IB/mlx4: Don't overwrite fast registration page list when posting work request

The low-level mlx4 driver modified the page-list addresses for fast
register work requests post send to big-endian, and set a "present"
bit.  This caused problems later when the consumer attempted to unmap
the pages using the page-list (using the list addresses which were
assumed to be still in CPU-endian order).  Fix the mlx4 driver to
allocate two buffers and use a private buffer for the hardware-format
bus addresses.

This patch fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1571>,
an NFS/RDMA server crash.  The cause of the crash was found by Vu Pham
of Mellanox.  The fix is along the lines suggested by Steve Wise in
comment #21 in bug 1571.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 9974e886b8dec23e7789be0889cbbc658e97c51b..8a7dd6795fa0a2117f3f21311c9a1a4eccdf4c9c 100644 (file)
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,6 +86,7 @@ struct mlx4_ib_mr {
 
 struct mlx4_ib_fast_reg_page_list {
        struct ib_fast_reg_page_list    ibfrpl;
+       __be64                         *mapped_page_list;
        dma_addr_t                      map;
 };
 

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 8e4d26d56a95f7e0571133915f35476e1860b541..8f3666b20ea43991d2f6f742d70161490b2851c8 100644 (file)
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
        if (!mfrpl)
                return ERR_PTR(-ENOMEM);
 
-       mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+       mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
+       if (!mfrpl->ibfrpl.page_list)
+               goto err_free;
+
+       mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
                                                     size, &mfrpl->map,
                                                     GFP_KERNEL);
        if (!mfrpl->ibfrpl.page_list)
@@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
        return &mfrpl->ibfrpl;
 
 err_free:
+       kfree(mfrpl->ibfrpl.page_list);
        kfree(mfrpl);
        return ERR_PTR(-ENOMEM);
 }
@@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
        struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
        int size = page_list->max_page_list_len * sizeof (u64);
 
-       dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
+       dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
                          mfrpl->map);
+       kfree(mfrpl->ibfrpl.page_list);
        kfree(mfrpl);
 }
 

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f385a24d31d28816aca661f647631e35ce45e09b..20724aee76f4766d80a9884da1e98f38d924ed50 100644 (file)
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
        int i;
 
        for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-               wr->wr.fast_reg.page_list->page_list[i] =
+               mfrpl->mapped_page_list[i] =
                        cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
                                    MLX4_MTT_FLAG_PRESENT);