Merge branch 'nfs-for-2.6.39' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6

* 'nfs-for-2.6.39' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: (54 commits)
  RPC: killing RPC tasks races fixed
  xprt: remove redundant check
  SUNRPC: Convert struct rpc_xprt to use atomic_t counters
  SUNRPC: Ensure we always run the tk_callback before tk_action
  sunrpc: fix printk format warning
  xprt: remove redundant null check
  nfs: BKL is no longer needed, so remove the include
  NFS: Fix a warning in fs/nfs/idmap.c
  Cleanup: Factor out some cut-and-paste code.
  cleanup: save 60 lines/100 bytes by combining two mostly duplicate functions.
  NFS: account direct-io into task io accounting
  gss:krb5 only include enctype numbers in gm_upcall_enctypes
  RPCRDMA: Fix FRMR registration/invalidate handling.
  RPCRDMA: Fix to XDR page base interpretation in marshalling logic.
  NFSv4: Send unmapped uid/gids to the server when using auth_sys
  NFSv4: Propagate the error NFS4ERR_BADOWNER to nfs4_do_setattr
  NFSv4: cleanup idmapper functions to take an nfs_server argument
  NFSv4: Send unmapped uid/gids to the server if the idmapper fails
  NFSv4: If the server sends us a numeric uid/gid then accept it
  NFSv4.1: reject zero layout with zeroed stripe unit
  ...

8 files changed, 120 insertions, 96 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 45dbf1521b9..f3914d0c507 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -417,7 +417,7 @@ static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
                 gss_msg->msg.len += len;
         }
         if (mech->gm_upcall_enctypes) {
-                len = sprintf(p, mech->gm_upcall_enctypes);
+                len = sprintf(p, "enctypes=%s ", mech->gm_upcall_enctypes);
                 p += len;
                 gss_msg->msg.len += len;
         }
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index f375decc024..9022f0a6503 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -750,7 +750,7 @@ static struct gss_api_mech gss_kerberos_mech = {
         .gm_ops         = &gss_kerberos_ops,
         .gm_pf_num      = ARRAY_SIZE(gss_kerberos_pfs),
         .gm_pfs         = gss_kerberos_pfs,
-        .gm_upcall_enctypes = "enctypes=18,17,16,23,3,1,2 ",
+        .gm_upcall_enctypes = "18,17,16,23,3,1,2",
 };
 
 static int __init init_kerberos_module(void)
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 57d344cf225..e7a96e478f6 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)
                 if (!(rovr->tk_flags & RPC_TASK_KILLED)) {
                         rovr->tk_flags |= RPC_TASK_KILLED;
                         rpc_exit(rovr, -EIO);
-                        rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr);
+                        if (RPC_IS_QUEUED(rovr))
+                                rpc_wake_up_queued_task(rovr->tk_waitqueue,
+                                                        rovr);
                 }
         }
         spin_unlock(&clnt->cl_lock);
@@ -597,6 +599,14 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
         }
 }
 
+void rpc_task_reset_client(struct rpc_task *task, struct rpc_clnt *clnt)
+{
+        rpc_task_release_client(task);
+        rpc_task_set_client(task, clnt);
+}
+EXPORT_SYMBOL_GPL(rpc_task_reset_client);
+
+
 static void
 rpc_task_set_rpc_message(struct rpc_task *task, const struct rpc_message *msg)
 {
@@ -636,12 +646,6 @@ struct rpc_task *rpc_run_task(const struct rpc_task_setup *task_setup_data)
         rpc_task_set_client(task, task_setup_data->rpc_client);
         rpc_task_set_rpc_message(task, task_setup_data->rpc_message);
 
-        if (task->tk_status != 0) {
-                int ret = task->tk_status;
-                rpc_put_task(task);
-                return ERR_PTR(ret);
-        }
-
         if (task->tk_action == NULL)
                 rpc_call_start(task);
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 3fc8624fcd1..ffb687671da 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -299,15 +299,8 @@ static void rpc_make_runnable(struct rpc_task *task)
         if (rpc_test_and_set_running(task))
                 return;
         if (RPC_IS_ASYNC(task)) {
-                int status;
-
                 INIT_WORK(&task->u.tk_work, rpc_async_schedule);
-                status = queue_work(rpciod_workqueue, &task->u.tk_work);
-                if (status < 0) {
-                        printk(KERN_WARNING "RPC: failed to add task to queue: error: %d!\n", status);
-                        task->tk_status = status;
-                        return;
-                }
+                queue_work(rpciod_workqueue, &task->u.tk_work);
         } else
                 wake_up_bit(&task->tk_runstate, RPC_TASK_QUEUED);
 }
@@ -637,14 +630,12 @@ static void __rpc_execute(struct rpc_task *task)
                         save_callback = task->tk_callback;
                         task->tk_callback = NULL;
                         save_callback(task);
-                }
-
-                /*
-                 * Perform the next FSM step.
-                 * tk_action may be NULL when the task has been killed
-                 * by someone else.
-                 */
-                if (!RPC_IS_QUEUED(task)) {
+                } else {
+                        /*
+                         * Perform the next FSM step.
+                         * tk_action may be NULL when the task has been killed
+                         * by someone else.
+                         */
                         if (task->tk_action == NULL)
                                 break;
                         task->tk_action(task);
@@ -843,12 +834,6 @@ struct rpc_task *rpc_new_task(const struct rpc_task_setup *setup_data)
         }
 
         rpc_init_task(task, setup_data);
-        if (task->tk_status < 0) {
-                int err = task->tk_status;
-                rpc_put_task(task);
-                return ERR_PTR(err);
-        }
-
         task->tk_flags |= flags;
         dprintk("RPC:       allocated task %p\n", task);
         return task;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 856274d7e85..9494c376735 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -202,10 +202,9 @@ int xprt_reserve_xprt(struct rpc_task *task)
                 goto out_sleep;
         }
         xprt->snd_task = task;
-        if (req) {
-                req->rq_bytes_sent = 0;
-                req->rq_ntrans++;
-        }
+        req->rq_bytes_sent = 0;
+        req->rq_ntrans++;
+
         return 1;
 
 out_sleep:
@@ -213,7 +212,7 @@ out_sleep:
                         task->tk_pid, xprt);
         task->tk_timeout = 0;
         task->tk_status = -EAGAIN;
-        if (req && req->rq_ntrans)
+        if (req->rq_ntrans)
                 rpc_sleep_on(&xprt->resend, task, NULL);
         else
                 rpc_sleep_on(&xprt->sending, task, NULL);
@@ -965,7 +964,7 @@ struct rpc_xprt *xprt_alloc(struct net *net, int size, int max_req)
         xprt = kzalloc(size, GFP_KERNEL);
         if (xprt == NULL)
                 goto out;
-        kref_init(&xprt->kref);
+        atomic_set(&xprt->count, 1);
 
         xprt->max_reqs = max_req;
         xprt->slot = kcalloc(max_req, sizeof(struct rpc_rqst), GFP_KERNEL);
@@ -1145,13 +1144,11 @@ found:
 
 /**
  * xprt_destroy - destroy an RPC transport, killing off all requests.
- * @kref: kref for the transport to destroy
+ * @xprt: transport to destroy
  *
  */
-static void xprt_destroy(struct kref *kref)
+static void xprt_destroy(struct rpc_xprt *xprt)
 {
-        struct rpc_xprt *xprt = container_of(kref, struct rpc_xprt, kref);
-
         dprintk("RPC:       destroying transport %p\n", xprt);
         xprt->shutdown = 1;
         del_timer_sync(&xprt->timer);
@@ -1175,7 +1172,8 @@ static void xprt_destroy(struct kref *kref)
  */
 void xprt_put(struct rpc_xprt *xprt)
 {
-        kref_put(&xprt->kref, xprt_destroy);
+        if (atomic_dec_and_test(&xprt->count))
+                xprt_destroy(xprt);
 }
 
 /**
@@ -1185,6 +1183,7 @@ void xprt_put(struct rpc_xprt *xprt)
  */
 struct rpc_xprt *xprt_get(struct rpc_xprt *xprt)
 {
-        kref_get(&xprt->kref);
-        return xprt;
+        if (atomic_inc_not_zero(&xprt->count))
+                return xprt;
+        return NULL;
 }
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 2ac3f6e8adf..554d0814c87 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -87,6 +87,8 @@ rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos,
         enum rpcrdma_chunktype type, struct rpcrdma_mr_seg *seg, int nsegs)
 {
         int len, n = 0, p;
+        int page_base;
+        struct page **ppages;
 
         if (pos == 0 && xdrbuf->head[0].iov_len) {
                 seg[n].mr_page = NULL;
@@ -95,34 +97,32 @@ rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos,
                 ++n;
         }
 
-        if (xdrbuf->page_len && (xdrbuf->pages[0] != NULL)) {
-                if (n == nsegs)
-                        return 0;
-                seg[n].mr_page = xdrbuf->pages[0];
-                seg[n].mr_offset = (void *)(unsigned long) xdrbuf->page_base;
-                seg[n].mr_len = min_t(u32,
-                        PAGE_SIZE - xdrbuf->page_base, xdrbuf->page_len);
-                len = xdrbuf->page_len - seg[n].mr_len;
+        len = xdrbuf->page_len;
+        ppages = xdrbuf->pages + (xdrbuf->page_base >> PAGE_SHIFT);
+        page_base = xdrbuf->page_base & ~PAGE_MASK;
+        p = 0;
+        while (len && n < nsegs) {
+                seg[n].mr_page = ppages[p];
+                seg[n].mr_offset = (void *)(unsigned long) page_base;
+                seg[n].mr_len = min_t(u32, PAGE_SIZE - page_base, len);
+                BUG_ON(seg[n].mr_len > PAGE_SIZE);
+                len -= seg[n].mr_len;
                 ++n;
-                p = 1;
-                while (len > 0) {
-                        if (n == nsegs)
-                                return 0;
-                        seg[n].mr_page = xdrbuf->pages[p];
-                        seg[n].mr_offset = NULL;
-                        seg[n].mr_len = min_t(u32, PAGE_SIZE, len);
-                        len -= seg[n].mr_len;
-                        ++n;
-                        ++p;
-                }
+                ++p;
+                page_base = 0;  /* page offset only applies to first page */
         }
 
+        /* Message overflows the seg array */
+        if (len && n == nsegs)
+                return 0;
+
         if (xdrbuf->tail[0].iov_len) {
                 /* the rpcrdma protocol allows us to omit any trailing
                  * xdr pad bytes, saving the server an RDMA operation. */
                 if (xdrbuf->tail[0].iov_len < 4 && xprt_rdma_pad_optimize)
                         return n;
                 if (n == nsegs)
+                        /* Tail remains, but we're out of segments */
                         return 0;
                 seg[n].mr_page = NULL;
                 seg[n].mr_offset = xdrbuf->tail[0].iov_base;
@@ -296,6 +296,8 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
         int copy_len;
         unsigned char *srcp, *destp;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(rqst->rq_xprt);
+        int page_base;
+        struct page **ppages;
 
         destp = rqst->rq_svec[0].iov_base;
         curlen = rqst->rq_svec[0].iov_len;
@@ -324,28 +326,25 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
                         __func__, destp + copy_len, curlen);
                 rqst->rq_svec[0].iov_len += curlen;
         }
-
         r_xprt->rx_stats.pullup_copy_count += copy_len;
-        npages = PAGE_ALIGN(rqst->rq_snd_buf.page_base+copy_len) >> PAGE_SHIFT;
+
+        page_base = rqst->rq_snd_buf.page_base;
+        ppages = rqst->rq_snd_buf.pages + (page_base >> PAGE_SHIFT);
+        page_base &= ~PAGE_MASK;
+        npages = PAGE_ALIGN(page_base+copy_len) >> PAGE_SHIFT;
         for (i = 0; copy_len && i < npages; i++) {
-                if (i == 0)
-                        curlen = PAGE_SIZE - rqst->rq_snd_buf.page_base;
-                else
-                        curlen = PAGE_SIZE;
+                curlen = PAGE_SIZE - page_base;
                 if (curlen > copy_len)
                         curlen = copy_len;
                 dprintk("RPC:       %s: page %d destp 0x%p len %d curlen %d\n",
                         __func__, i, destp, copy_len, curlen);
-                srcp = kmap_atomic(rqst->rq_snd_buf.pages[i],
-                                        KM_SKB_SUNRPC_DATA);
-                if (i == 0)
-                        memcpy(destp, srcp+rqst->rq_snd_buf.page_base, curlen);
-                else
-                        memcpy(destp, srcp, curlen);
+                srcp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
+                memcpy(destp, srcp+page_base, curlen);
                 kunmap_atomic(srcp, KM_SKB_SUNRPC_DATA);
                 rqst->rq_svec[0].iov_len += curlen;
                 destp += curlen;
                 copy_len -= curlen;
+                page_base = 0;
         }
         /* header now contains entire send message */
         return pad;
@@ -606,6 +605,8 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
 {
         int i, npages, curlen, olen;
         char *destp;
+        struct page **ppages;
+        int page_base;
 
         curlen = rqst->rq_rcv_buf.head[0].iov_len;
         if (curlen > copy_len) {        /* write chunk header fixup */
@@ -624,32 +625,29 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
         olen = copy_len;
         i = 0;
         rpcx_to_rdmax(rqst->rq_xprt)->rx_stats.fixup_copy_count += olen;
+        page_base = rqst->rq_rcv_buf.page_base;
+        ppages = rqst->rq_rcv_buf.pages + (page_base >> PAGE_SHIFT);
+        page_base &= ~PAGE_MASK;
+
         if (copy_len && rqst->rq_rcv_buf.page_len) {
-                npages = PAGE_ALIGN(rqst->rq_rcv_buf.page_base +
+                npages = PAGE_ALIGN(page_base +
                         rqst->rq_rcv_buf.page_len) >> PAGE_SHIFT;
                 for (; i < npages; i++) {
-                        if (i == 0)
-                                curlen = PAGE_SIZE - rqst->rq_rcv_buf.page_base;
-                        else
-                                curlen = PAGE_SIZE;
+                        curlen = PAGE_SIZE - page_base;
                         if (curlen > copy_len)
                                 curlen = copy_len;
                         dprintk("RPC:       %s: page %d"
                                 " srcp 0x%p len %d curlen %d\n",
                                 __func__, i, srcp, copy_len, curlen);
-                        destp = kmap_atomic(rqst->rq_rcv_buf.pages[i],
-                                                KM_SKB_SUNRPC_DATA);
-                        if (i == 0)
-                                memcpy(destp + rqst->rq_rcv_buf.page_base,
-                                                srcp, curlen);
-                        else
-                                memcpy(destp, srcp, curlen);
-                        flush_dcache_page(rqst->rq_rcv_buf.pages[i]);
+                        destp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
+                        memcpy(destp + page_base, srcp, curlen);
+                        flush_dcache_page(ppages[i]);
                         kunmap_atomic(destp, KM_SKB_SUNRPC_DATA);
                         srcp += curlen;
                         copy_len -= curlen;
                         if (copy_len == 0)
                                 break;
+                        page_base = 0;
                 }
                 rqst->rq_rcv_buf.page_len = olen - copy_len;
         } else
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 5f4c7b3bc71..d4297dc43dc 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -144,6 +144,7 @@ rpcrdma_cq_async_error_upcall(struct ib_event *event, void *context)
 static inline
 void rpcrdma_event_process(struct ib_wc *wc)
 {
+        struct rpcrdma_mw *frmr;
         struct rpcrdma_rep *rep =
                         (struct rpcrdma_rep *)(unsigned long) wc->wr_id;
 
@@ -154,15 +155,23 @@ void rpcrdma_event_process(struct ib_wc *wc)
                 return;
 
         if (IB_WC_SUCCESS != wc->status) {
-                dprintk("RPC:       %s: %s WC status %X, connection lost\n",
-                        __func__, (wc->opcode & IB_WC_RECV) ? "recv" : "send",
-                         wc->status);
+                dprintk("RPC:       %s: WC opcode %d status %X, connection lost\n",
+                        __func__, wc->opcode, wc->status);
                 rep->rr_len = ~0U;
-                rpcrdma_schedule_tasklet(rep);
+                if (wc->opcode != IB_WC_FAST_REG_MR && wc->opcode != IB_WC_LOCAL_INV)
+                        rpcrdma_schedule_tasklet(rep);
                 return;
         }
 
         switch (wc->opcode) {
+        case IB_WC_FAST_REG_MR:
+                frmr = (struct rpcrdma_mw *)(unsigned long)wc->wr_id;
+                frmr->r.frmr.state = FRMR_IS_VALID;
+                break;
+        case IB_WC_LOCAL_INV:
+                frmr = (struct rpcrdma_mw *)(unsigned long)wc->wr_id;
+                frmr->r.frmr.state = FRMR_IS_INVALID;
+                break;
         case IB_WC_RECV:
                 rep->rr_len = wc->byte_len;
                 ib_dma_sync_single_for_cpu(
@@ -1450,6 +1459,12 @@ rpcrdma_map_one(struct rpcrdma_ia *ia, struct rpcrdma_mr_seg *seg, int writing)
                 seg->mr_dma = ib_dma_map_single(ia->ri_id->device,
                                 seg->mr_offset,
                                 seg->mr_dmalen, seg->mr_dir);
+        if (ib_dma_mapping_error(ia->ri_id->device, seg->mr_dma)) {
+                dprintk("RPC:       %s: mr_dma %llx mr_offset %p mr_dma_len %zu\n",
+                        __func__,
+                        (unsigned long long)seg->mr_dma,
+                        seg->mr_offset, seg->mr_dmalen);
+        }
 }
 
 static void
@@ -1469,7 +1484,8 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
                         struct rpcrdma_xprt *r_xprt)
 {
         struct rpcrdma_mr_seg *seg1 = seg;
-        struct ib_send_wr frmr_wr, *bad_wr;
+        struct ib_send_wr invalidate_wr, frmr_wr, *bad_wr, *post_wr;
+
         u8 key;
         int len, pageoff;
         int i, rc;
@@ -1484,6 +1500,7 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
                 rpcrdma_map_one(ia, seg, writing);
                 seg1->mr_chunk.rl_mw->r.frmr.fr_pgl->page_list[i] = seg->mr_dma;
                 len += seg->mr_len;
+                BUG_ON(seg->mr_len > PAGE_SIZE);
                 ++seg;
                 ++i;
                 /* Check for holes */
@@ -1494,26 +1511,45 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         dprintk("RPC:       %s: Using frmr %p to map %d segments\n",
                 __func__, seg1->mr_chunk.rl_mw, i);
 
+        if (unlikely(seg1->mr_chunk.rl_mw->r.frmr.state == FRMR_IS_VALID)) {
+                dprintk("RPC:       %s: frmr %x left valid, posting invalidate.\n",
+                        __func__,
+                        seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey);
+                /* Invalidate before using. */
+                memset(&invalidate_wr, 0, sizeof invalidate_wr);
+                invalidate_wr.wr_id = (unsigned long)(void *)seg1->mr_chunk.rl_mw;
+                invalidate_wr.next = &frmr_wr;
+                invalidate_wr.opcode = IB_WR_LOCAL_INV;
+                invalidate_wr.send_flags = IB_SEND_SIGNALED;
+                invalidate_wr.ex.invalidate_rkey =
+                        seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
+                DECR_CQCOUNT(&r_xprt->rx_ep);
+                post_wr = &invalidate_wr;
+        } else
+                post_wr = &frmr_wr;
+
         /* Bump the key */
         key = (u8)(seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey & 0x000000FF);
         ib_update_fast_reg_key(seg1->mr_chunk.rl_mw->r.frmr.fr_mr, ++key);
 
         /* Prepare FRMR WR */
         memset(&frmr_wr, 0, sizeof frmr_wr);
+        frmr_wr.wr_id = (unsigned long)(void *)seg1->mr_chunk.rl_mw;
         frmr_wr.opcode = IB_WR_FAST_REG_MR;
-        frmr_wr.send_flags = 0;                 /* unsignaled */
+        frmr_wr.send_flags = IB_SEND_SIGNALED;
         frmr_wr.wr.fast_reg.iova_start = seg1->mr_dma;
         frmr_wr.wr.fast_reg.page_list = seg1->mr_chunk.rl_mw->r.frmr.fr_pgl;
         frmr_wr.wr.fast_reg.page_list_len = i;
         frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         frmr_wr.wr.fast_reg.length = i << PAGE_SHIFT;
+        BUG_ON(frmr_wr.wr.fast_reg.length < len);
         frmr_wr.wr.fast_reg.access_flags = (writing ?
                                 IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
                                 IB_ACCESS_REMOTE_READ);
         frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
         DECR_CQCOUNT(&r_xprt->rx_ep);
 
-        rc = ib_post_send(ia->ri_id->qp, &frmr_wr, &bad_wr);
+        rc = ib_post_send(ia->ri_id->qp, post_wr, &bad_wr);
 
         if (rc) {
                 dprintk("RPC:       %s: failed ib_post_send for register,"
@@ -1542,8 +1578,9 @@ rpcrdma_deregister_frmr_external(struct rpcrdma_mr_seg *seg,
                 rpcrdma_unmap_one(ia, seg++);
 
         memset(&invalidate_wr, 0, sizeof invalidate_wr);
+        invalidate_wr.wr_id = (unsigned long)(void *)seg1->mr_chunk.rl_mw;
         invalidate_wr.opcode = IB_WR_LOCAL_INV;
-        invalidate_wr.send_flags = 0;                   /* unsignaled */
+        invalidate_wr.send_flags = IB_SEND_SIGNALED;
         invalidate_wr.ex.invalidate_rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
         DECR_CQCOUNT(&r_xprt->rx_ep);
 
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index c7a7eba991b..cae761a8536 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -164,6 +164,7 @@ struct rpcrdma_mr_seg {		/* chunk descriptors */
                                 struct {
                                         struct ib_fast_reg_page_list *fr_pgl;
                                         struct ib_mr *fr_mr;
+                                        enum { FRMR_IS_INVALID, FRMR_IS_VALID  } state;
                                 } frmr;
                         } r;
                         struct list_head mw_list;