linux-toradex.git/drivers/target, branch master

Merge branch '7.3/scsi-fixes' into 7.4/scsi-staging

2026-10-24T01:23:33+00:00

Pull in scsi-fixes to resolve a merge conflict in libiscsi.c.

Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: iscsi: Use crypto library API

2026-10-15T02:03:45+00:00

Make iscsi_target_auth.c call into the crypto library directly instead
of going through crypto_shash.  This is simpler and much more efficient,
as it avoids overhead of the crypto_shash layer.  The hash computation
itself also no longer has error codes that need to be checked.

For simplicity, still do a memory allocation per operation to buffer the
data (which is typically less than 50 bytes here) so that the one-shot
digest functions can be used.  It's still much more efficient than doing
the super slow crypto_alloc_shash().

Signed-off-by: Eric Biggers 
Reviewed-by: David Disseldorp 
Link: https://patch.msgid.link/20261001044857.169487-1-ebiggers@kernel.org
Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: iscsi: Fix race in discovery auth updates

2026-10-14T03:08:43+00:00

Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.

Protect the lookup and replacement with the discovery TPG access lock,
as used by the other TPG configfs parameter updates.

Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Linfeng Sun 
Reviewed-by: Mike Christie 
Link: https://patch.msgid.link/20260811124843.6817-1-linfeng.sun.dev@gmail.com
Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: Disable interrupts while holding delayed_cmd_lock

2026-10-14T03:06:11+00:00

target_do_delayed_work() takes dev->delayed_cmd_lock with a plain
spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled
while the lock is held. Every other acquisition of that lock uses
spin_lock_irqsave(): target_handle_task_attr() and
transport_complete_ordered_sync() in target_core_transport.c, and
target_non_ordered_release() in target_core_device.c.

That was safe while every caller of transport_complete_task_attr() ran
in process context: target_complete_ok_work() from target_completion_wq,
transport_complete_qf() from dev->qf_work_queue, and
transport_generic_request_failure() from the submit and execute paths.

Since commit 06933066d88a ("scsi: target: Add support for completing
commands from backend context") that is no longer true. With
complete_type=1 on a fabric that sets direct_compl_supp,
target_complete() runs target_complete_ok_work() inline in the backend's
completion context, which target_complete_cmd_with_sense() documents as
"May be called from interrupt context". For iblock that is the bio
end_io.

target_complete_ok_work() starts with transport_complete_task_attr(),
which takes delayed_cmd_lock in two ways:

 - Every ORDERED command is put on dev->delayed_cmd_list by
   target_handle_task_attr() and dispatched from there by
   target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC.  Its
   completion therefore goes through transport_complete_ordered_sync().

 - A SIMPLE command that completes while an ORDERED command is pending
   drops the last reference to the killed dev->non_ordered, and
   percpu_ref_put() then runs target_non_ordered_release() in the
   completing context.

Both take the lock and, if commands are waiting, call
schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq,
i.e. on the CPU that took the completion. Further completions for the
same queue are typically delivered there too, so one arriving while the
work holds the lock spins on it forever.

Reaching this needs complete_type=1, which is not the default
(vhost-scsi, the only fabric with direct_compl_supp, defaults to
TARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt
context, and ORDERED commands from the initiator. Linux virtio_scsi
guests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;
any guest that uses the ORDERED task attribute, which vhost-scsi
accepts, does.

target_do_delayed_work() is a work item and always runs in process
context, so spin_lock_irq() is sufficient.

Found by inspection; no runtime report. A single ORDERED command goes
through both acquisitions, so with CONFIG_PROVE_LOCKING the first one
completed through direct completion should produce an inconsistent lock
state report on delayed_cmd_lock (hardirq or softirq, depending on where
the backend completes).

Fixes: 06933066d88a ("scsi: target: Add support for completing commands from backend context")
Signed-off-by: Yu Zhang 
Reviewed-by: Mike Christie 
Link: https://patch.msgid.link/20260927091329.13482-1-yuz08559@gmail.com
Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: core: Use assign_bit() where applicable

2026-09-23T02:29:47+00:00

Convert open-coded if/else with set_bit/clear_bit to the assign_bit API.

Signed-off-by: Peng Fan 
Reviewed-by: Bodo Stroesser 
Link: https://patch.msgid.link/20260919130853.3041614-1-peng.fan@oss.nxp.com
Signed-off-by: Martin K. Petersen (Oracle)

Merge tag 'v7.3-rc2' into 7.4/scsi-staging

2026-09-23T01:44:04+00:00

Merge Linux 7.3-rc2 to resolve libata and mpi3mr merge conflicts.

Signed-off-by: Martin K. Petersen (Oracle) 

Conflicts:
	drivers/ata/libata-scsi.c
	drivers/scsi/mpi3mr/mpi3mr_transport.c

Merge patch series "Use defined 16-bits ASC/ASCQ combinations"

2026-09-16T14:55:27+00:00

Damien Le Moal  says:

This patch series defines as macros all ASC/ASCQ combinations present in
https://www.t10.org/lists/asc-num.txt and converts the SCSI core code and
SCSI low level drivers to use these macros instead of hard-coded
ASC/ASCQs. To do this, struct scsi_sense_hdr and struct scsi_failure are
modified to replace the asc and ascq 8-bits fields with a 16-bits
sense_code field.

This cleans up the code in many places and makes it easier, and self
documented, to test sense codes in the case of errors.

Overall, there should be no functional chnages here.

Note: this series currently applies cleanly only to the scsi-staging tree.
It does not apply to Linus tree as commit 6d81700ad7c4 ("ata: libata-scsi:
do not raise UA for storage element depopulation and restoration") creates
a conflict with patch 37. The conflict is trivial to resolve, but this
will create a conflict in linux-next. Could you maybe rebase scsi-staging
on rc2 ?

Also please note that sashiko did comment about several pre-existing
issues for different drivers, but I am not addressing these issues in
this series.

[mkp: fixed ufs conflict]

Link: https://patch.msgid.link/20260908090308.1085097-1-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: Use combined sense codes

2026-09-16T14:42:48+00:00

Refactor the target core code to use the 16-bit sense codes for building
sense and replace all hard-coded additional sense codes and additional
sense code qualifiers with the enum values defined in
include/scsi/scsi_sense.h. This helps with code clarity as the sense codes
being processed are easier to test and self-documented.

No functional change intended.

Signed-off-by: Damien Le Moal 
Reviewed-by: Johannes Thumshirn 
Reviewed-by: Hannes Reinecke 
Link: https://patch.msgid.link/20260908090308.1085097-35-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle)

scsi: core: Drop Scsi_Host.default_lock

2026-09-02T02:46:18+00:00

Back in the 2.6.xx days, it was possible to for low-level drivers to set
the shost lock pointer. That is why there is a default lock and a
pointer to the shost lock.

However, support for this has long been removed, so drop
Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock.

Getting the address of embedded host_lock structure just requires adding
a fixed offset value to the shost pointer. However, getting the value of
the host_lock pointer requires loading from a fixed offset to the shost
pointer. The latter should be very slightly slower, which is relevant as
this lock is used a lot throughout the core code and drivers.

Signed-off-by: John Garry 
Acked-by: Damien Le Moal  # ata parts
Reviewed-by: Hannes Reinecke 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com
Signed-off-by: Martin K. Petersen (Oracle)

scsi: target: file: Use kmalloc() to allocate temporary protection buffer

2026-09-02T02:31:02+00:00

fd_do_prot_unmap() uses __get_free_page() to allocate a temporary buffer
that is used to invalidate protection info for the unmapped region by
filling with 0xff pattern.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Replace use of __get_free_page() with kmalloc().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Reviewed-by: Hannes Reinecke 
Signed-off-by: Mike Rapoport (Microsoft) 
Link: https://patch.msgid.link/20260704-b4-scsi-v2-1-7d2d21a810de@kernel.org
Signed-off-by: Martin K. Petersen (Oracle)