Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
 "This is pretty much just the usual array of smallish driver bugs.

   - remove bouncing addresses from the MAINTAINERS file

   - kernel oops and bad error handling fixes for hfi, i40iw, cxgb4, and
     hns drivers

   - various small LOC behavioral/operational bugs in mlx5, hns, qedr
     and i40iw drivers

   - two fixes for patches already sent during the merge window

   - a long-standing bug related to not decreasing the pinned pages
     count in the right MM was found and fixed"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits)
  RDMA/hns: Move the location for initializing tmp_len
  RDMA/hns: Bugfix for cq record db for kernel
  IB/uverbs: Fix uverbs_attr_get_obj
  RDMA/qedr: Fix doorbell bar mapping for dpi > 1
  IB/umem: Use the correct mm during ib_umem_release
  iw_cxgb4: Fix an error handling path in 'c4iw_get_dma_mr()'
  RDMA/i40iw: Avoid panic when reading back the IRQ affinity hint
  RDMA/i40iw: Avoid reference leaks when processing the AEQ
  RDMA/i40iw: Avoid panic when objects are being created and destroyed
  RDMA/hns: Fix the bug with NULL pointer
  RDMA/hns: Set NULL for __internal_mr
  RDMA/hns: Enable inner_pa_vld filed of mpt
  RDMA/hns: Set desc_dma_addr for zero when free cmq desc
  RDMA/hns: Fix the bug with rq sge
  RDMA/hns: Not support qp transition from reset to reset for hip06
  RDMA/hns: Add return operation when configured global param fail
  RDMA/hns: Update convert function of endian format
  RDMA/hns: Load the RoCE dirver automatically
  RDMA/hns: Bugfix for rq record db for kernel
  RDMA/hns: Add rq inline flags judgement
  ...

29 files changed, 116 insertions, 98 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 078fd80f664f..a9ca122957e9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5388,7 +5388,6 @@ S:	Maintained
 F:      drivers/iommu/exynos-iommu.c
 
 EZchip NPS platform support
-M:      Elad Kanfi <eladkan@mellanox.com>
 M:      Vineet Gupta <vgupta@synopsys.com>
 S:      Supported
 F:      arch/arc/plat-eznps
@@ -9021,7 +9020,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlx5/core/en_*
 
 MELLANOX ETHERNET INNOVA DRIVER
-M:      Ilan Tayari <ilant@mellanox.com>
 R:      Boris Pismenny <borisp@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
@@ -9031,7 +9029,6 @@ F:	drivers/net/ethernet/mellanox/mlx5/core/fpga/*
 F:      include/linux/mlx5/mlx5_ifc_fpga.h
 
 MELLANOX ETHERNET INNOVA IPSEC DRIVER
-M:      Ilan Tayari <ilant@mellanox.com>
 R:      Boris Pismenny <borisp@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
@@ -9087,7 +9084,6 @@ F:	include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX5 core VPI driver
 M:      Saeed Mahameed <saeedm@mellanox.com>
-M:      Matan Barak <matanb@mellanox.com>
 M:      Leon Romanovsky <leonro@mellanox.com>
 L:      netdev@vger.kernel.org
 L:      linux-rdma@vger.kernel.org
@@ -9098,7 +9094,6 @@ F:	drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
 
 MELLANOX MLX5 IB driver
-M:      Matan Barak <matanb@mellanox.com>
 M:      Leon Romanovsky <leonro@mellanox.com>
 L:      linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
@@ -9832,7 +9827,6 @@ F:	net/netfilter/xt_CONNSECMARK.c
 F:      net/netfilter/xt_SECMARK.c
 
 NETWORKING [TLS]
-M:      Ilya Lesokhin <ilyal@mellanox.com>
 M:      Aviad Yehezkel <aviadye@mellanox.com>
 M:      Dave Watson <davejwatson@fb.com>
 L:      netdev@vger.kernel.org
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 9a4e899d94b3..2b6c9b516070 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -119,7 +119,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
         umem->length     = size;
         umem->address    = addr;
         umem->page_shift = PAGE_SHIFT;
-        umem->pid        = get_task_pid(current, PIDTYPE_PID);
         /*
          * We ask for writable memory if any of the following
          * access flags are set.  "Local write" and "remote write"
@@ -132,7 +131,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                  IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND));
 
         if (access & IB_ACCESS_ON_DEMAND) {
-                put_pid(umem->pid);
                 ret = ib_umem_odp_get(context, umem, access);
                 if (ret) {
                         kfree(umem);
@@ -148,7 +146,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 
         page_list = (struct page **) __get_free_page(GFP_KERNEL);
         if (!page_list) {
-                put_pid(umem->pid);
                 kfree(umem);
                 return ERR_PTR(-ENOMEM);
         }
@@ -231,7 +228,6 @@ out:
         if (ret < 0) {
                 if (need_release)
                         __ib_umem_release(context->device, umem, 0);
-                put_pid(umem->pid);
                 kfree(umem);
         } else
                 current->mm->pinned_vm = locked;
@@ -274,8 +270,7 @@ void ib_umem_release(struct ib_umem *umem)
 
         __ib_umem_release(umem->context->device, umem, 1);
 
-        task = get_pid_task(umem->pid, PIDTYPE_PID);
-        put_pid(umem->pid);
+        task = get_pid_task(umem->context->tgid, PIDTYPE_PID);
         if (!task)
                 goto out;
         mm = get_task_mm(task);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index e90f2fd8dc16..1445918e3239 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -489,10 +489,10 @@ struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
 err_dereg_mem:
         dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
                   mhp->attr.pbl_addr, mhp->dereg_skb, mhp->wr_waitp);
-err_free_wr_wait:
-        c4iw_put_wr_wait(mhp->wr_waitp);
 err_free_skb:
         kfree_skb(mhp->dereg_skb);
+err_free_wr_wait:
+        c4iw_put_wr_wait(mhp->wr_waitp);
 err_free_mhp:
         kfree(mhp);
         return ERR_PTR(ret);
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index e6a60fa59f2b..e6bdd0c1e80a 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -5944,6 +5944,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
         u64 status;
         u32 sw_index;
         int i = 0;
+        unsigned long irq_flags;
 
         sw_index = dd->hw_to_sw[hw_context];
         if (sw_index >= dd->num_send_contexts) {
@@ -5953,10 +5954,12 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
                 return;
         }
         sci = &dd->send_contexts[sw_index];
+        spin_lock_irqsave(&dd->sc_lock, irq_flags);
         sc = sci->sc;
         if (!sc) {
                 dd_dev_err(dd, "%s: context %u(%u): no sc?\n", __func__,
                            sw_index, hw_context);
+                spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
                 return;
         }
 
@@ -5978,6 +5981,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
          */
         if (sc->type != SC_USER)
                 queue_work(dd->pport->hfi1_wq, &sc->halt_work);
+        spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
 
         /*
          * Update the counters for the corresponding status bits.
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index 14734d0d0b76..3a485f50fede 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -377,6 +377,7 @@ struct ib_cq *hns_roce_ib_create_cq(struct ib_device *ib_dev,
 
                         hr_cq->set_ci_db = hr_cq->db.db_record;
                         *hr_cq->set_ci_db = 0;
+                        hr_cq->db_en = 1;
                 }
 
                 /* Init mmt table and write buff address to mtt table */
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 47e1b6ac1e1a..8013d69c5ac4 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -722,6 +722,7 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
         free_mr->mr_free_pd = to_hr_pd(pd);
         free_mr->mr_free_pd->ibpd.device  = &hr_dev->ib_dev;
         free_mr->mr_free_pd->ibpd.uobject = NULL;
+        free_mr->mr_free_pd->ibpd.__internal_mr = NULL;
         atomic_set(&free_mr->mr_free_pd->ibpd.usecnt, 0);
 
         attr.qp_access_flags    = IB_ACCESS_REMOTE_WRITE;
@@ -1036,7 +1037,7 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
 
         do {
                 ret = hns_roce_v1_poll_cq(&mr_free_cq->ib_cq, ne, wc);
-                if (ret < 0) {
+                if (ret < 0 && hr_qp) {
                         dev_err(dev,
                            "(qp:0x%lx) starts, Poll cqe failed(%d) for mr 0x%x free! Remain %d cqe\n",
                            hr_qp->qpn, ret, hr_mr->key, ne);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 25916e8522ed..1f0965bb64ee 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -142,8 +142,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         unsigned long flags;
         unsigned int ind;
         void *wqe = NULL;
-        u32 tmp_len = 0;
         bool loopback;
+        u32 tmp_len;
         int ret = 0;
         u8 *smac;
         int nreq;
@@ -189,6 +189,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                 owner_bit =
                        ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
+                tmp_len = 0;
 
                 /* Corresponding to the QP type, wqe process separately */
                 if (ibqp->qp_type == IB_QPT_GSI) {
@@ -547,16 +548,20 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 }
 
                 if (i < hr_qp->rq.max_gs) {
-                        dseg[i].lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
-                        dseg[i].addr = 0;
+                        dseg->lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
+                        dseg->addr = 0;
                 }
 
                 /* rq support inline data */
-                sge_list = hr_qp->rq_inl_buf.wqe_list[ind].sg_list;
-                hr_qp->rq_inl_buf.wqe_list[ind].sge_cnt = (u32)wr->num_sge;
-                for (i = 0; i < wr->num_sge; i++) {
-                        sge_list[i].addr = (void *)(u64)wr->sg_list[i].addr;
-                        sge_list[i].len = wr->sg_list[i].length;
+                if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) {
+                        sge_list = hr_qp->rq_inl_buf.wqe_list[ind].sg_list;
+                        hr_qp->rq_inl_buf.wqe_list[ind].sge_cnt =
+                                                               (u32)wr->num_sge;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                sge_list[i].addr =
+                                               (void *)(u64)wr->sg_list[i].addr;
+                                sge_list[i].len = wr->sg_list[i].length;
+                        }
                 }
 
                 hr_qp->rq.wrid[ind] = wr->wr_id;
@@ -613,6 +618,8 @@ static void hns_roce_free_cmq_desc(struct hns_roce_dev *hr_dev,
         dma_unmap_single(hr_dev->dev, ring->desc_dma_addr,
                          ring->desc_num * sizeof(struct hns_roce_cmq_desc),
                          DMA_BIDIRECTIONAL);
+
+        ring->desc_dma_addr = 0;
         kfree(ring->desc);
 }
 
@@ -1081,6 +1088,7 @@ static int hns_roce_v2_profile(struct hns_roce_dev *hr_dev)
         if (ret) {
                 dev_err(hr_dev->dev, "Configure global param fail, ret = %d.\n",
                         ret);
+                return ret;
         }
 
         /* Get pf resource owned by every pf */
@@ -1372,6 +1380,8 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
 
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S,
                      mr->type == MR_TYPE_MR ? 0 : 1);
+        roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_INNER_PA_VLD_S,
+                     1);
         mpt_entry->byte_12_mw_pa = cpu_to_le32(mpt_entry->byte_12_mw_pa);
 
         mpt_entry->len_l = cpu_to_le32(lower_32_bits(mr->size));
@@ -2169,6 +2179,7 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp,
                                     struct hns_roce_v2_qp_context *context,
                                     struct hns_roce_v2_qp_context *qpc_mask)
 {
+        struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
         struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
 
         /*
@@ -2281,7 +2292,8 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp,
         context->rq_db_record_addr = hr_qp->rdb.dma >> 32;
         qpc_mask->rq_db_record_addr = 0;
 
-        roce_set_bit(context->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S, 1);
+        roce_set_bit(context->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S,
+                    (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) ? 1 : 0);
         roce_set_bit(qpc_mask->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S, 0);
 
         roce_set_field(context->byte_80_rnr_rx_cqn, V2_QPC_BYTE_80_RX_CQN_M,
@@ -4703,6 +4715,8 @@ static const struct pci_device_id hns_roce_hw_v2_pci_tbl[] = {
         {0, }
 };
 
+MODULE_DEVICE_TABLE(pci, hns_roce_hw_v2_pci_tbl);
+
 static int hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev,
                                   struct hnae3_handle *handle)
 {
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index 9d48bc07a9e6..96fb6a9ed93c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -199,7 +199,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev,
 
         memset(props, 0, sizeof(*props));
 
-        props->sys_image_guid = cpu_to_be32(hr_dev->sys_image_guid);
+        props->sys_image_guid = cpu_to_be64(hr_dev->sys_image_guid);
         props->max_mr_size = (u64)(~(0ULL));
         props->page_size_cap = hr_dev->caps.page_size_cap;
         props->vendor_id = hr_dev->vendor_id;
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index d4aad34c21e2..baaf906f7c2e 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -660,6 +660,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
                                 goto err_rq_sge_list;
                         }
                         *hr_qp->rdb.db_record = 0;
+                        hr_qp->rdb_en = 1;
                 }
 
                 /* Allocate QP buf */
@@ -955,7 +956,14 @@ int hns_roce_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         }
 
         if (cur_state == new_state && cur_state == IB_QPS_RESET) {
-                ret = 0;
+                if (hr_dev->caps.min_wqes) {
+                        ret = -EPERM;
+                        dev_err(dev, "cur_state=%d new_state=%d\n", cur_state,
+                                new_state);
+                } else {
+                        ret = 0;
+                }
+
                 goto out;
         }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index d5d8c1be345a..2f2b4426ded7 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -207,6 +207,7 @@ struct i40iw_msix_vector {
         u32 irq;
         u32 cpu_affinity;
         u32 ceq_id;
+        cpumask_t mask;
 };
 
 struct l2params_work {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 4cfa8f4647e2..f7c6fd9ff6e2 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -2093,7 +2093,7 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
         if (netif_is_bond_slave(netdev))
                 netdev = netdev_master_upper_dev_get(netdev);
 
-        neigh = dst_neigh_lookup(dst, &dst_addr);
+        neigh = dst_neigh_lookup(dst, dst_addr.sin6_addr.in6_u.u6_addr32);
 
         rcu_read_lock();
         if (neigh) {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 6139836fb533..c9f62ca7643c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -331,7 +331,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev)
                 switch (info->ae_id) {
                 case I40IW_AE_LLP_FIN_RECEIVED:
                         if (qp->term_flags)
-                                continue;
+                                break;
                         if (atomic_inc_return(&iwqp->close_timer_started) == 1) {
                                 iwqp->hw_tcp_state = I40IW_TCP_STATE_CLOSE_WAIT;
                                 if ((iwqp->hw_tcp_state == I40IW_TCP_STATE_CLOSE_WAIT) &&
@@ -360,7 +360,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev)
                         break;
                 case I40IW_AE_LLP_CONNECTION_RESET:
                         if (atomic_read(&iwqp->close_timer_started))
-                                continue;
+                                break;
                         i40iw_cm_disconn(iwqp);
                         break;
                 case I40IW_AE_QP_SUSPEND_COMPLETE:
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 9cd0d3ef9057..05001e6da1f8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -687,7 +687,6 @@ static enum i40iw_status_code i40iw_configure_ceq_vector(struct i40iw_device *iw
                                                          struct i40iw_msix_vector *msix_vec)
 {
         enum i40iw_status_code status;
-        cpumask_t mask;
 
         if (iwdev->msix_shared && !ceq_id) {
                 tasklet_init(&iwdev->dpc_tasklet, i40iw_dpc, (unsigned long)iwdev);
@@ -697,9 +696,9 @@ static enum i40iw_status_code i40iw_configure_ceq_vector(struct i40iw_device *iw
                 status = request_irq(msix_vec->irq, i40iw_ceq_handler, 0, "CEQ", iwceq);
         }
 
-        cpumask_clear(&mask);
-        cpumask_set_cpu(msix_vec->cpu_affinity, &mask);
-        irq_set_affinity_hint(msix_vec->irq, &mask);
+        cpumask_clear(&msix_vec->mask);
+        cpumask_set_cpu(msix_vec->cpu_affinity, &msix_vec->mask);
+        irq_set_affinity_hint(msix_vec->irq, &msix_vec->mask);
 
         if (status) {
                 i40iw_pr_err("ceq irq config fail\n");
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 40e4f5ab2b46..68679ad4c6da 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -394,6 +394,7 @@ static struct i40iw_pbl *i40iw_get_pbl(unsigned long va,
 
         list_for_each_entry(iwpbl, pbl_list, list) {
                 if (iwpbl->user_base == va) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
                         return iwpbl;
                 }
@@ -614,6 +615,7 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
                 return ERR_PTR(-ENOMEM);
 
         iwqp = (struct i40iw_qp *)mem;
+        iwqp->allocated_buffer = mem;
         qp = &iwqp->sc_qp;
         qp->back_qp = (void *)iwqp;
         qp->push_idx = I40IW_INVALID_PUSH_PAGE_INDEX;
@@ -642,7 +644,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
                 goto error;
         }
 
-        iwqp->allocated_buffer = mem;
         iwqp->iwdev = iwdev;
         iwqp->iwpd = iwpd;
         iwqp->ibqp.qp_num = qp_num;
@@ -1898,6 +1899,7 @@ static struct ib_mr *i40iw_reg_user_mr(struct ib_pd *pd,
                         goto error;
                 spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
                 list_add_tail(&iwpbl->list, &ucontext->qp_reg_mem_list);
+                iwpbl->on_list = true;
                 spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_CQ:
@@ -1908,6 +1910,7 @@ static struct ib_mr *i40iw_reg_user_mr(struct ib_pd *pd,
 
                 spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
                 list_add_tail(&iwpbl->list, &ucontext->cq_reg_mem_list);
+                iwpbl->on_list = true;
                 spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_MEM:
@@ -2045,14 +2048,18 @@ static void i40iw_del_memlist(struct i40iw_mr *iwmr,
         switch (iwmr->type) {
         case IW_MEMREG_TYPE_CQ:
                 spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
-                if (!list_empty(&ucontext->cq_reg_mem_list))
+                if (iwpbl->on_list) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
+                }
                 spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_QP:
                 spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
-                if (!list_empty(&ucontext->qp_reg_mem_list))
+                if (iwpbl->on_list) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
+                }
                 spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
                 break;
         default:
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.h b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
index 9067443cd311..76cf173377ab 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
@@ -78,6 +78,7 @@ struct i40iw_pbl {
         };
 
         bool pbl_allocated;
+        bool on_list;
         u64 user_base;
         struct i40iw_pble_alloc pble_alloc;
         struct i40iw_mr *iwmr;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index b4d8ff8ab807..69716a7ea993 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2416,7 +2416,7 @@ static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
         MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
 }
 
-static void set_flow_label(void *misc_c, void *misc_v, u8 mask, u8 val,
+static void set_flow_label(void *misc_c, void *misc_v, u32 mask, u32 val,
                            bool inner)
 {
         if (inner) {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 87b7c1be2a11..2193dc1765fb 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -484,11 +484,6 @@ static int qp_has_rq(struct ib_qp_init_attr *attr)
         return 1;
 }
 
-static int first_med_bfreg(void)
-{
-        return 1;
-}
-
 enum {
         /* this is the first blue flame register in the array of bfregs assigned
          * to a processes. Since we do not use it for blue flame but rather
@@ -514,6 +509,12 @@ static int num_med_bfreg(struct mlx5_ib_dev *dev,
         return n >= 0 ? n : 0;
 }
 
+static int first_med_bfreg(struct mlx5_ib_dev *dev,
+                           struct mlx5_bfreg_info *bfregi)
+{
+        return num_med_bfreg(dev, bfregi) ? 1 : -ENOMEM;
+}
+
 static int first_hi_bfreg(struct mlx5_ib_dev *dev,
                           struct mlx5_bfreg_info *bfregi)
 {
@@ -541,10 +542,13 @@ static int alloc_high_class_bfreg(struct mlx5_ib_dev *dev,
 static int alloc_med_class_bfreg(struct mlx5_ib_dev *dev,
                                  struct mlx5_bfreg_info *bfregi)
 {
-        int minidx = first_med_bfreg();
+        int minidx = first_med_bfreg(dev, bfregi);
         int i;
 
-        for (i = first_med_bfreg(); i < first_hi_bfreg(dev, bfregi); i++) {
+        if (minidx < 0)
+                return minidx;
+
+        for (i = minidx; i < first_hi_bfreg(dev, bfregi); i++) {
                 if (bfregi->count[i] < bfregi->count[minidx])
                         minidx = i;
                 if (!bfregi->count[minidx])
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 7d3763b2e01c..3f9afc02d166 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -401,49 +401,47 @@ int qedr_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
 {
         struct qedr_ucontext *ucontext = get_qedr_ucontext(context);
         struct qedr_dev *dev = get_qedr_dev(context->device);
-        unsigned long vm_page = vma->vm_pgoff << PAGE_SHIFT;
-        u64 unmapped_db = dev->db_phys_addr;
+        unsigned long phys_addr = vma->vm_pgoff << PAGE_SHIFT;
         unsigned long len = (vma->vm_end - vma->vm_start);
-        int rc = 0;
-        bool found;
+        unsigned long dpi_start;
+
+        dpi_start = dev->db_phys_addr + (ucontext->dpi * ucontext->dpi_size);
 
         DP_DEBUG(dev, QEDR_MSG_INIT,
-                 "qedr_mmap called vm_page=0x%lx vm_pgoff=0x%lx unmapped_db=0x%llx db_size=%x, len=%lx\n",
-                 vm_page, vma->vm_pgoff, unmapped_db, dev->db_size, len);
-        if (vma->vm_start & (PAGE_SIZE - 1)) {
-                DP_ERR(dev, "Vma_start not page aligned = %ld\n",
-                       vma->vm_start);
+                 "mmap invoked with vm_start=0x%pK, vm_end=0x%pK,vm_pgoff=0x%pK; dpi_start=0x%pK dpi_size=0x%x\n",
+                 (void *)vma->vm_start, (void *)vma->vm_end,
+                 (void *)vma->vm_pgoff, (void *)dpi_start, ucontext->dpi_size);
+
+        if ((vma->vm_start & (PAGE_SIZE - 1)) || (len & (PAGE_SIZE - 1))) {
+                DP_ERR(dev,
+                       "failed mmap, adrresses must be page aligned: start=0x%pK, end=0x%pK\n",
+                       (void *)vma->vm_start, (void *)vma->vm_end);
                 return -EINVAL;
         }
 
-        found = qedr_search_mmap(ucontext, vm_page, len);
-        if (!found) {
-                DP_ERR(dev, "Vma_pgoff not found in mapped array = %ld\n",
+        if (!qedr_search_mmap(ucontext, phys_addr, len)) {
+                DP_ERR(dev, "failed mmap, vm_pgoff=0x%lx is not authorized\n",
                        vma->vm_pgoff);
                 return -EINVAL;
         }
 
-        DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping doorbell bar\n");
-
-        if ((vm_page >= unmapped_db) && (vm_page <= (unmapped_db +
-                                                     dev->db_size))) {
-                DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping doorbell bar\n");
-                if (vma->vm_flags & VM_READ) {
-                        DP_ERR(dev, "Trying to map doorbell bar for read\n");
-                        return -EPERM;
-                }
-
-                vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        if (phys_addr < dpi_start ||
+            ((phys_addr + len) > (dpi_start + ucontext->dpi_size))) {
+                DP_ERR(dev,
+                       "failed mmap, pages are outside of dpi; page address=0x%pK, dpi_start=0x%pK, dpi_size=0x%x\n",
+                       (void *)phys_addr, (void *)dpi_start,
+                       ucontext->dpi_size);
+                return -EINVAL;
+        }
 
-                rc = io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-                                        PAGE_SIZE, vma->vm_page_prot);
-        } else {
-                DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping chains\n");
-                rc = remap_pfn_range(vma, vma->vm_start,
-                                     vma->vm_pgoff, len, vma->vm_page_prot);
+        if (vma->vm_flags & VM_READ) {
+                DP_ERR(dev, "failed mmap, cannot map doorbell bar for read\n");
+                return -EINVAL;
         }
-        DP_DEBUG(dev, QEDR_MSG_INIT, "qedr_mmap return code: %d\n", rc);
-        return rc;
+
+        vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        return io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, len,
+                                  vma->vm_page_prot);
 }
 
 struct ib_pd *qedr_alloc_pd(struct ib_device *ibdev,
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 2cb52fd48cf1..73a00a1c06f6 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -761,7 +761,6 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, struct ib_send_wr *wr,
         unsigned int mask;
         unsigned int length = 0;
         int i;
-        int must_sched;
 
         while (wr) {
                 mask = wr_opcode_mask(wr->opcode, qp);
@@ -791,14 +790,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, struct ib_send_wr *wr,
                 wr = wr->next;
         }
 
-        /*
-         * Must sched in case of GSI QP because ib_send_mad() hold irq lock,
-         * and the requester call ip_local_out_sk() that takes spin_lock_bh.
-         */
-        must_sched = (qp_type(qp) == IB_QPT_GSI) ||
-                        (queue_count(qp->sq.queue) > 1);
-
-        rxe_run_task(&qp->req.task, must_sched);
+        rxe_run_task(&qp->req.task, 1);
         if (unlikely(qp->req.state == QP_STATE_ERROR))
                 rxe_run_task(&qp->comp.task, 1);
 
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index fb8b7182f05e..25bf6955b6d0 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
         tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
+        depends on INFINIBAND_ADDR_TRANS && TARGET_CORE
         ---help---
 
           Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 88a8b5916624..dbb7464c018c 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
+        depends on INFINIBAND_ADDR_TRANS && BLOCK
         select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 3c7b61ddb0d1..7595664ee753 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 
 config NVME_TARGET_RDMA
         tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on INFINIBAND_ADDR_TRANS
         depends on NVME_TARGET
         select SGL_ALLOC
         help
diff --git a/drivers/staging/lustre/lnet/Kconfig b/drivers/staging/lustre/lnet/Kconfig
index ad049e6f24e4..f3b1ad4bd3dc 100644
--- a/drivers/staging/lustre/lnet/Kconfig
+++ b/drivers/staging/lustre/lnet/Kconfig
@@ -34,7 +34,7 @@ config LNET_SELFTEST
 
 config LNET_XPRT_IB
         tristate "LNET infiniband support"
-        depends on LNET && PCI && INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on LNET && PCI && INFINIBAND_ADDR_TRANS
         default LNET && INFINIBAND
         help
           This option allows the LNET users to use infiniband as an
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 5f132d59dfc2..d61e2de8d0eb 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -197,7 +197,7 @@ config CIFS_SMB311
 
 config CIFS_SMB_DIRECT
         bool "SMB Direct support (Experimental)"
-        depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
+        depends on CIFS=m && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND_ADDR_TRANS=y
         help
           Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1.
           SMB Direct allows transferring SMB packets over RDMA. If unsure,
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 23159dd5be18..a1fd63871d17 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -48,7 +48,6 @@ struct ib_umem {
         int                     writable;
         int                     hugetlb;
         struct work_struct      work;
-        struct pid             *pid;
         struct mm_struct       *mm;
         unsigned long           diff;
         struct ib_umem_odp     *odp_data;
diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
index 4a4201d997a7..095383a4bd1a 100644
--- a/include/rdma/uverbs_ioctl.h
+++ b/include/rdma/uverbs_ioctl.h
@@ -411,13 +411,13 @@ static inline int uverbs_attr_get_enum_id(const struct uverbs_attr_bundle *attrs
 static inline void *uverbs_attr_get_obj(const struct uverbs_attr_bundle *attrs_bundle,
                                         u16 idx)
 {
-        struct ib_uobject *uobj =
-                uverbs_attr_get(attrs_bundle, idx)->obj_attr.uobject;
+        const struct uverbs_attr *attr;
 
-        if (IS_ERR(uobj))
-                return uobj;
+        attr = uverbs_attr_get(attrs_bundle, idx);
+        if (IS_ERR(attr))
+                return ERR_CAST(attr);
 
-        return uobj->object;
+        return attr->obj_attr.uobject->object;
 }
 
 static inline int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle,
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index e6014e0e51f7..46c39f7da444 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -32,7 +32,7 @@ config NET_9P_XEN
 
 
 config NET_9P_RDMA
-        depends on INET && INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on INET && INFINIBAND_ADDR_TRANS
         tristate "9P RDMA Transport (Experimental)"
         help
           This builds support for an RDMA transport.
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index bffde4b46c5d..1a31502ee7db 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -8,7 +8,7 @@ config RDS
 
 config RDS_RDMA
         tristate "RDS over Infiniband"
-        depends on RDS && INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on RDS && INFINIBAND_ADDR_TRANS
         ---help---
           Allow RDS to use Infiniband as a transport.
           This transport supports RDMA operations.
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index ac09ca803296..6358e5271070 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -50,7 +50,7 @@ config SUNRPC_DEBUG
 
 config SUNRPC_XPRT_RDMA
         tristate "RPC-over-RDMA transport"
-        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on SUNRPC && INFINIBAND_ADDR_TRANS
         default SUNRPC && INFINIBAND
         select SG_POOL
         help