kernel/git/stable/linux.git/drivers/ufs, branch master

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi

2026-08-29T18:55:36+00:00

Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ...

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2026-08-21T18:23:20+00:00

Pull SCSI updates from James Bottomley: "One new driver: leapraid (similar to mpi3mr but OK'd by Broadcom). The usual suspects for driver updates (ufs, qla2xxx, smartpqi, zfcp, fnic, ibmvfc) plus a few small core updates: a fix for an uninitialized sg list pad bytes plus the removal of the dma mask check for max sectors. The big update in the sd driver is mostly code refactoring for obscure error leg handling" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (195 commits) scsi: fnic: Fix built-in NVMe/FC build scsi: fnic: Fix invalid comparison for error scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() scsi: zfcp: Enable CONTEXT_ANALYSIS scsi: zfcp: Add __must_hold() attribute to zfcp_qdio_sbal_get() scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock scsi: storvsc: Support manual scans for all Hyper-V targets scsi: sd: Fix sd_done() sense handling condition scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails scsi: sd: Fix error handling in sd_probe() after large pool creation failure scsi: leapraid: Add driver documentation scsi: leapraid: Add new SCSI driver scsi: ufs: Add support for the aggregated read query opcode scsi: ufs: Use unsigned types for the BSG query scsi: ibmvfc: Fix spelling mistake "Deleteing" -> "Deleting" scsi: qla2xxx: Update version to 12.00.00.2607b2 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak ...

scsi: ufs: core: Enable context analysis

2026-08-14T02:04:49+00:00

Annotate functions that modify the state of a synchronization object. Remove the struct semaphore annotations because lock context annotations are not supported for semaphores. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/3c975386a5bcb939f8a2a0d47fd621f234321a9e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle)

scsi: ufs: core: Set task state before io_schedule_timeout()

2026-08-14T02:04:49+00:00

Set the task state to TASK_UNINTERRUPTIBLE before calling io_schedule_timeout() in ufshcd_wait_for_pending_cmds(). Without setting the task state, io_schedule_timeout() returns immediately because the task state remains TASK_RUNNING. This results in a busy loop that wastes CPU cycles. Fixes: 2000bc309703 ("scsi: ufs: core: Reduce the clock scaling latency") Reviewed-by: Peter Wang Reported-by: Sashiko Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/8fe4526ce272811b28e99048b42358dd8f7c48af.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle)

Merge patch series "scsi: ufs: Add support for the aggregated read query opcode"

2026-08-07T15:34:35+00:00

Hyeoncheol Jeong says: UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet bundling multiple Descriptors, Attributes and Flags in a single QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor, so the reserved (device management) tag gets a dedicated UCD with an enlarged response area. Patch 1 is a preparatory cleanup that switches the BSG query descriptor length to unsigned types. Patch 2 adds the aggregated read support. v3: https://lore.kernel.org/linux-scsi/20260724030812epcms2p4eb2c77cb4dcd5fd51ca9c3eaa5ea4bfa@epcms2p4/ v2: https://lore.kernel.org/linux-scsi/20260722084819epcms2p49c27fce999e821385f7b5d7ea5a02868@epcms2p4/ Link: https://patch.msgid.link/20260728092208epcms2p881b17276fb41c006a4229c1d073b4ad0@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle)

scsi: ufs: Add support for the aggregated read query opcode

2026-08-07T15:32:19+00:00

UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet in a single query request. The packet may bundle multiple Descriptors, Attributes and Flags as group-headed groups, returned in the Data Segment of the QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor (up to a few KiB vs the 255-byte descriptor limit), so its response UPIU buffer must be enlarged. Enlarging the shared utp_transfer_cmd_desc would waste that extra space per tag, so add a dedicated utp_devman_cmd_desc with a 4 KiB response area (ALIGNED_DEVMAN_RSP_SIZE), allocated once for the reserved (device management) tag that aggregated read uses. Regular tags keep the 512-byte descriptor in a pool of (nutrs - UFSHCD_NUM_RESERVED) entries, leaving normal I/O unchanged. ufshcd_init_lrb() and ufshcd_host_memory_configure() pick the devman descriptor for the reserved tag and index the pool at (tag - UFSHCD_NUM_RESERVED) otherwise. The pre-4.1 MCQ tag recovery adds one compare against the devman UCD address and returns the reserved tag (UFSHCI 4.1+ carries the tag in the CQE), and the BSG raw-UPIU and device management paths learn the new opcode, sizing descriptors by QUERY_AGGREGATED_MAX_SIZE. Signed-off-by: Hyeoncheol Jeong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260728092741epcms2p8c53432ef3c2f0d6a63dd980ad5ef9f00@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle)

scsi: ufs: Use unsigned types for the BSG query

2026-08-07T15:32:19+00:00

The UPIU query length field is an unsigned 16-bit value per the UFS standard, but ufs_bsg carried it around in signed int. Switch the descriptor length and buffer pointer to u16/u8, fold the trivial ufs_bsg_get_query_desc_size() helper into its only caller, and replace min_t(int, ...) with min(). No functional change intended. Signed-off-by: Hyeoncheol Jeong Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260728092434epcms2p56b013ab7a2df90d3df9186322de54340@epcms2p5 Signed-off-by: Martin K. Petersen (Oracle)

scsi: core: pair EH runtime PM get and put

2026-08-07T15:00:49+00:00

shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle)

Merge patch series "scsi: ufs: Fix descriptor parsing and invalid input handling"

2026-08-06T20:26:29+00:00

Li Qiang says: The first patch validates string descriptor payload sizes and avoids raw descriptor overreads. The remaining patches protect invalid completion diagnostics, validate connected lane counts, validate RPMB frame sizes, use unaligned RPMB frame accesses, and retain a NUL terminator for debugfs input. Link: https://patch.msgid.link/20260717153914.26321-1-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle)

scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

2026-07-29T02:26:51+00:00

Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Co-developed-by: Jiazi Li Signed-off-by: Jiazi Li Signed-off-by: Ao Sun Reviewed-by: Bean Huo Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com Signed-off-by: Martin K. Petersen