Re: [PATCH v5 41/56] scsi: qla2xxx: Replace __le16 bitfields with scalar and accessors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Incomplete fix: `struct vp_rpt_id_entry_24xx_ext` still contains `__le16` bitfields, which causes endianness corruption on big-endian hosts.

Pre-existing issues:
- [High] Hardware-mapped target mode structures use `uint8_t` bitfields that are improperly packed on big-endian architectures.
--

--- Patch [41]: [PATCH v5 41/56] scsi: qla2xxx: Replace __le16 bitfields with scalar and accessors ---
commit 0d741959136e452484c2d9e17866323337b3d108
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Replace __le16 bitfields with scalar and accessors

This commit replaces __le16 bitfields in the 29xx extended IOCB structures
with a single __le16 scalar field and accessor functions. This change
addresses endianness corruption on big-endian hosts caused by C bitfield
packing order.

> diff --git a/drivers/scsi/qla2xxx/qla_fw29.h b/drivers/scsi/qla2xxx/qla_fw29.h
> index 600a40d8bd5ff..63bf350ddffc0 100644
> --- a/drivers/scsi/qla2xxx/qla_fw29.h
> +++ b/drivers/scsi/qla2xxx/qla_fw29.h

[ ... ]

> @@ -563,9 +586,7 @@ struct abts_entry_24xx_ext {
>  	__le16	nport_handle;		/* type 0x54 only */
>  
>  	__le16	control_flags;		/* type 0x55 only */
> -	__le16	vp_idx : 9;		/* VP index 9 bits */
> -	__le16	reserved_1_sof : 3;
> -	__le16	sof_type : 4;		/* sof_type is upper nibble */
> +	__le16	vp_idx_sof;		/* bits [8:0]=VP index, [15:12]=SOF type */
>  
>  	__le32	rx_xch_addr;
>  

[Severity: High]
Does this patch miss replacing the __le16 bitfields in the
vp_rpt_id_entry_24xx_ext structure?

Looking at drivers/scsi/qla2xxx/qla_fw29.h:

struct vp_rpt_id_entry_24xx_ext {
        ...
        __le16  vp_idx : 9;
        __le16  vp_status : 7;
        ...
};

When the firmware sends a 29xx extended VP Report ID IOCB,
qla24xx_report_id_acquisition() extracts the port ID from the bitfield:

drivers/scsi/qla2xxx/qla_mbx.c:qla24xx_report_id_acquisition() {
        ...
        vp_idx = rptid_entry_ext->vp_idx;
        vp_status = rptid_entry_ext->vp_status;
        ...
}

On big-endian architectures, C bitfield packing allocates from MSB to LSB.
Could the vp_idx field map to the wrong bits of the 16-bit word, causing
virtual port lookup to fail and breaking NPIV operations?

[Severity: High]
This is a pre-existing issue, but do the hardware-mapped target mode
structures use uint8_t bitfields that are improperly packed on big-endian
architectures?

In drivers/scsi/qla2xxx/qla_target.h, both abts_recv_from_24xx and
abts_resp_to_24xx define bitfields:

struct abts_recv_from_24xx {
        ...
        uint8_t  reserved_3:4;
        uint8_t  sof_type:4;
        ...
};

On big-endian hosts, sof_type maps to bits 0-3 instead of bits 4-7.

When qlt_24xx_send_abts_resp() assigns the response:

drivers/scsi/qla2xxx/qla_target.c:qlt_24xx_send_abts_resp() {
        ...
        resp->sof_type = abts->sof_type;
        ...
}

Will the hardware receive a corrupted byte where sof_type is encoded in the
wrong nibble, breaking target mode ABTS task management responses?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717152904.3155730-1-njavali@marvell.com?part=41