summaryrefslogtreecommitdiff
path: root/drivers/ufs
AgeCommit message (Collapse)Author
17 hoursMerge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsiHEADmasterLinus Torvalds
Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ...
9 daysMerge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsiLinus Torvalds
Pull SCSI updates from James Bottomley: "One new driver: leapraid (similar to mpi3mr but OK'd by Broadcom). The usual suspects for driver updates (ufs, qla2xxx, smartpqi, zfcp, fnic, ibmvfc) plus a few small core updates: a fix for an uninitialized sg list pad bytes plus the removal of the dma mask check for max sectors. The big update in the sd driver is mostly code refactoring for obscure error leg handling" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (195 commits) scsi: fnic: Fix built-in NVMe/FC build scsi: fnic: Fix invalid comparison for error scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() scsi: zfcp: Enable CONTEXT_ANALYSIS scsi: zfcp: Add __must_hold() attribute to zfcp_qdio_sbal_get() scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock scsi: storvsc: Support manual scans for all Hyper-V targets scsi: sd: Fix sd_done() sense handling condition scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails scsi: sd: Fix error handling in sd_probe() after large pool creation failure scsi: leapraid: Add driver documentation scsi: leapraid: Add new SCSI driver scsi: ufs: Add support for the aggregated read query opcode scsi: ufs: Use unsigned types for the BSG query scsi: ibmvfc: Fix spelling mistake "Deleteing" -> "Deleting" scsi: qla2xxx: Update version to 12.00.00.2607b2 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak ...
2026-08-13scsi: ufs: core: Enable context analysisBart Van Assche
Annotate functions that modify the state of a synchronization object. Remove the struct semaphore annotations because lock context annotations are not supported for semaphores. Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/3c975386a5bcb939f8a2a0d47fd621f234321a9e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-13scsi: ufs: core: Set task state before io_schedule_timeout()Bart Van Assche
Set the task state to TASK_UNINTERRUPTIBLE before calling io_schedule_timeout() in ufshcd_wait_for_pending_cmds(). Without setting the task state, io_schedule_timeout() returns immediately because the task state remains TASK_RUNNING. This results in a busy loop that wastes CPU cycles. Fixes: 2000bc309703 ("scsi: ufs: core: Reduce the clock scaling latency") Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/8fe4526ce272811b28e99048b42358dd8f7c48af.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07Merge patch series "scsi: ufs: Add support for the aggregated read query opcode"Martin K. Petersen (Oracle)
Hyeoncheol Jeong <hyenc.jeong@samsung.com> says: UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet bundling multiple Descriptors, Attributes and Flags in a single QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor, so the reserved (device management) tag gets a dedicated UCD with an enlarged response area. Patch 1 is a preparatory cleanup that switches the BSG query descriptor length to unsigned types. Patch 2 adds the aggregated read support. v3: https://lore.kernel.org/linux-scsi/20260724030812epcms2p4eb2c77cb4dcd5fd51ca9c3eaa5ea4bfa@epcms2p4/ v2: https://lore.kernel.org/linux-scsi/20260722084819epcms2p49c27fce999e821385f7b5d7ea5a02868@epcms2p4/ Link: https://patch.msgid.link/20260728092208epcms2p881b17276fb41c006a4229c1d073b4ad0@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07scsi: ufs: Add support for the aggregated read query opcodeHyeoncheol Jeong
UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet in a single query request. The packet may bundle multiple Descriptors, Attributes and Flags as group-headed groups, returned in the Data Segment of the QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor (up to a few KiB vs the 255-byte descriptor limit), so its response UPIU buffer must be enlarged. Enlarging the shared utp_transfer_cmd_desc would waste that extra space per tag, so add a dedicated utp_devman_cmd_desc with a 4 KiB response area (ALIGNED_DEVMAN_RSP_SIZE), allocated once for the reserved (device management) tag that aggregated read uses. Regular tags keep the 512-byte descriptor in a pool of (nutrs - UFSHCD_NUM_RESERVED) entries, leaving normal I/O unchanged. ufshcd_init_lrb() and ufshcd_host_memory_configure() pick the devman descriptor for the reserved tag and index the pool at (tag - UFSHCD_NUM_RESERVED) otherwise. The pre-4.1 MCQ tag recovery adds one compare against the devman UCD address and returns the reserved tag (UFSHCI 4.1+ carries the tag in the CQE), and the BSG raw-UPIU and device management paths learn the new opcode, sizing descriptors by QUERY_AGGREGATED_MAX_SIZE. Signed-off-by: Hyeoncheol Jeong <hyenc.jeong@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260728092741epcms2p8c53432ef3c2f0d6a63dd980ad5ef9f00@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07scsi: ufs: Use unsigned types for the BSG queryHyeoncheol Jeong
The UPIU query length field is an unsigned 16-bit value per the UFS standard, but ufs_bsg carried it around in signed int. Switch the descriptor length and buffer pointer to u16/u8, fold the trivial ufs_bsg_get_query_desc_size() helper into its only caller, and replace min_t(int, ...) with min(). No functional change intended. Signed-off-by: Hyeoncheol Jeong <hyenc.jeong@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260728092434epcms2p56b013ab7a2df90d3df9186322de54340@epcms2p5 Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07scsi: core: pair EH runtime PM get and putHongjie Fang
shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang <hongjiefang@asrmicro.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06Merge patch series "scsi: ufs: Fix descriptor parsing and invalid input ↵Martin K. Petersen (Oracle)
handling" Li Qiang <liqiang01@kylinos.cn> says: The first patch validates string descriptor payload sizes and avoids raw descriptor overreads. The remaining patches protect invalid completion diagnostics, validate connected lane counts, validate RPMB frame sizes, use unaligned RPMB frame accesses, and retain a NUL terminator for debugfs input. Link: https://patch.msgid.link/20260717153914.26321-1-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-07-28scsi: ufs: core: Initialize hba->rpmbs list in ufshcdAo Sun
Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Co-developed-by: Jiazi Li <jiazi.li@transsion.com> Signed-off-by: Jiazi Li <jiazi.li@transsion.com> Signed-off-by: Ao Sun <ao.sun@transsion.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-28scsi: ufs: core: Revert "Delegate the interrupt service routine to a ↵Bart Van Assche
threaded IRQ handler" There have been multiple reports of performance regressions caused by commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler"). Hence this revert. This patch reverts most of the following commits: * 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") * 6475cfb81fc4 ("scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command") This patch preserves the following commits: * 034d319c8899 ("scsi: ufs: core: Fix interrupt handling for MCQ Mode") * eabcac808ca3 ("scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock") Cc: Neil Armstrong <neil.armstrong@linaro.org> Cc: 孙魁 (Kui Sun) <kui.sun@unisoc.com> Cc: André Draszik <andre.draszik@linaro.org> Cc: Gregory CLEMENT <gregory.clement@bootlin.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Tested-by: André Draszik <andre.draszik@linaro.org> # on Pixel 6 Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/b70eb60a01f971bed68c42c5b555929db5f835df.1784135511.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-28scsi: ufs: core: Cancel RTC work in active-active suspendGuangshuo Li
UFS RTC support schedules ufs_rtc_update_work to periodically update the device RTC. The work can issue query commands and access the UFS host controller. A previous change moved the RTC work cancellation before the PRE_CHANGE vendor suspend callback to close a race in the common suspend path. However, the active-active path jumps directly to vops_suspend after flushing exception handling work and therefore bypasses the cancellation. If the RTC work runs while the vendor suspend callback is gating or otherwise changing hardware state, it can access the controller during suspend and trigger an SError. Cancel the RTC work before entering the vendor suspend callback in the active-active path. Since this path now cancels the work, move the RTC work scheduling outside the device and link state restoration block in the resume path. This restarts RTC updates after an active-active suspend and resume cycle. Fixes: b0bd84c39289 ("scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260714172726.1736967-1-lgs201920130244@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: host: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717035013.563791-1-panchuang@vivo.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: debugfs: Reserve space for a string terminatorLi Qiang
ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL. Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggering the UFS EH") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260717153914.26321-7-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: rpmb: Use unaligned accessors for RPMB framesLi Qiang
RPMB frame buffers are passed as u8 pointers and do not have an alignment guarantee. Use unaligned accessors for the req_resp field. Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260717153914.26321-6-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: rpmb: Validate request frame length before parsingLi Qiang
The RPMB core only verifies that request and response buffers are nonempty. This callback reads req_resp at the end of the first request frame before validating the request length. Require a complete frame before that access. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Link: https://patch.msgid.link/20260717153914.26321-5-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: core: Validate connected lane countsLi Qiang
The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated. Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Link: https://patch.msgid.link/20260717153914.26321-4-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: Avoid NULL CQE dereference when reporting invalid tagsLi Qiang
The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning. Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717153914.26321-3-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: core: Validate string descriptorsLi Qiang
The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread. Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading") Fixes: d794b499f948 ("scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717153914.26321-2-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: Switch WriteBooster missing free space message as warn_onceNeil Armstrong
Once the UFS WriteBooster fails to allocate memory, the situation will stay until fstrim or equivalent is ran. Mark is as a warning since it impacts the performance but only print it once for the lifetime of the kernel since it's not fatal. Otherwise it will be printed each time the device is resumed: [ 31.666880] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 52.655594] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 62.890469] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available ... Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260618-topic-ufs-wb-empty-warn-v1-1-ec744a153e0e@linaro.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "ufs: Add callback for vendor-specific RTT capability"Martin K. Petersen
ed.tsai@mediatek.com says: The first patch adds the get_hba_nortt() callback to the UFS core layer, allowing vendor drivers to provide dynamic, platform-specific RTT capability handling. The second patch implements this callback in the MediaTek UFS driver, distinguishing between legacy platforms (which require the RTT to be limited to 2) and newer MT6995 B0+ platforms (which can use the value from the capability register directly). The third patch removes the max_num_rtt field from ufs_hba_variant_ops as it is now replaced by the get_hba_nortt() callback. Link: https://patch.msgid.link/20260615055802.105479-1-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Always run tx_eqtr POST_CHANGE notifyCan Guo
ufshcd_tx_eqtr() skips POST_CHANGE notify when __ufshcd_tx_eqtr() fails. That can leave variant cleanup incomplete when PRE_CHANGE saved temporary state that POST_CHANGE is expected to restore. Always call POST_CHANGE once PRE_CHANGE has succeeded. Keep the TX EQTR result as the primary return value, and only propagate POST_CHANGE failure when TX EQTR itself succeeded. Log PRE_CHANGE and POST_CHANGE notify failures to make variant callback failures visible in TX EQTR error paths. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Tolerate RX_FOM read failures in TX EQTRCan Guo
ufshcd_get_rx_fom() aborted TX EQTR when a per-lane RX_FOM DME read failed. That makes the whole training flow fragile even though these reads can be treated as best effort. Keep TX EQTR running by logging RX_FOM read failures and continuing. Make failed lanes deterministic by initializing each lane FOM to 0 before reading and only updating it when the DME read succeeds. This avoids propagating stale or uninitialized values into EQTR evaluation. Also update the kerneldoc return description to match behavior: RX_FOM DME read failures are handled as warnings, while get_rx_fom() vops failures are still propagated to the caller. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: ufs-qcom: Restore TX Equalization settings on FOM failureCan Guo
ufs_qcom_get_rx_fom() applies temporary device TX Equalization values before forcing HS mode and running the EOM-based SW FOM scan. When one of these steps fails, the function can bypass the shared cleanup path and leave temporary TX Equalization settings programmed. Route those failures through the cleanup label so the original TX EQ settings are restored and link recovery runs before exit. This path also reuses ret for cleanup, so it may overwrite the original error. Keep that on purpose: if cleanup succeeds, the caller can proceed with the FOM result for the current iteration. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR contextCan Guo
TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart] Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2 Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "scsi: ufs: Add support for static TX Equalization settings"Martin K. Petersen
Can Guo <can.guo@oss.qualcomm.com> says: Hi, This series adds support for board-specific static TX Equalization settings provided through Device Tree. This series is based on the earlier TX Equalization enablement work and persistent storage/retrieval of optimal TX Equalization settings work: https://lore.kernel.org/all/20260325152154.1604082-1-can.guo@oss.qualcomm.com https://lore.kernel.org/all/20260424151420.111675-1-can.guo@oss.qualcomm.com Background ========== UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0 and M-PHY v6.0. These specs define TX Equalization for all High-Speed Gears (not only HS-G6) to compensate channel loss and improve signal integrity at high speed. For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be required depending on channel characteristics. This series adds vendor-neutral DT properties: - patternProperties: txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6] - fixed property: tx-precode-enable-g6 All properties use per-lane Host/Device tuples and accept 2 or 4 values for x1/x2 lane configurations: - txeq-preshoot-g[1-6]: values 0..7 - txeq-deemphasis-g[1-6]: values 0..7 - tx-precode-enable-g6: values 0/1 These properties carry board-level SI characterization data used as static TX Equalization settings for each High-Speed Gear. Example DTS snippet =================== The following x2-lane example shows the expected DT encoding: ufs@1d84000 { lanes-per-direction = <2>; txeq-preshoot-g6 = <1 2>, <3 4>; txeq-deemphasis-g6 = <0 1>, <2 3>; tx-precode-enable-g6 = <1 0>, <0 1>; }; Relationship with Adaptive TX Equalization ========================================== Adaptive TX Equalization remains the primary path when enabled. Static TX Equalization settings from DT are board-specific baseline values, but when adaptive TX Equalization is used, static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static DT settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static DT settings. So static DT settings are a fallback and are intended for cases where adaptive TX Equalization is not enabled/used. No behavior changes for platforms that do not provide these properties. What this series adds ===================== 1. dt-bindings: - Document txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6], and tx-precode-enable-g6 in ufs-common.yaml. - Define tuple encoding for host/device values per lane. - Add per-property value validation ranges in schema. 2. UFS core/platform integration: - Parse and validate per-gear DT TX EQ settings during platform init. - Store parsed values into per-gear TX EQ params and track DT origin using the from_dt flag. - Integrate static-state handling in TX EQ flow so DT-provided entries are fed through the adaptive TX Equalization path and then converted to normal runtime params. Link: https://patch.msgid.link/20260616113348.1168248-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: sysfs: Add HS_GEAR6 string in power_info/gear sysfs outputHimanshu Batra
In power_info/gear sysfs, currently it supports output only till gear 5. If operating mode is gear 6, it outputs "UNKNOWN". Add support for HS_GEAR6 string in sysfs output when operating mode is gear 6. Signed-off-by: Himanshu Batra <himanshubatra@google.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-12scsi: ufs: core: Remove max_num_rtt field from ufs_hba_variant_opsEd Tsai
Remove the max_num_rtt field from ufs_hba_variant_ops as it has been replaced by the get_hba_nortt() callback which provides more flexible platform-specific RTT capability handling. Signed-off-by: Ed Tsai <ed.tsai@mediatek.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260615055802.105479-4-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-12scsi: ufs: mediatek: Implement get_hba_nortt callback for RTT capabilityEd Tsai
Implement the get_hba_nortt callback to handle platform-specific RTT capability differences: - For legacy platforms and IP versions before MT6995 B0, the RTT capability from host controller register is problematic, so limit it to 2 (MTK_MAX_NUM_RTT_LEGACY). - For MT6995 B0 and later platforms, the issue is fixed and the value from host controller capability register can be used directly. This replaces the previous max_num_rtt field in ufs_hba_variant_ops with dynamic platform-specific logic. Signed-off-by: Ed Tsai <ed.tsai@mediatek.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260615055802.105479-3-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-12scsi: ufs: core: Add get_hba_nortt callback for vendor-specific RTT capabilityEd Tsai
The number of outstanding RTTs read from host controller capability register is problematic on some platforms. Add a new vendor callback get_hba_nortt() to allow platform vendors to override the default RTT capability value with platform-specific handling. This patch keeps max_num_rtt field for bisectability and will be removed in a later patch once all platforms are migrated. Signed-off-by: Ed Tsai <ed.tsai@mediatek.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260615055802.105479-2-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-12scsi: ufs: core: Add support for static TX Equalization settingsCan Guo
Parse board-specific static TX Equalization settings from Device Tree for each HS gear and store them in hba->tx_eq_params. Parse txeq-preshoot-g[1-6] and txeq-deemphasis-g[1-6] as per-lane tuples: <Host_Lane0 Device_Lane0>, [<Host_Lane1 Device_Lane1>]. For HS-G6, parse optional tx-precode-enable-g6 using the same per-lane Host/Device tuple format. If provided, it must contain values for all active lanes, and each value must be 0 or 1. Introduce from_dt in struct ufshcd_tx_eq_params to track whether TX EQ values came from static Device Tree data. When adaptive TX Equalization is used, these static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static Device Tree settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static Device Tree settings. So static Device Tree settings are a fallback for cases where adaptive TX Equalization is not enabled or not used. Adaptive TX Equalization remains the primary path when enabled. No behavior changes for platforms that do not provide these properties. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260616113348.1168248-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-08scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()Steven Rostedt
The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: 583e518e7100 ("scsi: ufs: core: Add hba parameter to trace events") Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260630185412.283c26c5@gandalf.local.home Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-21Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsiLinus Torvalds
Pull SCSI updates from James Bottomley: "Only ufs driver updates this time, apart from which this is just an assortment of bug fixes and AI assisted changes. The biggest other change is the reversion of the sas_user_scan patch which supported a mpi3mr NVME behaviour but caused major issues for other sas controllers. The next biggest is the removal of target reset in tcm_loop.c" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (56 commits) scsi: target: Remove tcm_loop target reset handling scsi: lpfc: Fix spelling mistakes in comments scsi: ufs: ufs-pci: Add AMD device ID support scsi: ufs: core: Handle PM commands timeout before SCSI EH scsi: devinfo: Broaden Promise VTrak E310/E610 identification scsi: target: Use constant-time crypto_memneq() for CHAP digests scsi: target: Fix hexadecimal CHAP_I handling scsi: scsi_debug: Fix one-partition tape setup bounds scsi: ufs: qcom: dt-bindings: Document the Hawi UFS controller scsi: mailmap: Update Avri Altman's email address scsi: ufs: Remove redundant vops NULL check and trivial wrapper scsi: ufs: Remove unnecessary return in void vops wrappers scsi: ufs: Fix wrong value printed in unexpected UPIU response case scsi: ufs: core: Fix NULL pointer dereference in scsi_cmd_priv() calls scsi: megaraid_mbox: Avoid double kfree() scsi: pm8001: Fix error code in non_fatal_log_show() scsi: lpfc: Turn lpfc_queue q_pgs into a flexible array scsi: ufs: core: Skip link param validation when lanes_per_direction is unset scsi: sas: Skip opt_sectors when DMA reports no real optimization hint scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" ...
2026-06-15Merge branch 7.1/scsi-fixes into 7.2/scsi-stagingMartin K. Petersen
Pull in outstanding commits from 7.1 branch. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-08scsi: ufs: ufs-pci: Add AMD device ID supportRajeshkumar Sambandham
Add PCI device ID 0x1022:0x1B29 for AMD UFS controllers. Signed-off-by: Rajeshkumar Sambandham <Rajeshkumar.Sambandham@amd.com> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://patch.msgid.link/20260602095931.2869516-1-Rajeshkumar.Sambandham@amd.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-08scsi: ufs: core: Handle PM commands timeout before SCSI EHHongjie Fang
A PM START STOP sent from the UFS well-known LU resume path can race with SCSI EH: The "wl resume" task flow is: __ufshcd_wl_resume() ufshcd_set_dev_pwr_mode(UFS_ACTIVE_PWR_MODE) ufshcd_execute_start_stop() scsi_execute_cmd() blk_execute_rq <-- wait scsi_check_passthrough() <-- may retry START STOP If the first START STOP time out, SCSI EH may already recover the link and reset the device before scsi_execute_cmd() returns: scsi_timeout() scsi_eh_scmd_add() scsi_error_handler() scsi_unjam_host() scsi_eh_ready_devs() scsi_eh_host_reset() ufshcd_eh_host_reset_handler() if (hba->pm_op_in_progress) ufshcd_link_recovery() ufshcd_device_reset() ufshcd_host_reset_and_restore() ... scsi_eh_flush_done_q() <-- wakeup "wl resume" task ... <-- host still in SHOST_RECOVERY scsi_restart_operations() A later passthrough retry can then run while the host is still in SHOST_RECOVERY and hit the SCMD_FAIL_IF_RECOVERING path: scsi_queue_rq() if (scsi_host_in_recovery(shost) && cmd->flags & SCMD_FAIL_IF_RECOVERING) return BLK_STS_OFFLINE That retry completes with DID_ERROR or DID_NO_CONNECT even though EH may already have restored the device to an operational ACTIVE state. Handle these PM timeouts directly from ufshcd_eh_timed_out() instead. After ufshcd_link_recovery(), complete the timed-out command immediately if it has not been completed already. For regular SCSI commands, complete them with DID_REQUEUE to match the existing MCQ force-completion semantics and allow scsi_execute_cmd() to retry if needed. For reserved internal device-management commands, finish the request with DID_TIME_OUT without calling ufshcd_release_scsi_cmd() since those commands use different resource lifetime rules. The system_suspending flag is no longer needed because PM command timeout handling now uses pm_op_in_progress. Fixes: b8c3a7bac9b6 ("scsi: ufs: Have midlayer retry start stop errors") Signed-off-by: Hongjie Fang <hongjiefang@asrmicro.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260605112034.3802540-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-02Merge tag 'soc-fixes-7.1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "Following the previous set of fixes, this addresses another significant number of small issues found in firmware drivers (tee, optee, qcomtee, qcom ice, exynos acpm) drivers through various tools. This is about error handling, resource leaks, concurrency and a use-after-free bug. The fixes for the Qualcomm ICE driver also introduce interface changes in the UFS and MMC drivers using it. Outside of firmware drivers, there are a few fixes across the tree: - Minor driver code mistakes in the Atmel EBI memory controller, the i.MX soc ID driver and socfpga boot logic - A defconfig change to avoid a boot time regression on multiple qualcomm boards - Device tree fixes for qualcomm, at91 and gemini, addressing mostly minor configuration mistakes" * tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits) firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling ARM: dts: gemini: Fix partition offsets ARM: socfpga: Fix OF node refcount leak in SMP setup soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node arm64: dts: qcom: milos: Add power-domain and iface clk for ice node tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() tee: fix params_from_user() error path in tee_ioctl_supp_recv tee: shm: fix shm leak in register_shm_helper() tee: fix tee_ioctl_object_invoke_arg padding arm64: defconfig: Enable PCI M.2 power sequencing driver scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get() mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get() soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL soc: qcom: ice: Return -ENODEV if the ICE platform device is not found soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() ARM: dts: microchip: sam9x7: fix GMAC clock configuration firmware: samsung: acpm: Fix mailbox channel leak on probe error ...
2026-06-01scsi: ufs: Remove redundant vops NULL check and trivial wrapperChanwoo Lee
ufshcd_variant_hba_init/exit() check 'if (!hba->vops)' before calling vops wrappers, but the wrappers already do NULL check internally. Remove the redundant checks. Also remove ufshcd_variant_hba_exit() entirely since it only wraps ufshcd_vops_exit() with no added value. Signed-off-by: Chanwoo Lee <cw9316.lee@samsung.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260529061623.301291-1-cw9316.lee@samsung.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-01scsi: ufs: Remove unnecessary return in void vops wrappersChanwoo Lee
ufshcd_vops_exit(), ufshcd_vops_setup_task_mgmt(), and ufshcd_vops_hibern8_notify() use 'return hba->vops->xxx()' while other void vops wrappers call without return. Remove the unnecessary return keywords for consistency. Signed-off-by: Chanwoo Lee <cw9316.lee@samsung.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260529061503.301182-1-cw9316.lee@samsung.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-01scsi: ufs: Fix wrong value printed in unexpected UPIU response caseChanwoo Lee
In ufshcd_transfer_rsp_status(), the default case of the inner switch statement prints the UPIU response code when an unexpected response is received. However, the code was printing 'result' variable which is always 0 at that point, making the error message useless for debugging. Fix this by printing the actual UPIU response code returned by ufshcd_get_req_rsp(). Fixes: 08108d31129a ("scsi: ufs: Improve type safety") Signed-off-by: Chanwoo Lee <cw9316.lee@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260527092134.275887-1-cw9316.lee@samsung.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-01scsi: ufs: core: Fix NULL pointer dereference in scsi_cmd_priv() callsChanwoo Lee
ufshcd_tag_to_cmd() may return NULL if no command is associated with the given tag. However, several callers dereference the returned cmd pointer via scsi_cmd_priv() without checking for NULL first, leading to a potential NULL pointer dereference. Fix this by adding NULL checks for cmd before calling scsi_cmd_priv() and moving the lrbp initialization after the NULL check. Signed-off-by: Chanwoo Lee <cw9316.lee@samsung.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260529010739.295391-1-cw9316.lee@samsung.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-01scsi: ufs: core: Skip link param validation when lanes_per_direction is unsetDaejun Park
ufshcd_validate_link_params(), added by commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link"), is called unconditionally from ufshcd_link_startup() and fails link startup with -ENOLINK when the connected lane count read from the device differs from hba->lanes_per_direction. lanes_per_direction is only set by ufshcd-pltfrm (default 2, or the "lanes-per-direction" devicetree property); ufshcd-pci controllers (e.g. Intel) leave it 0. As the device always reports >= 1 connected lanes, the check can never match and link startup always fails. Reproduced with QEMU's UFS device. Skip the check when lanes_per_direction is unset: with no expected value to validate against, restore the behaviour from before that commit. Fixes: e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link") Signed-off-by: Daejun Park <daejun7.park@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260520070009epcms2p6542f3abb7660839e9d8140b3f2f145c3@epcms2p6 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-22scsi: ufs: core: Optimize ufshcd_add_uic_command_trace()Bart Van Assche
Use cached values in ufshcd_add_uic_command_trace() instead of calling readl() when tracing command submission (UFS_CMD_SEND). Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260519212135.3130556-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-22scsi: ufs: core: Complain if UIC argument 2 is invalidBart Van Assche
According to the UFSHCI standard, the lowest byte of UIC argument 2 is an output value. Additionally, ufshcd_uic_cmd_compl() is based on the assumption that the lowest byte of UIC argument 2 is zero. Hence, complain if the result byte is set when a UIC command is submitted. Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260519212135.3130556-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-22scsi: ufs: core: Inline two functions related to UIC commandsBart Van Assche
The implementation of the two functions ufshcd_get_uic_cmd_result() and ufshcd_get_dme_attr_val() is very short. Additionally, both functions only have one caller. Inline both functions to make the code shorter. Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260519212135.3130556-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-22scsi: ufs: ufs-qcom: Use quirk EXTENDED_TX_EQTR_ADAPT_LENGTH_L0L1L2L3Can Guo
Use UFSHCD_QUIRK_EXTENDED_TX_EQTR_ADAPT_LENGTH_L0L1L2L3 for UFS Hosts HW major version 0x7 & minor version 0x1. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Link: https://patch.msgid.link/20260501131641.826258-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-22scsi: ufs: core: Add a quirk for extended TX EQTR Adapt L0L1L2L3 lengthCan Guo
Add a quirk to support TX Equalization Training (EQTR) using Adapt L0L1L2L3 length which is larger than what is allowed by M-PHY spec ver 6.0. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260501131641.826258-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-18scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get()Manivannan Sadhasivam
Now since the devm_of_qcom_ice_get() API never returns NULL, remove the NULL check and also simplify the error handling. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Acked-by: Martin K. Petersen <martin.petersen@oracle.com> # UFS Tested-by: Sumit Garg <sumit.garg@oss.qualcomm.com> # OP-TEE as TZ Acked-by: Sumit Garg <sumit.garg@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-5-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-05-14scsi: ufs: ufs-qcom: Enable Auto Hibern8 clock request supportPalash Kambar
On platforms that support Auto Hibern8 (AH8), the UFS controller can autonomously de-assert clk_req signals to the Global Clock Controller when entering the Hibern8 state. This allows Global Clock Controller (GCC) to gate unused clocks, improving power efficiency. Enable the Clock Request feature by setting the UFS_HW_CLK_CTRL_EN bit in the UFS_AH8_CFG register, as recommended in the Hardware Programming Guidelines. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Palash Kambar <palash.kambar@oss.qualcomm.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260423102023.3779489-3-palash.kambar@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-14scsi: ufs: core: Configure only active lanes during linkPalash Kambar
The number of connected lanes detected during UFS link startup can be fewer than the lanes specified in the device tree. The current driver logic attempts to configure all lanes defined in the device tree, regardless of their actual availability. This mismatch may cause failures during power mode changes. Hence, Add a check during link startup to ensure that only the lanes actually discovered are considered valid. If a mismatch is detected, fail the initialization early, preventing the driver from entering an unsupported configuration that could cause power mode transition failures. Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Palash Kambar <palash.kambar@oss.qualcomm.com> Link: https://patch.msgid.link/20260423102023.3779489-2-palash.kambar@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>