diff options
author | Roland Dreier <rolandd@cisco.com> | 2005-10-30 16:07:03 -0500 |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2005-10-31 10:10:32 -0500 |
commit | e5b251a24a9cd34a7ef98e361eb94e7ab122a554 (patch) | |
tree | c29760bafd7107252389712965ad7e4ed0791a82 /drivers/infiniband | |
parent | 7162a3e0db34e914a8bc5bf74bbae0b386310cf8 (diff) |
[IB] mthca: Avoid SRQ free WQE list corruption
Fix wqe_to_link() to use a structure field that we know is definitely
always unused for receive work requests, so that it really avoids the
free list corruption bug that the comment claims it does.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r-- | drivers/infiniband/hw/mthca/mthca_srq.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c index 64f70aa1b3c0..292f55be8cbd 100644 --- a/drivers/infiniband/hw/mthca/mthca_srq.c +++ b/drivers/infiniband/hw/mthca/mthca_srq.c | |||
@@ -75,15 +75,16 @@ static void *get_wqe(struct mthca_srq *srq, int n) | |||
75 | 75 | ||
76 | /* | 76 | /* |
77 | * Return a pointer to the location within a WQE that we're using as a | 77 | * Return a pointer to the location within a WQE that we're using as a |
78 | * link when the WQE is in the free list. We use an offset of 4 | 78 | * link when the WQE is in the free list. We use the imm field |
79 | * because in the Tavor case, posting a WQE may overwrite the first | 79 | * because in the Tavor case, posting a WQE may overwrite the next |
80 | * four bytes of the previous WQE. The offset avoids corrupting our | 80 | * segment of the previous WQE, but a receive WQE will never touch the |
81 | * free list if the WQE has already completed and been put on the free | 81 | * imm field. This avoids corrupting our free list if the previous |
82 | * list when we post the next WQE. | 82 | * WQE has already completed and been put on the free list when we |
83 | * post the next WQE. | ||
83 | */ | 84 | */ |
84 | static inline int *wqe_to_link(void *wqe) | 85 | static inline int *wqe_to_link(void *wqe) |
85 | { | 86 | { |
86 | return (int *) (wqe + 4); | 87 | return (int *) (wqe + offsetof(struct mthca_next_seg, imm)); |
87 | } | 88 | } |
88 | 89 | ||
89 | static void mthca_tavor_init_srq_context(struct mthca_dev *dev, | 90 | static void mthca_tavor_init_srq_context(struct mthca_dev *dev, |