scsi: mpt3sas: Fix incorrect 4GB boundary check

The driver must perform its 4GB boundary check using the pool's DMA address
instead of using the virtual address.

Link: https://lore.kernel.org/r/20220303140230.13098-1-sreekanth.reddy@broadcom.com
Fixes: df6c1c037d9f ("scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region")
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index ebb61b47dc2f0f415ed862708449e66ea58b5796..a10ceaa8f881c3f2a50d3d664843d98a7458206e 100644 (file)
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5723,14 +5723,13 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
  */
 
 static int
-mpt3sas_check_same_4gb_region(long reply_pool_start_address, u32 pool_sz)
+mpt3sas_check_same_4gb_region(dma_addr_t start_address, u32 pool_sz)
 {
-       long reply_pool_end_address;
+       dma_addr_t end_address;
 
-       reply_pool_end_address = reply_pool_start_address + pool_sz;
+       end_address = start_address + pool_sz - 1;
 
-       if (upper_32_bits(reply_pool_start_address) ==
-               upper_32_bits(reply_pool_end_address))
+       if (upper_32_bits(start_address) == upper_32_bits(end_address))
                return 1;
        else
                return 0;
@@ -5791,7 +5790,7 @@ _base_allocate_pcie_sgl_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
                }
 
                if (!mpt3sas_check_same_4gb_region(
-                   (long)ioc->pcie_sg_lookup[i].pcie_sgl, sz)) {
+                   ioc->pcie_sg_lookup[i].pcie_sgl_dma, sz)) {
                        ioc_err(ioc, "PCIE SGLs are not in same 4G !! pcie sgl (0x%p) dma = (0x%llx)\n",
                            ioc->pcie_sg_lookup[i].pcie_sgl,
                            (unsigned long long)
@@ -5846,8 +5845,8 @@ _base_allocate_chain_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
                            GFP_KERNEL, &ctr->chain_buffer_dma);
                        if (!ctr->chain_buffer)
                                return -EAGAIN;
-                       if (!mpt3sas_check_same_4gb_region((long)
-                           ctr->chain_buffer, ioc->chain_segment_sz)) {
+                       if (!mpt3sas_check_same_4gb_region(
+                           ctr->chain_buffer_dma, ioc->chain_segment_sz)) {
                                ioc_err(ioc,
                                    "Chain buffers are not in same 4G !!! Chain buff (0x%p) dma = (0x%llx)\n",
                                    ctr->chain_buffer,
@@ -5883,7 +5882,7 @@ _base_allocate_sense_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
            GFP_KERNEL, &ioc->sense_dma);
        if (!ioc->sense)
                return -EAGAIN;
-       if (!mpt3sas_check_same_4gb_region((long)ioc->sense, sz)) {
+       if (!mpt3sas_check_same_4gb_region(ioc->sense_dma, sz)) {
                dinitprintk(ioc, pr_err(
                    "Bad Sense Pool! sense (0x%p) sense_dma = (0x%llx)\n",
                    ioc->sense, (unsigned long long) ioc->sense_dma));
@@ -5916,7 +5915,7 @@ _base_allocate_reply_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
            &ioc->reply_dma);
        if (!ioc->reply)
                return -EAGAIN;
-       if (!mpt3sas_check_same_4gb_region((long)ioc->reply_free, sz)) {
+       if (!mpt3sas_check_same_4gb_region(ioc->reply_dma, sz)) {
                dinitprintk(ioc, pr_err(
                    "Bad Reply Pool! Reply (0x%p) Reply dma = (0x%llx)\n",
                    ioc->reply, (unsigned long long) ioc->reply_dma));
@@ -5951,7 +5950,7 @@ _base_allocate_reply_free_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
            GFP_KERNEL, &ioc->reply_free_dma);
        if (!ioc->reply_free)
                return -EAGAIN;
-       if (!mpt3sas_check_same_4gb_region((long)ioc->reply_free, sz)) {
+       if (!mpt3sas_check_same_4gb_region(ioc->reply_free_dma, sz)) {
                dinitprintk(ioc,
                    pr_err("Bad Reply Free Pool! Reply Free (0x%p) Reply Free dma = (0x%llx)\n",
                    ioc->reply_free, (unsigned long long) ioc->reply_free_dma));
@@ -5990,7 +5989,7 @@ _base_allocate_reply_post_free_array(struct MPT3SAS_ADAPTER *ioc,
            GFP_KERNEL, &ioc->reply_post_free_array_dma);
        if (!ioc->reply_post_free_array)
                return -EAGAIN;
-       if (!mpt3sas_check_same_4gb_region((long)ioc->reply_post_free_array,
+       if (!mpt3sas_check_same_4gb_region(ioc->reply_post_free_array_dma,
            reply_post_free_array_sz)) {
                dinitprintk(ioc, pr_err(
                    "Bad Reply Free Pool! Reply Free (0x%p) Reply Free dma = (0x%llx)\n",
@@ -6055,7 +6054,7 @@ base_alloc_rdpq_dma_pool(struct MPT3SAS_ADAPTER *ioc, int sz)
                         * resources and set DMA mask to 32 and allocate.
                         */
                        if (!mpt3sas_check_same_4gb_region(
-                               (long)ioc->reply_post[i].reply_post_free, sz)) {
+                               ioc->reply_post[i].reply_post_free_dma, sz)) {
                                dinitprintk(ioc,
                                    ioc_err(ioc, "bad Replypost free pool(0x%p)"
                                    "reply_post_free_dma = (0x%llx)\n",