summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-06scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap lockingNilesh Javali
qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Adjust feature gating in BSG paths for 29xx supportManish Rangankar
Extend qla2xxx BSG command handling to recognize QLA29xx adapters and align feature availability with hardware capabilities. Allow QLA29xx in paths previously restricted to QLA27xx/28xx: - Flash update capability queries (get/set) - BBCR data retrieval - D-port diagnostics - MPI and PEP version sysfs attributes Restrict unsupported operations on QLA29xx: - Reject flash image status query (no active image tracking) - Block qla28xx_validate_flash_image() Guard the qla27xx_get_active_image() call with an explicit IS_QLA27XX || IS_QLA28XX check so it is not reached from adapters that lack the legacy active-image layout. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-40-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add LS4 pass-through IOCB handling for 29xx seriesManish Rangankar
Extend the LS4 pass-through IOCB handling to support the 128-byte pt_ls4_request_ext layout used by 29xx series adapters. The extension grows inline DSD capacity from 2 to 5 entries. Function signatures are widened to void * so both layouts can be passed without casts. pt_ls4_request_ext overlays pt_ls4_request through exchange_address (offsets 0-27 are byte-identical), so common-header writes go through a single struct pt_ls4_request * view; only the divergent fields (vp_index width, tx_/rx_byte_count offset, dsd[] base) are branched. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-39-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add size check for extended VP report ID entryNilesh Javali
Add reserved_end[64] padding to bring the struct to 128 bytes, matching the hardware IOCB stride. Change qla24xx_report_id_acquisition() to accept a void pointer and extract vp_idx and vp_status from the extended structure on 29xx series adapters, maintaining data integrity for the larger IOCB format. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-38-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add build-time size check for VP config IOCB layoutNilesh Javali
Add a BUILD_BUG_ON for struct vp_config_entry_24xx_ext to verify its 128-byte size at compile time alongside the existing 64-byte check for struct vp_config_entry_24xx. Document in qla24xx_modify_vp_config() that the ext variant overlays the base 24xx layout for the first 64 bytes (all fields this helper reads and writes), so the IOCB can be built through a single struct vp_config_entry_24xx pointer regardless of the adapter's IOCB stride. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-37-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Update VP control IOCB handling for 29xx seriesNilesh Javali
Update VP control IOCB command and response handling to support the 29xx series adapters, which use the 128-byte vp_ctrl_entry_24xx_ext layout. Change the qla25xx_ctrlvp_iocb() and qla_ctrlvp_completed() function signatures from typed struct pointers to void *, since callers already pass a generic ring-slot pointer. Both the standard 64-byte vp_ctrl_entry_24xx and the 128-byte vp_ctrl_entry_24xx_ext are layout-identical for every field touched in these helpers (entry_type, handle, entry_count, command, vp_count, vp_idx_map, entry_status, comp_status, vp_idx_failed), so a single struct vp_ctrl_entry_24xx * view handles both adapter families without an IS_QLA29XX() branch. Add a BUILD_BUG_ON size check for the extended structure. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-36-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enhance ABTS processing for 29xx seriesNilesh Javali
Use extended ABTS entry structures (abts_entry_24xx_ext) for 29xx series adapters to properly handle the larger 128-byte IOCB format. Introduce type-generic macros (QLA_LOG_ABTS_RCV, QLA_BUILD_ABTS_BA_ACC, QLA_LOG_ISSUE_ABTS_RSP) that leverage the shared field names between abts_entry_24xx and abts_entry_24xx_ext to avoid code duplication. Branch on IS_QLA29XX() for receive logging, exchange termination, and BA_ACC response construction, with each path passing the correctly typed pointer to the shared macros. The sof_type handling difference (direct for 29xx bitfield vs & 0xf0 mask for legacy) is parameterized through the sof_val macro argument. Add BUILD_BUG_ON size check for struct abts_entry_24xx_ext. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-35-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add abort command handling for 29xx seriesNilesh Javali
Extend the abort-IOCB code path to support the 29xx extended abort_entry_24xx_ext structure alongside the existing abort_entry_24xx. The two layouts overlay byte-for-byte through req_que_no (offsets 0-17): entry_status (offset 3), the nport_handle/comp_status union (offset 8), and options (offset 10) sit at identical positions in both. After that they diverge: the 24xx variant carries reserved_1[30], port_id[3], and a u8 vp_index at offsets 48-51, while the ext variant places a __le16 vp_index at offset 18 and drops port_id. The drv / fw unions live at offset 56 in the 24xx layout but offset 24 in ext. Leverage this overlap by using a single struct abort_entry_24xx * view for the common header writes (entry_type, count, handle, nport_handle, handle_to_abort, req_que_no) and completion-status reads (entry_status, comp_status), branching on IS_QLA29XX() only where the layouts genuinely diverge: - port_id (24xx-only) and vp_index width on the issue path (qla24xx_abort_iocb in qla_iocb.c, qla24xx_abort_command in qla_mbx.c); - drv / fw union access in qla_nvme_abort_set_option / qla_nvme_abort_process_comp_status (qla_nvme.c); - completion comp_status read in qla24xx_abort_iocb_entry (qla_isr.c) is stride-agnostic -- no IS_QLA29XX dispatch needed. Function signatures in qla_nvme_abort_set_option(), qla_nvme_abort_process_comp_status(), qla24xx_abort_iocb(), and qla24xx_abort_iocb_entry() are widened to accept void * so both struct variants can be passed through. memset() uses qla_req_entry_size(ha) to match the ring-slot size. Response status checking now reads comp_status instead of nport_handle. A BUILD_BUG_ON verifies abort_entry_24xx_ext is 128 bytes. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-34-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enhance task management IOCB handling for 29xx seriesNilesh Javali
Update qla24xx_tm_iocb() and __qla24xx_issue_tmf() to support the extended task management structure (tsk_mgmt_entry_ext) for 29xx adapters. tsk_mgmt_entry_ext overlays tsk_mgmt_entry through control_flags (offsets 0-27 are byte-identical): entry_type, entry_count, handle, nport_handle, timeout, lun and control_flags sit at the same offsets and widths. The layouts diverge only after that point: - the 24xx layout has port_id[3] + u8 vp_index; - the ext layout has __le16 vp_index and no port_id. Factor the common IOCB header writes through a single tsk_mgmt_entry * view and branch on IS_QLA29XX() only for the diverging port_id / vp_index assignments. Change qla24xx_tm_iocb() to accept void *pkt to allow casting to either structure type. Add tsk_ext member to the tsk_mgmt_cmd union and a BUILD_BUG_ON size check for the 128-byte extended structure. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-33-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add 29xx extended logio IOCB supportNilesh Javali
The 29xx series uses a wider IOCB stride (128 bytes vs 64 bytes). The logio_entry_24xx_ext layout extends logio_entry_24xx with a wider vp_index field (__le16 vs u8) while keeping all other read-side fields (comp_status, io_parameter[0..10], entry_status) at identical offsets and widths. Update the logio IOCB builder functions (qla24xx_login_iocb, qla24xx_logout_iocb, qla24xx_prli_iocb, qla24xx_prlo_iocb, qla24xx_adisc_iocb) to accept a void pointer and dispatch the vp_index write through IS_QLA29XX(), using an inline cast to the extended layout at the single write site. In the completion handler qla24xx_logio_entry(), accept a void pointer and read through a single logio_entry_24xx view since all accessed fields sit at the same offsets in both layouts. Use the qla_req_entry_size() helper for the dump buffer size. In qla24xx_login_fabric() and qla24xx_fabric_logout(), allocate through a void pointer from the DMA pool and dispatch vp_index via the same inline-cast pattern. Add a BUILD_BUG_ON for logio_entry_24xx_ext to enforce the 128-byte size invariant at compile time. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-32-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add size check for ELS status entry layout on 29xxNilesh Javali
Add a BUILD_BUG_ON in qla2x00_module_init() to validate that struct els_sts_entry_24xx_ext is 128 bytes, matching the 29xx firmware IOCB size. The extended layout (29xx) overlays the base els_sts_entry_24xx for every field read in qla24xx_els_ct_entry(): comp_status, total_byte_count, error_subcode_1/2, d_id[], s_id[], and control_flags all sit at byte-identical offsets in both structs. Only vp_index/sof_type at offset 14-15 differs (bit-packed differently in the ext variant), but that field is write-only on the issue path and never read in this completion handler. Add a docblock at the top of qla24xx_els_ct_entry() documenting this layout property. Improve a few log messages for clarity. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-31-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Update handling of ELS IOCBs for 29xx seriesNilesh Javali
Update ELS IOCB handling to support the extended 128-byte els_entry_24xx_ext structure used by 29xx series adapters. Change the signatures of qla24xx_els_logo_iocb(), qla_els_pt_iocb(), and qla24xx_els_iocb() to accept a generic void pointer, enabling differentiation between standard and extended ELS structures at runtime. Introduce a static inline helper qla_els_set_vp_sof() in qla_inline.h that centralises the 24xx-vs-29xx vp_index/sof_type encoding: the 24xx layout uses separate u8 vp_index + u8 sof_type (EST_SOFI3), while 29xx uses a __le16 with bitfields (vp_index:9 / sof_type:4 / ELS_EXT_EST_SOFI3). All ELS issue paths now call this helper instead of open-coding the branch, including the RDP response path in qla_os.c. In qla2x00_start_sp(), collapse the IS_QLA29XX() branch for the handle assignment in SRB_ELS_CMD_HST_NOLOGIN: els_entry_24xx::handle and els_entry_24xx_ext::handle are both u32 at offset 4, so a single 24xx-view write is layout-compatible with both strides. DMA allocations in qla24xx_process_abts() and qla24xx_process_purex_rdp() are updated to use the correct size for the adapter type. A BUILD_BUG_ON is added to verify the extended structure size. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-30-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enhance purex_entry handling for 29xx seriesNilesh Javali
Update function signatures and internal logic across qla_edif.c, qla_isr.c, and qla_os.c to accept a generic pointer for packet data and differentiate between standard purex_entry_24xx and the extended purex_entry_24xx_ext structures based on IS_QLA29XX(). This ensures proper initialization and processing of command and response data for both 64-byte and 128-byte PUREX IOCBs across all ELS paths including auth_els, RDP, copy_std_pkt, copy_multiple_pkt, consume_iocb, and copy_purex_to_buffer. Where the two layouts overlap at byte-identical offsets (entry_count, frame_size, nport_handle, rx_xchg_addr, ox_id, status_flags, trunc_frame_size, s_id, d_id, els_frame_payload base, and response_t::signature), use a single struct purex_entry_24xx * view to avoid duplicating read paths. Branch only where field encoding differs: vp_idx (u8 at offset 6 in 24xx vs __le16 at offsets 6-7 in 29xx) and els_frame_payload[] array length (20 vs 84 bytes, handled via a sizeof_field()-based payload_size local). Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-29-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enhance ct_entry_24xx_ext iocb handling for 29xx seriesNilesh Javali
Refine the handling of I/O control blocks (IOCBs) for the 29xx series by introducing support for the extended structure ct_entry_24xx_ext. Update function signatures to accept a generic pointer for IOCB packets, differentiating between standard and extended structures, and ensuring proper initialization and processing of command and response data. Additionally, the size check for the extended structure is added to maintain integrity. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-28-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Update handling of status entries for 29xx seriesNilesh Javali
Modify the handling of status entries in the qla2xxx driver to accommodate the extended structure for the 29xx series. Changes include updating function signatures to accept a generic pointer for status packets, and adjusting the logic to differentiate between the standard and extended status entries. This ensures proper processing of completion statuses and error handling for the new hardware capabilities. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-27-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Handle sts_cont_entry_ext_t for 29xx adaptersNilesh Javali
29xx adapters use 128-byte response queue entries (sts_cont_entry_ext_t) instead of 64-byte (sts_cont_entry_t). Update all status continuation IOCB processing paths to branch on IS_QLA29XX() and use the correct entry type and data payload size. The affected functions are __qla_copy_purex_to_buffer(), qla27xx_copy_multiple_pkt(), qla2x00_status_cont_entry(), and their call sites in qla2x00_process_response_entry() and qla24xx_process_response_queue(). Change qla2x00_status_cont_entry() to accept void * so callers no longer need an explicit cast and the function can internally select the right structure based on the adapter type. Add BUILD_BUG_ON for sts_cont_entry_ext_t size (128 bytes). Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607142020.gqDaApes-lkp@intel.com/ Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-26-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add support for QLA29XX in memory allocationNilesh Javali
Enhance the qla2x00_mem_alloc function to include checks for QLA29XX adapters. This modification updates the conditions for memory allocation and cleanup, ensuring proper handling of the new adapter series alongside existing QLA27XX and QLA28XX checks. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-25-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbsNilesh Javali
__qla2x00_alloc_iocbs() open-codes ring pointer selection and entry size based on IS_QLA29XX(ha): 29xx reaches the slot via ring_ext_ptr and zeroes REQUEST_ENTRY_SIZE_EXT bytes, while other adapters use ring_ptr with REQUEST_ENTRY_SIZE bytes. Replace the two branches with the qla_req_ring_slot() and qla_req_entry_size() helpers, and initialise pkt at declaration. The IS_QLAFX00 register-mapped writes remain guarded because IS_QLAFX00 and IS_QLA29XX cannot be true simultaneously. No functional change: the bytes written to the firmware-visible IOCB are identical. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-24-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable qla2x00_shutdown for 29xxNilesh Javali
Enable qla2x00_shutdown for 29xx adapter by adding IS_QLA29XX check to the shutdown path that performs firmware abort cleanup. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-23-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add support for QLA29XX in data rate functionsNilesh Javali
Enhance the qla2x00_set_data_rate and qla2x00_get_data_rate functions to include checks for the QLA29XX series adapters. This modification ensures that the mailbox commands are correctly configured for the 29xx series, improving functionality and compatibility. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-22-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable set_els_cmds and echo_test for 29xxNilesh Javali
Add IS_QLA29XX() checks to qla25xx_set_els_cmds_supported() and qla2x00_echo_test() so that ELS command support and echo test diagnostics are available on 29xx series adapters. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-21-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable serdes, resource count and FCE trace for 29xxNilesh Javali
The 29xx adapters share the diagnostic and management interfaces already supported on ISP27xx/28xx, but several family capability gates still omitted IS_QLA29XX(), leaving these paths unreachable on 29xx. Add IS_QLA29XX() to the relevant checks so the following work on 29xx adapters: - Read/write SerDes word mailbox commands for PHY register access. - get_resource_cnts requests MBX_12 to report the extended firmware resource counts. - FCE trace: the enable-FCE mailbox command, the "fce" and "fw_resource_count" debugfs nodes in qla2x00_dfs_setup(), the debugfs enable write in qla2x00_dfs_fce_write(), and the FCE DMA buffer allocation in qla2x00_alloc_fce_trace(). Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-20-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable get_firmware_state for 29xxNilesh Javali
Enable get_firmware_state mailbox command for 29xx adapters by adding IS_QLA29XX() checks alongside existing IS_QLA27XX/IS_QLA28XX checks. This ensures MBX_12 (MPI state) is properly set up and reported for 29xx adapters. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-19-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable init_firmware mailbox for 29xxNilesh Javali
The init_firmware mailbox command needs 29xx adapter support for reading back SFP information via mb3 and for validating SFP status on successful firmware initialization. Add IS_QLA29XX() checks alongside the existing 27xx/28xx checks. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-18-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable get_adapter_id mailbox for 29xxNilesh Javali
Add IS_QLA29XX() alongside the existing 27xx/28xx checks in qla2x00_get_adapter_id() so that the additional mailbox registers (buffer-to-buffer credit, SCM/EDC status) are read on 29xx adapters. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-17-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Extend execute_fw mailbox to include 29xxNilesh Javali
Add IS_QLA29XX() to the BPM capability macros and to the execute-firmware mailbox command so that NVMe enable, minimum speed negotiation, 128 Gbps speed reporting, EDIF hardware detection, and FW-semaphore retry logic all apply to 29xx adapters. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-16-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Enable get_fw_version mailbox for 29xxNilesh Javali
The serdes_version and several firmware capability fields were not populated for 29xx because the get_fw_version mailbox path excluded it from the 27xx/28xx checks. Add IS_QLA29XX() to the relevant conditionals so that firmware version, EDIF, and serdes information are correctly retrieved on 29xx adapters. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-15-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Skip unsupported sysfs attributes for 29xxNilesh Javali
Not all sysfs attributes are applicable to the 29xx adapter. Return -EPERM for attributes that are meaningless on 29xx (gold firmware version, 84xx firmware version, flash block size, VLAN ID, VN-port MAC address, and CNA firmware dump toggle) so that userspace tools do not see stale or undefined values. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-14-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Skip image-set-valid attribute for 29xxNilesh Javali
The 29xx adapter does not support the QLA_IMG_SET_VALID_SUPPORT driver attribute. Gate the attribute behind an IS_QLA29XX() check so that userspace applications querying driver capabilities via BSG receive accurate information. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-13-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Update IO path to use 128-byte IOCBs for 29xxAnil Gurumurthy
Wire the 128-byte extended IOCB structures into the IO submission, completion, and queue-management paths. On 29xx adapters the driver now builds cmd_type_6_ext / cmd_type_7_ext command IOCBs and processes the corresponding extended status entries, while falling back to the existing 64-byte IOCBs for earlier adapters. Ring entry-size selection uses the qla_req_entry_size() / qla_rsp_entry_size() helpers and ring slot advancement uses qla_req_ring_advance() rather than open-coding IS_QLA29XX() branches at every call site. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607141827.R9mpeMZx-lkp@intel.com/ Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://lore.kernel.org/oe-kbuild-all/202607141827.R9mpeMZx-lkp@intel.com/ Link: https://patch.msgid.link/20260723050413.3897522-12-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add extended status continuation and marker IOCBsAnil Gurumurthy
Add the 128-byte sts_cont_entry_ext_t and mrk_entry_ext_t structures required by 29xx firmware. Include the qla_fw29.h header from qla_def.h so the new types are available throughout the driver. Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-11-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add 128-byte IOCB definitions for 29xxAnil Gurumurthy
The 29xx series uses 128-byte IOCBs instead of the 64-byte IOCBs used by earlier adapters. Add a new header (qla_fw29.h) with the extended IOCB structure definitions that match the 29xx firmware interface. Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-10-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add BSG MPI firmware load/dump for 29xxManish Rangankar
Add BSG vendor commands for loading and dumping MPI firmware on 29xx adapters. This extends the existing BSG infrastructure with the necessary mailbox wrappers and flash helpers for MPI operations. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-9-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add flash block read/write BSG support for 29xxManish Rangankar
Introduce QL_VND_READ_FLASH_BLOCK and QL_VND_WRITE_FLASH_BLOCK BSG vendor commands so that userspace tools can perform flash block-level operations on 29xx adapters via the isp_ops interface. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-8-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Remove redundant VPD flash read in sysfs read pathManish Rangankar
qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call. Fixes: 5fa8774c7f38 ("scsi: qla2xxx: Add 28xx flash primary/secondary status/image mechanism") Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-7-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add FC operational firmware load for 29xxManish Rangankar
Add support to load the 29xx FC operational firmware from the filesystem and to set up the corresponding firmware dump template. This follows the same request_firmware / segment-load pattern used by earlier adapters. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-6-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add 29xx support in queue initialisation pathManish Rangankar
Extend the queue initialisation and multi-queue management mailbox commands to include IS_QLA29XX() checks, following the same mailbox interface as 27xx/28xx. Unlike earlier adapters that use 64-byte request/response ring entries (request_t / response_t), 29xx uses 128-byte entries. Add struct request_ext and struct response_ext, which extend the legacy 64-byte layout with a 64-byte reserved area. The first 64 bytes are layout-compatible with the legacy structures, so common header accesses remain valid. The enlarged entry stride doubles the DMA ring memory allocated for both request and response queues on 29xx, and all ring pointer arithmetic must account for the wider entries (handled by later patches in this series). Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-5-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add NVRAM config support for 29xx adaptersManish Rangankar
Extend the NVRAM read and configuration-apply paths to handle the 29xx series. The 29xx NVRAM layout is similar to the 81xx family, so reuse the existing nvram_81xx parsing while adding 29xx-specific fields and init-sequence integration. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607141733.w1IF5m43-lkp@intel.com/ Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-4-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add flash read/write interface for 29xxManish Rangankar
The 29xx series uses a different flash access mechanism than earlier adapters. Add the mailbox wrappers and qla_sup helpers needed for flash read and write operations, including the necessary hooks in isp_ops so that the existing flash infrastructure can drive the new hardware. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607141520.k9T31Dpp-lkp@intel.com/ Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://lore.kernel.org/oe-kbuild-all/202607141520.k9T31Dpp-lkp@intel.com/ Link: https://patch.msgid.link/20260723050413.3897522-3-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06scsi: qla2xxx: Add 29xx series PCI device ID supportManish Rangankar
The QLA29xx is a new generation FC HBA that shares much of its architecture with the 27xx/28xx family. Register the new PCI device IDs, wire up IS_QLA29XX() capability checks in the probe and ISP-flags paths, and extend speed-capability logic so the driver correctly recognises and initialises 29xx adapters. Signed-off-by: Manish Rangankar <mrangankar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-2-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06Merge tag 'for-7.2-rc6-fixup-worker-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba: "This brings back the fixup worker infrastructure. It's a mechanism to detect pages/folios that are marked dirty without filesystem knowledge and require COW fixup. The consequence of not doing so is silent data loss. The first patch covers the scenarios in detail, also reflecting folio API port and subpage block size support added in recent years. The original fixup worker was only for pages. The patch is relatively big, half of the code is debugging and support code, the rest is the core design around the detection and fix. The second patch handles an unlikely case when there's work left during unmount" * tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: flush the fixup workers during close_ctree btrfs: trigger cow fixup via dirty_folio()
2026-08-06scsi: alua: Use access state macrosJohn Garry
Use the SCSI access state macros in alua_rtpg(), which is better than hardcoding. Signed-off-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260805145906.2825553-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06Merge patch series "scsi: ufs: Fix descriptor parsing and invalid input ↵Martin K. Petersen (Oracle)
handling" Li Qiang <liqiang01@kylinos.cn> says: The first patch validates string descriptor payload sizes and avoids raw descriptor overreads. The remaining patches protect invalid completion diagnostics, validate connected lane counts, validate RPMB frame sizes, use unaligned RPMB frame accesses, and retain a NUL terminator for debugfs input. Link: https://patch.msgid.link/20260717153914.26321-1-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-06Merge tag 'for-7.2-rc6-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix leak in encoded ioctl write - disable large folios on systems with highmem - disable block size > page size when there's no transparent hugepage support (under experimental config) - reject compressed inline extents without valid LZO headers - properly initialize cached inode mapping (if block size > page size) * tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: initialize inode mapping flags for cached inodes btrfs: disable bs > ps support if no transparent hugepage support btrfs: fix memory leak in btrfs_do_encoded_write() btrfs: lzo: reject inline extents without valid headers btrfs: disable large folios for systems with highmem
2026-08-06Merge tag 'wireless-next-2026-08-06' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06af_unix: Unlink scc_entry in unix_del_edge().Kuniyuki Iwashima
Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge(). Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm.") Reported-by: Kyle Zeng <kylebot@openai.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Kyle Zeng <kylebot@openai.com> Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm."). Link: https://patch.msgid.link/20260804002155.2233594-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge tag 'net-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Looks like our attempt to keep the PRs smaller have only prevented this one from getting even bigger. In the last 9 days there were 405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH net-next]. 37% of posted patches being fixes is pretty crazy, and that's likely undercounting because LLM "researchers" more often post fixes without knowing to tag the patches for specific trees. I don't have historic data. In any case, we keep adjusting the criteria. The next PR will be smaller. Current release - regressions: - net: defer netdev KOBJ_ADD uevent until the device is published, previously rtnl_lock would serialize the accesses vs publishing - net: explicitly cancel work to avoid races with ref tracker exit - qrtr: ns: raise lookup limit to 128 - eth: hns3: fix speed configuration residue after driver reload Previous releases - regressions: - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed flows with MSS and scaling_ratio variability - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit", broke some platforms (no packets coming thru) - eth: stmmac: resume PHY before hardware setup when opening the interface Previous releases - always broken: - another pile of fixes for less common protocols (SCTP, TLS, SMC etc.) - close a couple of AF_PACKET bugs and ways it can build skbs problematic for the rest of the stack - bridge: mrp: fix uninitialised bytes on the wire - net: devmem: prevent net-iov / page mixing, avoid crashes - eth: atlantic: free RX pages of consumed but not refilled buffers" * tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits) igc: fix netdev not re-attached after resume if interface is down tls: don't abort the connection on signal-interrupted sends net: avoid theoretical races with ref drain net: Defer netdev KOBJ_ADD uevent until the device is published MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li sctp: clear control chunk transport if it is being removed net/atm: fix slab-out-of-bounds read in vcc_setsockopt() s390/ism: Fix UAF of sba and ieq during ism_dev_exit() packet: use consistent hard_header_len in TX_RING send path packet: use consistent hard_header_len in non-ring send paths net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header bnge: Fix resource leak in bnge_init_nic() error path ptp: ocp: Fix board ID over-read tls: rx: restore msg_iter before TLS 1.3 optimistic retry selftests: tls: add a test for splicing onto a full plaintext record tls: don't leave a full plaintext sk_msg ring unpushed xdp: reject clones that overrun skb_shared_info tailroom mptcp: reclaim forward-allocated memory on RX path errors mptcp: fastopen: only mark MPTFO subflows with SYN data mptcp: pm: fix memory leak from alloc-during-teardown race ...
2026-08-06drm/amd/display: allow self-refresh exit while entry is blockedDavid Weber
amdgpu_dm_crtc_set_static_screen_optimze() maps sso_enable to the Replay and PSR1 vsync events. allow_sr_entry is an entry gate, but the helper currently applies it to both directions. A non-fast update clears allow_sr_entry. During a modeset, a separate hardware-programming event keeps self-refresh blocked while the stream is reprogrammed. If vblank is enabled before the entry delay expires, the ISM calls the helper with sso_enable false. The early return drops the disable request, so the vsync events are not set. After enough fast commits, allow_sr_entry becomes true and the hardware-programming event can be cleared. Since the vblank reference remains held, there is no further zero-to-one vblank transition to restore the missing vsync events. Replay or PSR1 can then become active while vblank is still enabled. Gate only requests that enable static-screen optimization. Always process disable requests so a vblank requestor keeps Replay and PSR1 blocked. On a Phoenix system, repeated SDDM-to-VT handoffs produced stuck flips followed by flip_done and commit-wait timeouts. The timeout was not observed with this change applied. Fixes: 3c108046e1d6 ("drm/amd/display: Add power module on Linux") Assisted-by: Codex:gpt-5.6-sol Assisted-by: Claude:opus-5 Signed-off-by: David Weber <weber.aulendorf@gmail.com> Reviewed-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit bd0c00982166d34ed47b11ba29cd8bf2950cc2e2) Cc: stable@vger.kernel.org
2026-08-06drm/amdgpu: fix aperture iounmap skipped on device removalAsad Kamal
amdgpu_pci_remove() calls drm_dev_unplug() before invoking the fini routines. After drm_dev_unplug() the drm_dev_enter() guard in amdgpu_ttm_fini() always returns false, so iounmap() for aper_base_kaddr is silently skipped. On connected_to_cpu hardware ioremap_cache() maps the aperture as WB; when iounmap() is skipped the stale WB PAT entry persists. On reload IP discovery's memremap(MEMREMAP_WC) on the same aperture range hits a WB/WC conflict, producing an ioremap error and failing re-probe. Remove the drm_dev_enter() guard and call iounmap() unconditionally. The aperture mapping is plain MMIO and does not require device-presence protection. Surprise-removal cleanup of aper_base_kaddr is already handled unconditionally by amdgpu_device_unmap_mmio(). Fixes: 62d5f9f7110a ("drm/amdgpu: Unmap MMIO mappings when device is not unplugged") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit fb3f68af9f6fce9343a2bd13b4d68a1c02d283df) Cc: stable@vger.kernel.org