user/sven/linux.git/drivers/scsi/pm8001, branch master

Merge branch '7.0/scsi-queue' into 7.0/scsi-fixes

2026-02-23T18:39:58Z

Pull in remaining fixes from 7.0/scsi-queue. Signed-off-by: Martin K. Petersen

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51Z

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28Z

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

scsi: pm8001: Fix use-after-free in pm8001_queue_command()

2026-02-18T02:35:43Z

Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled. Fixes: e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") Signed-off-by: Salomon Dushimirimana Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260213192806.439432-1-salomondush@google.com Signed-off-by: Martin K. Petersen

scsi: pm80xx: Add WQ_PERCPU to alloc_workqueue() users

2025-11-13T02:28:27Z

Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This adds a new WQ_PERCPU flag to explicitly request to alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107155257.316728-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen

scsi: pm80xx: Avoid -Wflex-array-member-not-at-end warnings

2025-09-10T02:40:32Z

Comment out unused field 'residual_count' in a couple of structures, and with this, fix the following -Wflex-array-member-not-at-end warnings: drivers/scsi/pm8001/pm8001_hwi.h:342:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/pm8001/pm80xx_hwi.h:561:32: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Jack Wang Reviewed-by: John Garry Signed-off-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen

scsi: pm8001: Use int instead of u32 to store error codes

2025-08-31T01:37:53Z

Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req(). Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com Signed-off-by: Martin K. Petersen

scsi: pm80xx: Fix race condition caused by static variables

2025-08-26T02:20:07Z

Eliminate the use of static variables within the log pull implementation to resolve a race condition and prevent data gaps when pulling logs from multiple controllers in parallel, ensuring each operation is properly isolated. Signed-off-by: Francisco Gutierrez Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com Signed-off-by: Martin K. Petersen

scsi: pm80xx: Use pm80xx_get_local_phy_id() to access phy array

2025-08-19T02:08:31Z

While the current code is perfectly fine (because we verify that the device is directly attached before using attached_phy to index the pm8001_ha->phy array), let's use the pm80xx_get_local_phy_id() helper anyway, to reduce the chance that someone will copy paste this pattern to other parts of the driver. Note that in this specific case, we still need to keep the check that the device is not behind an expander, because we do not want to clear attached_phy of the expander if a device behind the expander disappears (as that would disable all the other devices behind the expander). However, if it is the expander itself that disappears, attached_phy will be cleared, just like it would for any other directly attached device. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-22-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: Igor Pylypiv Acked-by: Jack Wang Signed-off-by: Martin K. Petersen

scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander

2025-08-19T02:08:31Z

For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, you cannot use attached_phy to index the pm8001_ha->phy array, without first verifying that the device is directly attached. Use the pm80xx_get_local_phy_id() helper to make sure that we use the local phy id to index the array, regardless if the device is directly attached or not. Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.") Reviewed-by: Igor Pylypiv Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen