xref: /openbmc/linux/net/sunrpc/xprtrdma/frwr_ops.c (revision 6a551c11)
1 /*
2  * Copyright (c) 2015 Oracle.  All rights reserved.
3  * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
4  */
5 
6 /* Lightweight memory registration using Fast Registration Work
7  * Requests (FRWR). Also referred to sometimes as FRMR mode.
8  *
9  * FRWR features ordered asynchronous registration and deregistration
10  * of arbitrarily sized memory regions. This is the fastest and safest
11  * but most complex memory registration mode.
12  */
13 
14 /* Normal operation
15  *
16  * A Memory Region is prepared for RDMA READ or WRITE using a FAST_REG
17  * Work Request (frmr_op_map). When the RDMA operation is finished, this
18  * Memory Region is invalidated using a LOCAL_INV Work Request
19  * (frmr_op_unmap).
20  *
21  * Typically these Work Requests are not signaled, and neither are RDMA
22  * SEND Work Requests (with the exception of signaling occasionally to
23  * prevent provider work queue overflows). This greatly reduces HCA
24  * interrupt workload.
25  *
26  * As an optimization, frwr_op_unmap marks MRs INVALID before the
27  * LOCAL_INV WR is posted. If posting succeeds, the MR is placed on
28  * rb_mws immediately so that no work (like managing a linked list
29  * under a spinlock) is needed in the completion upcall.
30  *
31  * But this means that frwr_op_map() can occasionally encounter an MR
32  * that is INVALID but the LOCAL_INV WR has not completed. Work Queue
33  * ordering prevents a subsequent FAST_REG WR from executing against
34  * that MR while it is still being invalidated.
35  */
36 
37 /* Transport recovery
38  *
39  * ->op_map and the transport connect worker cannot run at the same
40  * time, but ->op_unmap can fire while the transport connect worker
41  * is running. Thus MR recovery is handled in ->op_map, to guarantee
42  * that recovered MRs are owned by a sending RPC, and not one where
43  * ->op_unmap could fire at the same time transport reconnect is
44  * being done.
45  *
46  * When the underlying transport disconnects, MRs are left in one of
47  * three states:
48  *
49  * INVALID:	The MR was not in use before the QP entered ERROR state.
50  *		(Or, the LOCAL_INV WR has not completed or flushed yet).
51  *
52  * STALE:	The MR was being registered or unregistered when the QP
53  *		entered ERROR state, and the pending WR was flushed.
54  *
55  * VALID:	The MR was registered before the QP entered ERROR state.
56  *
57  * When frwr_op_map encounters STALE and VALID MRs, they are recovered
58  * with ib_dereg_mr and then are re-initialized. Beause MR recovery
59  * allocates fresh resources, it is deferred to a workqueue, and the
60  * recovered MRs are placed back on the rb_mws list when recovery is
61  * complete. frwr_op_map allocates another MR for the current RPC while
62  * the broken MR is reset.
63  *
64  * To ensure that frwr_op_map doesn't encounter an MR that is marked
65  * INVALID but that is about to be flushed due to a previous transport
66  * disconnect, the transport connect worker attempts to drain all
67  * pending send queue WRs before the transport is reconnected.
68  */
69 
70 #include "xprt_rdma.h"
71 
72 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
73 # define RPCDBG_FACILITY	RPCDBG_TRANS
74 #endif
75 
76 static struct workqueue_struct *frwr_recovery_wq;
77 
78 #define FRWR_RECOVERY_WQ_FLAGS		(WQ_UNBOUND | WQ_MEM_RECLAIM)
79 
80 int
81 frwr_alloc_recovery_wq(void)
82 {
83 	frwr_recovery_wq = alloc_workqueue("frwr_recovery",
84 					   FRWR_RECOVERY_WQ_FLAGS, 0);
85 	return !frwr_recovery_wq ? -ENOMEM : 0;
86 }
87 
88 void
89 frwr_destroy_recovery_wq(void)
90 {
91 	struct workqueue_struct *wq;
92 
93 	if (!frwr_recovery_wq)
94 		return;
95 
96 	wq = frwr_recovery_wq;
97 	frwr_recovery_wq = NULL;
98 	destroy_workqueue(wq);
99 }
100 
101 static int
102 __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r)
103 {
104 	struct rpcrdma_frmr *f = &r->frmr;
105 	int rc;
106 
107 	rc = ib_dereg_mr(f->fr_mr);
108 	if (rc) {
109 		pr_warn("rpcrdma: ib_dereg_mr status %d, frwr %p orphaned\n",
110 			rc, r);
111 		return rc;
112 	}
113 
114 	f->fr_mr = ib_alloc_mr(ia->ri_pd, IB_MR_TYPE_MEM_REG,
115 			       ia->ri_max_frmr_depth);
116 	if (IS_ERR(f->fr_mr)) {
117 		pr_warn("rpcrdma: ib_alloc_mr status %ld, frwr %p orphaned\n",
118 			PTR_ERR(f->fr_mr), r);
119 		return PTR_ERR(f->fr_mr);
120 	}
121 
122 	dprintk("RPC:       %s: recovered FRMR %p\n", __func__, r);
123 	f->fr_state = FRMR_IS_INVALID;
124 	return 0;
125 }
126 
127 static void
128 __frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
129 {
130 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
131 	struct rpcrdma_frmr *f = &mw->frmr;
132 	int rc;
133 
134 	rc = __frwr_reset_mr(ia, mw);
135 	ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir);
136 	if (rc)
137 		return;
138 
139 	rpcrdma_put_mw(r_xprt, mw);
140 }
141 
142 /* Deferred reset of a single FRMR. Generate a fresh rkey by
143  * replacing the MR.
144  *
145  * There's no recovery if this fails. The FRMR is abandoned, but
146  * remains in rb_all. It will be cleaned up when the transport is
147  * destroyed.
148  */
149 static void
150 __frwr_recovery_worker(struct work_struct *work)
151 {
152 	struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw,
153 					    mw_work);
154 
155 	__frwr_reset_and_unmap(r->mw_xprt, r);
156 	return;
157 }
158 
159 /* A broken MR was discovered in a context that can't sleep.
160  * Defer recovery to the recovery worker.
161  */
162 static void
163 __frwr_queue_recovery(struct rpcrdma_mw *r)
164 {
165 	INIT_WORK(&r->mw_work, __frwr_recovery_worker);
166 	queue_work(frwr_recovery_wq, &r->mw_work);
167 }
168 
169 static int
170 __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
171 	    unsigned int depth)
172 {
173 	struct rpcrdma_frmr *f = &r->frmr;
174 	int rc;
175 
176 	f->fr_mr = ib_alloc_mr(pd, IB_MR_TYPE_MEM_REG, depth);
177 	if (IS_ERR(f->fr_mr))
178 		goto out_mr_err;
179 
180 	f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL);
181 	if (!f->fr_sg)
182 		goto out_list_err;
183 
184 	sg_init_table(f->fr_sg, depth);
185 
186 	init_completion(&f->fr_linv_done);
187 
188 	return 0;
189 
190 out_mr_err:
191 	rc = PTR_ERR(f->fr_mr);
192 	dprintk("RPC:       %s: ib_alloc_mr status %i\n",
193 		__func__, rc);
194 	return rc;
195 
196 out_list_err:
197 	rc = -ENOMEM;
198 	dprintk("RPC:       %s: sg allocation failure\n",
199 		__func__);
200 	ib_dereg_mr(f->fr_mr);
201 	return rc;
202 }
203 
204 static void
205 __frwr_release(struct rpcrdma_mw *r)
206 {
207 	int rc;
208 
209 	rc = ib_dereg_mr(r->frmr.fr_mr);
210 	if (rc)
211 		dprintk("RPC:       %s: ib_dereg_mr status %i\n",
212 			__func__, rc);
213 	kfree(r->frmr.fr_sg);
214 }
215 
216 static int
217 frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
218 	     struct rpcrdma_create_data_internal *cdata)
219 {
220 	int depth, delta;
221 
222 	ia->ri_max_frmr_depth =
223 			min_t(unsigned int, RPCRDMA_MAX_DATA_SEGS,
224 			      ia->ri_device->attrs.max_fast_reg_page_list_len);
225 	dprintk("RPC:       %s: device's max FR page list len = %u\n",
226 		__func__, ia->ri_max_frmr_depth);
227 
228 	/* Add room for frmr register and invalidate WRs.
229 	 * 1. FRMR reg WR for head
230 	 * 2. FRMR invalidate WR for head
231 	 * 3. N FRMR reg WRs for pagelist
232 	 * 4. N FRMR invalidate WRs for pagelist
233 	 * 5. FRMR reg WR for tail
234 	 * 6. FRMR invalidate WR for tail
235 	 * 7. The RDMA_SEND WR
236 	 */
237 	depth = 7;
238 
239 	/* Calculate N if the device max FRMR depth is smaller than
240 	 * RPCRDMA_MAX_DATA_SEGS.
241 	 */
242 	if (ia->ri_max_frmr_depth < RPCRDMA_MAX_DATA_SEGS) {
243 		delta = RPCRDMA_MAX_DATA_SEGS - ia->ri_max_frmr_depth;
244 		do {
245 			depth += 2; /* FRMR reg + invalidate */
246 			delta -= ia->ri_max_frmr_depth;
247 		} while (delta > 0);
248 	}
249 
250 	ep->rep_attr.cap.max_send_wr *= depth;
251 	if (ep->rep_attr.cap.max_send_wr > ia->ri_device->attrs.max_qp_wr) {
252 		cdata->max_requests = ia->ri_device->attrs.max_qp_wr / depth;
253 		if (!cdata->max_requests)
254 			return -EINVAL;
255 		ep->rep_attr.cap.max_send_wr = cdata->max_requests *
256 					       depth;
257 	}
258 
259 	rpcrdma_set_max_header_sizes(ia, cdata, max_t(unsigned int, 1,
260 						      RPCRDMA_MAX_DATA_SEGS /
261 						      ia->ri_max_frmr_depth));
262 	return 0;
263 }
264 
265 /* FRWR mode conveys a list of pages per chunk segment. The
266  * maximum length of that list is the FRWR page list depth.
267  */
268 static size_t
269 frwr_op_maxpages(struct rpcrdma_xprt *r_xprt)
270 {
271 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
272 
273 	return min_t(unsigned int, RPCRDMA_MAX_DATA_SEGS,
274 		     RPCRDMA_MAX_HDR_SEGS * ia->ri_max_frmr_depth);
275 }
276 
277 static void
278 __frwr_sendcompletion_flush(struct ib_wc *wc, struct rpcrdma_frmr *frmr,
279 			    const char *wr)
280 {
281 	frmr->fr_state = FRMR_IS_STALE;
282 	if (wc->status != IB_WC_WR_FLUSH_ERR)
283 		pr_err("rpcrdma: %s: %s (%u/0x%x)\n",
284 		       wr, ib_wc_status_msg(wc->status),
285 		       wc->status, wc->vendor_err);
286 }
287 
288 /**
289  * frwr_wc_fastreg - Invoked by RDMA provider for each polled FastReg WC
290  * @cq:	completion queue (ignored)
291  * @wc:	completed WR
292  *
293  */
294 static void
295 frwr_wc_fastreg(struct ib_cq *cq, struct ib_wc *wc)
296 {
297 	struct rpcrdma_frmr *frmr;
298 	struct ib_cqe *cqe;
299 
300 	/* WARNING: Only wr_cqe and status are reliable at this point */
301 	if (wc->status != IB_WC_SUCCESS) {
302 		cqe = wc->wr_cqe;
303 		frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
304 		__frwr_sendcompletion_flush(wc, frmr, "fastreg");
305 	}
306 }
307 
308 /**
309  * frwr_wc_localinv - Invoked by RDMA provider for each polled LocalInv WC
310  * @cq:	completion queue (ignored)
311  * @wc:	completed WR
312  *
313  */
314 static void
315 frwr_wc_localinv(struct ib_cq *cq, struct ib_wc *wc)
316 {
317 	struct rpcrdma_frmr *frmr;
318 	struct ib_cqe *cqe;
319 
320 	/* WARNING: Only wr_cqe and status are reliable at this point */
321 	if (wc->status != IB_WC_SUCCESS) {
322 		cqe = wc->wr_cqe;
323 		frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
324 		__frwr_sendcompletion_flush(wc, frmr, "localinv");
325 	}
326 }
327 
328 /**
329  * frwr_wc_localinv - Invoked by RDMA provider for each polled LocalInv WC
330  * @cq:	completion queue (ignored)
331  * @wc:	completed WR
332  *
333  * Awaken anyone waiting for an MR to finish being fenced.
334  */
335 static void
336 frwr_wc_localinv_wake(struct ib_cq *cq, struct ib_wc *wc)
337 {
338 	struct rpcrdma_frmr *frmr;
339 	struct ib_cqe *cqe;
340 
341 	/* WARNING: Only wr_cqe and status are reliable at this point */
342 	cqe = wc->wr_cqe;
343 	frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
344 	if (wc->status != IB_WC_SUCCESS)
345 		__frwr_sendcompletion_flush(wc, frmr, "localinv");
346 	complete_all(&frmr->fr_linv_done);
347 }
348 
349 static int
350 frwr_op_init(struct rpcrdma_xprt *r_xprt)
351 {
352 	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
353 	struct ib_device *device = r_xprt->rx_ia.ri_device;
354 	unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth;
355 	struct ib_pd *pd = r_xprt->rx_ia.ri_pd;
356 	int i;
357 
358 	spin_lock_init(&buf->rb_mwlock);
359 	INIT_LIST_HEAD(&buf->rb_mws);
360 	INIT_LIST_HEAD(&buf->rb_all);
361 
362 	i = max_t(int, RPCRDMA_MAX_DATA_SEGS / depth, 1);
363 	i += 2;				/* head + tail */
364 	i *= buf->rb_max_requests;	/* one set for each RPC slot */
365 	dprintk("RPC:       %s: initalizing %d FRMRs\n", __func__, i);
366 
367 	while (i--) {
368 		struct rpcrdma_mw *r;
369 		int rc;
370 
371 		r = kzalloc(sizeof(*r), GFP_KERNEL);
372 		if (!r)
373 			return -ENOMEM;
374 
375 		rc = __frwr_init(r, pd, device, depth);
376 		if (rc) {
377 			kfree(r);
378 			return rc;
379 		}
380 
381 		r->mw_xprt = r_xprt;
382 		list_add(&r->mw_list, &buf->rb_mws);
383 		list_add(&r->mw_all, &buf->rb_all);
384 	}
385 
386 	return 0;
387 }
388 
389 /* Post a FAST_REG Work Request to register a memory region
390  * for remote access via RDMA READ or RDMA WRITE.
391  */
392 static int
393 frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
394 	    int nsegs, bool writing)
395 {
396 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
397 	struct ib_device *device = ia->ri_device;
398 	enum dma_data_direction direction = rpcrdma_data_dir(writing);
399 	struct rpcrdma_mr_seg *seg1 = seg;
400 	struct rpcrdma_mw *mw;
401 	struct rpcrdma_frmr *frmr;
402 	struct ib_mr *mr;
403 	struct ib_reg_wr *reg_wr;
404 	struct ib_send_wr *bad_wr;
405 	int rc, i, n, dma_nents;
406 	u8 key;
407 
408 	mw = seg1->rl_mw;
409 	seg1->rl_mw = NULL;
410 	do {
411 		if (mw)
412 			__frwr_queue_recovery(mw);
413 		mw = rpcrdma_get_mw(r_xprt);
414 		if (!mw)
415 			return -ENOMEM;
416 	} while (mw->frmr.fr_state != FRMR_IS_INVALID);
417 	frmr = &mw->frmr;
418 	frmr->fr_state = FRMR_IS_VALID;
419 	mr = frmr->fr_mr;
420 	reg_wr = &frmr->fr_regwr;
421 
422 	if (nsegs > ia->ri_max_frmr_depth)
423 		nsegs = ia->ri_max_frmr_depth;
424 
425 	for (i = 0; i < nsegs;) {
426 		if (seg->mr_page)
427 			sg_set_page(&frmr->fr_sg[i],
428 				    seg->mr_page,
429 				    seg->mr_len,
430 				    offset_in_page(seg->mr_offset));
431 		else
432 			sg_set_buf(&frmr->fr_sg[i], seg->mr_offset,
433 				   seg->mr_len);
434 
435 		++seg;
436 		++i;
437 
438 		/* Check for holes */
439 		if ((i < nsegs && offset_in_page(seg->mr_offset)) ||
440 		    offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len))
441 			break;
442 	}
443 	frmr->fr_nents = i;
444 	frmr->fr_dir = direction;
445 
446 	dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction);
447 	if (!dma_nents) {
448 		pr_err("RPC:       %s: failed to dma map sg %p sg_nents %u\n",
449 		       __func__, frmr->fr_sg, frmr->fr_nents);
450 		return -ENOMEM;
451 	}
452 
453 	n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE);
454 	if (unlikely(n != frmr->fr_nents)) {
455 		pr_err("RPC:       %s: failed to map mr %p (%u/%u)\n",
456 		       __func__, frmr->fr_mr, n, frmr->fr_nents);
457 		rc = n < 0 ? n : -EINVAL;
458 		goto out_senderr;
459 	}
460 
461 	dprintk("RPC:       %s: Using frmr %p to map %u segments (%u bytes)\n",
462 		__func__, mw, frmr->fr_nents, mr->length);
463 
464 	key = (u8)(mr->rkey & 0x000000FF);
465 	ib_update_fast_reg_key(mr, ++key);
466 
467 	reg_wr->wr.next = NULL;
468 	reg_wr->wr.opcode = IB_WR_REG_MR;
469 	frmr->fr_cqe.done = frwr_wc_fastreg;
470 	reg_wr->wr.wr_cqe = &frmr->fr_cqe;
471 	reg_wr->wr.num_sge = 0;
472 	reg_wr->wr.send_flags = 0;
473 	reg_wr->mr = mr;
474 	reg_wr->key = mr->rkey;
475 	reg_wr->access = writing ?
476 			 IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
477 			 IB_ACCESS_REMOTE_READ;
478 
479 	DECR_CQCOUNT(&r_xprt->rx_ep);
480 	rc = ib_post_send(ia->ri_id->qp, &reg_wr->wr, &bad_wr);
481 	if (rc)
482 		goto out_senderr;
483 
484 	seg1->rl_mw = mw;
485 	seg1->mr_rkey = mr->rkey;
486 	seg1->mr_base = mr->iova;
487 	seg1->mr_nsegs = frmr->fr_nents;
488 	seg1->mr_len = mr->length;
489 
490 	return frmr->fr_nents;
491 
492 out_senderr:
493 	dprintk("RPC:       %s: ib_post_send status %i\n", __func__, rc);
494 	__frwr_queue_recovery(mw);
495 	return rc;
496 }
497 
498 static struct ib_send_wr *
499 __frwr_prepare_linv_wr(struct rpcrdma_mr_seg *seg)
500 {
501 	struct rpcrdma_mw *mw = seg->rl_mw;
502 	struct rpcrdma_frmr *f = &mw->frmr;
503 	struct ib_send_wr *invalidate_wr;
504 
505 	f->fr_state = FRMR_IS_INVALID;
506 	invalidate_wr = &f->fr_invwr;
507 
508 	memset(invalidate_wr, 0, sizeof(*invalidate_wr));
509 	f->fr_cqe.done = frwr_wc_localinv;
510 	invalidate_wr->wr_cqe = &f->fr_cqe;
511 	invalidate_wr->opcode = IB_WR_LOCAL_INV;
512 	invalidate_wr->ex.invalidate_rkey = f->fr_mr->rkey;
513 
514 	return invalidate_wr;
515 }
516 
517 /* Invalidate all memory regions that were registered for "req".
518  *
519  * Sleeps until it is safe for the host CPU to access the
520  * previously mapped memory regions.
521  */
522 static void
523 frwr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
524 {
525 	struct ib_send_wr *invalidate_wrs, *pos, *prev, *bad_wr;
526 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
527 	struct rpcrdma_mr_seg *seg;
528 	unsigned int i, nchunks;
529 	struct rpcrdma_frmr *f;
530 	struct rpcrdma_mw *mw;
531 	int rc;
532 
533 	dprintk("RPC:       %s: req %p\n", __func__, req);
534 
535 	/* ORDER: Invalidate all of the req's MRs first
536 	 *
537 	 * Chain the LOCAL_INV Work Requests and post them with
538 	 * a single ib_post_send() call.
539 	 */
540 	invalidate_wrs = pos = prev = NULL;
541 	seg = NULL;
542 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
543 		seg = &req->rl_segments[i];
544 
545 		pos = __frwr_prepare_linv_wr(seg);
546 
547 		if (!invalidate_wrs)
548 			invalidate_wrs = pos;
549 		else
550 			prev->next = pos;
551 		prev = pos;
552 
553 		i += seg->mr_nsegs;
554 	}
555 	f = &seg->rl_mw->frmr;
556 
557 	/* Strong send queue ordering guarantees that when the
558 	 * last WR in the chain completes, all WRs in the chain
559 	 * are complete.
560 	 */
561 	f->fr_invwr.send_flags = IB_SEND_SIGNALED;
562 	f->fr_cqe.done = frwr_wc_localinv_wake;
563 	reinit_completion(&f->fr_linv_done);
564 	INIT_CQCOUNT(&r_xprt->rx_ep);
565 
566 	/* Transport disconnect drains the receive CQ before it
567 	 * replaces the QP. The RPC reply handler won't call us
568 	 * unless ri_id->qp is a valid pointer.
569 	 */
570 	rc = ib_post_send(ia->ri_id->qp, invalidate_wrs, &bad_wr);
571 	if (rc)
572 		goto reset_mrs;
573 
574 	wait_for_completion(&f->fr_linv_done);
575 
576 	/* ORDER: Now DMA unmap all of the req's MRs, and return
577 	 * them to the free MW list.
578 	 */
579 unmap:
580 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
581 		seg = &req->rl_segments[i];
582 		mw = seg->rl_mw;
583 		seg->rl_mw = NULL;
584 
585 		ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents,
586 				f->fr_dir);
587 		rpcrdma_put_mw(r_xprt, mw);
588 
589 		i += seg->mr_nsegs;
590 		seg->mr_nsegs = 0;
591 	}
592 
593 	req->rl_nchunks = 0;
594 	return;
595 
596 reset_mrs:
597 	pr_warn("%s: ib_post_send failed %i\n", __func__, rc);
598 
599 	/* Find and reset the MRs in the LOCAL_INV WRs that did not
600 	 * get posted. This is synchronous, and slow.
601 	 */
602 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
603 		seg = &req->rl_segments[i];
604 		mw = seg->rl_mw;
605 		f = &mw->frmr;
606 
607 		if (mw->frmr.fr_mr->rkey == bad_wr->ex.invalidate_rkey) {
608 			__frwr_reset_mr(ia, mw);
609 			bad_wr = bad_wr->next;
610 		}
611 
612 		i += seg->mr_nsegs;
613 	}
614 	goto unmap;
615 }
616 
617 /* Use a slow, safe mechanism to invalidate all memory regions
618  * that were registered for "req".
619  */
620 static void
621 frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
622 		   bool sync)
623 {
624 	struct rpcrdma_mr_seg *seg;
625 	struct rpcrdma_mw *mw;
626 	unsigned int i;
627 
628 	for (i = 0; req->rl_nchunks; req->rl_nchunks--) {
629 		seg = &req->rl_segments[i];
630 		mw = seg->rl_mw;
631 
632 		if (sync)
633 			__frwr_reset_and_unmap(r_xprt, mw);
634 		else
635 			__frwr_queue_recovery(mw);
636 
637 		i += seg->mr_nsegs;
638 		seg->mr_nsegs = 0;
639 		seg->rl_mw = NULL;
640 	}
641 }
642 
643 static void
644 frwr_op_destroy(struct rpcrdma_buffer *buf)
645 {
646 	struct rpcrdma_mw *r;
647 
648 	/* Ensure stale MWs for "buf" are no longer in flight */
649 	flush_workqueue(frwr_recovery_wq);
650 
651 	while (!list_empty(&buf->rb_all)) {
652 		r = list_entry(buf->rb_all.next, struct rpcrdma_mw, mw_all);
653 		list_del(&r->mw_all);
654 		__frwr_release(r);
655 		kfree(r);
656 	}
657 }
658 
659 const struct rpcrdma_memreg_ops rpcrdma_frwr_memreg_ops = {
660 	.ro_map				= frwr_op_map,
661 	.ro_unmap_sync			= frwr_op_unmap_sync,
662 	.ro_unmap_safe			= frwr_op_unmap_safe,
663 	.ro_open			= frwr_op_open,
664 	.ro_maxpages			= frwr_op_maxpages,
665 	.ro_init			= frwr_op_init,
666 	.ro_destroy			= frwr_op_destroy,
667 	.ro_displayname			= "frwr",
668 };
669