IB/mlx4: Don't overwrite fast registration page list when posting work request
The low-level mlx4 driver modified the page-list addresses for fast register work requests post send to big-endian, and set a "present" bit. This caused problems later when the consumer attempted to unmap the pages using the page-list (using the list addresses which were assumed to be still in CPU-endian order). Fix the mlx4 driver to allocate two buffers and use a private buffer for the hardware-format bus addresses. This patch fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1571>, an NFS/RDMA server crash. The cause of the crash was found by Vu Pham of Mellanox. The fix is along the lines suggested by Steve Wise in comment #21 in bug 1571. Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
56a50adda4
commit
2b6b7d4be4
|
@ -86,6 +86,7 @@ struct mlx4_ib_mr {
|
|||
|
||||
struct mlx4_ib_fast_reg_page_list {
|
||||
struct ib_fast_reg_page_list ibfrpl;
|
||||
__be64 *mapped_page_list;
|
||||
dma_addr_t map;
|
||||
};
|
||||
|
||||
|
|
|
@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
|
|||
if (!mfrpl)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
|
||||
mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
|
||||
mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
|
||||
if (!mfrpl->ibfrpl.page_list)
|
||||
goto err_free;
|
||||
|
||||
mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
|
||||
size, &mfrpl->map,
|
||||
GFP_KERNEL);
|
||||
if (!mfrpl->ibfrpl.page_list)
|
||||
|
@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
|
|||
return &mfrpl->ibfrpl;
|
||||
|
||||
err_free:
|
||||
kfree(mfrpl->ibfrpl.page_list);
|
||||
kfree(mfrpl);
|
||||
return ERR_PTR(-ENOMEM);
|
||||
}
|
||||
|
@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
|
|||
struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
|
||||
int size = page_list->max_page_list_len * sizeof (u64);
|
||||
|
||||
dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
|
||||
dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
|
||||
mfrpl->map);
|
||||
kfree(mfrpl->ibfrpl.page_list);
|
||||
kfree(mfrpl);
|
||||
}
|
||||
|
||||
|
|
|
@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
|
|||
int i;
|
||||
|
||||
for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
|
||||
wr->wr.fast_reg.page_list->page_list[i] =
|
||||
mfrpl->mapped_page_list[i] =
|
||||
cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
|
||||
MLX4_MTT_FLAG_PRESENT);
|
||||
|
||||
|
|
Loading…
Reference in New Issue