diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2012-06-22 10:52:34 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-07-25 04:11:12 +0100 |
| commit | cb480c94c8e89014cdb54201a413bf9d36f6cd41 (patch) | |
| tree | 53b08d4b2a74135d723a5be54409a0541855b44c /include/scsi/libsas.h | |
| parent | 1e1cdddbadc5f3044882127f3931a19f48b1a69b (diff) | |
| download | lwn-cb480c94c8e89014cdb54201a413bf9d36f6cd41.tar.gz lwn-cb480c94c8e89014cdb54201a413bf9d36f6cd41.zip | |
libsas: fix taskfile corruption in sas_ata_qc_fill_rtf
commit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.
fill_result_tf() grabs the taskfile flags from the originating qc which
sas_ata_qc_fill_rtf() promptly overwrites. The presence of an
ata_taskfile in the sata_device makes it tempting to just copy the full
contents in sas_ata_qc_fill_rtf(). However, libata really only wants
the fis contents and expects the other portions of the taskfile to not
be touched by ->qc_fill_rtf. To that end store a fis buffer in the
sata_device and use ata_tf_from_fis() like every other ->qc_fill_rtf()
implementation.
Reported-by: Praveen Murali <pmurali@logicube.com>
Tested-by: Praveen Murali <pmurali@logicube.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include/scsi/libsas.h')
| -rw-r--r-- | include/scsi/libsas.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h index 6a308d42d98f..1e100c63d542 100644 --- a/include/scsi/libsas.h +++ b/include/scsi/libsas.h @@ -159,6 +159,8 @@ enum ata_command_set { ATAPI_COMMAND_SET = 1, }; +#define ATA_RESP_FIS_SIZE 24 + struct sata_device { enum ata_command_set command_set; struct smp_resp rps_resp; /* report_phy_sata_resp */ @@ -170,7 +172,7 @@ struct sata_device { struct ata_port *ap; struct ata_host ata_host; - struct ata_taskfile tf; + u8 fis[ATA_RESP_FIS_SIZE]; u32 sstatus; u32 serror; u32 scontrol; @@ -486,7 +488,7 @@ enum exec_status { */ struct ata_task_resp { u16 frame_len; - u8 ending_fis[24]; /* dev to host or data-in */ + u8 ending_fis[ATA_RESP_FIS_SIZE]; /* dev to host or data-in */ u32 sstatus; u32 serror; u32 scontrol; |