From 44ea66879d5638cfed5b5ecf628badfd8ec26f36 Mon Sep 17 00:00:00 2001 From: Roland Dreier Date: Sat, 16 Apr 2005 15:26:24 -0700 Subject: [PATCH] IB/mthca: fix MTT allocation in mem-free mode Fix bug in MTT allocation in mem-free mode. I misunderstood the MTT size value returned by the firmware -- it is really the size of a single MTT entry, since mem-free mode does not segment the MTT as the original firmware did. This meant that our MTT addresses ended up being off by a factor of 8. This meant that our MTT allocations might overlap, and so we could overwrite and corrupt earlier memory regions when writing new MTT entries. We fix this by always using our 64-byte MTT segment size. This allows some simplification of the code as well, since there's no reason to put the MTT segment size in a variable -- we can always use our enum value directly. Signed-off-by: Roland Dreier Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/infiniband/hw/mthca/mthca_mr.c') diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c index 66656379ea7..5cde296b406 100644 --- a/drivers/infiniband/hw/mthca/mthca_mr.c +++ b/drivers/infiniband/hw/mthca/mthca_mr.c @@ -263,7 +263,7 @@ int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd, goto err_out_mpt_free; } - for (i = dev->limits.mtt_seg_size / 8, mr->order = 0; + for (i = MTHCA_MTT_SEG_SIZE / 8, mr->order = 0; i < list_len; i <<= 1, ++mr->order) ; /* nothing */ @@ -286,7 +286,7 @@ int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd, mtt_entry = MAILBOX_ALIGN(mailbox); mtt_entry[0] = cpu_to_be64(dev->mr_table.mtt_base + - mr->first_seg * dev->limits.mtt_seg_size); + mr->first_seg * MTHCA_MTT_SEG_SIZE); mtt_entry[1] = 0; for (i = 0; i < list_len; ++i) mtt_entry[i + 2] = cpu_to_be64(buffer_list[i] | @@ -330,7 +330,7 @@ int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd, memset(&mpt_entry->lkey, 0, sizeof *mpt_entry - offsetof(struct mthca_mpt_entry, lkey)); mpt_entry->mtt_seg = cpu_to_be64(dev->mr_table.mtt_base + - mr->first_seg * dev->limits.mtt_seg_size); + mr->first_seg * MTHCA_MTT_SEG_SIZE); if (0) { mthca_dbg(dev, "Dumping MPT entry %08x:\n", mr->ibmr.lkey); -- cgit v1.2.3