Stefan Hajnoczi [Thu, 2 Apr 2026 18:03:42 +0000 (14:03 -0400)]
scsi: target: Don't validate ignored fields in PROUT PREEMPT
The PERSISTENT RESERVE OUT command's PREEMPT service action provides two
different functions: 1. preempting persistent reservations and 2.
removing registrations. In the latter case the spec says:
b) ignore the contents of the SCOPE field and the TYPE field;
The code currently validates the SCOPE and TYPE fields even when PREEMPT
is called to remove registrations.
This patch achieves spec compliance by validating the SCOPE and TYPE
fields only when they will actually be used.
To confirm my interpretation of the specification I tested against HPE
3PAR storage and found the TYPE field is indeed ignored in this case.
Cc: Maurizio Lombardi <mlombard@redhat.com> Cc: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Link: https://patch.msgid.link/20260402180342.126583-1-stefanha@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Li RongQing [Tue, 31 Mar 2026 05:32:45 +0000 (01:32 -0400)]
scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation
Change the memory allocation for qp_cpu_map to use the actual number of
CPUs ('nr_cpu_ids') instead of the maximum possible CPUs ('NR_CPUS').
This saves memory on systems where the maximum CPU limit is much higher
than the active CPU count.
Yang Xiuwei [Mon, 30 Mar 2026 01:49:52 +0000 (09:49 +0800)]
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
If device_add(&sdkp->disk_dev) fails, put_device() runs
scsi_disk_release(), which frees the scsi_disk but leaves the gendisk
referenced. The device_add_disk() error path in sd_probe() calls
put_disk(gd); call put_disk(gd) here to mirror that cleanup.
Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()") Cc: stable@vger.kernel.org Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Link: https://patch.msgid.link/20260330014952.152776-1-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Li Tian [Mon, 6 Apr 2026 01:53:44 +0000 (09:53 +0800)]
scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC
The storvsc driver has become stricter in handling SRB status codes
returned by the Hyper-V host. When using Virtual Fibre Channel (vFC)
passthrough, the host may return SRB_STATUS_DATA_OVERRUN for
PERSISTENT_RESERVE_IN commands if the allocation length in the CDB does
not match the host's expected response size.
Currently, this status is treated as a fatal error, propagating
Host_status=0x07 [DID_ERROR] to the SCSI mid-layer. This causes
userspace storage utilities (such as sg_persist) to fail with transport
errors, even when the host has actually returned the requested
reservation data in the buffer.
Refactor the existing command-specific workarounds into a new helper
function, storvsc_host_mishandles_cmd(), and add PERSISTENT_RESERVE_IN
to the list of commands where SRB status errors should be suppressed for
vFC devices. This ensures that the SCSI mid-layer processes the returned
data buffer instead of terminating the command.
Signed-off-by: Li Tian <litian@redhat.com> Reviewed-by: Long Li <longli@microsoft.com> Reviewed-by: Laurence Oberman <loberman@redhat.com> Link: https://patch.msgid.link/20260406015344.12566-1-litian@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Eric Biggers [Sat, 4 Apr 2026 20:30:03 +0000 (13:30 -0700)]
scsi: iscsi_tcp: Remove unneeded selections of CRYPTO and CRYPTO_MD5
As far as I can tell, CRYPTO_MD5 has been unnecessary here ever since it
was added by commit c899e4ef96f0 ("[SCSI] open-iscsi/linux-iscsi-5
Initiator: Kconfig update") in 2005.
CRYPTO was needed until commit 92186c1455a2 ("scsi: iscsi_tcp: Switch to
using the crc32c library"), but is no longer needed.
Merge patch series "Update lpfc to revision 15.0.0.0"
Justin Tee <justintee8345@gmail.com> says:
Update lpfc to revision 15.0.0.0
This patch set adds support for the G8 ASIC found on the LPe42100
series adapter models.
Updates are made to irq affinity assignment, mailbox command handling
related to initialization, SGL construction, firmware download
diagnostics, and the removal of an outdated performance feature. We
also add 128G link speed selection and support.
The patches were cut against Martin's 7.1/scsi-queue tree.
Justin Tee [Tue, 31 Mar 2026 20:59:27 +0000 (13:59 -0700)]
scsi: lpfc: Add PCI ID support for LPe42100 series adapters
Update supported pci_device_id table to include the values for the G8 ASIC
Device ID utilized by LPe42100 series of adapters. The default reporting
string will be "LPe42100".
Justin Tee [Tue, 31 Mar 2026 20:59:26 +0000 (13:59 -0700)]
scsi: lpfc: Introduce 128G link speed selection and support
128G link speed selection and support is added for various mailbox
commands, defines, and ACQE handling. The default behavior to
autonegotiate supported link speed remains the same.
Justin Tee [Tue, 31 Mar 2026 20:59:25 +0000 (13:59 -0700)]
scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates
When WRITE_OBJECT mailbox command fails during firmware update, the
lpfc_log_write_firmware_error() routine is used to log and parse commonly
found error codes. Update this routine to also include ASIC_ID register
checks for notifying users of incompatible images.
Justin Tee [Tue, 31 Mar 2026 20:59:24 +0000 (13:59 -0700)]
scsi: lpfc: Update construction of SGL when XPSGL is enabled
The construction of SGLs is updated to safeguard ASIC boundary requirements
when using XPSGL.
The LSP type SGE is used to notify where a continuing SGL resides.
Typically, this means that the LSP is the last SGE in an SGL because the
current SGL has reached its maximum size and the LSP is used to refer to
the next follow up SGL. Due to ASIC boundary requirements, there is a need
to ensure a 4 KB boundary is not crossed. Thus, for a maximum size of 256
byte SGLs or 16 SGEs, this means restricting the LSP to being the 12th SGE
for the very first SGL that is used for pre-registration. If additional
SGEs are needed, the LSP will be the last SGE position within that follow
up SGL as was previously implemented.
Justin Tee [Tue, 31 Mar 2026 20:59:23 +0000 (13:59 -0700)]
scsi: lpfc: Remove deprecated PBDE feature
The PBDE feature is no longer supported and its related fields are removed
in this patch. There are no expected side effects with regards to existing
functionality.
If lpfc_issue_reg_vfi() returns an error in lpfc_rcv_plogi(), then
execution of lpfc_rcv_plogi() continues and lpfc_reg_rpi() is called, which
allocates an mbuf. When this REG_RPI mailbox is issued, it inevitably
fails because the VFI is not registered. However, the REG_RPI failure does
not free the mbuf that was allocated in lpfc_reg_rpi() because there is no
check for mbox error status in lpfc_defer_plogi_acc().
Fix by adding a check in lpfc_rcv_plogi() if lpfc_reg_vfi() fails, then
exit early. Also, add mailbox status check in lpfc_defer_plogi_acc to
enter the REG_RPI mbox_cmpl functions and free the allocated mbuf.
Justin Tee [Tue, 31 Mar 2026 20:59:21 +0000 (13:59 -0700)]
scsi: lpfc: Log MCQE contents for mbox commands with no context
Update log message to display the entirety of an MCQE for which there is no
submission context. This log message is not expected to occur and hence is
tagged as a LOG_TRACE_EVENT. As such, move the hbalock release to before
this log message so that the trace event process does not hold the hbalock
for too long.
Justin Tee [Tue, 31 Mar 2026 20:59:20 +0000 (13:59 -0700)]
scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type
When specifying rq version, it is preferred to refer to SLI4 interface type
instead of the get_sli4_parameters mailbox command response. If SLI4
if_type is 2 or above, then the newer version 1 is used for rq_create
mailbox commands. Otherwise, version 0 is used and is meant for older
adapters.
Justin Tee [Tue, 31 Mar 2026 20:59:19 +0000 (13:59 -0700)]
scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids
The purpose of the lpfc_next_online_cpu() call is to save the CPU index for
the next iteration of the for (index = 0; index < vectors; index++) loop.
Because we’ve reached the last iteration of the loop, cpumask_next(cpu,
aff_mask) returns nr_cpu_ids. Thus, if we already know we've reached the
last iteration of the IRQ affinity assignment loop, then we can just break
and exit.
scsi: ufs: core: Make the header files self-contained
Add the include directives and forward declarations that are missing
from the UFS core header files. This prevents compilation failures if
include directives are reordered.
scsi: ufs: core: Remove an include directive from ufshcd-crypto.h
Nothing in the ufshcd-crypto.h header file depends on the ufshcd-priv.h
header file. Hence, stop including that header file. This include
directive was introduced by commit 4bc26113c603 ("scsi: ufs: Split the
ufshcd.h header file").
scsi: aic7xxx: Fix compiler warnings triggered by user space code
Fix the following compiler warnings:
aicasm_gram.y:1107:24: warning: comparison of different enumeration types
('scope_type' and 'enum yytokentype') [-Wenum-compare]
1107 | || last_scope->type == T_ELSE) {
| ~~~~~~~~~~~~~~~~ ^ ~~~~~~
aicasm_scan.l:392:14: warning: using the result of an assignment as a condition
without parentheses [-Wparentheses]
392 | while (c = *yptr++) {
| ~~^~~~~~~~~
aicasm_macro_scan.l:153:1: warning: non-void function does not return a value
[-Wreturn-type]
153 | }
| ^
scsi: hpsa: Enlarge controller and IRQ name buffers
hpsa formats the controller name into h->devname[8] and derives
interrupt names from it in h->intrname[][16]. Once host_no reaches four
digits, "hpsa%d" no longer fits in devname, and the derived IRQ names
can then overrun the interrupt-name buffers as well.
The previous fix switched these builders to bounded formatting, but that
would truncate user-visible controller and IRQ names. Keep the existing
names intact instead by enlarging the fixed buffers to cover the current
formatted strings.
Fixes: 2946e82bdd76 ("hpsa: use scsi host_no as hpsa controller number") Fixes: 8b47004a5512 ("hpsa: add interrupt number to /proc/interrupts interrupt name") Acked-by: Don Brace <don.brace@microchip.com> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260401120552.78541-1-pengpeng@iscas.ac.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Merge patch series "scsi: ufs: Add TX Equalization support for UFS 5.0"
Can Guo <can.guo@oss.qualcomm.com> says:
Hi,
The UFS v5.0 and UFSHCI v5.0 standards have published, introducing support
for HS-G6 (46.6 Gbps per lane) through the new UniPro V3.0 interconnect
layer and M-PHY V6.0 physical layer specifications. To achieve reliable
operation at these higher speeds, UniPro V3.0 introduces TX Equalization
and Pre-Coding mechanisms that are essential for signal integrity.
This patch series implements TX Equalization support in the UFS core
driver as specified in UFSHCI v5.0, along with the necessary vendor
operations and a reference implementation for Qualcomm UFS host
controllers.
Background
==========
TX Equalization is a signal conditioning technique that compensates for
channel impairments at high data rates (HS-G4 through HS-G6). It works
by adjusting two key parameters:
- PreShoot: Pre-emphasis applied before the main signal transition
- DeEmphasis: De-emphasis applied after the main signal transition
UniPro V3.0 defines TX Equalization Training (EQTR) procedure to
automatically discover optimal TX Equalization settings. The EQTR
procedure:
1. Starts from the most reliable link state (HS-G1)
2. Iterates through all possible PreShoot and DeEmphasis combinations
3. Evaluates signal quality using Figure of Merit (FOM) measurements
4. Selects the best settings for both host and device TX lanes
For HS-G6, Pre-Coding is also introduced to further improve signal
quality. Pre-Coding must be enabled on both transmitter and receiver
when the RX_FOM indicates it is required.
Implementation Overview
=======================
The implementation follows the UFSHCI v5.0 specification and consists of:
Core Infrastructure (Patches 1-6):
- New vops callback negotiate_pwr_mode() to allow vendors to negotiate
power mode parameters before applying TX Equalization settings
- Support for HS-G6 gear enumeration
- Complete TX EQTR procedure implementation in ufs-txeq.c
- Debugfs interface for TX Equalization parameter inspection and manual
retraining
- Module parameters for adaptive TX Equalization control
Qualcomm Implementation (Patches 7-11):
- PHY-specific configurations for TX EQTR procedure
- Vendor-specific FOM measurement support
- TX Equalization settings application
- Enable TX Equalization for HW version 0x7 and onwards
The implementation is designed to be vendor-agnostic, with platform-
specific details handled through the vops callbacks. Other vendors can
add support by implementing the three new vops:
- tx_eqtr_notify(): Called before/after TX EQTR for vendor setup
- apply_tx_eqtr_settings(): Apply vendor-specific PHY configurations
- get_rx_fom(): Retrieve vendor-specific FOM measurements if needed
Module Parameters
=================
The implementation provides several module parameters for flexibility:
- use_adaptive_txeq: Enable/disable adaptive TX Equalization (default: false)
- adaptive_txeq_gear: Minimum gear for adaptive TX EQ (default: HS-G6)
- use_txeq_presets: Use only the 8 standaird presets (default: false)
- txeq_presets_selected[]: Select specific presets for EQTR
Testing
=======
This patch series has been tested on Qualcomm platforms with UFS 5.0
devices, validating:
- Successful TX EQTR completion for HS-G6
- Proper FOM evaluation and optimal settings selection
- Pre-Coding enablement for HS-G6
- Power mode changes with TX Equalization settings applied
- Report of TX Equalization settings via debugfs entries
- Report of TX EQTR histories via debug entries (see next section)
- Re-training TX Equalization via debugfs entry
Example of TX EQTR history
==========================
Device TX EQTR record summary -
Target Power Mode: HS-G6, Rate-B
Most recent record index: 2
Most recent record timestamp: 219573378 us
TX Lane 0 FOM - PreShoot\DeEmphasis
\ 0 1 2 3 4 5 6 7
0 50 70 65 - - - - x
1 x x x x x x x x
2 100 90 70 - - - - x
3 x x x x x x x x
4 95 90 - - - - - x
5 - - - - - - - x
6 x x x x x x x x
7 x x x x x x x x
TX Lane 1 FOM - PreShoot\DeEmphasis
\ 0 1 2 3 4 5 6 7
0 50 70 60 - - - - x
1 x x x x x x x x
2 100 80 65 - - - - x
3 x x x x x x x x
4 95 85 - - - - - x
5 - - - - - - - x
6 x x x x x x x x
7 x x x x x x x x
Patch Structure
===============
Patches 1-3: Preparatory changes for power mode negotiation and HS-G6
Patch 4: Core TX Equalization and EQTR implementation
Patches 5-7: Debugfs support for TX Equalization
Patches 8-12: Qualcomm vendor implementation
Next
====
One more series has been developed to enhance TX Equalization support,
which will be submitted for review after this series is accepted:
- Provide board specific (static) TX Equalization settings from DTS
- Parse static TX Equalization settings from DTS if provided
- Apply static TX Equalization settings if use_adaptive_txeq is disabled
- Add support for UFS v5.0 attributes qTxEQGnSettings & wTxEQGnSettingsExt
- Enable persistent storage and retrieval of optimal TX Equalization settings
Can Guo [Wed, 25 Mar 2026 15:21:54 +0000 (08:21 -0700)]
scsi: ufs: ufs-qcom: Enable TX Equalization
Enable TX Equalization for hosts with HW version 0x7 and onwards.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-13-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
On some platforms, when Host Software triggers TX Equalization Training, HW
does not take TX EQTR settings programmed in PA_TxEQTRSetting, instead HW
takes TX EQTR settings from PA_TxEQG1Setting. Implement vops
apply_tx_eqtr_setting() to work around it by programming TX EQTR settings
to PA_TxEQG1Setting during TX EQTR procedure.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-12-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:52 +0000 (08:21 -0700)]
scsi: ufs: ufs-qcom: Implement vops get_rx_fom()
On some platforms, host's M-PHY RX_FOM Attribute always reads 0, meaning SW
cannot rely on Figure of Merit (FOM) to identify the optimal TX
Equalization settings for device's TX Lanes. Implement the vops
ufs_qcom_get_rx_fom() such that SW can utilize the UFS Eye Opening Monitor
(EOM) to evaluate the TX Equalization settings for device's TX Lanes.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-11-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
On some platforms, HW does not support triggering TX EQTR from the most
reliable High-Speed (HS) Gear (HS Gear1), but only allows to trigger TX
EQTR for the target HS Gear from the same HS Gear. To work around the HW
limitation, implement vops tx_eqtr_notify() to change Power Mode to the
target TX EQTR HS Gear prior to TX EQTR procedure and change Power Mode
back to HS Gear1 (the most reliable gear) post TX EQTR procedure.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-10-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
If HS-G6 Power Mode change handshake is successful and outbound data Lanes
are expected to transmit ADAPT, M-TX Lanes shall be configured as
if (Adapt Type == REFRESH)
TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 = PA_PeerRxHsG6AdaptRefreshL0L1L2L3.
else if (Adapt Type == INITIAL)
TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 = PA_PeerRxHsG6AdaptInitialL0L1L2L3.
On some platforms, the ADAPT_L0_L1_L2_L3 duration on Host TX Lanes is only
a half of theoretical ADAPT_L0_L1_L2_L3 duration TADAPT_L0_L1_L2_L3 (in
PAM-4 UI) calculated from TX_HS_ADAPT_LENGTH_L0_L1_L2_L3.
For such platforms, the workaround is to double the ADAPT_L0_L1_L2_L3
duration by uplifting TX_HS_ADAPT_LENGTH_L0_L1_L2_L3. UniPro initializes
TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 during HS-G6 Power Mode change handshake, it
would be too late for SW to update TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 post
HS-G6 Power Mode change. Update PA_PeerRxHsG6AdaptRefreshL0L1L2L3 and
PA_PeerRxHsG6AdaptInitialL0L1L2L3 post Link Startup and before HS-G6 Power
Mode change, so that the UniPro would use the updated value during HS-G6
Power Mode change handshake.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-9-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:49 +0000 (08:21 -0700)]
scsi: ufs: core: Add support to retrain TX Equalization via debugfs
Drastic environmental changes, such as significant temperature shifts, can
impact link signal integrity. In such cases, retraining TX Equalization is
necessary to compensate for these environmental changes.
Add a debugfs entry, 'tx_eq_ctrl', to allow userspace to manually trigger
the TX Equalization training (EQTR) procedure and apply the identified
optimal settings on the fly. These entries are created on a per-gear basis
for High Speed Gear 4 (HS-G4) and above, as TX EQTR is not supported for
lower gears.
The 'tx_eq_ctrl' entry currently accepts the 'retrain' command to initiate
the procedure. The interface is designed to be scalable to support
additional commands in the future.
Reading the 'tx_eq_ctrl' entry provides a usage hint to the user, ensuring
the interface is self-documenting.
The ufshcd's debugfs folder structure will look like below:
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-8-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:48 +0000 (08:21 -0700)]
scsi: ufs: core: Add helpers to pause and resume command processing
In preparation for supporting TX Equalization refreshing, introduce helper
functions to safely pause and resume command processing.
ufshcd_pause_command_processing() ensures the host is in a quiescent state
by stopping the block layer tagset, acquiring the necessary locks
(scan_mutex and clk_scaling_lock), and waiting for any in-flight commands
to complete within a specified timeout.
ufshcd_resume_command_processing() restores the host to its previous
operational state by reversing these steps in the correct order.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-7-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:47 +0000 (08:21 -0700)]
scsi: ufs: core: Add debugfs entries for TX Equalization params
Add debugfs support for UFS TX Equalization and UFS TX Equalization
Training (EQTR) to facilitate runtime inspection of link quality. These
entries allow developers to monitor and optimize TX Equalization parameters
and EQTR records during live operation.
The debugfs entries are organized on a per-gear basis under the HBA's
debugfs root. Since TX EQTR is only defined for High Speed Gear 4 (HS-G4)
and above, EQTR-related entries are explicitly excluded for HS-G1 through
HS-G3 to avoid exposing unsupported attributes.
The ufshcd's debugfs folder structure will look like below:
Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-6-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:46 +0000 (08:21 -0700)]
scsi: ufs: core: Add support for TX Equalization
MIPI Unipro3.0 introduced PA_TxEQGnSetting and PA_PreCodeEn attributes for
TX Equalization and Pre-Coding. It is Host Software's responsibility to
configure these attributes for both host and device before initiating Power
Mode Change to High-Speed Gears.
MIPI Unipro3.0 also introduced TX Equalization Training (EQTR) to identify
optimal TX Equalization settings for use by both Host's and Device's
UniPro. TX EQTR shall be initiated from the most reliable High-Speed Gear
(HS-G1) targeting High-Speed Gears (HS-G4 to HS-G6).
Implement TX Equalization configuration and TX EQTR procedure as defined
in UFSHCI v5.0 specification. The TX EQTR procedure determines the optimal
TX Equalization settings by iterating through all possible PreShoot and
DeEmphasis combinations and selecting the best combinations for both Host
and Device based on Figure of Merit (FOM) evaluation.
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-5-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:45 +0000 (08:21 -0700)]
scsi: ufs: core: Add UFS_HS_G6 and UFS_HS_GEAR_MAX to enum ufs_hs_gear_tag
Add UFS_HS_G6 to enum ufs_hs_gear_tag. In addition, add UFS_HS_GEAR_MAX to
enum ufs_hs_gear_tag to facilitate iteration over valid High Speed Gears.
Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:44 +0000 (08:21 -0700)]
scsi: ufs: core: Pass force_pmc to ufshcd_config_pwr_mode() as a parameter
Currently, callers must manually toggle hba->force_pmc before and after
calling ufshcd_config_pwr_mode() to force a Power Mode change. Introduce
enum ufshcd_pmc_policy and refactor ufshcd_config_pwr_mode() to accept
pmc_policy as a parameter to force a Power Mode change.
Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo [Wed, 25 Mar 2026 15:21:43 +0000 (08:21 -0700)]
scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode()
Most vendor specific implemenations of vops pwr_change_notify(PRE_CHANGE)
are fulfilling two things at once:
- Vendor specific target power mode negotiation
- Vendor specific power mode change preparation
When TX Equalization is added into consideration, before power mode change
to a target power mode, TX Equalization Training (EQTR) needs be done for
that target power mode. In addition, UFSHCI spec requires to start TX EQTR
from HS-G1 (the most reliable High Speed Gear).
Adding TX EQTR before pwr_change_notify(PRE_CHANGE) is not applicable
because we don't know the negotiated power mode yet.
Adding TX EQTR post pwr_change_notify(PRE_CHANGE) is inappropriate because
pwr_change_notify(PRE_CHANGE) has finished preparation for a power mode
change to negotiated power mode, yet we are changing power mode to HS-G1
for TX EQTR.
Add a new vops negotiate_pwr_mode() so that vendor specific power mode
negotiation can be fulfilled in its vendor specific implementations. Later
on, TX EQTR can be added post vops negotiate_pwr_mode() and before vops
pwr_change_notify(PRE_CHANGE).
Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260325152154.1604082-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Ranjan Kumar [Fri, 20 Mar 2026 09:03:26 +0000 (14:33 +0530)]
scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset
Enhance the IOC shutdown process to handle transient failures during
controller cleanup. Add retry logic with configurable maximum retry
count (MPI3MR_MAX_SHUTDOWN_RETRY_COUNT) and proper timeout management
that resets on each retry attempt. This ensures shutdown can recover
from temporary issues without failing completely.
Ranjan Kumar [Fri, 20 Mar 2026 09:03:25 +0000 (14:33 +0530)]
scsi: mpi3mr: Add queue-full tracking for operational request queues
Track queue-full conditions on operational request queues in the driver.
Record the last host tag returned to the SCSI mid-layer and count I/Os
affected by queue-full conditions.
Ranjan Kumar [Fri, 20 Mar 2026 09:03:24 +0000 (14:33 +0530)]
scsi: mpi3mr: Reset controller on invalid I/O completion
Operational replies without a valid scsi_cmnd indicate an invalid I/O
completion and a potentially inconsistent controller state. Track this
condition and allow the watchdog to trigger a soft reset to safely
recover.
Kexin Sun [Sat, 21 Mar 2026 10:59:04 +0000 (18:59 +0800)]
scsi: iscsi_tcp: update outdated comment for renamed iscsi_conn_set_callbacks()
The function iscsi_conn_set_callbacks() was renamed to
iscsi_sw_tcp_conn_set_callbacks() by commit 38e1a8f5479d ("[SCSI]
iscsi_tcp: hook iscsi_tcp into new libiscsi_tcp module"). Update the
stale reference in iscsi_sw_tcp_conn_restore_callbacks().
Kexin Sun [Sat, 21 Mar 2026 10:59:09 +0000 (18:59 +0800)]
scsi: lpfc: Update outdated comment for renamed lpfc_freenode()
The function lpfc_freenode() was renamed to lpfc_cleanup_node() by
commit 685f0bf7afe0 ("[SCSI] lpfc 8.1.12 : Collapse discovery lists to a
single node list"), and commit a70e63eee1c1 ("scsi: lpfc: Fix NPIV
Fabric Node reference counting") later removed the lpfc_unreg_rpi() call
from lpfc_cleanup_node().
Remove the now-inaccurate "called from lpfc_freenode()" sentence and
reflow the remaining comment text for lpfc_unreg_rpi().
The event_list processes non-hotplug events (such as LUN capacity
changes), so remove the conditions that guard the initial kicks in
_probe() and _restore(), as well as the work cancellation in _remove().
Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Link: https://patch.msgid.link/20260325180857.3675854-3-jdaley@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Joshua Daley [Wed, 25 Mar 2026 18:08:56 +0000 (19:08 +0100)]
scsi: virtio_scsi: Move INIT_WORK calls to virtscsi_probe()
The last step of virtscsi_handle_event() is to call
virtscsi_kick_event(), which calls INIT_WORK on its own work
item. INIT_WORK resets the work item's data bits to 0.
If this occurs while the work item is being flushed by
cancel_work_sync(), then kernel/workqueue.c/work_offqd_enable triggers a
kernel warning, as it expects the "disable" bit to be 1:
This warning may occur if a controller is detached immediately following
a disk detach.
Move the INIT_WORK call to prevent this. Don't re-init event list work
items in virtscsi_kick_event(), init them only once in virtscsi_probe()
instead.
Kees Cook [Mon, 23 Mar 2026 17:13:15 +0000 (10:13 -0700)]
scsi: target: Replace strncpy() with strscpy() in VPD dump functions
Replace the deprecated[1] strncpy() with strscpy() in
transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().
All four functions follow the same pattern: a local
buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated
via sprintf()/snprintf() (always NUL-terminated), then conditionally
copied to p_buf with strncpy(). The p_buf destination is used as a
C string by all callers in target_core_configfs.c: strlen(buf) and
sprintf(page+len, "%s", buf) to build sysfs output.
NUL-padding is not required: callers in target_core_configfs.c
pre-zero p_buf with memset() or initializer before calling these
functions, and consume p_buf only as a NUL-terminated C string via
strlen() and "%s", never exposing trailing bytes.
No behavioral change: the source buf is always NUL-terminated and
shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output.
Arnd Bergmann [Mon, 23 Mar 2026 09:57:39 +0000 (10:57 +0100)]
scsi: esas2r: Fix __printf annotation on esas2r_log_master()
clang-22 started warning about functions that take printf format
strings:
drivers/scsi/esas2r/esas2r_log.c:160:50: error: diagnostic behavior may be improved by adding the 'format(printf, 3, 0)' attribute to the declaration of 'esas2r_log_master' [-Werror,-Wmissing-format-attribute]
121 | retval = vsnprintf(buffer, buflen, format, args);
| ^
drivers/scsi/esas2r/esas2r_log.c:121:12: note: 'esas2r_log_master' declared here
121 | static int esas2r_log_master(const long level,
| ^
The warning already got silenced for gcc but not clang in the past.
Rather than modify that hack to turn it off for both, just add the
attribute as suggested and remove the pragma again.
Thinh Nguyen [Sat, 14 Mar 2026 01:17:40 +0000 (01:17 +0000)]
scsi: target: file: Use kzalloc_flex for aio_cmd
The target_core_file doesn't initialize the aio_cmd->iocb for the
ki_write_stream. When a write command fd_execute_rw_aio() is executed,
we may get a bogus ki_write_stream value, causing unintended write
failure status when checking iocb->ki_write_stream > max_write_streams
in the block device.
Let's just use kzalloc_flex when allocating the aio_cmd and let
ki_write_stream=0 to fix this issue.
Yihang Li [Tue, 17 Mar 2026 06:31:47 +0000 (14:31 +0800)]
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard
and multi-channel scans"), if the device supports multiple channels (0 to
shost->max_channel), user_scan() invokes updated sas_user_scan() to perform
the scan behavior for a specific transfer. However, when the user
specifies shost->max_channel, it will return -EINVAL, which is not
expected.
Fix and support specifying the scan shost->max_channel for scanning.
Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans") Signed-off-by: Yihang Li <liyihang9@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Link: https://patch.msgid.link/20260317063147.2182562-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Josef Bacik [Tue, 17 Mar 2026 00:23:29 +0000 (20:23 -0400)]
scsi: target: tcm_loop: Drain commands in target_reset handler
tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS
without draining any in-flight commands. The SCSI EH documentation
(scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver
has made lower layers "forget about timed out scmds" and is ready for new
commands. Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug,
mpi3mr) enforces this by draining or completing outstanding commands before
returning SUCCESS.
Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight
scsi_cmnd structures for recovery commands (e.g. TUR) while the target core
still has async completion work queued for the old se_cmd. The memset in
queuecommand zeroes se_lun and lun_ref_active, causing
transport_lun_remove_cmd() to skip its percpu_ref_put(). The leaked LUN
reference prevents transport_clear_lun_ref() from completing, hanging
configfs LUN unlink forever in D-state:
INFO: task rm:264 blocked for more than 122 seconds.
rm D 0 264 258 0x00004000
Call Trace:
__schedule+0x3d0/0x8e0
schedule+0x36/0xf0
transport_clear_lun_ref+0x78/0x90 [target_core_mod]
core_tpg_remove_lun+0x28/0xb0 [target_core_mod]
target_fabric_port_unlink+0x50/0x60 [target_core_mod]
configfs_unlink+0x156/0x1f0 [configfs]
vfs_unlink+0x109/0x290
do_unlinkat+0x1d5/0x2d0
Fix this by making tcm_loop_target_reset() actually drain commands:
1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that
the target core knows about (those not yet CMD_T_COMPLETE).
2. Use blk_mq_tagset_busy_iter() to iterate all started requests and
flush_work() on each se_cmd — this drains any deferred completion work
for commands that already had CMD_T_COMPLETE set before the TMR (which
the TMR skips via __target_check_io_state()). This is the same pattern
used by mpi3mr, scsi_debug, and libsas to drain outstanding commands
during reset.
Eric Biggers [Mon, 16 Mar 2026 22:36:31 +0000 (15:36 -0700)]
scsi: lpfc: Use the crc32c() function
lpfc_cgn_calc_crc32(data, size, crc) is really just an open-coded version
of ~crc32c(bitrev32(crc), data, size). However, all callers pass crc ==
~0, so it can be simplified even further to just ~crc32c(~0, data, size).
Remove the crc argument and implement it that way.
While we're at it, also use proper types in the function prototype.
Tyllis Xu [Sat, 14 Mar 2026 17:01:50 +0000 (12:01 -0500)]
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
A malicious or compromised VIO server can return a num_written value in the
discover targets MAD response that exceeds max_targets. This value is
stored directly in vhost->num_targets without validation, and is then used
as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which
is only allocated for max_targets entries. Indices at or beyond max_targets
access kernel memory outside the DMA-coherent allocation. The
out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI
MADs that are sent back to the VIO server, leaking kernel memory.
Fix by clamping num_written to max_targets before storing it.
Fixes: 072b91f9c651 ("[SCSI] ibmvfc: IBM Power Virtual Fibre Channel Adapter Client Driver") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com> Reviewed-by: Dave Marquardt <davemarq@linux.ibm.com> Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260314170151.548614-1-LivelyCarpet87@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
vamshi gajjela [Tue, 10 Mar 2026 19:03:08 +0000 (00:33 +0530)]
scsi: ufs: core: Handle MCQ IAG events
Add support for handling aggregation-based interrupts when operating in MCQ
mode.
In legacy interrupt mode, an IE.IAGES is triggered when the counter or
timer threshold is reached. To manage this, the handler now resets the
aggregation counter and timer by writing to the MCQIACRy.CTR register.
Since the register layout of MCQIACRy is identical to the existing UTRIACR
register, this implementation reuses the previously defined bitfield masks
to maintain consistency and reduce code duplication.
Extend ufshcd_handle_mcq_cq_events() with a boolean iag parameter. If set,
the handler resets the MCQ IAG counter and timer.
Define MCQ_IAG_EVENT_STATUS (0x200000) and include it in
UFSHCD_ENABLE_MCQ_INTRS to ensure the interrupt is unmasked during
initialization.
scsi: ses: Handle positive SCSI error from ses_recv_diag()
ses_recv_diag() can return a positive value, which also means that an
error happened, so do not only test for negative values.
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Link: https://patch.msgid.link/2026022301-bony-overstock-a07f@gregkh Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Shawn Lin [Fri, 13 Mar 2026 02:21:07 +0000 (10:21 +0800)]
scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item
Add the mphy reset property to the devicetree bindings for the Rockchip
RK3576 UFS host controller. The mphy reset signal is used to reset the
physical adapter. Resetting other components while leaving the mphy unreset
may occasionally prevent the UFS controller from successfully linking up
with the device.
This addresses an intermittent hardware bug where the UFS link fails to
establish under specific timing conditions with certain chips. While
difficult to reproduce initially, this issue was consistently observed in
downstream testing and requires explicit mphy reset control for full
stability.
Although this change increases the maxItems for resets and adds a new entry
(which technically alters the binding ABI), it does not break compatibility
for existing Linux systems. The driver uses
devm_reset_control_array_get_exclusive() to manage resets, allowing it to
function correctly with both older Device Trees (without the mphy entry)
and newer ones.
Fixes: d90e92023771 ("scsi: ufs: dt-bindings: Document Rockchip UFS host controller") Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/1773368467-109650-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Ed Tsai [Tue, 10 Mar 2026 00:52:28 +0000 (08:52 +0800)]
scsi: ufs: core: Add quirks for VCC ramp-up delay
On some platforms, the VCC regulator has a slow ramp-up time. Add a delay
after enabling VCC to ensure voltage has fully stabilized before we enable
the clocks.
Mike Christie [Sat, 7 Mar 2026 22:06:30 +0000 (16:06 -0600)]
scsi: target: core: Fix complete_type use
There were two copy and paste type of errors where I swapped 'complete'
with 'submit' names. Use the correct variables and definitions.
This problem was found by Dmitry Bogdanov and this patch builds on top of
his patch to fix a second instance that was found.
Fixes: 06933066d88a ("scsi: target: Add support for completing commands from backend context") Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
[mnc: Fixed second instance] Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://patch.msgid.link/20260307220630.131008-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Xingui Yang [Thu, 5 Mar 2026 06:40:39 +0000 (14:40 +0800)]
scsi: hisi_sas: Fix NULL pointer exception during user_scan()
user_scan() invokes updated sas_user_scan() for channel 0, and if
successful, iteratively scans remaining channels (1 to shost->max_channel)
via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix
sas_user_scan() to handle wildcard and multi-channel scans"). However,
hisi_sas supports only one channel, and the current value of max_channel is
1. sas_user_scan() for channel 1 will trigger the following NULL pointer
exception:
Fixes: e21fe3a52692 ("scsi: hisi_sas: add initialisation for v3 pci-based controller") Signed-off-by: Xingui Yang <yangxingui@huawei.com> Signed-off-by: Yihang Li <liyihang9@huawei.com> Link: https://patch.msgid.link/20260305064039.4096775-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.
qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
Fixes: 82f522ae0d97 ("scsi: qla2xxx: Fix double free of fcport") Fixes: 4895009c4bb7 ("scsi: qla2xxx: Prevent command send on chip reset") Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com> Signed-off-by: Farhat Abbas <fabbas@cloudlinux.com> Link: https://patch.msgid.link/aYsDln9NFQQsPDgg@vova-pc Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Wang Shuaiwei [Sat, 7 Mar 2026 03:51:28 +0000 (11:51 +0800)]
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
In __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel
the UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,
POST_CHANGE). This creates a race condition where ufshcd_rtc_work() can
still be running while ufshcd_vops_suspend() is executing. When
UFSHCD_CAP_CLK_GATING is not supported, the condition
!hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc()
to be executed. Since ufshcd_vops_suspend() typically performs clock
gating operations, executing ufshcd_update_rtc() at that moment triggers
an SError. The kernel panic trace is as follows:
Fix this by moving cancel_delayed_work_sync() before the call to
ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is
fully completed or cancelled at that point.
Cc: Bean Huo <beanhuo@iokpp.de> Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Wang Shuaiwei <wangshuaiwei1@xiaomi.com> Link: https://patch.msgid.link/20260307035128.3419687-1-wangshuaiwei1@xiaomi.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Peter Wang [Fri, 6 Mar 2026 05:43:02 +0000 (13:43 +0800)]
scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
Only return IRQ_WAKE_THREAD when MCQ and ESI are not enabled and no UIC
command is active. The default UIC command timeout is 500ms, Using threaded
IRQs during an active UIC command increases the risk of timeout due to
possible preemption by other system IRQs.
Can Guo [Thu, 5 Mar 2026 11:08:56 +0000 (03:08 -0800)]
scsi: ufs: core: Add support to notify userspace of UniPro QoS events
The UniPro stack manages to repair many potential Link problems without the
need to notify the Application Layer. Repair mechanisms of the stack
include L2 re-transmission and successful handling of PA_INIT.req.
Nevertheless, any successful repair sequence requires Link bandwidth that
is no longer vailable for the Application. Therefore, it may be useful for
an Application to understand how often such repair attempts are made.
The DME implements Quality of Service monitoring using a simple counting
scheme, counting error events and comparing them against the number of
correctly received or transmitted bytes. When the error counter exceeds a
programmed threshold before the byte counter overflows, a DME_QoS.ind is
issued to the Application and both counters are reset. When the byte
counter overflows before the error counter has reached the programmed
threshold, both counters are reset without triggering a DME_QoS.ind.
The DME provides Link quality monitoring for the following purposes:
1. Detection of re-occurring repaired fatal error conditions on the Link
(PA_INIT loop). This kind of detection is useful if capabilities
exchanged between local and peer permit a potential operation at a
higher M-PHY Gear, but the physical interconnect between local and peer
Device does not, or, after Line quality degradation, no longer satisfies
channel characteristics.
2. Detection of degraded inbound or outbound Link quality, to allow an
Application to issue an ADAPT sequence for a Link running in HS-G4 or
higher HS Gears. This kind of detection is used to monitor a slowly
degrading Link quality, e.g., one being affected by temperature and
voltage variations, against the expected M-PHY bit error rate.
Userspace can configure and enable UniPro QoS via UniPro QoS Attributes
(via UFS BSG) and get notified by dme_qos_notification without polling
UniPro QoS Status attribute. The dme_qos_notification attribute is a
bitfield with the following bit assignments:
Bit Description
=== ======================================
0 DME QoS Monitor has been reset by host
1 QoS from TX is detected
2 QoS from RX is detected
3 QoS from PA_INIT is detected
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260305110856.959211-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Chaohai Chen [Thu, 5 Mar 2026 02:51:24 +0000 (10:51 +0800)]
scsi: core: Drop using the host_lock to protect async_scan race condition
Previously, host_lock was used to prevent bit-set conflicts in async_scan,
but this approach introduced naked reads in some code paths.
Convert async_scan from a bitfield to a bool type to eliminate bit-level
conflicts entirely. Use __guarded_by(&scan_mutex) to indicate that the
async_scan variable is protected by scan_mutex.
Signed-off-by: Chaohai Chen <wdhh6@aliyun.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: John Garry <john.g.garry@oracle.com> Link: https://patch.msgid.link/20260305025125.3649517-1-wdhh6@aliyun.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Merge patch series "scsi: target: Add support for completing commands from backend context"
The following patches made over Linus's current tree allow users to
tell the target layer to perform direct completions instead of always
deferring to LIO's completion workqueue. When the frontend driver
already has multiple worker threads (or you are doing a LUN per target
with a single thread per target) then bypassing the LIO workqueue can
increase performance 20-30%.
Mike Christie [Sun, 22 Feb 2026 23:27:04 +0000 (17:27 -0600)]
scsi: vhost-scsi: Report direction completion support
This has vhost-scsi report that it supports direct completions.
When using a worker task per queue or group of queues with fast backends
then enabling direct completion and submissions increases performance
20-30% with workloads like:
As jobs matches and passes the number of vCPUs in the VM then the
benefit increases.
However, when using a single worker then queueing completions and
submissions is best as the worker is busy handling mapping data and
setting/tearing down commands.
Mike Christie [Sun, 22 Feb 2026 23:27:03 +0000 (17:27 -0600)]
scsi: target: Allow userspace to set the completion type
This allows userspace to request if we complete in the backend context
or the frontend driver. It works the same as submission where you can
write 0 to 2 to complete_type:
0 - Use the fabric driver's preference.
1 - Complete from the backend calling context if the fabric supports
it.
2 - Queue the completion to LIO's completion workqueue.
Mike Christie [Sun, 22 Feb 2026 23:27:02 +0000 (17:27 -0600)]
scsi: target: Use driver completion preference by default
This has us use the driver's completion preference by default. There is
no behavior changes with this patch and we queue completion to LIO's
completion workqueue by default.
Mike Christie [Sun, 22 Feb 2026 23:27:01 +0000 (17:27 -0600)]
scsi: target: Add support for completing commands from backend context
To complete a command several drivers just drop their reference and add
it to list to be processed by a driver specific thread. So there's no
need to go from backend context to the LIO thread then to the driver's
thread. When avoiding the LIO thread, IOPS can increase from 20-30% for
workloads like:
where increasing jobs increases the performance improvement (this is
using NVMe drives with LIO's submit_type=1 to directly submit).
Add the infrastructure so drivers and userspace can control how to
complete a command like is done for the submission path. In this commit
there is no behavior change and we continue to defer to the LIO
workqueue thread. In the subsequent commits we will allow drivers to
report what they support and allow userspace to control the behavior.
The WRITE SAME(16) and WRITE SAME(10) SCSI commands use a page from a
dedicated mempool (sd_page_pool) for their payload. This pool was
initialized to allocate single pages, which was sufficient as long as the
device sector size did not exceed the PAGE_SIZE.
Given that block layer now supports block size upto 64KB, i.e. beyond
PAGE_SIZE, initialize a large page pool in sd_probe() if a higher sector
device is attached, ensuring atomicity. Adapt sd_set_special_bvec() to use
large page pool when a higher sector size device is attached. Hence enable
sector sizes > PAGE_SIZE in SCSI sd driver.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Swarna Prabhu <s.prabhu@samsung.com> Co-developed-by: Pankaj Raghav <p.raghav@samsung.com> Signed-off-by: Pankaj Raghav <p.raghav@samsung.com> Link: https://patch.msgid.link/20260219043741.276729-2-sw.prabhu6@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
scsi: target: Fix recursive locking in __configfs_open_file()
In flush_write_buffer, &p->frag_sem is acquired and then the loaded store
function is called, which, here, is target_core_item_dbroot_store(). This
function called filp_open(), following which these functions were called
(in reverse order), according to the call trace:
target_core_item_dbroot_store() tries to validate the new file path by
trying to open the file path provided to it; however, in this case, the bug
report shows:
db_root: not a directory: /sys/kernel/config/target/dbroot
indicating that the same configfs file was tried to be opened, on which it
is currently working on. Thus, it is trying to acquire frag_sem semaphore
of the same file of which it already holds the semaphore obtained in
flush_write_buffer(), leading to acquiring the semaphore in a nested manner
and a possibility of recursive locking.
Fix this by modifying target_core_item_dbroot_store() to use kern_path()
instead of filp_open() to avoid opening the file using filesystem-specific
function __configfs_open_file(), and further modifying it to make this fix
compatible.
Yang Erkun [Tue, 27 Jan 2026 06:20:44 +0000 (14:20 +0800)]
scsi: sg: Remove deprecated sg-big-buff
These deprecated sysctl has been broken since commit 26d1c80fd61e
("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") and nobody has found
this. I believe it's time to remove it, which will allow us to clean up a
significant amount of code.
Yang Erkun [Tue, 27 Jan 2026 06:20:43 +0000 (14:20 +0800)]
scsi: sg: Resolve soft lockup issue when opening /dev/sgX
The parameter def_reserved_size defines the default buffer size reserved
for each Sg_fd and should be restricted to a range between 0 and 1,048,576
(see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the
function sg_proc_write_dressz enforces this limit, it is possible to bypass
it by directly modifying the module parameter as shown below, which then
causes a soft lockup:
The fix is to use module_param_cb to validate and reject invalid values
assigned to def_reserved_size.
Fixes: 6460e75a104d ("[SCSI] sg: fixes for large page_size") Signed-off-by: Yang Erkun <yangerkun@huawei.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260127062044.3034148-3-yangerkun@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Yang Erkun [Tue, 27 Jan 2026 06:20:42 +0000 (14:20 +0800)]
scsi: sg: Fix sysctl sg-big-buff register during sg_init()
Commit 26d1c80fd61e ("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") made
a mistake. sysctl sg-big-buff was not created because the call to
register_sg_sysctls() was placed on the wrong code path.
Fixes: 26d1c80fd61e ("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") Signed-off-by: Yang Erkun <yangerkun@huawei.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260127062044.3034148-2-yangerkun@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Igor Pylypiv [Mon, 9 Feb 2026 21:21:51 +0000 (13:21 -0800)]
scsi: core: Add 'serial' sysfs attribute for SCSI/SATA
Add a 'serial' sysfs attribute for SCSI and SATA devices. This attribute
exposes the Unit Serial Number, which is derived from the Device
Identification Vital Product Data (VPD) page 0x80.
Whitespace is stripped from the retrieved serial number to handle the
different alignment (right-aligned for SCSI, potentially left-aligned for
SATA). As noted in SAT-5 10.5.3, "Although SPC-5 defines the PRODUCT SERIAL
NUMBER field as right-aligned, ACS-5 does not require its SERIAL NUMBER
field to be right-aligned. Therefore, right-alignment of the PRODUCT SERIAL
NUMBER field for the translation is not assured."
This attribute is used by tools such as lsblk to display the serial number
of block devices.
[mkp: length adjustment]
Signed-off-by: Igor Pylypiv <ipylypiv@google.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Link: https://patch.msgid.link/20260209212151.342151-1-ipylypiv@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Florian Fuchs [Fri, 27 Feb 2026 18:18:23 +0000 (19:18 +0100)]
scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
The Iomega ZIP 100 (Z100P2) can't process IO Advice Hints Grouping mode
page query. It immediately switches to the status phase 0xb8 after
receiving the subpage code 0x05 of MODE_SENSE_10 command, which fails
imm_out() and turns into DID_ERROR of this command, which leads to unusable
device. This was tested with an Iomega ZIP 100 (Z100P2) connected with a
StarTech PEX1P2 AX99100 PCIe parallel port card.
Prior to this fix, Test Unit Ready fails and the drive can't be used:
IMM: returned SCSI status b8
sd 7:0:6:0: [sdh] Test Unit Ready failed: Result: hostbyte=0x01 driverbyte=DRIVER_OK
Ranjan Kumar [Wed, 25 Feb 2026 08:26:22 +0000 (13:56 +0530)]
scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
The driver retains reset history even after the IOC has successfully
reached the READY state. That leaves stale reset information active during
normal operation and can mislead recovery and diagnostics. In addition, if
the IOC becomes READY just as the ready timeout loop exits, the driver
still follows the failure path and may retry or report failure incorrectly.
Clear reset history once READY is confirmed so driver state matches actual
IOC status. After the timeout loop, recheck the IOC state and treat READY
as success instead of failing.
Randy Dunlap [Tue, 24 Feb 2026 23:49:54 +0000 (15:49 -0800)]
scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h
Avoid all kernel-doc warnings in lpfc.h:
- Use the correct function parameter name
- Add a '*' to a kernel-doc line
- Repair the function Returns: comments
Fixes these warnings:
Warning: drivers/scsi/lpfc/lpfc.h:1674 No description found for return
value of 'lpfc_next_online_cpu'
Warning: drivers/scsi/lpfc/lpfc.h:1686 No description found for return
value of 'lpfc_next_present_cpu'
Warning: drivers/scsi/lpfc/lpfc.h:1700 function parameter 'eq' not
described in 'lpfc_sli4_mod_hba_eq_delay'
Warning: drivers/scsi/lpfc/lpfc.h:1755 bad line: --------------------------
Warning: drivers/scsi/lpfc/lpfc.h:1759 No description found for return
value of 'lpfc_is_vmid_enabled'
Fixes: 8fe4ce5836e9 ("scsi: core: Fix a use-after-free") Cc: stable@vger.kernel.org Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> Reviewed-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260223232728.93350-1-junxiao.bi@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bart Van Assche [Mon, 23 Feb 2026 22:00:30 +0000 (14:00 -0800)]
scsi: megaraid_sas: Protect more code with instance->reset_mutex
megasas_get_device_list() and megasas_get_snapdump_properties() may unlock
instance->reset_mutex indirectly. Hence, hold reset_mutex while calling
these functions.
Cc: Kashyap Desai <kashyap.desai@broadcom.com> Cc: Sumit Saxena <sumit.saxena@broadcom.com> Cc: Shivasharan S <shivasharan.srikanteshwara@broadcom.com> Cc: Chandrakanth patil <chandrakanth.patil@broadcom.com> Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: megaraidlinux.pdl@broadcom.com Cc: linux-scsi@vger.kernel.org Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260223220102.2158611-31-bart.vanassche@linux.dev Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bart Van Assche [Mon, 23 Feb 2026 22:00:29 +0000 (14:00 -0800)]
scsi: fnic: Make fnic_queuecommand() easier to analyze
Move a spin_unlock_irqrestore() call such that the io_lock_acquired
variable can be eliminated. This patch prepares for enabling the Clang
thread-safety analyzer.
Cc: Satish Kharat <satishkh@cisco.com> Cc: Sesidhar Baddela <sebaddel@cisco.com> Cc: Karan Tilak Kumar <kartilak@cisco.com> Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com> Link: https://patch.msgid.link/20260223220102.2158611-30-bart.vanassche@linux.dev Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
wangshuaiwei [Tue, 24 Feb 2026 06:32:28 +0000 (14:32 +0800)]
scsi: ufs: core: Fix shift out of bounds when MAXQ=32
According to JESD223F, the maximum number of queues (MAXQ) is 32. When MCQ
is enabled and ESI is disabled, nr_hw_queues=32 causes a shift overflow
problem.
Fix this by using 64-bit intermediate values to handle the nr_hw_queues=32
case safely.
scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset()
Modify logic to remove unnecessary acquire/release of spinlock to set
in_remove flag. There's also no need to check for init status to call
fnic_fcpio_reset.
Tested-by: Karan Tilak Kumar <kartilak@cisco.com> Reviewed-by: Sesidhar Baddela <sebaddel@cisco.com> Reviewed-by: Arulprabhu Ponnusamy <arulponn@cisco.com> Reviewed-by: Gian Carlo Boffa <gcboffa@cisco.com> Reviewed-by: Arun Easi <aeasi@cisco.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Karan Tilak Kumar <kartilak@cisco.com> Co-developed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260217223943.7938-4-kartilak@cisco.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
projects / thirdparty / kernel / linux.git / log
