Commit 1da48f58 authored by Chuck Lever's avatar Chuck Lever Committed by Greg Kroah-Hartman

rxe: IB_WR_REG_MR does not capture MR's iova field

[ Upstream commit b024dd0e ]

FRWR memory registration is done with a series of calls and WRs.
1. ULP invokes ib_dma_map_sg()
2. ULP invokes ib_map_mr_sg()
3. ULP posts an IB_WR_REG_MR on the Send queue

Step 2 generates an iova. It is permissible for ULPs to change this
iova (with certain restrictions) between steps 2 and 3.

rxe_map_mr_sg captures the MR's iova but later when rxe processes the
REG_MR WR, it ignores the MR's iova field. If a ULP alters the MR's iova
after step 2 but before step 3, rxe never captures that change.

When the remote sends an RDMA Read targeting that MR, rxe looks up the
R_key, but the altered iova does not match the iova stored in the MR,
causing the RDMA Read request to fail.
Reported-by: default avatarAnna Schumaker <>
Signed-off-by: default avatarChuck Lever <>
Reviewed-by: Sagi Grimberg's avatarSagi Grimberg <>
Signed-off-by: default avatarJason Gunthorpe <>
Signed-off-by: default avatarSasha Levin <>
parent c5656fd9
......@@ -643,6 +643,7 @@ int rxe_requester(void *arg)
rmr->access = wqe->wr.wr.reg.access;
rmr->lkey = wqe->wr.wr.reg.key;
rmr->rkey = wqe->wr.wr.reg.key;
rmr->iova = wqe->>iova;
wqe->state = wqe_state_done;
wqe->status = IB_WC_SUCCESS;
} else {
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment