scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.

Thus, you cannot use attached_phy to index the pm8001_ha->phy array,
without first verifying that the device is directly attached.

Use the pm80xx_get_local_phy_id() helper to make sure that we use the
local phy id to index the array, regardless if the device is directly
attached or not.

Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.")
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 5595913eb7fc15ea9cdf3a1c9584027daf418af5..c5354263b45e865129a6ac6dc87362ea1d154fbb 100644 (file)
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -1063,7 +1063,7 @@ int pm8001_abort_task(struct sas_task *task)
        struct pm8001_hba_info *pm8001_ha;
        struct pm8001_device *pm8001_dev;
        int rc = TMF_RESP_FUNC_FAILED, ret;
-       u32 phy_id, port_id;
+       u32 port_id;
        struct sas_task_slow slow_task;
 
        if (!task->lldd_task || !task->dev)
@@ -1072,7 +1072,6 @@ int pm8001_abort_task(struct sas_task *task)
        dev = task->dev;
        pm8001_dev = dev->lldd_dev;
        pm8001_ha = pm8001_find_ha_by_dev(dev);
-       phy_id = pm8001_dev->attached_phy;
 
        if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) {
                // If the controller is seeing fatal errors
@@ -1104,7 +1103,8 @@ int pm8001_abort_task(struct sas_task *task)
                if (pm8001_ha->chip_id == chip_8006) {
                        DECLARE_COMPLETION_ONSTACK(completion_reset);
                        DECLARE_COMPLETION_ONSTACK(completion);
-                       struct pm8001_phy *phy = pm8001_ha->phy + phy_id;
+                       u32 phy_id = pm80xx_get_local_phy_id(dev);
+                       struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
                        port_id = phy->port->port_id;
 
                        /* 1. Set Device state as Recovery */