commit f27a95845b01e86d67c8b014b4f41bd3327daa63
Author: Arthur Simchaev <arthur.simchaev@sandisk.com>
Date:   Thu Feb 20 16:20:39 2025 +0200

    scsi: ufs: core: bsg: Fix crash when arpmb command fails
    
    If the device doesn't support arpmb we'll crash due to copying user data in
    bsg_transport_sg_io_fn().
    
    In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not
    set the job's reply_len.
    
    Memory crash backtrace:
    3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22
    
    4,1308,531166555,-;Call Trace:
    
    4,1309,531166559,-; <TASK>
    
    4,1310,531166565,-; ? show_regs+0x6d/0x80
    
    4,1311,531166575,-; ? die+0x37/0xa0
    
    4,1312,531166583,-; ? do_trap+0xd4/0xf0
    
    4,1313,531166593,-; ? do_error_trap+0x71/0xb0
    
    4,1314,531166601,-; ? usercopy_abort+0x6c/0x80
    
    4,1315,531166610,-; ? exc_invalid_op+0x52/0x80
    
    4,1316,531166622,-; ? usercopy_abort+0x6c/0x80
    
    4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20
    
    4,1318,531166643,-; ? usercopy_abort+0x6c/0x80
    
    4,1319,531166652,-; __check_heap_object+0xe3/0x120
    
    4,1320,531166661,-; check_heap_object+0x185/0x1d0
    
    4,1321,531166670,-; __check_object_size.part.0+0x72/0x150
    
    4,1322,531166679,-; __check_object_size+0x23/0x30
    
    4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0
    
    Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg")
    Cc: stable@vger.kernel.org
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Signed-off-by: Arthur Simchaev <arthur.simchaev@sandisk.com>
    Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.com
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit fe06b7c07f3fbcce2a2ca6f7b0d543b5699ea00f
Author: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Date:   Wed Feb 19 16:20:47 2025 +0530

    scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init()
    
    Commit bb9850704c04 ("scsi: ufs: core: Honor runtime/system PM levels if
    set by host controller drivers") introduced the check for setting default
    PM levels only if the levels are uninitialized by the host controller
    drivers. But it missed the fact that the levels could be initialized to 0
    (UFS_PM_LVL_0) on purpose by the controller drivers. Even though none of
    the drivers are doing so now, the logic should be fixed irrespectively.
    
    So set the default levels unconditionally before calling ufshcd_hba_init()
    API which initializes the controller drivers. It ensures that the
    controller drivers could override the default levels if required.
    
    Fixes: bb9850704c04 ("scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers")
    Reported-by: Bao D. Nguyen <quic_nguyenb@quicinc.com>
    Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Link: https://lore.kernel.org/r/20250219105047.49932-1-manivannan.sadhasivam@linaro.org
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit dce5c4afd035e8090a26e5d776b1682c0e649683
Author: Ye Bin <yebin10@huawei.com>
Date:   Mon Feb 17 10:16:28 2025 +0800

    scsi: core: Clear driver private data when retrying request
    
    After commit 1bad6c4a57ef ("scsi: zero per-cmd private driver data for each
    MQ I/O"), the xen-scsifront/virtio_scsi/snic drivers all removed code that
    explicitly zeroed driver-private command data.
    
    In combination with commit 464a00c9e0ad ("scsi: core: Kill DRIVER_SENSE"),
    after virtio_scsi performs a capacity expansion, the first request will
    return a unit attention to indicate that the capacity has changed. And then
    the original command is retried. As driver-private command data was not
    cleared, the request would return UA again and eventually time out and fail.
    
    Zero driver-private command data when a request is retried.
    
    Fixes: f7de50da1479 ("scsi: xen-scsifront: Remove code that zeroes driver-private command data")
    Fixes: c2bb87318baa ("scsi: virtio_scsi: Remove code that zeroes driver-private command data")
    Fixes: c3006a926468 ("scsi: snic: Remove code that zeroes driver-private command data")
    Signed-off-by: Ye Bin <yebin10@huawei.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://lore.kernel.org/r/20250217021628.2929248-1-yebin@huaweicloud.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 4fa382be430421e1445f9c95c4dc9b7e0949ae8a
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Feb 14 14:43:44 2025 -0800

    scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()
    
    ufshcd_is_ufs_dev_busy(), ufshcd_print_host_state() and
    ufshcd_eh_timed_out() are used in both modes (legacy mode and MCQ mode).
    hba->outstanding_reqs only represents the outstanding requests in legacy
    mode. Hence, change hba->outstanding_reqs into scsi_host_busy(hba->host) in
    these functions.
    
    Fixes: eacb139b77ff ("scsi: ufs: core: mcq: Enable multi-circular queue")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://lore.kernel.org/r/20250214224352.3025151-1-bvanassche@acm.org
    Reviewed-by: Peter Wang <peter.wang@mediatek.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>