linux.git/drivers/ufs/core, branch v7.2

scsi: core: pair EH runtime PM get and put

2026-08-07T15:00:49+00:00

shost->eh_noresume is currently consulted twice in one error handling
iteration: once before scsi_autopm_get_host() and once again before
scsi_autopm_put_host().

That is racy when a PM-triggered error path flips shost->eh_noresume
while the SCSI EH thread is still running.

The problem flow looks like this:
PM path
  ufshcd_set_dev_pwr_mode()
    shost->eh_noresume = 1
    ufshcd_execute_start_stop  <-- trigger EH
    ...
    shost->eh_noresume = 0

EH path
  scsi_error_handler()
    if (!shost->eh_noresume)
      scsi_autopm_get_host()  <-- skipped
    ...
    if (!shost->eh_noresume)
       scsi_autopm_put_host()  <-- executed later

In that case one EH iteration can skip autoresume on entry and still
drop a runtime PM reference on exit. That leaves an unmatched runtime PM
put and can trigger a runtime PM usage count underflow.

Fix this by making eh_noresume a regular bool so it can be accessed with
READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use
that snapshot for both runtime PM get and put decisions.

Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host")
Signed-off-by: Hongjie Fang 
Reviewed-by: Bart Van Assche 
Reviewed-by: Peter Wang 
Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com
Signed-off-by: Martin K. Petersen (Oracle)

scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

2026-07-29T02:26:51+00:00

Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
pointer dereference in the device teardown path if ufs_rpmb_probe()
fails.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Co-developed-by: Jiazi Li 
Signed-off-by: Jiazi Li 
Signed-off-by: Ao Sun 
Reviewed-by: Bean Huo 
Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com
Signed-off-by: Martin K. Petersen

scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"

2026-07-29T01:52:09+00:00

There have been multiple reports of performance regressions caused by
commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service
routine to a threaded IRQ handler"). Hence this revert.

This patch reverts most of the following commits:

 * 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service
   routine to a threaded IRQ handler")

 * 6475cfb81fc4 ("scsi: ufs: core: Avoid IRQ thread wakeup during active
   UIC command")

This patch preserves the following commits:

 * 034d319c8899 ("scsi: ufs: core: Fix interrupt handling for MCQ Mode")

 * eabcac808ca3 ("scsi: ufs: core: Fix IRQ lock inversion for the SCSI
   host lock")

Cc: Neil Armstrong 
Cc: 孙魁 (Kui Sun) 
Cc: André Draszik 
Cc: Gregory CLEMENT 
Cc: Sebastian Andrzej Siewior 
Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler")
Signed-off-by: Bart Van Assche 
Reviewed-by: Sebastian Andrzej Siewior 
Tested-by: André Draszik  # on Pixel 6
Reviewed-by: André Draszik 
Link: https://patch.msgid.link/b70eb60a01f971bed68c42c5b555929db5f835df.1784135511.git.bvanassche@acm.org
Signed-off-by: Martin K. Petersen

scsi: ufs: core: Cancel RTC work in active-active suspend

2026-07-29T01:52:08+00:00

UFS RTC support schedules ufs_rtc_update_work to periodically update the
device RTC. The work can issue query commands and access the UFS host
controller.

A previous change moved the RTC work cancellation before the PRE_CHANGE
vendor suspend callback to close a race in the common suspend path.
However, the active-active path jumps directly to vops_suspend after
flushing exception handling work and therefore bypasses the
cancellation.

If the RTC work runs while the vendor suspend callback is gating or
otherwise changing hardware state, it can access the controller during
suspend and trigger an SError.

Cancel the RTC work before entering the vendor suspend callback in the
active-active path. Since this path now cancels the work, move the RTC
work scheduling outside the device and link state restoration block in
the resume path. This restarts RTC updates after an active-active
suspend and resume cycle.

Fixes: b0bd84c39289 ("scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend")
Signed-off-by: Guangshuo Li 
Reviewed-by: Peter Wang 
Reviewed-by: Bean Huo 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260714172726.1736967-1-lgs201920130244@gmail.com
Signed-off-by: Martin K. Petersen

scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()

2026-07-09T01:51:36+00:00

The trace events in drivers/ufs/core/ufs_trace.h were converted to take
a pointer to the hba structure as an argument for the tracepoint and
then in TP_printk() the printing of the dev_name from the ring buffer
was converted to using the dev dereferenced pointer from the hba saved
pointer.

This is not allowed as the TP_printk() is executed at the time the trace
event is read from /sys/kernel/tracing/trace file. That can happen
literally, seconds, minutes, hours, weeks, days, or even months later!
There is no guarantee that the hba pointer will still exist by the time
it is dereferenced when the "trace" file is read.

Instead, save the device name from the hba pointer at the time the
tracepoint is called and place it into the ring buffer event. Then the
TP_printk() can read the name directly from the ring buffer and remove
the possibility that it will read a freed pointer and crash the kernel.

This was detected when testing the trace event code that looks for
TP_printk() parameters doing illegal derferences[1]

[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/

Cc: stable@vger.kernel.org
Fixes: 583e518e7100 ("scsi: ufs: core: Add hba parameter to trace events")
Signed-off-by: Steven Rostedt 
Reviewed-by: Peter Wang 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260630185412.283c26c5@gandalf.local.home
Signed-off-by: Martin K. Petersen

Merge branch 7.1/scsi-fixes into 7.2/scsi-staging

2026-06-16T01:01:30+00:00

Pull in outstanding commits from 7.1 branch.

Signed-off-by: Martin K. Petersen

scsi: ufs: core: Handle PM commands timeout before SCSI EH

2026-06-08T21:41:45+00:00

A PM START STOP sent from the UFS well-known LU resume path can race
with SCSI EH:

The "wl resume" task flow is:
  __ufshcd_wl_resume()
    ufshcd_set_dev_pwr_mode(UFS_ACTIVE_PWR_MODE)
      ufshcd_execute_start_stop()
        scsi_execute_cmd()
          blk_execute_rq           <-- wait
          scsi_check_passthrough() <-- may retry START STOP

If the first START STOP time out, SCSI EH may already recover the link and
reset the device before scsi_execute_cmd() returns:

  scsi_timeout()
    scsi_eh_scmd_add()
      scsi_error_handler()
        scsi_unjam_host()
          scsi_eh_ready_devs()
            scsi_eh_host_reset()
              ufshcd_eh_host_reset_handler()
                if (hba->pm_op_in_progress)
                  ufshcd_link_recovery()
                    ufshcd_device_reset()
                    ufshcd_host_reset_and_restore()
          ...
          scsi_eh_flush_done_q()   <-- wakeup "wl resume" task
        ...                        <-- host still in SHOST_RECOVERY
        scsi_restart_operations()

A later passthrough retry can then run while the host is still in
SHOST_RECOVERY and hit the SCMD_FAIL_IF_RECOVERING path:

  scsi_queue_rq()
    if (scsi_host_in_recovery(shost) &&
        cmd->flags & SCMD_FAIL_IF_RECOVERING)
      return BLK_STS_OFFLINE

That retry completes with DID_ERROR or DID_NO_CONNECT even though EH may
already have restored the device to an operational ACTIVE state.

Handle these PM timeouts directly from ufshcd_eh_timed_out() instead.
After ufshcd_link_recovery(), complete the timed-out command immediately
if it has not been completed already.

For regular SCSI commands, complete them with DID_REQUEUE to match the
existing MCQ force-completion semantics and allow scsi_execute_cmd() to
retry if needed. For reserved internal device-management commands,
finish the request with DID_TIME_OUT without calling
ufshcd_release_scsi_cmd() since those commands use different resource
lifetime rules.

The system_suspending flag is no longer needed because PM command
timeout handling now uses pm_op_in_progress.

Fixes: b8c3a7bac9b6 ("scsi: ufs: Have midlayer retry start stop errors")
Signed-off-by: Hongjie Fang 
Reviewed-by: Bart Van Assche 
Reviewed-by: Peter Wang 
Link: https://patch.msgid.link/20260605112034.3802540-1-hongjiefang@asrmicro.com
Signed-off-by: Martin K. Petersen

scsi: ufs: Remove redundant vops NULL check and trivial wrapper

2026-06-02T02:01:54+00:00

ufshcd_variant_hba_init/exit() check 'if (!hba->vops)' before calling
vops wrappers, but the wrappers already do NULL check internally. Remove
the redundant checks. Also remove ufshcd_variant_hba_exit() entirely
since it only wraps ufshcd_vops_exit() with no added value.

Signed-off-by: Chanwoo Lee 
Reviewed-by: Peter Wang 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260529061623.301291-1-cw9316.lee@samsung.com
Signed-off-by: Martin K. Petersen

scsi: ufs: Remove unnecessary return in void vops wrappers

2026-06-02T01:59:51+00:00

ufshcd_vops_exit(), ufshcd_vops_setup_task_mgmt(), and
ufshcd_vops_hibern8_notify() use 'return hba->vops->xxx()' while other
void vops wrappers call without return.  Remove the unnecessary return
keywords for consistency.

Signed-off-by: Chanwoo Lee 
Reviewed-by: Peter Wang 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260529061503.301182-1-cw9316.lee@samsung.com
Signed-off-by: Martin K. Petersen

scsi: ufs: Fix wrong value printed in unexpected UPIU response case

2026-06-02T01:59:00+00:00

In ufshcd_transfer_rsp_status(), the default case of the inner switch
statement prints the UPIU response code when an unexpected response is
received. However, the code was printing 'result' variable which is
always 0 at that point, making the error message useless for debugging.

Fix this by printing the actual UPIU response code returned by
ufshcd_get_req_rsp().

Fixes: 08108d31129a ("scsi: ufs: Improve type safety")
Signed-off-by: Chanwoo Lee 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260527092134.275887-1-cw9316.lee@samsung.com
Signed-off-by: Martin K. Petersen