Re: [PATCH v4 29/56] scsi: qla2xxx: Update handling of ELS IOCBs for 29xx series

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Endian-unsafe use of C bitfields for hardware-facing DMA descriptors in `qla_els_set_vp_sof()`.
--

--- Patch [29]: [PATCH v4 29/56] scsi: qla2xxx: Update handling of ELS IOCBs for 29xx series ---
commit c4548b60cd936f5a4a71288b8a287eb9009e46b8
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update handling of ELS IOCBs for 29xx series

Update ELS IOCB handling to support the extended 128-byte
els_entry_24xx_ext structure used by 29xx series adapters.

> diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
> index 49b858e7cf2a1..2ade5e8522516 100644
> --- a/drivers/scsi/qla2xxx/qla_inline.h
> +++ b/drivers/scsi/qla2xxx/qla_inline.h

[ ... ]

> @@ -863,3 +863,31 @@ qla_sts_fwi2_extract(struct qla_hw_data *ha, void *pkt,
>  		host_to_fcp_swap(s->data, sizeof(s->data));
>  	}
>  }
> +
> +/*
> + * qla_els_set_vp_sof() - write the vp_index / sof_type pair into an ELS
> + *    pass-through IOCB (els_entry_24xx{,_ext}).
> + *
> + * Both layouts have the same 16-bit slot at offset 14, but it is encoded
> + * differently:
> + *   - 24xx: separate u8 vp_index + u8 sof_type with EST_SOFI3 (1 << 4)
> + *   - 29xx: __le16 with bitfields { vp_index:9, reserved_1_sof:3,
> + *           sof_type:4 } and ELS_EXT_EST_SOFI3
> + * so this is the single point in the driver that knows about that
> + * encoding split.
> + */
> +static inline void
> +qla_els_set_vp_sof(struct scsi_qla_host *vha, void *pkt, u16 vp_idx)
> +{
> +	if (IS_QLA29XX(vha->hw)) {
> +		struct els_entry_24xx_ext *ext = pkt;
> +
> +		ext->vp_index = vp_idx;
> +		ext->sof_type = ELS_EXT_EST_SOFI3;
[Severity: High]
Can the use of C bitfields here cause endianness issues on big-endian
architectures?

Since the hardware DMA descriptor struct els_entry_24xx_ext defines these
fields as:

    __le16 vp_index : 9;
    __le16 reserved_1_sof : 3;
    __le16 sof_type : 4;

the compiler will pack the bitfields starting from the most significant bit
of the word on big-endian systems (such as s390x or PowerPC). However, the
little-endian 29xx hardware expects vp_index to occupy the lowest 9 bits.

Could this mismatch cause the adapter firmware to read corrupted Virtual Port
(VP) indices and SOF types when qla_els_set_vp_sof() is called on the ELS
issue paths, potentially routing ELS commands to the wrong VP and leading to
login failures, cross-VM traffic leakage, or firmware crashes?

> +	} else {
> +		struct els_entry_24xx *e = pkt;
> +
> +		e->vp_index = vp_idx;
> +		e->sof_type = EST_SOFI3;
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714095353.289460-1-njavali@marvell.com?part=29