[SCSI] mpt2sas: Copy message frame before releasing to free pool to have a local...

Current driver is  not clearing the per device tm_busy flag
following the Task Mangement request completion from the IOCTL path.
When this flag is set, the IO queues are frozen.   The reason the flag
didn't get cleared is becuase the driver is referencing
memory associated to the mpi request following the completion, when
the memory had been reallocated for a new request.  When the memory
was reallocated, the driver didn't clear the flag becuase it was
expecting a task managment reqeust, and the reallocated request was
for SCSI_IO.  To fix the problem the driver needs to have a cached
backup copy of the original reqeust.

Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index c3f34a76913b3f945c9ef7ffa38de3cc7aa4692d..55ac1cb34778e8c671a49b979a17b6d995b587cb 100644 (file)
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -626,7 +626,7 @@ static long
 _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
     struct mpt2_ioctl_command karg, void __user *mf, enum block_state state)
 {
-       MPI2RequestHeader_t *mpi_request;
+       MPI2RequestHeader_t *mpi_request = NULL, *request;
        MPI2DefaultReply_t *mpi_reply;
        u32 ioc_state;
        u16 ioc_status;
@@ -679,31 +679,50 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                printk(MPT2SAS_INFO_FMT "%s: ioc is operational\n",
                    ioc->name, __func__);
 
-       smid = mpt2sas_base_get_smid_scsiio(ioc, ioc->ctl_cb_idx, NULL);
-       if (!smid) {
-               printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
-                   ioc->name, __func__);
-               ret = -EAGAIN;
+       mpi_request = kzalloc(ioc->request_sz, GFP_KERNEL);
+       if (!mpi_request) {
+               printk(MPT2SAS_ERR_FMT "%s: failed obtaining a memory for "
+                   "mpi_request\n", ioc->name, __func__);
+               ret = -ENOMEM;
                goto out;
        }
 
-       ret = 0;
-       ioc->ctl_cmds.status = MPT2_CMD_PENDING;
-       memset(ioc->ctl_cmds.reply, 0, ioc->reply_sz);
-       mpi_request = mpt2sas_base_get_msg_frame(ioc, smid);
-       ioc->ctl_cmds.smid = smid;
-       data_out_sz = karg.data_out_size;
-       data_in_sz = karg.data_in_size;
-
        /* copy in request message frame from user */
        if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
                    __func__);
                ret = -EFAULT;
-               mpt2sas_base_free_smid(ioc, smid);
                goto out;
        }
 
+       if (mpi_request->Function == MPI2_FUNCTION_SCSI_TASK_MGMT) {
+               smid = mpt2sas_base_get_smid_hpr(ioc, ioc->ctl_cb_idx);
+               if (!smid) {
+                       printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
+                           ioc->name, __func__);
+                       ret = -EAGAIN;
+                       goto out;
+               }
+       } else {
+
+               smid = mpt2sas_base_get_smid_scsiio(ioc, ioc->ctl_cb_idx, NULL);
+               if (!smid) {
+                       printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
+                           ioc->name, __func__);
+                       ret = -EAGAIN;
+                       goto out;
+               }
+       }
+
+       ret = 0;
+       ioc->ctl_cmds.status = MPT2_CMD_PENDING;
+       memset(ioc->ctl_cmds.reply, 0, ioc->reply_sz);
+       request = mpt2sas_base_get_msg_frame(ioc, smid);
+       memcpy(request, mpi_request, karg.data_sge_offset*4);
+       ioc->ctl_cmds.smid = smid;
+       data_out_sz = karg.data_out_size;
+       data_in_sz = karg.data_in_size;
+
        if (mpi_request->Function == MPI2_FUNCTION_SCSI_IO_REQUEST ||
            mpi_request->Function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH) {
                if (!le16_to_cpu(mpi_request->FunctionDependent1) ||
@@ -749,7 +768,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
        }
 
        /* add scatter gather elements */
-       psge = (void *)mpi_request + (karg.data_sge_offset*4);
+       psge = (void *)request + (karg.data_sge_offset*4);
 
        if (!data_out_sz && !data_in_sz) {
                mpt2sas_base_build_zero_len_sge(ioc, psge);
@@ -797,7 +816,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
        case MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
        {
                Mpi2SCSIIORequest_t *scsiio_request =
-                   (Mpi2SCSIIORequest_t *)mpi_request;
+                   (Mpi2SCSIIORequest_t *)request;
                scsiio_request->SenseBufferLength = SCSI_SENSE_BUFFERSIZE;
                scsiio_request->SenseBufferLowAddress =
                    mpt2sas_base_get_sense_buffer_dma(ioc, smid);
@@ -812,7 +831,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
        case MPI2_FUNCTION_SCSI_TASK_MGMT:
        {
                Mpi2SCSITaskManagementRequest_t *tm_request =
-                   (Mpi2SCSITaskManagementRequest_t *)mpi_request;
+                   (Mpi2SCSITaskManagementRequest_t *)request;
 
                dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "TASK_MGMT: "
                    "handle(0x%04x), task_type(0x%02x)\n", ioc->name,
@@ -985,6 +1004,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                pci_free_consistent(ioc->pdev, data_out_sz, data_out,
                    data_out_dma);
 
+       kfree(mpi_request);
        ioc->ctl_cmds.status = MPT2_CMD_NOT_USED;
        mutex_unlock(&ioc->ctl_cmds.mutex);
        return ret;