diff options
| author |   Chuck Lever <chuck.lever@oracle.com> | 2018-11-25 17:13:08 -0500 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2018-11-29 17:10:06 -0700 |
| commit | b024dd0eba6e6d568f69d63c5e3153aba94c23e3 (patch) | |
| tree | f9eadb281eab0d4ba7ef2fb49877756134a12fce /drivers/infiniband/sw | |
| parent | RDMA/mlx5: Attach a DEVX counter via raw flow creation (diff) | |
| download | linux-dev-b024dd0eba6e6d568f69d63c5e3153aba94c23e3.tar.xz linux-dev-b024dd0eba6e6d568f69d63c5e3153aba94c23e3.zip | |
rxe: IB_WR_REG_MR does not capture MR's iova field
FRWR memory registration is done with a series of calls and WRs.
1. ULP invokes ib_dma_map_sg()
2. ULP invokes ib_map_mr_sg()
3. ULP posts an IB_WR_REG_MR on the Send queue
Step 2 generates an iova. It is permissible for ULPs to change this
iova (with certain restrictions) between steps 2 and 3.
rxe_map_mr_sg captures the MR's iova but later when rxe processes the
REG_MR WR, it ignores the MR's iova field. If a ULP alters the MR's iova
after step 2 but before step 3, rxe never captures that change.
When the remote sends an RDMA Read targeting that MR, rxe looks up the
R_key, but the altered iova does not match the iova stored in the MR,
causing the RDMA Read request to fail.
Reported-by: Anna Schumaker <schumaker.anna@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/sw')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_req.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c index b546721efbfe..c5d9b558fa90 100644 --- a/drivers/infiniband/sw/rxe/rxe_req.c +++ b/drivers/infiniband/sw/rxe/rxe_req.c @@ -643,6 +643,7 @@ next_wqe: rmr->access = wqe->wr.wr.reg.access; rmr->lkey = wqe->wr.wr.reg.key; rmr->rkey = wqe->wr.wr.reg.key; + rmr->iova = wqe->wr.wr.reg.mr->iova; wqe->state = wqe_state_done; wqe->status = IB_WC_SUCCESS; } else { |