From b5bc467f6e4022a495d6c89f65d5466346e3861b Mon Sep 17 00:00:00 2001
From: "Kashyap, Desai" <kashyap.desai@lsi.com>
Date: Sat, 13 Nov 2010 04:31:14 +0530
Subject: [PATCH] --- yaml --- r: 226759 b: refs/heads/master c:
 dd3741d30300f9cf1adc046773a4bb87252d96ac h: refs/heads/master i:   226757:
 aa01c19f698bf2df8f516a1cb7d63273f5078335   226755:
 3afb1d44be4cc4b74ae9cd64b408e3d843f6c9c8   226751:
 547ca674cb892c1f64746ea1f68f5ef6b2361d49 v: v3

---
 [refs]                                    | 2 +-
 trunk/drivers/scsi/mpt2sas/mpt2sas_base.c | 8 +++++++-
 trunk/drivers/scsi/mpt2sas/mpt2sas_base.h | 2 ++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 3adaf8ea80f4..e1b29682d545 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 363fa50fc35357b1361fb63b0726335de993374a
+refs/heads/master: dd3741d30300f9cf1adc046773a4bb87252d96ac
diff --git a/trunk/drivers/scsi/mpt2sas/mpt2sas_base.c b/trunk/drivers/scsi/mpt2sas/mpt2sas_base.c
index 12faf64f91b0..d1c53455c063 100644
--- a/trunk/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/trunk/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -758,7 +758,7 @@ _base_get_cb_idx(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 		if (smid < ioc->internal_smid) {
 			i = smid - ioc->hi_priority_smid;
 			cb_idx = ioc->hpr_lookup[i].cb_idx;
-		} else {
+		} else if (smid <= ioc->hba_queue_depth)  {
 			i = smid - ioc->internal_smid;
 			cb_idx = ioc->internal_lookup[i].cb_idx;
 		}
@@ -848,6 +848,7 @@ _base_interrupt(int irq, void *bus_id)
 		return IRQ_NONE;
 
 	completed_cmds = 0;
+	cb_idx = 0xFF;
 	do {
 		rd.word = rpf->Words;
 		if (rd.u.low == UINT_MAX || rd.u.high == UINT_MAX)
@@ -860,6 +861,9 @@ _base_interrupt(int irq, void *bus_id)
 		    MPI2_RPY_DESCRIPT_FLAGS_ADDRESS_REPLY) {
 			reply = le32_to_cpu
 				(rpf->AddressReply.ReplyFrameAddress);
+			if (reply > ioc->reply_dma_max_address ||
+			    reply < ioc->reply_dma_min_address)
+				reply = 0;
 		} else if (request_desript_type ==
 		    MPI2_RPY_DESCRIPT_FLAGS_TARGET_COMMAND_BUFFER)
 			goto next;
@@ -2221,6 +2225,8 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
 		    ioc->name);
 		goto out;
 	}
+	ioc->reply_dma_min_address = (u32)(ioc->reply_dma);
+	ioc->reply_dma_max_address = (u32)(ioc->reply_dma) + sz;
 	dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "reply pool(0x%p): depth"
 	    "(%d), frame_size(%d), pool_size(%d kB)\n", ioc->name, ioc->reply,
 	    ioc->reply_free_queue_depth, ioc->reply_sz, sz/1024));
diff --git a/trunk/drivers/scsi/mpt2sas/mpt2sas_base.h b/trunk/drivers/scsi/mpt2sas/mpt2sas_base.h
index 0b15a8bdebfc..63f7a196f42d 100644
--- a/trunk/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/trunk/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -737,6 +737,8 @@ struct MPT2SAS_ADAPTER {
 	u16		reply_sz;
 	u8		*reply;
 	dma_addr_t	reply_dma;
+	u32		reply_dma_max_address;
+	u32		reply_dma_min_address;
 	struct dma_pool *reply_dma_pool;
 
 	/* reply free queue */