[SCSI] ips: Fix up for correct scatter/gather processing

Added kmap_atomic/kunmap_atomic. Added protection of KM_IRQ0 slot with
local_irq_save(), local_irq_restore(), and comments.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

1 files changed, 36 insertions, 13 deletions

diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index eeae7ccb0dd2..0a252e7aca6e 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -219,15 +219,12 @@ module_param(ips, charp, 0);
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,5,0)
 #include <linux/blk.h>
 #include "sd.h"
-#define IPS_SG_ADDRESS(sg)       ((sg)->address)
 #define IPS_LOCK_SAVE(lock,flags) spin_lock_irqsave(&io_request_lock,flags)
 #define IPS_UNLOCK_RESTORE(lock,flags) spin_unlock_irqrestore(&io_request_lock,flags)
 #ifndef __devexit_p
 #define __devexit_p(x) x
 #endif
 #else
-#define IPS_SG_ADDRESS(sg)      (page_address((sg)->page) ? \
-                                   page_address((sg)->page)+(sg)->offset : NULL)
 #define IPS_LOCK_SAVE(lock,flags) do{spin_lock(lock);(void)flags;}while(0)
 #define IPS_UNLOCK_RESTORE(lock,flags) do{spin_unlock(lock);(void)flags;}while(0)
 #endif
@@ -1605,6 +1602,8 @@ ips_proc_info(struct Scsi_Host *host, char *buffer, char **start, off_t offset,
 static int
 ips_is_passthru(Scsi_Cmnd * SC)
 {
+	unsigned long flags;
+
 	METHOD_TRACE("ips_is_passthru", 1);
 
 	if (!SC)
@@ -1622,10 +1621,20 @@ ips_is_passthru(Scsi_Cmnd * SC)
 			return 1;
 		else if (SC->use_sg) {
 			struct scatterlist *sg = SC->request_buffer;
-			char *buffer = IPS_SG_ADDRESS(sg);
+			char  *buffer; 
+
+			/* kmap_atomic() ensures addressability of the user buffer.*/
+			/* local_irq_save() protects the KM_IRQ0 address slot.     */
+			local_irq_save(flags);
+			buffer = kmap_atomic(sg->page, KM_IRQ0) + sg->offset; 
 			if (buffer && buffer[0] == 'C' && buffer[1] == 'O' &&
-			    buffer[2] == 'P' && buffer[3] == 'P')
+			    buffer[2] == 'P' && buffer[3] == 'P') {
+				kunmap_atomic(buffer - sg->offset, KM_IRQ0);
+				local_irq_restore(flags);
 				return 1;
+			}
+			kunmap_atomic(buffer - sg->offset, KM_IRQ0);
+			local_irq_restore(flags);
 		}
 	}
 	return 0;
@@ -3656,14 +3665,21 @@ ips_scmd_buf_write(Scsi_Cmnd * scmd, void *data, unsigned
 		int i;
 		unsigned int min_cnt, xfer_cnt;
 		char *cdata = (char *) data;
+		unsigned char *buffer;
+		unsigned long flags;
 		struct scatterlist *sg = scmd->request_buffer;
 		for (i = 0, xfer_cnt = 0;
 		     (i < scmd->use_sg) && (xfer_cnt < count); i++) {
-			if (!IPS_SG_ADDRESS(&sg[i]))
-				return;
 			min_cnt = min(count - xfer_cnt, sg[i].length);
-			memcpy(IPS_SG_ADDRESS(&sg[i]), &cdata[xfer_cnt],
-			       min_cnt);
+
+			/* kmap_atomic() ensures addressability of the data buffer.*/
+			/* local_irq_save() protects the KM_IRQ0 address slot.     */
+			local_irq_save(flags);
+			buffer = kmap_atomic(sg[i].page, KM_IRQ0) + sg[i].offset;
+			memcpy(buffer, &cdata[xfer_cnt], min_cnt);
+			kunmap_atomic(buffer - sg[i].offset, KM_IRQ0);
+			local_irq_restore(flags);
+
 			xfer_cnt += min_cnt;
 		}
 
@@ -3688,14 +3704,21 @@ ips_scmd_buf_read(Scsi_Cmnd * scmd, void *data, unsigned
 		int i;
 		unsigned int min_cnt, xfer_cnt;
 		char *cdata = (char *) data;
+		unsigned char *buffer;
+		unsigned long flags;
 		struct scatterlist *sg = scmd->request_buffer;
 		for (i = 0, xfer_cnt = 0;
 		     (i < scmd->use_sg) && (xfer_cnt < count); i++) {
-			if (!IPS_SG_ADDRESS(&sg[i]))
-				return;
 			min_cnt = min(count - xfer_cnt, sg[i].length);
-			memcpy(&cdata[xfer_cnt], IPS_SG_ADDRESS(&sg[i]),
-			       min_cnt);
+
+			/* kmap_atomic() ensures addressability of the data buffer.*/
+			/* local_irq_save() protects the KM_IRQ0 address slot.     */
+			local_irq_save(flags);
+			buffer = kmap_atomic(sg[i].page, KM_IRQ0) + sg[i].offset;
+			memcpy(&cdata[xfer_cnt], buffer, min_cnt);
+			kunmap_atomic(buffer - sg[i].offset, KM_IRQ0);
+			local_irq_restore(flags);
+
 			xfer_cnt += min_cnt;
 		}