linux-stable.git/drivers/ufs/host, branch linux-6.16.y

scsi: ufs: ufs-qcom: Fix ESI null pointer dereference

2025-08-28T14:34:47+00:00

[ Upstream commit 6300d5c5438724c0876828da2f6e2c1a661871fc ]

ESI/MSI is a performance optimization feature that provides dedicated
interrupts per MCQ hardware queue. This is optional feature and UFS MCQ
should work with and without ESI feature.

Commit e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse")
brings a regression in ESI (Enhanced System Interrupt) configuration that
causes a null pointer dereference when Platform MSI allocation fails.

The issue occurs in when platform_device_msi_init_and_alloc_irqs() in
ufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses
__free() macro for automatic cleanup free MSI resources that were never
successfully allocated.

Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000008

  Call trace:
  mutex_lock+0xc/0x54 (P)
  platform_device_msi_free_irqs_all+0x1c/0x40
  ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom]
  ufshcd_config_mcq+0x28/0x104
  ufshcd_init+0xa3c/0xf40
  ufshcd_pltfrm_init+0x504/0x7d4
  ufs_qcom_probe+0x20/0x58 [ufs_qcom]

Fix by restructuring the ESI configuration to try MSI allocation first,
before any other resource allocation and instead use explicit cleanup
instead of __free() macro to avoid cleanup of unallocated resources.

Tested on SM8750 platform with MCQ enabled, both with and without
Platform ESI support.

Fixes: e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse")
Cc: Manivannan Sadhasivam 
Cc: Thomas Gleixner 
Cc: James Bottomley 
Signed-off-by: Nitin Rawat 
Link: https://lore.kernel.org/r/20250811073330.20230-1-quic_nitirawa@quicinc.com
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6

2025-08-28T14:34:47+00:00

[ Upstream commit 7a9d5195a7f5871a4ad4e55fc567a2b3bee49a59 ]

The MCQ feature and ESI are supported by all Qualcomm UFS controller
versions 6 and above.

Therefore, update the ESI vector mask in the UFS_MEM_CFG3 register for
platforms with major version number of 6 or higher.

Reviewed-by: Manivannan Sadhasivam 
Signed-off-by: Bao D. Nguyen 
Signed-off-by: Nitin Rawat 
Link: https://lore.kernel.org/r/20250714075336.2133-2-quic_nitirawa@quicinc.com
Signed-off-by: Martin K. Petersen 
Stable-dep-of: 6300d5c54387 ("scsi: ufs: ufs-qcom: Fix ESI null pointer dereference")
Signed-off-by: Sasha Levin

scsi: ufs: ufs-pci: Fix default runtime and system PM levels

2025-08-28T14:34:18+00:00

commit 6de7435e6b81fe52c0ab4c7e181f6b5decd18eb1 upstream.

Intel MTL-like host controllers support auto-hibernate.  Using
auto-hibernate with manual (driver initiated) hibernate produces more
complex operation.  For example, the host controller will have to exit
auto-hibernate simply to allow the driver to enter hibernate state
manually.  That is not recommended.

The default rpm_lvl and spm_lvl is 3, which includes manual hibernate.

Change the default values to 2, which does not.

Note, to be simpler to backport to stable kernels, utilize the UFS PCI
driver's ->late_init() call back.  Recent commits have made it possible
to set up a controller-specific default in the regular ->init() call
back, but not all stable kernels have those changes.

Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter 
Link: https://lore.kernel.org/r/20250723165856.145750-3-adrian.hunter@intel.com
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers

2025-08-28T14:34:18+00:00

commit 4428ddea832cfdb63e476eb2e5c8feb5d36057fe upstream.

UFSHCD core disables the UIC completion interrupt when issuing UIC
hibernation commands, and re-enables it afterwards if it was enabled to
start with, refer ufshcd_uic_pwr_ctrl(). For Intel MTL-like host
controllers, accessing the register to re-enable the interrupt disrupts
the state transition.

Use hibern8_notify variant operation to disable the interrupt during the
entire hibernation, thereby preventing the disruption.

Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL")
Cc: stable@vger.kernel.org
Signed-off-by: Archana Patni 
Link: https://lore.kernel.org/r/20250723165856.145750-2-adrian.hunter@intel.com
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE

2025-08-28T14:34:17+00:00

commit 01aad16c2257ab8ff33b152b972c9f2e1af47912 upstream.

On Google gs101, the number of UTP transfer request slots (nutrs) is 32,
and in this case the driver ends up programming the UTRL_NEXUS_TYPE
incorrectly as 0.

This is because the left hand side of the shift is 1, which is of type
int, i.e. 31 bits wide. Shifting by more than that width results in
undefined behaviour.

Fix this by switching to the BIT() macro, which applies correct type
casting as required. This ensures the correct value is written to
UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift
warning:

    UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21
    shift exponent 32 is too large for 32-bit type 'int'

For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE
write.

Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
Cc: stable@vger.kernel.org
Signed-off-by: André Draszik 
Link: https://lore.kernel.org/r/20250707-ufs-exynos-shift-v1-1-1418e161ae40@linaro.org
Reviewed-by: Bart Van Assche 
Reviewed-by: Peter Griffin 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2025-06-07T03:02:51+00:00

Pull SCSI fixes from James Bottomley:
 "Mostly trivial updates and bug fixes (core update is a comment
  spelling fix).

  The bigger UFS update is the clock scaling and frequency fixes"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
  scsi: ufs: qcom: Call ufs_qcom_cfg_timers() in clock scaling path
  scsi: ufs: qcom: Map devfreq OPP freq to UniPro Core Clock freq
  scsi: ufs: qcom: Check gear against max gear in vop freq_to_gear()
  scsi: aacraid: Remove useless code
  scsi: core: devinfo: Fix typo in comment
  scsi: ufs: core: Don't perform UFS clkscaling during host async scan

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2025-05-30T05:17:52+00:00

Pull SCSI updates from James Bottomley:
 "Updates to the usual drivers (smartpqi, ufs, lpfc, scsi_debug, target,
  hisi_sas) with the only substantive core change being the removal of
  the stream_status member from the scsi_stream_status_header (to get
  rid of flex array members)"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (77 commits)
  scsi: target: core: Constify struct target_opcode_descriptor
  scsi: target: core: Constify enabled() in struct target_opcode_descriptor
  scsi: hisi_sas: Fix warning detected by sparse
  scsi: mpt3sas: Fix _ctl_get_mpt_mctp_passthru_adapter() to return IOC pointer
  scsi: sg: Remove unnecessary NULL check before unregister_sysctl_table()
  scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
  scsi: ufs: qcom: dt-bindings: Document the SM8750 UFS Controller
  scsi: mvsas: Fix typos in SAS/SATA VSP register comments
  scsi: fnic: Replace memset() with eth_zero_addr()
  scsi: ufs: core: Support updating device command timeout
  scsi: ufs: core: Change hwq_id type and value
  scsi: ufs: core: Increase the UIC command timeout further
  scsi: zfcp: Simplify workqueue allocation
  scsi: ufs: core: Print error value as hex format in ufshcd_err_handler()
  scsi: sd: Remove the stream_status member from scsi_stream_status_header
  scsi: docs: Clean up some style in scsi_mid_low_api
  scsi: core: Remove unused scsi_dev_info_list_del_keyed()
  scsi: isci: Remove unused sci_remote_device_reset()
  scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH
  scsi: smartpqi: Delete a stray tab in pqi_is_parity_write_stream()
  ...

scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()

2025-05-28T02:13:18+00:00

Prevent calling phy_exit() before phy_init() to avoid abnormal power
count and the following warning during boot up.

[5.146763] phy phy-1d80000.phy.0: phy_power_on was called before phy_init

Fixes: 7bac65687510 ("scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()")
Signed-off-by: Nitin Rawat 
Link: https://lore.kernel.org/r/20250526153821.7918-2-quic_nitirawa@quicinc.com
Reviewed-by: Konrad Dybcio 
Signed-off-by: Martin K. Petersen

scsi: ufs: qcom: Call ufs_qcom_cfg_timers() in clock scaling path

2025-05-28T02:07:04+00:00

ufs_qcom_cfg_timers() is clock freq dependent like
ufs_qcom_set_core_clk_ctrl(), hence move ufs_qcom_cfg_timers() call to
clock scaling path. In addition, do not assume the devfreq OPP freq is
always the 'core_clock' freq although 'core_clock' is the first clock
phandle in device tree, use ufs_qcom_opp_freq_to_clk_freq() to find the
core clk freq.

Signed-off-by: Can Guo 
Co-developed-by: Ziqi Chen 
Signed-off-by: Ziqi Chen 
Link: https://lore.kernel.org/r/20250522021537.999107-4-quic_ziqichen@quicinc.com
Reported-by: Luca Weiss 
Closes: https://lore.kernel.org/linux-arm-msm/D9FZ9U3AEXW4.1I12FX3YQ3JPW@fairphone.com/
Tested-by: Luca Weiss 
Reviewed-by: Bean Huo 
Tested-by: Loïc Minier 
Signed-off-by: Martin K. Petersen

scsi: ufs: qcom: Map devfreq OPP freq to UniPro Core Clock freq

2025-05-28T02:06:40+00:00

On some platforms, the devfreq OPP freq may be different than the unipro
core clock freq. Implement ufs_qcom_opp_freq_to_clk_freq() and use it to
find the unipro core clk freq.

Fixes: c02fe9e222d1 ("scsi: ufs: qcom: Implement the freq_to_gear_speed() vop")
Signed-off-by: Can Guo 
Co-developed-by: Ziqi Chen 
Signed-off-by: Ziqi Chen 
Link: https://lore.kernel.org/r/20250522021537.999107-3-quic_ziqichen@quicinc.com
Reported-by: Luca Weiss 
Closes: https://lore.kernel.org/linux-arm-msm/D9FZ9U3AEXW4.1I12FX3YQ3JPW@fairphone.com/
Tested-by: Luca Weiss 
Reviewed-by: Bean Huo 
Tested-by: Loïc Minier 
Signed-off-by: Martin K. Petersen