From nobody Fri Jun 12 11:18:43 2026 Received: from mail-lj1-f202.google.com (mail-lj1-f202.google.com [209.85.208.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A572E47CC6F for ; Fri, 15 May 2026 12:17:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778847476; cv=none; b=hxZpVvPA5O76V0bHw5qmz8YAzig4uaFZEeVBPGB91zKOiRPveBkL7aHBofxEuu3lVp5dOVCRHkMErpjEarObpPwpH0zDkvarAx2ePKVw1vhBugzHs1OCGEt2Yw2KgdP6CQvSBDD3rhIHg7CD8frfn4a7gtLukHP0AnyAPEWTpJM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778847476; c=relaxed/simple; bh=6Ef2CBZfCR2yn2K+QpFf+BsYWi9Mqgb8LjXQV7Uqz8M=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=oKYsp1Rc0a7go5N+woTGuoao4BXlbpHOUg39fVYoz580/Ftap5NZHLcHtSRMRFHC+3ez6BE9TO2hP3WNMWfkqNr2xDper85dzfplsvT6mAAEvgY6dfER2Yfiqo5bCjXLIGRY/Rp1diLJmi7awe47oZvdqM+CEInnT9s1RXPjV58= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rnj.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=qXAP9eG8; arc=none smtp.client-ip=209.85.208.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rnj.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="qXAP9eG8" Received: by mail-lj1-f202.google.com with SMTP id 38308e7fff4ca-3939de90af6so10461041fa.3 for ; Fri, 15 May 2026 05:17:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1778847473; x=1779452273; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=GZKonZOt8iemB50IPvFZn8F0iIu6czcIgS1NcKpIgzs=; b=qXAP9eG85iwGixu24AkAA9edumMJ8Gq+wcn4TrElsXrJTn5U8xOT0DjQaTUqx4Jbsa nOG2+hBgfH4bbBrfU9QGnmNynkdnT+xm8HkxS5Zg0dX8rVmIFQ56FDH4HMnsKqScpqRi Rja88lVQGhffmRXN/FTdzZckWylx59lQHAoMPgvq/dqioel4NYHEq2AomMTRYtNy0kBm qqra6Hdtt4LsyGHQhpq6lqDT74gm4/mv7Bvq4nxhHDYKhSMvL0NcWO9XhRFGhHcqpDjz +/CoczS32AmgYF480uItIzMzeiRQnskcoCV1QjoCjzLVixTLE24qct2jPumTRmjgfY/g BIwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778847473; x=1779452273; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=GZKonZOt8iemB50IPvFZn8F0iIu6czcIgS1NcKpIgzs=; b=Osra2e4gZeAUpybD09tUwliEpL3KQ9GLy02DxjAHO4CN3uGTtl2jlgbu76kEIu2ypF WmBPajBXRLF1iPOx8qad8w+u3ByIyEGBBjuReL3B3JrTuVW5Xf6OR68j5nlSeH7GJ/Za meYMRaZhV6dL4AlCOYJohgNTw6HR0i6QUZH2GhQmb4WnFKvdpw2obK89D3lpsJVjVb0l 1SHxdfnnjyyzBBcVDRbTjR/1+czivDP4/+iuQ8rGQSbmpG0qhuNFj7ki/yyxKzEXNjaF JDjjL2Utd6d/9qclPQjb4HfknF1mQFa8U8vaAl3Wnm/ywTCnKs66Vb0PpXvCCBa0gmh2 lnzw== X-Forwarded-Encrypted: i=1; AFNElJ8hJFWC8Jhv+m2e2FIXsjfMy8LMwmTRGmUsoBn/2kLDkEZDAKzdRW8naaJSyCk0ck3QouYpMKvu+yNANXQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyduKDIDnqcGaZiEZ2NGu/GbQBH6PbmAGcjwce91DjEYATJOX4L QBgLQB2nMlDtOvcVogSuYVTD7NFKnYYIK9SyZetmiGvM2PeTw1LnuvQpT9gYMDmgvbcusg== X-Received: from ljco1.prod.google.com ([2002:a2e:7301:0:b0:393:bc09:3df]) (user=rnj job=prod-delivery.src-stubby-dispatcher) by 2002:a2e:8a95:0:b0:38e:9ece:61e9 with SMTP id 38308e7fff4ca-39561ed8c8emr10219591fa.25.1778847472704; Fri, 15 May 2026 05:17:52 -0700 (PDT) Date: Fri, 15 May 2026 12:15:39 +0000 In-Reply-To: <20260515-fortify_pm80-v1-0-2863187f6d4b@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260515-fortify_pm80-v1-0-2863187f6d4b@google.com> X-Developer-Key: i=rnj@google.com; a=ed25519; pk=QwUkB1OONd7dk9zV4pLRQRehoWHHsLcRZD2QcswqHTc= X-Developer-Signature: v=1; a=ed25519-sha256; t=1778847470; l=2964; i=rnj@google.com; s=20260515; h=from:subject:message-id; bh=6Ef2CBZfCR2yn2K+QpFf+BsYWi9Mqgb8LjXQV7Uqz8M=; b=nZUYmaIRoYQC9otHVeIHVnwbPxC6SEJ+UXvgsN6z9gQqKp3QhWLFEBYFUcazK2bsaJnyt934t AGoh7R9lqgPBd5+kv3iJ71kT1TYGUxu6a5s8SicN6XW2O3XJ0vDG/IY X-Mailer: b4 0.14.3 Message-ID: <20260515-fortify_pm80-v1-1-2863187f6d4b@google.com> Subject: [PATCH 1/2] scsi: pm8001: Redefine sas_identify_frame structure From: Ronja Meyer To: Jack Wang , "James E.J. Bottomley" , "Martin K. Petersen" , Tom Peng , Kevin Ao , Lindar Liu , James Bottomley Cc: jack wang , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Ronja Meyer , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The sas_identify structure defined by pm8001 doesn't have a CRC field. Add a new sas_identify_frame_local structure without the CRC field. The equivalent change was already made to the pm80xx driver in: commit 5990fd57ebea ("scsi: pm80xx: redefine sas_identify_frame structure") Sending to stable, as this change is required for the fortify-panic fix later in this chain to apply cleanly. Cc: stable@vger.kernel.org Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") Signed-off-by: Ronja Meyer --- drivers/scsi/pm8001/pm8001_hwi.h | 101 +++++++++++++++++++++++++++++++++++= +++- 1 file changed, 99 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_= hwi.h index f1ce8df082b0..14b162f93eb8 100644 --- a/drivers/scsi/pm8001/pm8001_hwi.h +++ b/drivers/scsi/pm8001/pm8001_hwi.h @@ -133,6 +133,103 @@ =20 /* for new SPC controllers MEMBASE III is shared between BIOS and DATA */ #define GSM_SM_BASE 0x4F0000 + +#ifdef __LITTLE_ENDIAN_BITFIELD +struct sas_identify_frame_local { + /* Byte 0 */ + u8 frame_type:4; + u8 dev_type:3; + u8 _un0:1; + + /* Byte 1 */ + u8 _un1; + + /* Byte 2 */ + union { + struct { + u8 _un20:1; + u8 smp_iport:1; + u8 stp_iport:1; + u8 ssp_iport:1; + u8 _un247:4; + }; + u8 initiator_bits; + }; + + /* Byte 3 */ + union { + struct { + u8 _un30:1; + u8 smp_tport:1; + u8 stp_tport:1; + u8 ssp_tport:1; + u8 _un347:4; + }; + u8 target_bits; + }; + + /* Byte 4 - 11 */ + u8 _un4_11[8]; + + /* Byte 12 - 19 */ + u8 sas_addr[SAS_ADDR_SIZE]; + + /* Byte 20 */ + u8 phy_id; + + u8 _un21_27[7]; + +} __packed; + +#elif defined(__BIG_ENDIAN_BITFIELD) +struct sas_identify_frame_local { + /* Byte 0 */ + u8 _un0:1; + u8 dev_type:3; + u8 frame_type:4; + + /* Byte 1 */ + u8 _un1; + + /* Byte 2 */ + union { + struct { + u8 _un247:4; + u8 ssp_iport:1; + u8 stp_iport:1; + u8 smp_iport:1; + u8 _un20:1; + }; + u8 initiator_bits; + }; + + /* Byte 3 */ + union { + struct { + u8 _un347:4; + u8 ssp_tport:1; + u8 stp_tport:1; + u8 smp_tport:1; + u8 _un30:1; + }; + u8 target_bits; + }; + + /* Byte 4 - 11 */ + u8 _un4_11[8]; + + /* Byte 12 - 19 */ + u8 sas_addr[SAS_ADDR_SIZE]; + + /* Byte 20 */ + u8 phy_id; + + u8 _un21_27[7]; +} __packed; +#else +#error "Bitfield order not defined!" +#endif + struct mpi_msg_hdr{ __le32 header; /* Bits [11:0] - Message operation code */ /* Bits [15:12] - Message Category */ @@ -153,8 +250,8 @@ struct mpi_msg_hdr{ struct phy_start_req { __le32 tag; __le32 ase_sh_lm_slr_phyid; - struct sas_identify_frame sas_identify; - u32 reserved[5]; + struct sas_identify_frame_local sas_identify; /* _local to omit CRC field= */ + u32 reserved[6]; } __attribute__((packed, aligned(4))); =20 =20 --=20 2.54.0.563.g4f69b47b94-goog From nobody Fri Jun 12 11:18:43 2026 Received: from mail-lj1-f201.google.com (mail-lj1-f201.google.com [209.85.208.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 890F43D25C6 for ; Fri, 15 May 2026 12:17:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778847478; cv=none; b=Wq/Zl+6v0MrRy6wcw/Rk/Hd9YSsPdFqUUZosZwNLPXmxaLKt+f3MXayfKSSTi1CjUbvkJsSANkJ7tso8tHiEea4ARvOQqs0nvXT5fIEPjqx6GY1GQ8hEDrG58IzHKUscDiVYpe3uhi4PkjOZGebob1QvH2SdTpzA6yj6YqdZM2M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778847478; c=relaxed/simple; bh=F3u/QH/ZhYfqyIB9F98+uK1QXh9jLK2lRsp6iEp0P04=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Lpi8x+knEuDNNm6Pti9l3q19n8UWM0cupoCznLuD9IqmdZPdrUIpa2Ns3RXNqNOUg8YAyPaDDgRpGsT4aezkP5TJ2FAzybNXImQuOv3ec3wU57eobQhY++qt09LKmqWB9tqnqTPaNbuCejlFzXw4ShUrRyqVmwYsvvkteUMWTUE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rnj.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=qjH8aBH8; arc=none smtp.client-ip=209.85.208.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rnj.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="qjH8aBH8" Received: by mail-lj1-f201.google.com with SMTP id 38308e7fff4ca-393a6ee3c75so44650501fa.3 for ; Fri, 15 May 2026 05:17:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1778847474; x=1779452274; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=//Plx+YvoT4buEKO1lurHogNmkZC/8PnjF1rYPj5af0=; b=qjH8aBH8IpMtyZbyCmIRjkKwmyCVSXRjcynlFGqAXrDDD+jbyXjh0TqH3C+UnhaSRM FM6O90drlmgClqhce7a82EELHY1WThBk6JYqjAYKEEH3dB0hK/YYfU2ctoi7nV7hMBL6 MTNnv8obxHrknGJ3TKZt5/TdjNyfZh+tOrceDQcEpG5eQpHsImTTlvu15IpVfGtDFCIl eMhKWCHUqdWyNfZiFdeXCtScaD31dFNEJWubJxeTi8VoKFUxqbdh0uPirx6pry5+Tkec Qfau5NX3sWNb8XG4PRuc+KtMv1KJhXqHXHku4IXg54rywllhFhxYWuKP/JXXbZ7v2gd4 VTsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778847474; x=1779452274; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=//Plx+YvoT4buEKO1lurHogNmkZC/8PnjF1rYPj5af0=; b=YT3siBoMg11PEluPKhCuzIYk3WW9aupkQF1NFrgEsiSICIpadyJwveZQFcXhbC17fO rdCKiHctyEHa2+DCLTi961UakDx5w4+BbsyH0uDddI1MDzQZiZdnsjSARtMbdW0Zf6xq cre5zbPD2qtRVlFLOkXAmefee75DBW5AwYxptd7KOSJFVSMJ9gQcUc1kdAQALepgWdde JXrIZcx7XOm9jvjOwZo1qdqDIxICZWYtfYHmv7kM/rnoJGuo9HF+Pe97crMi2IlvmBip JAh9ScZBHW3PmfEBIViGhHvPbkvU8/GQs4auVLVjUtuMelwl2foug/GmX1F/9sNpDpSI IRIQ== X-Forwarded-Encrypted: i=1; AFNElJ+aXzsv+c1lsSEveOr+v3iDHQzhkquHhgeLafBRju2nzTArBbgHMNn0ggQyPOMHXjdovMli7zP0cZTfmsA=@vger.kernel.org X-Gm-Message-State: AOJu0YzJ+Sp0ASKijr4kH3myQASS6mjcLWnamo2yJmk1e08C1vsaEeca G5C783tWDzyX27r3N8mJc4jEsZguWPcdcbjKX5IWNsOWXgPEofox4qghDmIIl71/5Q2TpQ== X-Received: from ljmk24.prod.google.com ([2002:a2e:a278:0:b0:393:7fb2:6b5a]) (user=rnj job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6512:1241:b0:5aa:b6a:7a8c with SMTP id 2adb3069b0e04-5aa0e7755fbmr993792e87.43.1778847473713; Fri, 15 May 2026 05:17:53 -0700 (PDT) Date: Fri, 15 May 2026 12:15:40 +0000 In-Reply-To: <20260515-fortify_pm80-v1-0-2863187f6d4b@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260515-fortify_pm80-v1-0-2863187f6d4b@google.com> X-Developer-Key: i=rnj@google.com; a=ed25519; pk=QwUkB1OONd7dk9zV4pLRQRehoWHHsLcRZD2QcswqHTc= X-Developer-Signature: v=1; a=ed25519-sha256; t=1778847470; l=7156; i=rnj@google.com; s=20260515; h=from:subject:message-id; bh=F3u/QH/ZhYfqyIB9F98+uK1QXh9jLK2lRsp6iEp0P04=; b=6fmA6McFYcRaDItPhb+fZmQtDIdYKJC3l0wEIBdMC3GU+PulntNIaqMzfJBNuLEiE+BUiOyaF LgexaHhaWuMBtF2+HgskDlz/4jUbUk6vMJzW/BTl8XBm7Mf4vn1oGfQ X-Mailer: b4 0.14.3 Message-ID: <20260515-fortify_pm80-v1-2-2863187f6d4b@google.com> Subject: [PATCH 2/2] scsi: pm8001: Match hw_event_resp to HBA data layout From: Ronja Meyer To: Jack Wang , "James E.J. Bottomley" , "Martin K. Petersen" , Tom Peng , Kevin Ao , Lindar Liu , James Bottomley Cc: jack wang , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Ronja Meyer , stable@vger.kernel.org, Igor Pylypiv Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Correct the hw_event_resp struct definition to match the layout of data sent by the HBA. Remove pointer arithmetics previously required to work around incorrect struct definition. Looking at the struct definition before this patch: struct hw_event_resp { [...] struct sas_identify_frame sas_identify; struct dev_to_host_fis sata_fis; } __attribute__((packed, aligned(4))); Previously the memcpy() in hw_event_sata_phy_up() crossed reading from the sas_identify struct over into the sata_fis struct. This was necessary, because the hw_event_resp struct definition didn't align properly with what the HBA actually sent. The member sas_identify right before the member sata_fis was 4 bytes too long, causing the first 4 bytes of the sata_fis to be shifted into the last 4 bytes of sas_identify. The code worked around this by subtracting 4 bytes from both the sata_fis pointer, as well as sizeof(sas_identify), when they were used. FORTIFY_SOURCE detected this deliberate choice to cross struct member boundaries as an out-of-bounds read, even though in this case it didn't lead to a vulnerability. Hence the following fortify-panic was triggered: kernel BUG at lib/string_helpers.c:1044! RIP: 0010:__fortify_panic+0x9/0x10 hw_event_sata_phy_up+0xea/0x120 [pm80xx] process_one_iomb+0x634e/0x6360 [pm80xx] process_oq+0x391/0x430 [pm80xx] pm80xx_chip_isr+0x78/0x100 [pm80xx] tasklet_action_common+0x16a/0x2b0 handle_softirqs+0xcd/0x2a0 __irq_exit_rcu+0x50/0x100 common_interrupt+0x89/0xa0 Furthermore hw_event_resp was 64 bytes before this patch, which is 4 bytes too long. Messages exchanged between the pm8001 and the host kernel can be a maximum of 64 bytes, as defined in iomb_size. The message structs defined in pm8001_hwi.h must have a size of 60 bytes, in order to leave space for a 4 byte header that implicitly precedes each message. Luckily the code interacting with hw_event_resp doesn't ever seem to read or write the last 4 bytes of the struct and doesn't seem to use the incorrect size of the struct in a copy operation. Hence it doesn't overflow in practice. Further the pm80xx driver was unaffected by this bug. While the pm80xx struct was also 64 bytes, the message size on pm80xx is 128 bytes. Hence it is able to fit the 68 byte header and message without overflowing. This is not security critical AFAICT. Cc: stable@vger.kernel.org Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") Co-developed-by: Igor Pylypiv Signed-off-by: Igor Pylypiv Signed-off-by: Ronja Meyer --- drivers/scsi/pm8001/pm8001_hwi.c | 6 +++--- drivers/scsi/pm8001/pm8001_hwi.h | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 6 +++--- drivers/scsi/pm8001/pm80xx_hwi.h | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_= hwi.c index fff8d877abb9..e90f2d98d8ed 100644 --- a/drivers/scsi/pm8001/pm8001_hwi.c +++ b/drivers/scsi/pm8001/pm8001_hwi.c @@ -3164,8 +3164,8 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha= , void *piomb) sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE, GFP_ATOMIC); spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags); memcpy(phy->frame_rcvd, &pPayload->sas_identify, - sizeof(struct sas_identify_frame)-4); - phy->frame_rcvd_size =3D sizeof(struct sas_identify_frame) - 4; + sizeof(struct sas_identify_frame_local)); + phy->frame_rcvd_size =3D sizeof(struct sas_identify_frame_local); pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr); spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags); if (pm8001_ha->flags =3D=3D PM8001F_RUN_TIME) @@ -3208,7 +3208,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_h= a, void *piomb) phy->sas_phy.oob_mode =3D SATA_OOB_MODE; sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE, GFP_ATOMIC); spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags); - memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4), + memcpy(phy->frame_rcvd, &pPayload->sata_fis, sizeof(struct dev_to_host_fis)); phy->frame_rcvd_size =3D sizeof(struct dev_to_host_fis); phy->identify.target_port_protocols =3D SAS_PROTOCOL_SATA; diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_= hwi.h index 14b162f93eb8..2b5483989886 100644 --- a/drivers/scsi/pm8001/pm8001_hwi.h +++ b/drivers/scsi/pm8001/pm8001_hwi.h @@ -326,7 +326,7 @@ struct hw_event_resp { __le32 lr_evt_status_phyid_portid; __le32 evt_param; __le32 npip_portstate; - struct sas_identify_frame sas_identify; + struct sas_identify_frame_local sas_identify; /* _local to omit CRC field= */ struct dev_to_host_fis sata_fis; } __attribute__((packed, aligned(4))); =20 diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_= hwi.c index 954f307352e6..03293e9b84e6 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -3241,8 +3241,8 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha= , void *piomb) sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE, GFP_ATOMIC); spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags); memcpy(phy->frame_rcvd, &pPayload->sas_identify, - sizeof(struct sas_identify_frame)-4); - phy->frame_rcvd_size =3D sizeof(struct sas_identify_frame) - 4; + sizeof(struct sas_identify_frame_local)); + phy->frame_rcvd_size =3D sizeof(struct sas_identify_frame_local); pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr); spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags); if (pm8001_ha->flags =3D=3D PM8001F_RUN_TIME) @@ -3289,7 +3289,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_h= a, void *piomb) phy->sas_phy.oob_mode =3D SATA_OOB_MODE; sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE, GFP_ATOMIC); spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags); - memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4), + memcpy(phy->frame_rcvd, &pPayload->sata_fis, sizeof(struct dev_to_host_fis)); phy->frame_rcvd_size =3D sizeof(struct dev_to_host_fis); phy->identify.target_port_protocols =3D SAS_PROTOCOL_SATA; diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_= hwi.h index d8a63b7fed6a..5ccc010a2368 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.h +++ b/drivers/scsi/pm8001/pm80xx_hwi.h @@ -351,7 +351,7 @@ struct mpi_msg_hdr { struct phy_start_req { __le32 tag; __le32 ase_sh_lm_slr_phyid; - struct sas_identify_frame_local sas_identify; /* 28 Bytes */ + struct sas_identify_frame_local sas_identify; /* _local to omit CRC field= */ __le32 spasti; u32 reserved[21]; } __attribute__((packed, aligned(4))); @@ -427,7 +427,7 @@ struct hw_event_resp { __le32 lr_status_evt_portid; __le32 evt_param; __le32 phyid_npip_portstate; - struct sas_identify_frame sas_identify; + struct sas_identify_frame_local sas_identify; /* _local to omit CRC field= */ struct dev_to_host_fis sata_fis; } __attribute__((packed, aligned(4))); =20 --=20 2.54.0.563.g4f69b47b94-goog