653 Author: TanZheng Date: Fri Jul 24 15:58:50 2026 +0800 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer. Check whether the hooks that need to be called are supported. Fixes: 394f81184882 ("scsi: target: Add block PR support to iblock") Signed-off-by: TanZheng Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260724075850.280699-1-kensanya@163.com Signed-off-by: Martin K. Petersen commit 6e468644fc17a8528f3494a28d31c9d2e7353fb6 Author: John Garry Date: Mon Jun 29 08:53:10 2026 +0000 scsi: core: Drop dev->dma_mask check in evaluating max_sectors When evaluating shost->max_sectors, we currently check dma_dev->dma_mask is non-NULL, as dma_max_mapping_size(dma_dev) could previously not handle unset dma_dev->dma_mask - this is no longer the case. Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260629085310.2298552-3-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen commit 81d273096f122ebb27640fcf1ff0637f8c959f88 Author: John Garry Date: Mon Jun 29 08:53:09 2026 +0000 scsi: dma-mapping: Make dma_max_mapping_size() return 0 for no DMA capability For when a device is not DMA capable, the max mapping size would be 0, so make dma_max_mapping_size() reflect that. Signed-off-by: John Garry Reviewed-by: Robin Murphy Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260629085310.2298552-2-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen commit 98575b9ffc3ac3b4de8b997eb1c4243a287b8e82 Author: Randy Dunlap Date: Sun Jul 19 18:37:59 2026 -0700 scsi: ufs: ufshcd: Fix all kernel-doc warnings - Use the correct name for a struct in kernel-doc - Add kernel-doc for missing struct members or correct the name Warning: ./include/ufs/ufshcd.h:201 Excess struct member 'task_tag' description in 'ufshcd_lrb' Warning: ./include/ufs/ufshcd.h:220 expecting prototype for struct ufs_query_resp. Prototype was for struct ufs_query_res instead Warning: ./include/ufs/ufshcd.h:577 struct member 'suspend_on_no_request' not described in 'ufs_clk_scaling' Warning: ./include/ufs/ufshcd.h:1269 struct member 'nortt' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'trigger_eh_attr' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'timeout_attr' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'lsdb_sup' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 struct member 'vcc_off_delay_us' not described in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'desc_size' description in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'res' description in 'ufs_hba' Warning: ./include/ufs/ufshcd.h:1309 struct member 'sq_tail_slot' not described in 'ufs_hw_queue' Warning: ./include/ufs/ufshcd.h:1309 Excess struct member 'sq_tp_slot' description in 'ufs_hw_queue' Signed-off-by: Randy Dunlap Reviewed-by: Alim Akhtar Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260720013759.2979593-1-rdunlap@infradead.org Signed-off-by: Martin K. Petersen commit e0329beb37abc50da5f1ef1d9f6f160fcda75c1f Author: Nitin Rawat Date: Mon Jul 20 01:28:33 2026 +0530 scsi: ufs: dt-bindings: Document the Maili UFS Controller Document the UFS Controller on Maili SoC. Signed-off-by: Nitin Rawat Reviewed-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260719195833.136543-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 4857949b58cdb61f8cd41ca4ffc674b85896ef61 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:49 2026 -0700 scsi: ibmvfc: fail nvme-fc fcp-io and ls requests during transport reset The current purge code for flushing outstanding commands during a transport reset only deals with SCSI commands. Rename the ibmvfc_scsi_eh_done completion handler to ibmvfc_vfc_eh_done and wire it to correctly complete nvme fcp and ls commands when flushing the inflight command list during a reset. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-34-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4e70b8795ee3ac9aa24d55bff6c11674af2e7fcf Author: Tyrel Datwyler Date: Wed Jul 22 17:01:48 2026 -0700 scsi: ibmvfc: implement nvme-fc FCP abort callback Implement the NVMe-FC FCP abort callback by issuing an NVMF cancel MAD on the same submission queue used by the original FCP request. Use the original request event stored in abort_req->private to recover the associated ibmvfc queue, then allocate a new event from that queue so the cancel is sent on the matching nvme_scrq. Factor the TMF setup into a dedicated helper, mirroring the LS abort path, and populate the cancel key, task tag, target WWPN, and association ID needed for the VIOS NVMF abort request. The abort path sends the cancel synchronously, waits for completion, frees the temporary event, and logs non-zero MAD status values for debugging. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-33-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 20bec08f0208fa6e94ef81ecc44a126cca6ab50f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:47 2026 -0700 scsi: ibmvfc: implement nvme-fc LS abort handling callback Implement the NVMe FC-LS abort callback by issuing an ibmvfc cancel MAD to the VIOS for the outstanding link-service request. Use the saved event pointer from the original FC-LS request to identify the command to cancel, submit the cancel operation, and complete the abort request based on the returned status. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-32-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 73c13e30c56f92b7050cc3cd45b901f861b0c588 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:46 2026 -0700 scsi: ibmvfc: implement nvme-fc IO command submission callback Add helpers to initialize an ibmvfc command from an nvmefc_fcp_req, map request scatterlists into either an inline descriptor or an external DMA pool list, and submit the request on the selected NVMe hardware queue. On completion, translate ibmvfc status into the NVMe-FC response format, including transferred length and CQE handling for no-DMA responses. Also store the NVMe request pointer in struct ibmvfc_event so the completion path can finish the original request. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-31-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 7088e1c8b665eaa50c80f364821e0b19832858c5 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:45 2026 -0700 scsi: ibmvfc: implement nvme-fc LS submission transport callback NVMe FC Link Service commands are required to use the ibmvfc_passthru MAD. Initialize a pssthru mad for the target port including the DMA addresses for the FC4_LS request and response as well as the max length of each IU as provided in the nvmefc_ls_req struct. FC4_LS commands are sent via the primary CRQ. Further, store the assoc_id during a create association request as this is a required field in our vfc_cmd struct for nvme_fcp_io commands. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-30-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 86e4953580964323a727fc8eb8efb21e47cce1b0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:44 2026 -0700 scsi: ibmvfc: implement LLDD callbacks for mapping nvme-fc queues Implement the NVMe-FC queue create and delete callbacks and map NVMe controller queues onto ibmvfc hardware queues. Use qidx of NVMe controller queue to map onto a ibmvfc_queue channel. The Admin queue is always qidx 0 and general practice among other drivers is to map both the Admin queue and first IO queue to the same HW queue. Add a new ibmvfc_nvme_qhandle struct that will be used as the opaque queue handle by the NVMe-FC layer when issuing fcp IO. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-29-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 6fac8df932d8814e8a49736216614c26f51f83a0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:43 2026 -0700 scsi: ibmvfc: declare global function definitions Some common functions will require visibility by both SCSI and NVMe protocols. Make common ibmvfc helper routines available to the NVMe support code. Remove static from the core event allocation, event initialization, event free, target release, command error, and event send helpers, and declare them in ibmvfc.h. This allows ibmvfc-nvme.c to reuse the existing event and target infrastructure. No functional change is intended. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-28-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 28ec8670892c738cac121beb68d38e6c735a001c Author: Tyrel Datwyler Date: Wed Jul 22 17:01:42 2026 -0700 scsi: ibmvfc: extend ibmvfc_debug visibility to ibmvfc-nvme.h Export ibmvfc_debug so the NVMe support code can use the existing ibmvfc_dbg logging macro. The debug control variable is currently file-local to the core driver, which prevents protocol-specific code in ibmvfc-nvme.c from using the shared debug infrastructure. Make the variable global within the module and declare it in ibmvfc-nvme.h. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-27-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 696d1cc2aaa2d7041b64ea714a7460e2d365235c Author: Tyrel Datwyler Date: Wed Jul 22 17:01:41 2026 -0700 scsi: ibmvfc: process NVMe/FC rports in work thread Add an NVMe-specific remote-port add helper and update the rport worker thread to walk the NVMe target list, register new NVMe remote ports, and rescan existing ones through the NVMe-FC midlayer. Also handle delete and delete-with-logout transitions for NVMe remote ports in the same worker context used for SCSI rports. This keeps remote-port registration serialized in the existing worker model while allowing NVMe targets to participate in the common target state machine. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-26-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 3831863f9f5663680e002d8dc3e85e57ef15bb47 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:40 2026 -0700 scsi: ibmvfc: register local nvme fc port after fabric login Register the local NVMe/FC port only after fabric login has completed. The VIOS returns the client port ID in the fabric login response, and that port ID is required to populate the local-port information passed to the NVMe-FC midlayer. Delay local-port registration until that data is available and update the registration helper accordingly. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-25-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 13b7fdf3274c2e7445e442cf83a80c9252fba702 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:39 2026 -0700 scsi: ibmvfc: implement NVMe/FC stubs for local/remote port registration Implement the initial NVMe/FC local-port and remote-port registration functions that notify the NVMe-FC midlayr of port discovery and loss. Register the local port with the NVMe-FC transport, register discovered remote ports against that local port, and add matching unregister paths that wait for the NVMe-FC core to complete asynchronous deletion before dropping driver references. Also store driver-private host and target pointers in the registered NVMe-FC port objects. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-24-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0a3ab63e43b8eeb19a454e5eedca3e99cd737a94 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:38 2026 -0700 scsi: ibmvfc: update state machine to process NVMe/FC targets Update the host work loop and target state-machine helpers to process NVMe targets in addition to SCSI targets. Check both protocol-specific target lists when determining whether there is initialization or logout work pending, and extend the query, target init, and target delete phases to dispatch work for NVMe targets using the same common state-machine callbacks. This allows the existing discovery and login state machine to drive NVMe/FC targets through query, login, and deletion without duplicating the control flow. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-23-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit e0fca728a89f14c2edd3e9f5343d0f019d8f50dd Author: Tyrel Datwyler Date: Wed Jul 22 17:01:37 2026 -0700 scsi: ibmvfc: delete NVMe/FC targets as well as SCSI Extend target deletion paths to process NVMe targets as well as SCSI targets. Update link-down, and host reinitialization flows to walk both the SCSI and NVMe target lists when marking targets for deletion. This ensures that protocol-specific target state stays consistent across adapter resets and fabric events. Rename ibmvfc_relogin to ibmvfc_scsi_relogin as it acts on a scsi command. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-22-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 249313b3f7b5dbbf1aed31feff339ab48937a6fc Author: Tyrel Datwyler Date: Wed Jul 22 17:01:36 2026 -0700 scsi: ibmvfc: allocate targets based on protocol Allocate discovered targets onto the channel-group list that matches their protocol. When a target is created, use the discovered protocol type to decide which list it belongs on. This keeps protocol-specific discovery results isolated and allows later state-machine and remote-port code to walk the correct target set. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-21-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5bdeab3c146786939e980cb5b040a3372aadc28f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:35 2026 -0700 scsi: ibmvfc: add NVMe/FC Query Target support Add protocol-specific query-target support for NVMe/FC targets. Use the NVMe query-target specific MAD when querying an NVMe target and update the associated debug and error logging to include the target protocol. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-20-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit d11c05ddc2b69543353952b569f26d3f791ff339 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:34 2026 -0700 scsi: ibmvfc: add NVMe/FC Process Login support Extend PRLI handling code to support NVMe/FC targets. When the target protocol is NVMe/FC, issue the NVMe process login MAD, set the NVMe FC-4 type, and populate NVMe-specific service parameters. On completion, decode the returned PRLI service parameters and derive the appropriate remote-port roles for NVMe initiator, target, and discovery ports. Keep the existing SCSI PRLI flow unchanged while allowing the common target state machine to complete login for NVMe/FC targets. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-19-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4bc896bf09592758756a451852af095c0dbc7c0e Author: Tyrel Datwyler Date: Wed Jul 22 17:01:33 2026 -0700 scsi: ibmvfc: add NVMe/FC Port Login support Expand the target login path to issue the NVMe/FC-specific port login MAD for NVMe targets. Select the correct PLOGI MAD opcode based on the target protocol and include the protocol name in success and failure logging. The rest of the target login flow remains shared with the existing SCSI implementation. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-18-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 577608a2001977e54589b4357b277cba88dbab83 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:32 2026 -0700 scsi: ibmvfc: add NVMe/FC Implicit Logout and Move Login support Add protocol-specific handling for implicit logout and move-login operations on NVMe/FC targets. Select the NVMe/FC-specific implicit logout opcode when operating on an NVMe target and update the associated logging so protocol-specific operations are visible in debug output. This extends the existing target relogin and migration-related flows to work with NVMe targets as well as SCSI targets. These changes are needed so target reauthentication and target movement continue to work once NVMe/FC targets are added to the driver's state machine. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-17-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 5e9dd03726ad4d7a8fb57f1c4921fc3dc955c47f Author: Tyrel Datwyler Date: Wed Jul 22 17:01:31 2026 -0700 scsi: ibmvfc: send NVMe target discovery MAD Extend target discovery to send protocol-specific discover-target MADs for NVMe/FC. Use the protocol-aware discovery helper to build an NVMe discover-target request, submit it when NVMe/FC support is active, and process the returned target count using the NVMe channel group's discovery buffer. This allows the driver to discover NVMe/FC targets in parallel with the existing SCSI discovery flow while keeping protocol-specific target data separate. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-16-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit fe150862d5b9bef1f0ccc4e2443677dc91c8a332 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:30 2026 -0700 scsi: ibmvfc: allocate and free NVMe channel group discover buffer Allocate a discovery buffer for the NVMe channel group and free it on all teardown and error paths. The existing discovery-buffer allocation only covered the SCSI channel group. This patch is prepratory for sending NVMe/FC target discovery MAD. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-15-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 8acacfa8b0f8b17e740730b3e96f99ff726065b2 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:29 2026 -0700 scsi: ibmvfc: add helper to check NVMe/FC support with active channels It can be the case that NVMeoF is enabled on both the client and VIOS, but no queues are configured making the need to do NVMe target discovery pointless. Add a helper to short hand the capabilities check and active NVMe queue check. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-14-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit a29ee1473ab5b5c85726efdc2f36c78d1a45ab41 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:28 2026 -0700 scsi: ibmvfc: add helper for creating protocol specific discovery event Refactor discover-target event creation so it can be shared by both SCSI and NVMe/FC discovery. Introduce a helper that takes a protocol-specific channel group, selects the correct discover-target opcode, and maps the corresponding discovery buffer into the MAD. This is a preparatory cleanup for issuing protocol-specific discovery MADs in later patches. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-13-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit c34ca34f1dbdf40c368eed42efe273561c3800ba Author: Tyrel Datwyler Date: Wed Jul 22 17:01:27 2026 -0700 scsi: ibmvfc: add wrapper to get vhost associated with a channel struct Add ibmvfc_channels_to_vhost() to recover the parent struct ibmvfc_host from a protocol-specific struct ibmvfc_channels. Later patches need to operate on either the SCSI or NVMe channel group and still access host-wide state such as the primary CRQ, device, and logging context. Centralize that mapping in a helper instead of open- coding container lookups at each call site. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-12-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit ecc03d958e371881cff4d8e5ebaa4ec760ab65ec Author: Tyrel Datwyler Date: Wed Jul 22 17:01:26 2026 -0700 scsi: ibmvfc: add logic for protocol specific fabric logins Add support for the protocol-specific fabric login flow introduced by the updated client/VIOS interface. After NPIV login, a VIOS that advertises protocol-specific support requires separate fabric login MADs for SCSI and NVMe/FC. Track whether SCSI and NVMe/FC fabric login are needed, extend channel enquiry/setup handling to negotiate both SCSI and NVMe queue counts, and issue the appropriate fabric login MADs before target discovery begins. Also update command layout selection so the driver uses the v3 command format when the VIOS advertises NVMe/FC-capable framing. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-11-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 319f6545a2d44e1f18c0b3cc0445c74daf381651 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:25 2026 -0700 scsi: ibmvfc: alloc/dealloc sub-queues for nvme channels Allocate, register, deregister, and release NVMe subordinate CRQs alongside the existing SCSI sub-CRQs. Update the CRQ reset and re-enable paths to tear down and recreate NVMe sub-queues, extend sub-CRQ initialization to allocate NVMe channels when enabled, and release NVMe channel resources during adapter teardown. This keeps the NVMe queue lifecycle aligned with the existing SCSI queue lifecycle so both protocols are reset consistently across probe, remove, and connection recovery. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-10-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 018fc39652914c403d660da03234c8276e388dc0 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:24 2026 -0700 scsi: ibmvfc: initialize NVMe channel configuration during driver probe Initialize the host's NVMe channel-group state during probe. Set up the NVMe channel list head, desired queue count, maximum queue count, protocol identifier, and enablement state alongside the existing SCSI channel-group initialization in ibmvfc_probe(). This prepares the driver with a NVMe/FC channel group that can will be used by later patches for NVMe queue allocation, discovery buffers, target management, and IO submission. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-9-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 848c70852e3fb82d881ea6b917436c4b1046fdc7 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:23 2026 -0700 scsi: ibmvfc: split NVMe support into separate source file and add transport stubs Rename ibmvfc.c to ibmvfc-core.c as first step in decoupling each protocol from the core driver logic. Add ibmvfc-nvme.[ch] files, and register an nvme_fc_port_template with empty callback stubs. Add empty registration functions definitions for local and remote ports. No functional NVMe/FC support is added yet. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-8-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 4991c8f57b61480c83736f3224952a5f55e324df Author: Tyrel Datwyler Date: Wed Jul 22 17:01:22 2026 -0700 scsi: ibmvfc: add NVMe/FC protocol interface definitions Add the protocol definitions for client-VIOS interface updates needed to support NVMe/FC over the ibmvfc NPIV transport. Extend the ibmvfc interface with: - NVMe/FC-specific capability bits and opcodes - protocol-specific channel and queue definitions - updated channel enquiry/setup fields for NVMe queues - v3 command layout support for protocol-specific payloads These changes provide the common header and interface plumbing needed by later patches that add NVMe/FC login, discovery, remote-port handling, and I/O submission. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-7-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit de7ac0f3f08b1b411adcc48835e90f36e242f0c3 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:21 2026 -0700 scsi: ibmvfc: move target list from host to protocol specific channel groups Prepare the driver for protocol-specific target management by moving the target list and target count out of struct ibmvfc_host and into struct ibmvfc_channels. Today the driver only maintains a single SCSI target list, but NVMe/FC support will require separate target tracking for each protocol-specific channel group. Update the existing target iteration, allocation, and discovery paths to use the SCSI channel group's target list instead of a host-wide list. This is a preparatory refactoring only. No functional change is intended for existing SCSI operation. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-6-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 99143433f7f14139ac373c553ec8e1317d0ae58a Author: Tyrel Datwyler Date: Wed Jul 22 17:01:20 2026 -0700 scsi: ibmvfc: free ibmvfc_target allocations with mempool_free The ibmvfc_target *tgt structures for discovery are allocated using mempool_alloc but in turn free'd via kfree in ibmvfc_release_target breaking pool guarentees. Fixup ibmvfc_release_target to call mempool_free instead so that memory is properly returned to the mempool instead of the general allocator. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-5-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0122eab60b151d7815f420a91c7315944a037714 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:19 2026 -0700 scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete path Unlike ibmvfc_tgt_implicit_logout the ibmvfc_tgt_implicit_logout_and_del path fails to check for a NULL evt returned from ibmvfc_get_reserved_event and passes that directly to ibmvfc_send_event which will unconditionally derefence the evt. Check for a NULL evt and perform same escalation as ibmvfc_implicit_logout. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-4-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 7e35396ec853983e7a85de9c4e5ad5b3c090c018 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:18 2026 -0700 scsi: ibmvfc: flush rport_add_work_q during driver teardown INIT_WORK is called on rport_add_work_q during driver probe. When the adapter is removed, ibmvfc_remove() stops the work thread and proceeds to tear down the FC host, but any work item queued via schedule_work() that raced the teardown could still be running or pending in the system workqueue. Add a flush_work() call after kthread_stop() and before fc_remove_host() to drain any outstanding rport add work before the FC host and its rports are torn down. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-3-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 9c2aa65000f6f99e543500cabe4c67ff758d3ff6 Author: Tyrel Datwyler Date: Wed Jul 22 17:01:17 2026 -0700 scsi: ibmvfc: don't call locked done variant for MADs on send failure MADs are processed with the requirement that the host_lock is held for MAD sends and completions. When a MAD job step is called the host lock is already held and there is an unlikely scenario where h_send_crq fails with something other than H_CLOSED. If this happens there is a special done handler for MADs that tries to take the host lock. In this failure scenario fall back to the saved evt->_done unlocked completion handler. Signed-off-by: Tyrel Datwyler Link: https://patch.msgid.link/20260723000149.969416-2-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen commit 0cad7bd51301678ad5c9aad701be29eab2ab4e7a Author: Pan Chuang Date: Fri Jul 17 11:50:13 2026 +0800 scsi: ufs: host: Remove redundant dev_err() Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260717035013.563791-1-panchuang@vivo.com Signed-off-by: Martin K. Petersen commit 4d5282c06ca198319c2de41b10511ddcb8068f42 Author: Shawn Guo Date: Mon Jul 20 10:35:52 2026 +0800 scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc Qualcomm UFS controller found on SoCs SA8255P/SA8797P has a MCQ I/O address space. It should be defined in the bindings even though Linux driver currently doesn't utilize it. Fix the binding before it gets adopted by DTS. Fixes: e2725ed2a7fb ("scsi: ufs: dt-bindings: Document bindings for SA8255P UFS Host Controller") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260720023552.2667237-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Author: Xingui Yang Date: Thu Jul 16 16:11:45 2026 +0800 scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock: the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue, calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI devices and waits for the host to become runtime-active. But the host cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the drain is blocked on that very handler. However skipping the drain reintroduces a race: hisi_sas returns from resume before all PHY UP work and libsas discovery work finish. The controller may then autosuspend while disks are still waking up. The disks issue IO to a suspended controller, the IO fails, and the disks get disabled. Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT notification to after sas_drain_work(). By then the host resume is about to complete, so device removal through device_link no longer blocks on the resume and the cycle is broken. With the deadlock gone, restore sas_resume_ha() (the draining variant) in hisi_sas and remove sas_resume_ha_no_sync(). The reorder is safe for the other libsas consumers (isci, pm8001, aic94xx, mvsas). During suspend, sas_suspend_devices() calls sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a timed-out phy's disk is immediately rejected by the LLDD before reaching hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET), and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both complete directly via scsi_done() without entering SCSI EH. This is identical in both the old and new ordering since lldd_dev_gone runs during suspend, before resume. The reorder only affects when the PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work() vs. asynchronous after resume returns), not whether I/O can reach the device. aic94xx and mvsas do not register any PM ops and never reach this code path. Fixes: fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") Signed-off-by: Xingui Yang Reviewed-by: John Garry Link: https://patch.msgid.link/20260716081145.3950172-1-yangxingui@huawei.com Signed-off-by: Martin K. Petersen commit c1dea15f819cded9b3faf58f8bec72323568b6e6 Author: HyeongJun An Date: Thu Jul 16 15:58:48 2026 +0900 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Suggested-by: Chris Leech Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260716065848.1653431-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen commit 9b61402740eb993fc2cb6c2c2d5e74f6be15ddca Author: Colin Ian King Date: Tue Jul 14 08:35:10 2026 +0100 scsi: dc395x: Remove unused variable 'fact' The variable 'fact' was used for debug but this was removed in commit 62b434b0db2c ("scsi: dc395x: Remove DEBUG conditional compilation"). The variable is now redundant and can be removed. Cleans up clang scan build warning: drivers/scsi/dc395x.c: In function ‘msgin_set_sync’: drivers/scsi/dc395x.c:2185:13: warning: variable ‘fact’ set but not used [-Wunused-but-set-variable] 2185 | int fact; Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260714073510.43289-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit 98b87885de4b7f605533a2860685f5689fce8e82 Author: HyeongJun An Date: Tue Jul 14 19:49:34 2026 +0900 scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen commit 0617678ca22cece6e3853e28f7fec6b0c6472df5 Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:33 2026 +0200 scsi: zorro7xx: Make use of struct zorro_device_id::driver_data_ptr Usage of .driver_data_ptr allows to drop several casts. A nice upside of that is that now the constness of the linked structures is kept and the compiler warns about zdd missing a const. So add this missing const, too. While touching the zorro_device_id array, drop an unneeded explicit zero in the list terminator. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/b7f3b4bfa5daabf8a3043177341b8dbb4e4d980e.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 841970b2f6cbbfd57647b9e8799f6ed55e47e04f Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:32 2026 +0200 scsi: zorro: Simplify storing pointers in device id struct Technically it is fine (on all current Linux architectures) to store a pointer in an unsigned long variable. However this needs explicit casting which is an easy source for type mismatches. By replacing the plain unsigned long .driver_data in struct zorro_device_id by an anonymous union, most of the casting can be dropped. There is still some implicit casting involved (between a void * and a driver specific pointer type), but that's better than the approach to store a pointer in an unsigned long variable as this doesn't lose the information that the data being pointed to is const. All users of struct zorro_device_id are initialized in a way that is compatible with the new definition, so no adaptions are needed there. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Reviewed-by: Max Staudt Acked-by: Helge Deller Link: https://patch.msgid.link/49576a7501128c93ef318566ed7faefce163f1fd.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 108e48a9a405be611e6812f105b4d376de5640b8 Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:28 2026 +0200 scsi: zorro: a2091: gvp11: Use named initializer for zorro_device_id Using named initializers is more explicit and thus easier to parse for a human. It's also more robust to changes in the struct definition. This robustness is relevant for a planned change to struct zorro_device_id that replaces .driver_data by an anonymous union. While touching these arrays, drop explicit zeros from the list terminator. This change doesn't introduce changes to the compiled zorro_device_id arrays. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/9602004a447b474b15ca1e110d6d3c277f669e20.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 81117c076f79fe982bca0c3009538a04694e1045 Author: Uwe Kleine-König (The Capable Hub) Date: Wed Jun 10 16:36:28 2026 +0200 scsi: NCR5380: Improve style of pnp_device_id array terminator To match how device-id array terminators look like for other device types drop '.id = ""' from it and let the compiler care for zeroing the entry. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 85666bde770cbbfa59f25e2d704776e56466ff52 Author: Uwe Kleine-König (The Capable Hub) Date: Wed Jun 10 16:36:28 2026 +0200 scsi: aha1542: Improve style of pnp_device_id array terminator To match how device-id array terminators look like for other device types drop '.id = ""' from it and let the compiler care for zeroing the entry. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 18ae351fec146e77a454449a47f3268db591ff7f Author: Uwe Kleine-König (The Capable Hub) Date: Tue May 26 16:17:27 2026 +0200 scsi: ata: pata_budda: Use named initializer for zorro_device_id Using named initializers is more explicit and thus easier to parse for a human. It's also more robust to changes in the struct definition. This robustness is relevant for a planned change to struct zorro_device_id that replaces .driver_data by an anonymous union. This change doesn't introduce changes to the compiled zorro_device_id array. Signed-off-by: Uwe Kleine-König (The Capable Hub) Acked-by: Niklas Cassel Acked-by: Damien Le Moal Reviewed-by: Geert Uytterhoeven Acked-by: Helge Deller Link: https://patch.msgid.link/a20f52aeee9dfcacfaea43ff280fa1867878cbbe.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen commit 7268e509b43ac1734e1bdb7d18553f7e1080dfb4 Author: Shivaprasad G Bhat Date: Fri May 15 13:45:18 2026 +0000 scsi: qla2xxx: Handle INTx not connected while passing through The PCI_INTERRUPT_PIN reports if the device supports the INTx. However, when the device is assigned to a guest via vfio, the PCI_INTERRUPT_PIN is set to 0 (i.e none) if the line is not connected and/or the platform cannot route the interrupt. In such cases, the guest PCI_INTERRUPT_PIN is 0 and the port number becomes -1 (255, uint8_t underflow) for qla[25|27|28]xx and qla2031 devices. The flt_region_nvram is never set, and subsequently the LUN detection fails. Below warnings show the NVRAM configuration failure: []-0073:1: Inconsistent NVRAM checksum=0xffffffc0 id=HCAM version=0x100. []-0074:1: Falling back to functioning (yet invalid -- WWPN) defaults. []-0076:1: NVRAM configuration failed. Handle this case and set the port_no to devfn like its done everywhere else. Reference: commit 2bd42b03ab6b ("vfio/pci: Virtualize zero INTx PIN if no pdev->irq") Signed-off-by: Shivaprasad G Bhat Reviewed-by: Kyle Mahlkuch Link: https://patch.msgid.link/177885270578.1573.14283751510936407585.stgit@linux.ibm.com Signed-off-by: Martin K. Petersen commit c6cee609f614b790a72cb34d6d28b3635c874ddf Author: Neil Armstrong Date: Thu Jun 18 09:52:09 2026 +0200 scsi: ufs: Switch WriteBooster missing free space message as warn_once Once the UFS WriteBooster fails to allocate memory, the situation will stay until fstrim or equivalent is ran. Mark is as a warning since it impacts the performance but only print it once for the lifetime of the kernel since it's not fatal. Otherwise it will be printed each time the device is resumed: [ 31.666880] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 52.655594] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 62.890469] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available ... Signed-off-by: Neil Armstrong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260618-topic-ufs-wb-empty-warn-v1-1-ec744a153e0e@linaro.org Signed-off-by: Martin K. Petersen commit f13faec1d4c16b3705d1eccffb8ba6723f1102ff Author: Can Guo Date: Thu Jun 25 05:13:05 2026 -0700 scsi: ufs: core: Always run tx_eqtr POST_CHANGE notify ufshcd_tx_eqtr() skips POST_CHANGE notify when __ufshcd_tx_eqtr() fails. That can leave variant cleanup incomplete when PRE_CHANGE saved temporary state that POST_CHANGE is expected to restore. Always call POST_CHANGE once PRE_CHANGE has succeeded. Keep the TX EQTR result as the primary return value, and only propagate POST_CHANGE failure when TX EQTR itself succeeded. Log PRE_CHANGE and POST_CHANGE notify failures to make variant callback failures visible in TX EQTR error paths. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 4bd0875b7e571eeeed45fdab52672b850c1845a5 Author: Can Guo Date: Thu Jun 25 05:13:04 2026 -0700 scsi: ufs: core: Tolerate RX_FOM read failures in TX EQTR ufshcd_get_rx_fom() aborted TX EQTR when a per-lane RX_FOM DME read failed. That makes the whole training flow fragile even though these reads can be treated as best effort. Keep TX EQTR running by logging RX_FOM read failures and continuing. Make failed lanes deterministic by initializing each lane FOM to 0 before reading and only updating it when the DME read succeeds. This avoids propagating stale or uninitialized values into EQTR evaluation. Also update the kerneldoc return description to match behavior: RX_FOM DME read failures are handled as warnings, while get_rx_fom() vops failures are still propagated to the caller. Signed-off-by: Can Guo Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 890b10e76e6cca5a3b4fa48a994eb3cdc566dec3 Author: Can Guo Date: Thu Jun 25 05:13:03 2026 -0700 scsi: ufs: ufs-qcom: Restore TX Equalization settings on FOM failure ufs_qcom_get_rx_fom() applies temporary device TX Equalization values before forcing HS mode and running the EOM-based SW FOM scan. When one of these steps fails, the function can bypass the shared cleanup path and leave temporary TX Equalization settings programmed. Route those failures through the cleanup label so the original TX EQ settings are restored and link recovery runs before exit. This path also reuses ret for cleanup, so it may overwrite the original error. Keep that on purpose: if cleanup succeeds, the caller can proceed with the FOM result for the current iteration. Signed-off-by: Can Guo Reviewed-by: Bean Huo Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260625121306.1655467-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 760fc6f0e25a72832c2fcf37ecf5f1b770ec8374 Author: Can Guo Date: Thu Jun 18 07:09:29 2026 -0700 scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart] Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2 Signed-off-by: Can Guo Reviewed-by: Ziqi Chen Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 78f638ff3bc19d8faeac109b50dd0bab87871ff4 Author: Himanshu Batra Date: Tue Jun 16 15:31:21 2026 +0530 scsi: ufs: sysfs: Add HS_GEAR6 string in power_info/gear sysfs output In power_info/gear sysfs, currently it supports output only till gear 5. If operating mode is gear 6, it outputs "UNKNOWN". Add support for HS_GEAR6 string in sysfs output when operating mode is gear 6. Signed-off-by: Himanshu Batra Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com Signed-off-by: Martin K. Petersen commit 53b056ef7f7c0dfda981701f0236ca8704a787c9 Author: Yihang Li Date: Tue Jun 16 11:20:51 2026 +0800 scsi: MAINTAINERS: Update HiSilicon hisi_sas driver maintainer to Xingui Yang Replace myself with Xingui Yang who is very familiar with the HiSilicon hisi_sas drivers. Signed-off-by: Yihang Li Reviewed-by: Jason Yan Link: https://patch.msgid.link/20260616032051.1268608-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit e166bafc483e927150cb9b5f286c9191ea0df84e Author: Haoxiang Li Date: Tue Jun 23 00:00:28 2026 +0800 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping the SCSI command, and dropping the outstanding IOACCEL command count before returning. Fixes: c5dfd106414f ("scsi: hpsa: correct device resets") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Acked-by: Don Brace Link: https://patch.msgid.link/20260622160028.1240496-1-haoxiang_li2024@163.com Signed-off-by: Martin K. Petersen commit 2c007acf7b31c39c08ce4959451ad00b19be4c1f Author: WenTao Liang Date: Thu Jun 11 13:30:37 2026 +0800 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below. Cc: stable@vger.kernel.org Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization") Signed-off-by: WenTao Liang Reviewed-by: Daniel Wagner Link: https://patch.msgid.link/20260611053037.63756-1-vulab@iscas.ac.cn Signed-off-by: Martin K. Petersen commit 9cb2d5291dbfe7bed565ead3337047dee9ed1064 Author: Haoxiang Li Date: Mon Jun 22 15:58:44 2026 +0800 scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct_dispatch_fcp_cmd() allocates an efct_io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before handing the IO to the SCSI layer. Free the allocated IO before returning from this error path. Fixes: f45ae6aac0a0 ("scsi: elx: efct: Unsolicited FC frame processing routines") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Daniel Wagner Link: https://patch.msgid.link/20260622075844.832871-1-haoxiang_li2024@163.com Signed-off-by: Martin K. Petersen commit dccf3b1798b70f94e958b3d00b83010399e6fb05 Author: David Jeffery Date: Mon Jun 15 13:46:30 2026 -0400 scsi: core: wake eh reliably when using scsi_schedule_eh Drivers which use the scsi_schedule_eh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There is no enforced memory order between setting the host into error recovery state and counting busy commands. This can result in a race with scsi_dec_host_busy where neither CPU sees both conditions of all commands inactive and the host error state to request waking the error handler. To fix this, run the scsi_schedule_eh's scsi_eh_wakeup from a new work item which will use rcu to ensure scsi_schedule_eh's call to scsi_host_busy will occur after the error state is globally visible and will be seen by any current scsi_dec_host_busy callers. Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq") Signed-off-by: David Jeffery Link: https://patch.msgid.link/20260615174630.11492-1-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit fda6a1f3c3d7047b5ce5654487649c2daa738bfc Author: Bryam Vargas Date: Wed Jun 10 04:22:48 2026 +0000 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged. Fixes: 4949314c7283 ("target: Allow control CDBs with data > 1 page") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: John Garry Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20260610042245.35473-1-hexlabsecurity@proton.me Signed-off-by: Martin K. Petersen commit d04a179085c262c9ed577d0a4cbc6482ff1fd9a3 Author: Bryam Vargas Date: Thu Jun 11 13:42:26 2026 -0500 scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling it how many bytes are valid. For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with an unbounded strstr() (and on the error path prints the name with a further unbounded "%s"). An initiator can submit a TransportID whose iSCSI name contains neither a ",i,0x" substring nor a NUL terminator, filling the parameter list to its end, so the scan runs off the end of the buffer. When the parameter list spans more than one page the buffer is a multi-page vmap (transport_kmap_data_sg()), so the over-read walks into the trailing vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It is reachable by any fabric that delivers a PR OUT to a device exported through an iSCSI TPG, including a guest via vhost-scsi. Pass the number of received bytes down to the parser and validate the iSCSI TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up front: reject it if it is below the spc4r17 minimum or larger than the received buffer, then bound the separator search, the ISID walk and the name copy by that length. This is the length check the callers already perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len against tpdl, core_scsi3_emulate_register_and_move() validates it against data_length), moved ahead of the scan. Also drop the unbounded "%s" of the unterminated name. Add per-format explicit name-length checks before copying into i_str, rather than silently truncating with min_t: for FORMAT CODE 00b reject if the descriptor body (tid_len - 4 bytes) cannot fit in i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion (from &buf[4] up to the separator) cannot fit. Both checks make the bounds intent explicit at each format branch. While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x" separator sits at the very end of the descriptor: that leaves an empty ISID and points the returned port nexus pointer at buf + tid_len, one past the descriptor, which the registration code (__core_scsi3_locate_pr_reg(), __core_scsi3_alloc_registration()) then dereferences as the ISID string -- the same over-read of the parameter buffer for a malformed descriptor. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: John Garry Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20260611-b4-disp-9f20739e-v6-1-f6630e2aae44@proton.me Signed-off-by: Martin K. Petersen commit 8cbaf7b1ab4dd9ced322b6ebf60b079cc3a3d8d2 Author: Louis Sautier Date: Wed Jul 1 00:49:22 2026 +0200 scsi: mpt3sas: Add hwmon support Expose the IOC and board temperature sensors of LSI / Broadcom SAS HBAs through hwmon. Readings come from MPI IO Unit Page 7 via the accessor added in the preceding patch. The same fields are exposed by Broadcom's userspace tooling through the /dev/mpt[23]ctl ioctl path (typically root-only): IOCTemperature and BoardTemperature in lsiutil; ROC and Controller in storcli. With this driver, sensors(1) shows them unprivileged: $ sensors mpt3sas-pci-0200 mpt3sas-pci-0200 Adapter: PCI adapter IOC: +42.0°C Each channel is gated independently by its *TemperatureUnits field through is_visible(); cards that populate only one sensor expose only one input file, and cards that populate neither do not register an hwmon device. The hwmon code is gated directly on CONFIG_HWMON. IS_REACHABLE() is used rather than IS_ENABLED() so that SCSI_MPT3SAS=y with HWMON=m still builds; in that configuration, the sensors are not exposed (same pattern as i915 and xe). Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Louis Sautier Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260630224922.2543096-3-sautier.louis@gmail.com Signed-off-by: Martin K. Petersen commit 26018997054dabe5d8f17495f2d75f211d01884b Author: Louis Sautier Date: Wed Jul 1 00:49:21 2026 +0200 scsi: mpt3sas: Add IO Unit Page 7 config accessor Add mpt3sas_config_get_iounit_pg7(), mirroring the existing iounit page accessors. Used by the hwmon driver added in the following patch to read the IOC and board temperatures. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Louis Sautier Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260630224922.2543096-2-sautier.louis@gmail.com Signed-off-by: Martin K. Petersen commit 7ebadbae3dd793663f313e4046c1c20e12351769 Author: Ed Tsai Date: Mon Jun 15 13:57:17 2026 +0800 scsi: ufs: core: Remove max_num_rtt field from ufs_hba_variant_ops Remove the max_num_rtt field from ufs_hba_variant_ops as it has been replaced by the get_hba_nortt() callback which provides more flexible platform-specific RTT capability handling. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-4-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit 75f529a7bcd4aaac7cf73dc885041d7f66403570 Author: Ed Tsai Date: Mon Jun 15 13:57:16 2026 +0800 scsi: ufs: mediatek: Implement get_hba_nortt callback for RTT capability Implement the get_hba_nortt callback to handle platform-specific RTT capability differences: - For legacy platforms and IP versions before MT6995 B0, the RTT capability from host controller register is problematic, so limit it to 2 (MTK_MAX_NUM_RTT_LEGACY). - For MT6995 B0 and later platforms, the issue is fixed and the value from host controller capability register can be used directly. This replaces the previous max_num_rtt field in ufs_hba_variant_ops with dynamic platform-specific logic. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-3-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit e7896d02cb4d0e6b4e97c62af669109ab809c0ca Author: Ed Tsai Date: Mon Jun 15 13:57:15 2026 +0800 scsi: ufs: core: Add get_hba_nortt callback for vendor-specific RTT capability The number of outstanding RTTs read from host controller capability register is problematic on some platforms. Add a new vendor callback get_hba_nortt() to allow platform vendors to override the default RTT capability value with platform-specific handling. This patch keeps max_num_rtt field for bisectability and will be removed in a later patch once all platforms are migrated. Signed-off-by: Ed Tsai Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260615055802.105479-2-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit ecb8d6da1356abc3168e530fc328b3d461107d0f Author: Can Guo Date: Tue Jun 16 04:33:48 2026 -0700 scsi: ufs: core: Add support for static TX Equalization settings Parse board-specific static TX Equalization settings from Device Tree for each HS gear and store them in hba->tx_eq_params. Parse txeq-preshoot-g[1-6] and txeq-deemphasis-g[1-6] as per-lane tuples: , []. For HS-G6, parse optional tx-precode-enable-g6 using the same per-lane Host/Device tuple format. If provided, it must contain values for all active lanes, and each value must be 0 or 1. Introduce from_dt in struct ufshcd_tx_eq_params to track whether TX EQ values came from static Device Tree data. When adaptive TX Equalization is used, these static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static Device Tree settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static Device Tree settings. So static Device Tree settings are a fallback for cases where adaptive TX Equalization is not enabled or not used. Adaptive TX Equalization remains the primary path when enabled. No behavior changes for platforms that do not provide these properties. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260616113348.1168248-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit ce36dbeb2951607304cc5451a33ddcf06880d726 Author: Can Guo Date: Tue Jun 16 04:33:47 2026 -0700 scsi: ufs: dt-bindings: Document static TX Equalization settings properties UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0 and M-PHY v6.0. These specs define TX Equalization for all High-Speed Gears (not only HS-G6) to compensate channel loss and improve signal integrity at high speed. For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be required depending on channel characteristics. Document vendor-neutral properties in ufs-common.yaml: - txeq-preshoot-g[1-6] - txeq-deemphasis-g[1-6] - tx-precode-enable-g6 Values are per-lane Host/Device tuples (2 values for x1, 4 values for x2). PreShoot/DeEmphasis range from 0..7, and Precode is 0/1. These are board-specific signal-integrity tuning values. They depend on channel SI/PHY characterization and validation (host PHY, device PHY, package, and board routing), and are determined by HW/PHY designers. Although UFSHCI v5.0 supports TX Equalization Training via UniPro v3.0, which allows host software to determine optimal TX Equalization at runtime, static board-specific TX Equalization settings in the Device Tree are still necessary because: - TX Equalization Training is not supported for HS-G3 and below - TX Equalization Training is disabled on some platforms Reviewed-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Can Guo Link: https://patch.msgid.link/20260616113348.1168248-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 1bd28625e25be549ee7c47532e7c3ef91c682410 Author: Abdun Nihaal Date: Tue Jul 7 12:23:02 2026 +0530 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() The memory allocated for mboxq using mempool_alloc() is not freed in some of the early exit error paths. Fix that by moving the mempool_free() call to an earlier point after last use. Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Reviewed-by: Justin Tee Link: https://patch.msgid.link/20260707065304.949135-1-nihaal@cse.iitm.ac.in Signed-off-by: Martin K. Petersen commit 1d3a742afeb761eaead774691bde1ced699e9a5d Author: Xu Rao Date: Tue Jul 7 11:08:45 2026 +0800 scsi: sg: Report request-table problems when any status is set SG_GET_REQUEST_TABLE reports per-request diagnostic state through sg_req_info::problem. The field is meant to indicate whether there is an error to report for a completed request. sg_fill_request_table() currently combines masked_status, host_status and driver_status with bitwise AND. This only reports a problem when all three status fields are non-zero at the same time. A normal target check condition, for example, has masked_status set while host_status and driver_status may both be zero, so the request is incorrectly reported as clean. Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when any of the three status fields is non-zero. Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/54B60C19F7DB8889+20260707030845.970018-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen commit 46aea2c64e110ed1878fa5363f86ddc8fd79c9c4 Author: Steven Rostedt Date: Tue Jun 30 18:54:12 2026 -0400 scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: 583e518e7100 ("scsi: ufs: core: Add hba parameter to trace events") Signed-off-by: Steven Rostedt Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260630185412.283c26c5@gandalf.local.home Signed-off-by: Martin K. Petersen commit 1e9036e7580bd3eda6849ca64b07223ed80dc440 Author: Ben Dooks Date: Tue Jun 23 14:24:27 2026 +0100 scsi: virtio_scsi: Fix up endian conversions for warning messages There are several places where printing functions are being passed parameters that have not been through endian conversion functions. Use virtio32_to_cpu() to fix the warnings. Fixes the following warnings from (prototype) sparse: drivers/scsi/virtio_scsi.c:126:9: warning: incorrect type in argument 7 (different base types) drivers/scsi/virtio_scsi.c:126:9: expected unsigned int drivers/scsi/virtio_scsi.c:126:9: got restricted __virtio32 [usertype] sense_len drivers/scsi/virtio_scsi.c:312:17: warning: incorrect type in argument 2 (different base types) drivers/scsi/virtio_scsi.c:312:17: expected unsigned int drivers/scsi/virtio_scsi.c:312:17: got restricted __virtio32 [usertype] reason drivers/scsi/virtio_scsi.c:412:17: warning: incorrect type in argument 2 (different base types) drivers/scsi/virtio_scsi.c:412:17: expected unsigned int drivers/scsi/virtio_scsi.c:412:17: got restricted __virtio32 [usertype] event Signed-off-by: Ben Dooks Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20260623132427.838900-1-ben.dooks@codethink.co.uk Signed-off-by: Martin K. Petersen commit 57a6ed0b41677ccc5e28cc0976e495c1dfa33747 Author: Arnd Bergmann Date: Thu Jun 11 14:55:56 2026 +0200 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() bfa_fcs_fdmi_get_portattr() gets inlined into multiple places and has two fairly large variables on the stack, to the point of causing a warning in some randconfig builds: drivers/scsi/bfa/bfa_fcs_lport.c:2198:1: error: stack frame size (1560) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_portattr_block' [-Werror,-Wframe-larger-than] 2198 | bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi, | ^ drivers/scsi/bfa/bfa_fcs_lport.c:1856:1: error: stack frame size (1600) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_rhba_pyld' [-Werror,-Wframe-larger-than] 1856 | bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld) | ^ Mark the inner function as noinline_for_stack to keep it separate from the other variables and prevent multiple copies of the same variable to get inlined here. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260611125601.3385418-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit 66aefc277ebb796ec285d550305535dc3fc0179f Author: Michael Bommarito Date: Thu Jun 11 08:30:46 2026 -0400 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsiback_device_action() obtains a command tag in scsiback_get_pend_req() and submits a task-management request with target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and scsiback jumps to the err: label, which sends a response but frees nothing, leaking the tag. Impact: a pvSCSI guest can leak the command tags of a LUN's session, stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests whenever target_submit_tmr() fails. transport_generic_free_cmd() cannot be used here. By the time target_submit_tmr() returns an error it has already run __target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the pointer dangling. Letting the command release run target_free_cmd_mem() would then double-free se_tmr_req. Use the same helper, which returns just the tag, on this path too. Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260611123046.2323342-3-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit ca978f8a93d4d36841839bf2847d29b88c2591d6 Author: Michael Bommarito Date: Thu Jun 11 08:30:45 2026 -0400 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0; the se_cmd is initialised (kref_init() via target_init_cmd()) only later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB path. The two error paths in scsiback_do_cmd_fn() taken before the command is submitted -- a failed scsiback_gnttab_data_map() and an unknown ring_req.act -- call transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a refcount of 0. That underflows it ("refcount_t: underflow; use-after-free") and, as the release function is not run, leaks the command tag. Impact: a pvSCSI guest can leak every command tag of a LUN's session, stopping the LUN, by submitting requests with a bad grant reference or an unknown request type; under panic_on_warn the refcount underflow panics the host. Add a helper that just returns the tag with target_free_tag() and sends the error response. It frees the tag while the v2p reference still pins the session, and snapshots the response fields beforehand because freeing the tag can let another ring reuse the pending_req slot. Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260611123046.2323342-2-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit e81f1079f9000892cf54b23a9572ad5d86036fca Author: Catalin Iacob Date: Mon Jun 8 17:29:16 2026 +0300 scsi: core: Remove export for scsi_device_from_queue() Commit 1cea5180f2f8 ("block: remove pktcdvd driver") left behind an export that is now dead code. Remove it and move the declaration of scsi_device_from_queue() to drivers/scsi/scsi_priv.h. Signed-off-by: Catalin Iacob Link: https://patch.msgid.link/20260608-remove-pktcdvd-references-v4-1-72f88b04cc87@gmail.com Signed-off-by: Martin K. Petersen