Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Doug Ledford:
 "This is our first pull request of the rc cycle. It's not that it's
  been overly quiet, we were just waiting on a few things before sending
  this off.

  For instance, the 6 patch series from Intel for the hfi1 driver had
  actually been pulled in on Tuesday for a Wednesday pull request, only
  to have Jason notice something I missed, so we held off for some
  testing, and then on Thursday had to respin the series because the
  very first patch needed a minor fix (unnecessary cast is all).

  There is a sizable hns patch series in here, as well as a reasonably
  largish hfi1 patch series, then all of the lines of uapi updates are
  just the change to the new official Linux-OpenIB SPDX tag (a bunch of
  our files had what amounts to a BSD-2-Clause + MIT Warranty statement
  as their license as a result of the initial code submission years ago,
  and the SPDX folks decided it was unique enough to warrant a unique
  tag), then the typical mlx4 and mlx5 updates, and finally some cxgb4
  and core/cache/cma updates to round out the bunch.

  None of it was overly large by itself, but in the 2 1/2 weeks we've
  been collecting patches, it has added up :-/.

  As best I can tell, it's been through 0day (I got a notice about my
  last for-next push, but not for my for-rc push, but Jason seems to
  think that failure messages are prioritized and success messages not
  so much). It's also been through linux-next. And yes, we did notice in
  the context portion of the CMA query gid fix patch that there is a
  dubious BUG_ON() in the code, and have plans to audit our BUG_ON usage
  and remove it anywhere we can.

  Summary:

   - Various build fixes (USER_ACCESS=m and ADDR_TRANS turned off)

   - SPDX license tag cleanups (new tag Linux-OpenIB)

   - RoCE GID fixes related to default GIDs

   - Various fixes to: cxgb4, uverbs, cma, iwpm, rxe, hns (big batch),
     mlx4, mlx5, and hfi1 (medium batch)"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (52 commits)
  RDMA/cma: Do not query GID during QP state transition to RTR
  IB/mlx4: Fix integer overflow when calculating optimal MTT size
  IB/hfi1: Fix memory leak in exception path in get_irq_affinity()
  IB/{hfi1, rdmavt}: Fix memory leak in hfi1_alloc_devdata() upon failure
  IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
  IB/hfi1: Fix loss of BECN with AHG
  IB/hfi1 Use correct type for num_user_context
  IB/hfi1: Fix handling of FECN marked multicast packet
  IB/core: Make ib_mad_client_id atomic
  iw_cxgb4: Atomically flush per QP HW CQEs
  IB/uverbs: Fix kernel crash during MR deregistration flow
  IB/uverbs: Prevent reregistration of DM_MR to regular MR
  RDMA/mlx4: Add missed RSS hash inner header flag
  RDMA/hns: Fix a couple misspellings
  RDMA/hns: Submit bad wr
  RDMA/hns: Update assignment method for owner field of send wqe
  RDMA/hns: Adjust the order of cleanup hem table
  RDMA/hns: Only assign dqpn if IB_QP_PATH_DEST_QPN bit is set
  RDMA/hns: Remove some unnecessary attr_mask judgement
  RDMA/hns: Only assign mtu if IB_QP_PATH_MTU bit is set
  ...

63 files changed, 407 insertions, 208 deletions

diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index ee270e065ba9..2a972ed6851b 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -61,9 +61,12 @@ config INFINIBAND_ON_DEMAND_PAGING
           pages on demand instead.
 
 config INFINIBAND_ADDR_TRANS
-        bool
+        bool "RDMA/CM"
         depends on INFINIBAND
         default y
+        ---help---
+          Support for RDMA communication manager (CM).
+          This allows for a generic connection abstraction over RDMA.
 
 config INFINIBAND_ADDR_TRANS_CONFIGFS
         bool
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index e337b08de2ff..fb2d347f760f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -291,14 +291,18 @@ static int find_gid(struct ib_gid_table *table, const union ib_gid *gid,
                  * so lookup free slot only if requested.
                  */
                 if (pempty && empty < 0) {
-                        if (data->props & GID_TABLE_ENTRY_INVALID) {
-                                /* Found an invalid (free) entry; allocate it */
-                                if (data->props & GID_TABLE_ENTRY_DEFAULT) {
-                                        if (default_gid)
-                                                empty = curr_index;
-                                } else {
-                                        empty = curr_index;
-                                }
+                        if (data->props & GID_TABLE_ENTRY_INVALID &&
+                            (default_gid ==
+                             !!(data->props & GID_TABLE_ENTRY_DEFAULT))) {
+                                /*
+                                 * Found an invalid (free) entry; allocate it.
+                                 * If default GID is requested, then our
+                                 * found slot must be one of the DEFAULT
+                                 * reserved slots or we fail.
+                                 * This ensures that only DEFAULT reserved
+                                 * slots are used for default property GIDs.
+                                 */
+                                empty = curr_index;
                         }
                 }
 
@@ -420,8 +424,10 @@ int ib_cache_gid_add(struct ib_device *ib_dev, u8 port,
         return ret;
 }
 
-int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
-                     union ib_gid *gid, struct ib_gid_attr *attr)
+static int
+_ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                  union ib_gid *gid, struct ib_gid_attr *attr,
+                  unsigned long mask, bool default_gid)
 {
         struct ib_gid_table *table;
         int ret = 0;
@@ -431,11 +437,7 @@ int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
 
         mutex_lock(&table->lock);
 
-        ix = find_gid(table, gid, attr, false,
-                      GID_ATTR_FIND_MASK_GID      |
-                      GID_ATTR_FIND_MASK_GID_TYPE |
-                      GID_ATTR_FIND_MASK_NETDEV,
-                      NULL);
+        ix = find_gid(table, gid, attr, default_gid, mask, NULL);
         if (ix < 0) {
                 ret = -EINVAL;
                 goto out_unlock;
@@ -452,6 +454,17 @@ out_unlock:
         return ret;
 }
 
+int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
+                     union ib_gid *gid, struct ib_gid_attr *attr)
+{
+        unsigned long mask = GID_ATTR_FIND_MASK_GID       |
+                             GID_ATTR_FIND_MASK_GID_TYPE |
+                             GID_ATTR_FIND_MASK_DEFAULT  |
+                             GID_ATTR_FIND_MASK_NETDEV;
+
+        return _ib_cache_gid_del(ib_dev, port, gid, attr, mask, false);
+}
+
 int ib_cache_gid_del_all_netdev_gids(struct ib_device *ib_dev, u8 port,
                                      struct net_device *ndev)
 {
@@ -728,7 +741,7 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                                   unsigned long gid_type_mask,
                                   enum ib_cache_gid_default_mode mode)
 {
-        union ib_gid gid;
+        union ib_gid gid = { };
         struct ib_gid_attr gid_attr;
         struct ib_gid_table *table;
         unsigned int gid_type;
@@ -736,7 +749,9 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
 
         table = ib_dev->cache.ports[port - rdma_start_port(ib_dev)].gid;
 
-        make_default_gid(ndev, &gid);
+        mask = GID_ATTR_FIND_MASK_GID_TYPE |
+               GID_ATTR_FIND_MASK_DEFAULT |
+               GID_ATTR_FIND_MASK_NETDEV;
         memset(&gid_attr, 0, sizeof(gid_attr));
         gid_attr.ndev = ndev;
 
@@ -747,12 +762,12 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
                 gid_attr.gid_type = gid_type;
 
                 if (mode == IB_CACHE_GID_DEFAULT_MODE_SET) {
-                        mask = GID_ATTR_FIND_MASK_GID_TYPE |
-                               GID_ATTR_FIND_MASK_DEFAULT;
+                        make_default_gid(ndev, &gid);
                         __ib_cache_gid_add(ib_dev, port, &gid,
                                            &gid_attr, mask, true);
                 } else if (mode == IB_CACHE_GID_DEFAULT_MODE_DELETE) {
-                        ib_cache_gid_del(ib_dev, port, &gid, &gid_attr);
+                        _ib_cache_gid_del(ib_dev, port, &gid,
+                                          &gid_attr, mask, true);
                 }
         }
 }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 51a641002e10..a693fcd4c513 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -382,6 +382,8 @@ struct cma_hdr {
 #define CMA_VERSION 0x00
 
 struct cma_req_info {
+        struct sockaddr_storage listen_addr_storage;
+        struct sockaddr_storage src_addr_storage;
         struct ib_device *device;
         int port;
         union ib_gid local_gid;
@@ -866,7 +868,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
 {
         struct ib_qp_attr qp_attr;
         int qp_attr_mask, ret;
-        union ib_gid sgid;
 
         mutex_lock(&id_priv->qp_mutex);
         if (!id_priv->id.qp) {
@@ -889,12 +890,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv,
         if (ret)
                 goto out;
 
-        ret = ib_query_gid(id_priv->id.device, id_priv->id.port_num,
-                           rdma_ah_read_grh(&qp_attr.ah_attr)->sgid_index,
-                           &sgid, NULL);
-        if (ret)
-                goto out;
-
         BUG_ON(id_priv->cma_dev->device != id_priv->id.device);
 
         if (conn_param)
@@ -1340,11 +1335,11 @@ static bool validate_net_dev(struct net_device *net_dev,
 }
 
 static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
-                                          const struct cma_req_info *req)
+                                          struct cma_req_info *req)
 {
-        struct sockaddr_storage listen_addr_storage, src_addr_storage;
-        struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage,
-                        *src_addr = (struct sockaddr *)&src_addr_storage;
+        struct sockaddr *listen_addr =
+                        (struct sockaddr *)&req->listen_addr_storage;
+        struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage;
         struct net_device *net_dev;
         const union ib_gid *gid = req->has_gid ? &req->local_gid : NULL;
         int err;
@@ -1359,11 +1354,6 @@ static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event,
         if (!net_dev)
                 return ERR_PTR(-ENODEV);
 
-        if (!validate_net_dev(net_dev, listen_addr, src_addr)) {
-                dev_put(net_dev);
-                return ERR_PTR(-EHOSTUNREACH);
-        }
-
         return net_dev;
 }
 
@@ -1490,15 +1480,51 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
                 }
         }
 
+        /*
+         * Net namespace might be getting deleted while route lookup,
+         * cm_id lookup is in progress. Therefore, perform netdevice
+         * validation, cm_id lookup under rcu lock.
+         * RCU lock along with netdevice state check, synchronizes with
+         * netdevice migrating to different net namespace and also avoids
+         * case where net namespace doesn't get deleted while lookup is in
+         * progress.
+         * If the device state is not IFF_UP, its properties such as ifindex
+         * and nd_net cannot be trusted to remain valid without rcu lock.
+         * net/core/dev.c change_net_namespace() ensures to synchronize with
+         * ongoing operations on net device after device is closed using
+         * synchronize_net().
+         */
+        rcu_read_lock();
+        if (*net_dev) {
+                /*
+                 * If netdevice is down, it is likely that it is administratively
+                 * down or it might be migrating to different namespace.
+                 * In that case avoid further processing, as the net namespace
+                 * or ifindex may change.
+                 */
+                if (((*net_dev)->flags & IFF_UP) == 0) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+
+                if (!validate_net_dev(*net_dev,
+                                 (struct sockaddr *)&req.listen_addr_storage,
+                                 (struct sockaddr *)&req.src_addr_storage)) {
+                        id_priv = ERR_PTR(-EHOSTUNREACH);
+                        goto err;
+                }
+        }
+
         bind_list = cma_ps_find(*net_dev ? dev_net(*net_dev) : &init_net,
                                 rdma_ps_from_service_id(req.service_id),
                                 cma_port_from_service_id(req.service_id));
         id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
+err:
+        rcu_read_unlock();
         if (IS_ERR(id_priv) && *net_dev) {
                 dev_put(*net_dev);
                 *net_dev = NULL;
         }
-
         return id_priv;
 }
 
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index 9821ae900f6d..da12da1c36f6 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                         struct sockaddr_storage *mapped_sockaddr,
                         u8 nl_client)
 {
-        struct hlist_head *hash_bucket_head;
+        struct hlist_head *hash_bucket_head = NULL;
         struct iwpm_mapping_info *map_info;
         unsigned long flags;
         int ret = -EINVAL;
@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr,
                 }
         }
         spin_unlock_irqrestore(&iwpm_mapinfo_lock, flags);
+
+        if (!hash_bucket_head)
+                kfree(map_info);
         return ret;
 }
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index c50596f7f98a..b28452a55a08 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -59,7 +59,7 @@ module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
 
 static struct list_head ib_mad_port_list;
-static u32 ib_mad_client_id = 0;
+static atomic_t ib_mad_client_id = ATOMIC_INIT(0);
 
 /* Port list lock */
 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
@@ -377,7 +377,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         }
 
         spin_lock_irqsave(&port_priv->reg_lock, flags);
-        mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
+        mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id);
 
         /*
          * Make sure MAD registration (if supplied)
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index cc2966380c0c..c0e4fd55e2cc 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -255,6 +255,7 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
                                             struct net_device *rdma_ndev)
 {
         struct net_device *real_dev = rdma_vlan_dev_real_dev(event_ndev);
+        unsigned long gid_type_mask;
 
         if (!rdma_ndev)
                 return;
@@ -264,21 +265,22 @@ static void bond_delete_netdev_default_gids(struct ib_device *ib_dev,
 
         rcu_read_lock();
 
-        if (rdma_is_upper_dev_rcu(rdma_ndev, event_ndev) &&
-            is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev) ==
-            BONDING_SLAVE_STATE_INACTIVE) {
-                unsigned long gid_type_mask;
-
+        if (((rdma_ndev != event_ndev &&
+              !rdma_is_upper_dev_rcu(rdma_ndev, event_ndev)) ||
+             is_eth_active_slave_of_bonding_rcu(rdma_ndev, real_dev)
+                                                 ==
+             BONDING_SLAVE_STATE_INACTIVE)) {
                 rcu_read_unlock();
+                return;
+        }
 
-                gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
+        rcu_read_unlock();
 
-                ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
-                                             gid_type_mask,
-                                             IB_CACHE_GID_DEFAULT_MODE_DELETE);
-        } else {
-                rcu_read_unlock();
-        }
+        gid_type_mask = roce_gid_type_mask_support(ib_dev, port);
+
+        ib_cache_gid_set_default_gid(ib_dev, port, rdma_ndev,
+                                     gid_type_mask,
+                                     IB_CACHE_GID_DEFAULT_MODE_DELETE);
 }
 
 static void enum_netdev_ipv4_ips(struct ib_device *ib_dev,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 74329483af6d..eab43b17e9cf 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -159,6 +159,23 @@ static void ucma_put_ctx(struct ucma_context *ctx)
                 complete(&ctx->comp);
 }
 
+/*
+ * Same as ucm_get_ctx but requires that ->cm_id->device is valid, eg that the
+ * CM_ID is bound.
+ */
+static struct ucma_context *ucma_get_ctx_dev(struct ucma_file *file, int id)
+{
+        struct ucma_context *ctx = ucma_get_ctx(file, id);
+
+        if (IS_ERR(ctx))
+                return ctx;
+        if (!ctx->cm_id->device) {
+                ucma_put_ctx(ctx);
+                return ERR_PTR(-EINVAL);
+        }
+        return ctx;
+}
+
 static void ucma_close_event_id(struct work_struct *work)
 {
         struct ucma_event *uevent_close =  container_of(work, struct ucma_event, close_work);
@@ -683,7 +700,7 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+        if ((cmd.src_addr.sin6_family && !rdma_addr_size_in6(&cmd.src_addr)) ||
             !rdma_addr_size_in6(&cmd.dst_addr))
                 return -EINVAL;
 
@@ -734,7 +751,7 @@ static ssize_t ucma_resolve_route(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
@@ -1050,7 +1067,7 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
         if (!cmd.conn_param.valid)
                 return -EINVAL;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
@@ -1092,7 +1109,7 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
@@ -1120,7 +1137,7 @@ static ssize_t ucma_reject(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
@@ -1139,7 +1156,7 @@ static ssize_t ucma_disconnect(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
@@ -1167,15 +1184,10 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
         if (cmd.qp_state > IB_QPS_ERR)
                 return -EINVAL;
 
-        ctx = ucma_get_ctx(file, cmd.id);
+        ctx = ucma_get_ctx_dev(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        if (!ctx->cm_id->device) {
-                ret = -EINVAL;
-                goto out;
-        }
-
         resp.qp_attr_mask = 0;
         memset(&qp_attr, 0, sizeof qp_attr);
         qp_attr.qp_state = cmd.qp_state;
@@ -1316,13 +1328,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
-                return -EINVAL;
-
         optval = memdup_user(u64_to_user_ptr(cmd.optval),
                              cmd.optlen);
         if (IS_ERR(optval)) {
@@ -1384,7 +1396,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
         else
                 return -EINVAL;
 
-        ctx = ucma_get_ctx(file, cmd->id);
+        ctx = ucma_get_ctx_dev(file, cmd->id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 13cb5e4deb86..21a887c9523b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -691,6 +691,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
 
         mr->device  = pd->device;
         mr->pd      = pd;
+        mr->dm      = NULL;
         mr->uobject = uobj;
         atomic_inc(&pd->usecnt);
         mr->res.type = RDMA_RESTRACK_MR;
@@ -765,6 +766,11 @@ ssize_t ib_uverbs_rereg_mr(struct ib_uverbs_file *file,
 
         mr = uobj->object;
 
+        if (mr->dm) {
+                ret = -EINVAL;
+                goto put_uobjs;
+        }
+
         if (cmd.flags & IB_MR_REREG_ACCESS) {
                 ret = ib_check_mr_access(cmd.access_flags);
                 if (ret)
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c93970dc8f1..8d32c4ae368c 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -234,6 +234,15 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met
                         return -EINVAL;
         }
 
+        for (; i < method_spec->num_buckets; i++) {
+                struct uverbs_attr_spec_hash *attr_spec_bucket =
+                        method_spec->attr_buckets[i];
+
+                if (!bitmap_empty(attr_spec_bucket->mandatory_attrs_bitmask,
+                                  attr_spec_bucket->num_attrs))
+                        return -EINVAL;
+        }
+
         return 0;
 }
 
diff --git a/drivers/infiniband/core/uverbs_std_types_flow_action.c b/drivers/infiniband/core/uverbs_std_types_flow_action.c
index cbcec3da12f6..b4f016dfa23d 100644
--- a/drivers/infiniband/core/uverbs_std_types_flow_action.c
+++ b/drivers/infiniband/core/uverbs_std_types_flow_action.c
@@ -363,28 +363,28 @@ static int UVERBS_HANDLER(UVERBS_METHOD_FLOW_ACTION_ESP_MODIFY)(struct ib_device
 
 static const struct uverbs_attr_spec uverbs_flow_action_esp_keymat[] = {
         [IB_UVERBS_FLOW_ACTION_ESP_KEYMAT_AES_GCM] = {
-                .ptr = {
+                { .ptr = {
                         .type = UVERBS_ATTR_TYPE_PTR_IN,
                         UVERBS_ATTR_TYPE(struct ib_uverbs_flow_action_esp_keymat_aes_gcm),
                         .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                },
+                } },
         },
 };
 
 static const struct uverbs_attr_spec uverbs_flow_action_esp_replay[] = {
         [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_NONE] = {
-                .ptr = {
+                { .ptr = {
                         .type = UVERBS_ATTR_TYPE_PTR_IN,
                         /* No need to specify any data */
                         .len = 0,
-                }
+                } }
         },
         [IB_UVERBS_FLOW_ACTION_ESP_REPLAY_BMP] = {
-                .ptr = {
+                { .ptr = {
                         .type = UVERBS_ATTR_TYPE_PTR_IN,
                         UVERBS_ATTR_STRUCT(struct ib_uverbs_flow_action_esp_replay_bmp, size),
                         .flags = UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO,
-                }
+                } }
         },
 };
 
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7eff3aeffe01..6ddfb1fade79 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1656,6 +1656,7 @@ struct ib_mr *ib_alloc_mr(struct ib_pd *pd,
         if (!IS_ERR(mr)) {
                 mr->device  = pd->device;
                 mr->pd      = pd;
+                mr->dm      = NULL;
                 mr->uobject = NULL;
                 atomic_inc(&pd->usecnt);
                 mr->need_inval = false;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 6f2b26126c64..2be2e1ac1b5f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -315,7 +315,7 @@ static void advance_oldest_read(struct t4_wq *wq)
  * Deal with out-of-order and/or completions that complete
  * prior unsignalled WRs.
  */
-void c4iw_flush_hw_cq(struct c4iw_cq *chp)
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp)
 {
         struct t4_cqe *hw_cqe, *swcqe, read_cqe;
         struct c4iw_qp *qhp;
@@ -339,6 +339,13 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
                 if (qhp == NULL)
                         goto next_cqe;
 
+                if (flush_qhp != qhp) {
+                        spin_lock(&qhp->lock);
+
+                        if (qhp->wq.flushed == 1)
+                                goto next_cqe;
+                }
+
                 if (CQE_OPCODE(hw_cqe) == FW_RI_TERMINATE)
                         goto next_cqe;
 
@@ -390,6 +397,8 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp)
 next_cqe:
                 t4_hwcq_consume(&chp->cq);
                 ret = t4_next_hw_cqe(&chp->cq, &hw_cqe);
+                if (qhp && flush_qhp != qhp)
+                        spin_unlock(&qhp->lock);
         }
 }
 
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index feeb8ee6f4a2..44161ca4d2a8 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -875,6 +875,11 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
 
         rdev->status_page->db_off = 0;
 
+        init_completion(&rdev->rqt_compl);
+        init_completion(&rdev->pbl_compl);
+        kref_init(&rdev->rqt_kref);
+        kref_init(&rdev->pbl_kref);
+
         return 0;
 err_free_status_page_and_wr_log:
         if (c4iw_wr_log && rdev->wr_log)
@@ -893,13 +898,15 @@ destroy_resource:
 
 static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
-        destroy_workqueue(rdev->free_workq);
         kfree(rdev->wr_log);
         c4iw_release_dev_ucontext(rdev, &rdev->uctx);
         free_page((unsigned long)rdev->status_page);
         c4iw_pblpool_destroy(rdev);
         c4iw_rqtpool_destroy(rdev);
+        wait_for_completion(&rdev->pbl_compl);
+        wait_for_completion(&rdev->rqt_compl);
         c4iw_ocqp_pool_destroy(rdev);
+        destroy_workqueue(rdev->free_workq);
         c4iw_destroy_resource(&rdev->resource);
 }
 
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index cc929002c05e..831027717121 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -185,6 +185,10 @@ struct c4iw_rdev {
         struct wr_log_entry *wr_log;
         int wr_log_size;
         struct workqueue_struct *free_workq;
+        struct completion rqt_compl;
+        struct completion pbl_compl;
+        struct kref rqt_kref;
+        struct kref pbl_kref;
 };
 
 static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
@@ -1049,7 +1053,7 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
 u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size);
-void c4iw_flush_hw_cq(struct c4iw_cq *chp);
+void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp);
 void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
 int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp);
 int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index de77b6027d69..ae167b686608 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1343,12 +1343,12 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
         qhp->wq.flushed = 1;
         t4_set_wq_in_error(&qhp->wq);
 
-        c4iw_flush_hw_cq(rchp);
+        c4iw_flush_hw_cq(rchp, qhp);
         c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
         rq_flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
 
         if (schp != rchp)
-                c4iw_flush_hw_cq(schp);
+                c4iw_flush_hw_cq(schp, qhp);
         sq_flushed = c4iw_flush_sq(qhp);
 
         spin_unlock(&qhp->lock);
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index 3cf25997ed2b..0ef25ae05e6f 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
                 rdev->stats.pbl.cur += roundup(size, 1 << MIN_PBL_SHIFT);
                 if (rdev->stats.pbl.cur > rdev->stats.pbl.max)
                         rdev->stats.pbl.max = rdev->stats.pbl.cur;
+                kref_get(&rdev->pbl_kref);
         } else
                 rdev->stats.pbl.fail++;
         mutex_unlock(&rdev->stats.lock);
         return (u32)addr;
 }
 
+static void destroy_pblpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+
+        rdev = container_of(kref, struct c4iw_rdev, pbl_kref);
+        gen_pool_destroy(rdev->pbl_pool);
+        complete(&rdev->pbl_compl);
+}
+
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
         pr_debug("addr 0x%x size %d\n", addr, size);
@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
         rdev->stats.pbl.cur -= roundup(size, 1 << MIN_PBL_SHIFT);
         mutex_unlock(&rdev->stats.lock);
         gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 
 int c4iw_pblpool_create(struct c4iw_rdev *rdev)
@@ -310,7 +321,7 @@ int c4iw_pblpool_create(struct c4iw_rdev *rdev)
 
 void c4iw_pblpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->pbl_pool);
+        kref_put(&rdev->pbl_kref, destroy_pblpool);
 }
 
 /*
@@ -331,12 +342,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
                 rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT);
                 if (rdev->stats.rqt.cur > rdev->stats.rqt.max)
                         rdev->stats.rqt.max = rdev->stats.rqt.cur;
+                kref_get(&rdev->rqt_kref);
         } else
                 rdev->stats.rqt.fail++;
         mutex_unlock(&rdev->stats.lock);
         return (u32)addr;
 }
 
+static void destroy_rqtpool(struct kref *kref)
+{
+        struct c4iw_rdev *rdev;
+
+        rdev = container_of(kref, struct c4iw_rdev, rqt_kref);
+        gen_pool_destroy(rdev->rqt_pool);
+        complete(&rdev->rqt_compl);
+}
+
 void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
 {
         pr_debug("addr 0x%x size %d\n", addr, size << 6);
@@ -344,6 +365,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
         rdev->stats.rqt.cur -= roundup(size << 6, 1 << MIN_RQT_SHIFT);
         mutex_unlock(&rdev->stats.lock);
         gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 
 int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
@@ -380,7 +402,7 @@ int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
 
 void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
 {
-        gen_pool_destroy(rdev->rqt_pool);
+        kref_put(&rdev->rqt_kref, destroy_rqtpool);
 }
 
 /*
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index a97055dd4fbd..b5fab55cc275 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -412,7 +412,6 @@ static void hfi1_cleanup_sdma_notifier(struct hfi1_msix_entry *msix)
 static int get_irq_affinity(struct hfi1_devdata *dd,
                             struct hfi1_msix_entry *msix)
 {
-        int ret;
         cpumask_var_t diff;
         struct hfi1_affinity_node *entry;
         struct cpu_mask_set *set = NULL;
@@ -424,10 +423,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
         extra[0] = '\0';
         cpumask_clear(&msix->mask);
 
-        ret = zalloc_cpumask_var(&diff, GFP_KERNEL);
-        if (!ret)
-                return -ENOMEM;
-
         entry = node_affinity_lookup(dd->node);
 
         switch (msix->type) {
@@ -458,6 +453,9 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
          * finds its CPU here.
          */
         if (cpu == -1 && set) {
+                if (!zalloc_cpumask_var(&diff, GFP_KERNEL))
+                        return -ENOMEM;
+
                 if (cpumask_equal(&set->mask, &set->used)) {
                         /*
                          * We've used up all the CPUs, bump up the generation
@@ -469,6 +467,8 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                 cpumask_andnot(diff, &set->mask, &set->used);
                 cpu = cpumask_first(diff);
                 cpumask_set_cpu(cpu, &set->used);
+
+                free_cpumask_var(diff);
         }
 
         cpumask_set_cpu(cpu, &msix->mask);
@@ -482,7 +482,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd,
                 hfi1_setup_sdma_notifier(msix);
         }
 
-        free_cpumask_var(diff);
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 46d1475b2154..bd837a048bf4 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -433,31 +433,43 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                                bool do_cnp)
 {
         struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+        struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
         struct ib_other_headers *ohdr = pkt->ohdr;
         struct ib_grh *grh = pkt->grh;
         u32 rqpn = 0, bth1;
-        u16 pkey, rlid, dlid = ib_get_dlid(pkt->hdr);
+        u16 pkey;
+        u32 rlid, slid, dlid = 0;
         u8 hdr_type, sc, svc_type;
         bool is_mcast = false;
 
+        /* can be called from prescan */
         if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
                 is_mcast = hfi1_is_16B_mcast(dlid);
                 pkey = hfi1_16B_get_pkey(pkt->hdr);
                 sc = hfi1_16B_get_sc(pkt->hdr);
+                dlid = hfi1_16B_get_dlid(pkt->hdr);
+                slid = hfi1_16B_get_slid(pkt->hdr);
                 hdr_type = HFI1_PKT_TYPE_16B;
         } else {
                 is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
                            (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
                 pkey = ib_bth_get_pkey(ohdr);
                 sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+                dlid = ib_get_dlid(pkt->hdr);
+                slid = ib_get_slid(pkt->hdr);
                 hdr_type = HFI1_PKT_TYPE_9B;
         }
 
         switch (qp->ibqp.qp_type) {
+        case IB_QPT_UD:
+                dlid = ppd->lid;
+                rlid = slid;
+                rqpn = ib_get_sqpn(pkt->ohdr);
+                svc_type = IB_CC_SVCTYPE_UD;
+                break;
         case IB_QPT_SMI:
         case IB_QPT_GSI:
-        case IB_QPT_UD:
-                rlid = ib_get_slid(pkt->hdr);
+                rlid = slid;
                 rqpn = ib_get_sqpn(pkt->ohdr);
                 svc_type = IB_CC_SVCTYPE_UD;
                 break;
@@ -482,7 +494,6 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
                                               dlid, rlid, sc, grh);
 
         if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
-                struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
                 u32 lqpn = bth1 & RVT_QPN_MASK;
                 u8 sl = ibp->sc_to_sl[sc];
 
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 32c48265405e..cac2c62bc42d 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1537,13 +1537,13 @@ void set_link_ipg(struct hfi1_pportdata *ppd);
 void process_becn(struct hfi1_pportdata *ppd, u8 sl, u32 rlid, u32 lqpn,
                   u32 rqpn, u8 svc_type);
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                 const struct ib_grh *old_grh);
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                     u8 sc5, const struct ib_grh *old_grh);
 typedef void (*hfi1_handle_cnp)(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                                u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                                u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                                 u8 sc5, const struct ib_grh *old_grh);
 
 #define PKEY_CHECK_INVALID -1
@@ -2437,7 +2437,7 @@ static inline void hfi1_make_16b_hdr(struct hfi1_16b_header *hdr,
                 ((slid >> OPA_16B_SLID_SHIFT) << OPA_16B_SLID_HIGH_SHIFT);
         lrh2 = (lrh2 & ~OPA_16B_DLID_MASK) |
                 ((dlid >> OPA_16B_DLID_SHIFT) << OPA_16B_DLID_HIGH_SHIFT);
-        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | (pkey << OPA_16B_PKEY_SHIFT);
+        lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | ((u32)pkey << OPA_16B_PKEY_SHIFT);
         lrh2 = (lrh2 & ~OPA_16B_L4_MASK) | l4;
 
         hdr->lrh[0] = lrh0;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 33eba2356742..6309edf811df 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -88,9 +88,9 @@
  * pio buffers per ctxt, etc.)  Zero means use one user context per CPU.
  */
 int num_user_contexts = -1;
-module_param_named(num_user_contexts, num_user_contexts, uint, S_IRUGO);
+module_param_named(num_user_contexts, num_user_contexts, int, 0444);
 MODULE_PARM_DESC(
-        num_user_contexts, "Set max number of user contexts to use");
+        num_user_contexts, "Set max number of user contexts to use (default: -1 will use the real (non-HT) CPU count)");
 
 uint krcvqs[RXE_NUM_DATA_VL];
 int krcvqsset;
@@ -1209,30 +1209,49 @@ static void finalize_asic_data(struct hfi1_devdata *dd,
         kfree(ad);
 }
 
-static void __hfi1_free_devdata(struct kobject *kobj)
+/**
+ * hfi1_clean_devdata - cleans up per-unit data structure
+ * @dd: pointer to a valid devdata structure
+ *
+ * It cleans up all data structures set up by
+ * by hfi1_alloc_devdata().
+ */
+static void hfi1_clean_devdata(struct hfi1_devdata *dd)
 {
-        struct hfi1_devdata *dd =
-                container_of(kobj, struct hfi1_devdata, kobj);
         struct hfi1_asic_data *ad;
         unsigned long flags;
 
         spin_lock_irqsave(&hfi1_devs_lock, flags);
-        idr_remove(&hfi1_unit_table, dd->unit);
-        list_del(&dd->list);
+        if (!list_empty(&dd->list)) {
+                idr_remove(&hfi1_unit_table, dd->unit);
+                list_del_init(&dd->list);
+        }
         ad = release_asic_data(dd);
         spin_unlock_irqrestore(&hfi1_devs_lock, flags);
-        if (ad)
-                finalize_asic_data(dd, ad);
+
+        finalize_asic_data(dd, ad);
         free_platform_config(dd);
         rcu_barrier(); /* wait for rcu callbacks to complete */
         free_percpu(dd->int_counter);
         free_percpu(dd->rcv_limit);
         free_percpu(dd->send_schedule);
         free_percpu(dd->tx_opstats);
+        dd->int_counter   = NULL;
+        dd->rcv_limit     = NULL;
+        dd->send_schedule = NULL;
+        dd->tx_opstats    = NULL;
         sdma_clean(dd, dd->num_sdma);
         rvt_dealloc_device(&dd->verbs_dev.rdi);
 }
 
+static void __hfi1_free_devdata(struct kobject *kobj)
+{
+        struct hfi1_devdata *dd =
+                container_of(kobj, struct hfi1_devdata, kobj);
+
+        hfi1_clean_devdata(dd);
+}
+
 static struct kobj_type hfi1_devdata_type = {
         .release = __hfi1_free_devdata,
 };
@@ -1265,6 +1284,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
                 return ERR_PTR(-ENOMEM);
         dd->num_pports = nports;
         dd->pport = (struct hfi1_pportdata *)(dd + 1);
+        dd->pcidev = pdev;
+        pci_set_drvdata(pdev, dd);
 
         INIT_LIST_HEAD(&dd->list);
         idr_preload(GFP_KERNEL);
@@ -1331,9 +1352,7 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
         return dd;
 
 bail:
-        if (!list_empty(&dd->list))
-                list_del_init(&dd->list);
-        rvt_dealloc_device(&dd->verbs_dev.rdi);
+        hfi1_clean_devdata(dd);
         return ERR_PTR(ret);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 83d66e862207..c1c982908b4b 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
         resource_size_t addr;
         int ret = 0;
 
-        dd->pcidev = pdev;
-        pci_set_drvdata(pdev, dd);
-
         addr = pci_resource_start(pdev, 0);
         len = pci_resource_len(pdev, 0);
 
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index d486355880cb..cbf7faa5038c 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -199,6 +199,7 @@ void free_platform_config(struct hfi1_devdata *dd)
 {
         /* Release memory allocated for eprom or fallback file read. */
         kfree(dd->platform_config.data);
+        dd->platform_config.data = NULL;
 }
 
 void get_port_type(struct hfi1_pportdata *ppd)
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index 1869f639c3ae..b5966991d647 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -204,6 +204,8 @@ static void clean_i2c_bus(struct hfi1_i2c_bus *bus)
 
 void clean_up_i2c(struct hfi1_devdata *dd, struct hfi1_asic_data *ad)
 {
+        if (!ad)
+                return;
         clean_i2c_bus(ad->i2c_bus0);
         ad->i2c_bus0 = NULL;
         clean_i2c_bus(ad->i2c_bus1);
diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
index 3daa94bdae3a..c0071ca4147a 100644
--- a/drivers/infiniband/hw/hfi1/ruc.c
+++ b/drivers/infiniband/hw/hfi1/ruc.c
@@ -733,6 +733,20 @@ static inline void hfi1_make_ruc_bth(struct rvt_qp *qp,
         ohdr->bth[2] = cpu_to_be32(bth2);
 }
 
+/**
+ * hfi1_make_ruc_header_16B - build a 16B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                                             struct ib_other_headers *ohdr,
                                             u32 bth0, u32 bth2, int middle,
@@ -777,6 +791,12 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
         else
                 middle = 0;
 
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                becn = true;
+                middle = 0;
+        }
         if (middle)
                 build_ahg(qp, bth2);
         else
@@ -784,11 +804,6 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
 
         bth0 |= pkey;
         bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                becn = true;
-        }
         hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
 
         if (!ppd->lid)
@@ -806,6 +821,20 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
                           pkey, becn, 0, l4, priv->s_sc);
 }
 
+/**
+ * hfi1_make_ruc_header_9B - build a 9B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
                                            struct ib_other_headers *ohdr,
                                            u32 bth0, u32 bth2, int middle,
@@ -839,6 +868,12 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
         else
                 middle = 0;
 
+        if (qp->s_flags & RVT_S_ECN) {
+                qp->s_flags &= ~RVT_S_ECN;
+                /* we recently received a FECN, so return a BECN */
+                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
+                middle = 0;
+        }
         if (middle)
                 build_ahg(qp, bth2);
         else
@@ -846,11 +881,6 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
 
         bth0 |= pkey;
         bth0 |= extra_bytes << 20;
-        if (qp->s_flags & RVT_S_ECN) {
-                qp->s_flags &= ~RVT_S_ECN;
-                /* we recently received a FECN, so return a BECN */
-                bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
-        }
         hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
         hfi1_make_ib_hdr(&ps->s_txreq->phdr.hdr.ibh,
                          lrh0,
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index bcf3b0bebac8..69c17a5ef038 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -628,7 +628,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibport *ibp, u16 pkey)
 }
 
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+                    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
                     u8 sc5, const struct ib_grh *old_grh)
 {
         u64 pbc, pbc_flags = 0;
@@ -687,7 +687,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 }
 
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-                u32 pkey, u32 slid, u32 dlid, u8 sc5,
+                u16 pkey, u32 slid, u32 dlid, u8 sc5,
                 const struct ib_grh *old_grh)
 {
         u64 pbc, pbc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 0eeabfbee192..63b5b3edabcb 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -912,7 +912,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                 obj_per_chunk = buf_chunk_size / obj_size;
                 num_hem = (nobj + obj_per_chunk - 1) / obj_per_chunk;
                 bt_chunk_num = bt_chunk_size / 8;
-                if (table->type >= HEM_TYPE_MTT)
+                if (type >= HEM_TYPE_MTT)
                         num_bt_l0 = bt_chunk_num;
 
                 table->hem = kcalloc(num_hem, sizeof(*table->hem),
@@ -920,7 +920,7 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                 if (!table->hem)
                         goto err_kcalloc_hem_buf;
 
-                if (check_whether_bt_num_3(table->type, hop_num)) {
+                if (check_whether_bt_num_3(type, hop_num)) {
                         unsigned long num_bt_l1;
 
                         num_bt_l1 = (num_hem + bt_chunk_num - 1) /
@@ -939,8 +939,8 @@ int hns_roce_init_hem_table(struct hns_roce_dev *hr_dev,
                                 goto err_kcalloc_l1_dma;
                 }
 
-                if (check_whether_bt_num_2(table->type, hop_num) ||
-                        check_whether_bt_num_3(table->type, hop_num)) {
+                if (check_whether_bt_num_2(type, hop_num) ||
+                        check_whether_bt_num_3(type, hop_num)) {
                         table->bt_l0 = kcalloc(num_bt_l0, sizeof(*table->bt_l0),
                                                GFP_KERNEL);
                         if (!table->bt_l0)
@@ -1039,14 +1039,14 @@ void hns_roce_cleanup_hem_table(struct hns_roce_dev *hr_dev,
 void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
 {
         hns_roce_cleanup_hem_table(hr_dev, &hr_dev->cq_table.table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
         if (hr_dev->caps.trrl_entry_sz)
                 hns_roce_cleanup_hem_table(hr_dev,
                                            &hr_dev->qp_table.trrl_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.irrl_table);
         hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qp_table.qp_table);
         hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtpt_table);
-        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
         if (hns_roce_check_whether_mhop(hr_dev, HEM_TYPE_CQE))
                 hns_roce_cleanup_hem_table(hr_dev,
                                            &hr_dev->mr_table.mtt_cqe_table);
+        hns_roce_cleanup_hem_table(hr_dev, &hr_dev->mr_table.mtt_table);
 }
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 8b84ab7800d8..25916e8522ed 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -71,6 +71,11 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         return -EINVAL;
                 }
 
+                if (wr->opcode == IB_WR_RDMA_READ) {
+                        dev_err(hr_dev->dev, "Not support inline data!\n");
+                        return -EINVAL;
+                }
+
                 for (i = 0; i < wr->num_sge; i++) {
                         memcpy(wqe, ((void *)wr->sg_list[i].addr),
                                wr->sg_list[i].length);
@@ -148,7 +153,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                      ibqp->qp_type != IB_QPT_GSI &&
                      ibqp->qp_type != IB_QPT_UD)) {
                 dev_err(dev, "Not supported QP(0x%x)type!\n", ibqp->qp_type);
-                *bad_wr = NULL;
+                *bad_wr = wr;
                 return -EOPNOTSUPP;
         }
 
@@ -182,7 +187,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 qp->sq.wrid[(qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1)] =
                                                                       wr->wr_id;
 
-                owner_bit = ~(qp->sq.head >> ilog2(qp->sq.wqe_cnt)) & 0x1;
+                owner_bit =
+                       ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
 
                 /* Corresponding to the QP type, wqe process separately */
                 if (ibqp->qp_type == IB_QPT_GSI) {
@@ -456,6 +462,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 } else {
                         dev_err(dev, "Illegal qp_type(0x%x)\n", ibqp->qp_type);
                         spin_unlock_irqrestore(&qp->sq.lock, flags);
+                        *bad_wr = wr;
                         return -EOPNOTSUPP;
                 }
         }
@@ -2592,10 +2599,12 @@ static void modify_qp_init_to_init(struct ib_qp *ibqp,
         roce_set_field(qpc_mask->byte_4_sqpn_tst, V2_QPC_BYTE_4_SQPN_M,
                        V2_QPC_BYTE_4_SQPN_S, 0);
 
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-                       V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+        if (attr_mask & IB_QP_DEST_QPN) {
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, hr_qp->qpn);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
         roce_set_field(context->byte_168_irrl_idx,
                        V2_QPC_BYTE_168_SQ_SHIFT_BAK_M,
                        V2_QPC_BYTE_168_SQ_SHIFT_BAK_S,
@@ -2650,8 +2659,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                 return -EINVAL;
         }
 
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
-            (attr_mask & IB_QP_PKEY_INDEX) || (attr_mask & IB_QP_QKEY)) {
+        if (attr_mask & IB_QP_ALT_PATH) {
                 dev_err(dev, "INIT2RTR attr_mask (0x%x) error\n", attr_mask);
                 return -EINVAL;
         }
@@ -2800,10 +2808,12 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
                                V2_QPC_BYTE_140_RR_MAX_S, 0);
         }
 
-        roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-                       V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
-        roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
-                       V2_QPC_BYTE_56_DQPN_S, 0);
+        if (attr_mask & IB_QP_DEST_QPN) {
+                roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_DQPN_M,
+                               V2_QPC_BYTE_56_DQPN_S, attr->dest_qp_num);
+                roce_set_field(qpc_mask->byte_56_dqpn_err,
+                               V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+        }
 
         /* Configure GID index */
         port_num = rdma_ah_get_port_num(&attr->ah_attr);
@@ -2845,7 +2855,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
         if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_UD)
                 roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                                V2_QPC_BYTE_24_MTU_S, IB_MTU_4096);
-        else
+        else if (attr_mask & IB_QP_PATH_MTU)
                 roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
                                V2_QPC_BYTE_24_MTU_S, attr->path_mtu);
 
@@ -2922,11 +2932,9 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
                 return -EINVAL;
         }
 
-        /* If exist optional param, return error */
-        if ((attr_mask & IB_QP_ALT_PATH) || (attr_mask & IB_QP_ACCESS_FLAGS) ||
-            (attr_mask & IB_QP_QKEY) || (attr_mask & IB_QP_PATH_MIG_STATE) ||
-            (attr_mask & IB_QP_CUR_STATE) ||
-            (attr_mask & IB_QP_MIN_RNR_TIMER)) {
+        /* Not support alternate path and path migration */
+        if ((attr_mask & IB_QP_ALT_PATH) ||
+            (attr_mask & IB_QP_PATH_MIG_STATE)) {
                 dev_err(dev, "RTR2RTS attr_mask (0x%x)error\n", attr_mask);
                 return -EINVAL;
         }
@@ -3161,7 +3169,8 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
                    (cur_state == IB_QPS_RTR && new_state == IB_QPS_ERR) ||
                    (cur_state == IB_QPS_RTS && new_state == IB_QPS_ERR) ||
                    (cur_state == IB_QPS_SQD && new_state == IB_QPS_ERR) ||
-                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR)) {
+                   (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR) ||
+                   (cur_state == IB_QPS_ERR && new_state == IB_QPS_ERR)) {
                 /* Nothing */
                 ;
         } else {
@@ -4478,7 +4487,7 @@ static int hns_roce_v2_create_eq(struct hns_roce_dev *hr_dev,
         ret = hns_roce_cmd_mbox(hr_dev, mailbox->dma, 0, eq->eqn, 0,
                                 eq_cmd, HNS_ROCE_CMD_TIMEOUT_MSECS);
         if (ret) {
-                dev_err(dev, "[mailbox cmd] creat eqc failed.\n");
+                dev_err(dev, "[mailbox cmd] create eqc failed.\n");
                 goto err_cmd_mbox;
         }
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index e289a924e789..d4aad34c21e2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -620,7 +620,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
                                         to_hr_ucontext(ib_pd->uobject->context),
                                         ucmd.db_addr, &hr_qp->rdb);
                         if (ret) {
-                                dev_err(dev, "rp record doorbell map failed!\n");
+                                dev_err(dev, "rq record doorbell map failed!\n");
                                 goto err_mtt;
                         }
                 }
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 17f4f151a97f..61d8b06375bb 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -346,7 +346,7 @@ int mlx4_ib_umem_calc_optimal_mtt_size(struct ib_umem *umem, u64 start_va,
         /* Add to the first block the misalignment that it suffers from. */
         total_len += (first_block_start & ((1ULL << block_shift) - 1ULL));
         last_block_end = current_block_start + current_block_len;
-        last_block_aligned_end = round_up(last_block_end, 1 << block_shift);
+        last_block_aligned_end = round_up(last_block_end, 1ULL << block_shift);
         total_len += (last_block_aligned_end - last_block_end);
 
         if (total_len & ((1ULL << block_shift) - 1ULL))
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 50af8915e7ec..199648adac74 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -673,7 +673,8 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                                           MLX4_IB_RX_HASH_SRC_PORT_TCP  |
                                           MLX4_IB_RX_HASH_DST_PORT_TCP  |
                                           MLX4_IB_RX_HASH_SRC_PORT_UDP  |
-                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_INNER)) {
                 pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
                          ucmd->rx_hash_fields_mask);
                 return (-EOPNOTSUPP);
diff --git a/drivers/infiniband/hw/mlx5/Kconfig b/drivers/infiniband/hw/mlx5/Kconfig
index bce263b92821..fb4d77be019b 100644
--- a/drivers/infiniband/hw/mlx5/Kconfig
+++ b/drivers/infiniband/hw/mlx5/Kconfig
@@ -1,6 +1,7 @@
 config MLX5_INFINIBAND
         tristate "Mellanox Connect-IB HCA support"
         depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on INFINIBAND_USER_ACCESS || INFINIBAND_USER_ACCESS=n
         ---help---
           This driver provides low-level InfiniBand support for
           Mellanox Connect-IB PCI Express host channel adapters (HCAs).
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 241cf4ff9901..b4d8ff8ab807 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -52,7 +52,6 @@
 #include <linux/mlx5/port.h>
 #include <linux/mlx5/vport.h>
 #include <linux/mlx5/fs.h>
-#include <linux/mlx5/fs_helpers.h>
 #include <linux/list.h>
 #include <rdma/ib_smi.h>
 #include <rdma/ib_umem.h>
@@ -180,7 +179,7 @@ static int mlx5_netdev_event(struct notifier_block *this,
                         if (rep_ndev == ndev)
                                 roce->netdev = (event == NETDEV_UNREGISTER) ?
                                         NULL : ndev;
-                } else if (ndev->dev.parent == &ibdev->mdev->pdev->dev) {
+                } else if (ndev->dev.parent == &mdev->pdev->dev) {
                         roce->netdev = (event == NETDEV_UNREGISTER) ?
                                 NULL : ndev;
                 }
@@ -5427,9 +5426,7 @@ static void mlx5_ib_stage_cong_debugfs_cleanup(struct mlx5_ib_dev *dev)
 static int mlx5_ib_stage_uar_init(struct mlx5_ib_dev *dev)
 {
         dev->mdev->priv.uar = mlx5_get_uars_page(dev->mdev);
-        if (!dev->mdev->priv.uar)
-                return -ENOMEM;
-        return 0;
+        return PTR_ERR_OR_ZERO(dev->mdev->priv.uar);
 }
 
 static void mlx5_ib_stage_uar_cleanup(struct mlx5_ib_dev *dev)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 1520a2f20f98..90a9c461cedc 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -866,25 +866,28 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
                        int *order)
 {
         struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct ib_umem *u;
         int err;
 
-        *umem = ib_umem_get(pd->uobject->context, start, length,
-                            access_flags, 0);
-        err = PTR_ERR_OR_ZERO(*umem);
+        *umem = NULL;
+
+        u = ib_umem_get(pd->uobject->context, start, length, access_flags, 0);
+        err = PTR_ERR_OR_ZERO(u);
         if (err) {
-                *umem = NULL;
-                mlx5_ib_err(dev, "umem get failed (%d)\n", err);
+                mlx5_ib_dbg(dev, "umem get failed (%d)\n", err);
                 return err;
         }
 
-        mlx5_ib_cont_pages(*umem, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
+        mlx5_ib_cont_pages(u, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages,
                            page_shift, ncont, order);
         if (!*npages) {
                 mlx5_ib_warn(dev, "avoid zero region\n");
-                ib_umem_release(*umem);
+                ib_umem_release(u);
                 return -EINVAL;
         }
 
+        *umem = u;
+
         mlx5_ib_dbg(dev, "npages %d, ncont %d, order %d, page_shift %d\n",
                     *npages, *ncont, *order, *page_shift);
 
@@ -1458,13 +1461,12 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
         int access_flags = flags & IB_MR_REREG_ACCESS ?
                             new_access_flags :
                             mr->access_flags;
-        u64 addr = (flags & IB_MR_REREG_TRANS) ? virt_addr : mr->umem->address;
-        u64 len = (flags & IB_MR_REREG_TRANS) ? length : mr->umem->length;
         int page_shift = 0;
         int upd_flags = 0;
         int npages = 0;
         int ncont = 0;
         int order = 0;
+        u64 addr, len;
         int err;
 
         mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
@@ -1472,6 +1474,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
 
         atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
 
+        if (!mr->umem)
+                return -EINVAL;
+
+        if (flags & IB_MR_REREG_TRANS) {
+                addr = virt_addr;
+                len = length;
+        } else {
+                addr = mr->umem->address;
+                len = mr->umem->length;
+        }
+
         if (flags != IB_MR_REREG_PD) {
                 /*
                  * Replace umem. This needs to be done whether or not UMR is
@@ -1479,6 +1492,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                  */
                 flags |= IB_MR_REREG_TRANS;
                 ib_umem_release(mr->umem);
+                mr->umem = NULL;
                 err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                   &npages, &page_shift, &ncont, &order);
                 if (err)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7ed4b70f6447..87b7c1be2a11 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -259,7 +259,11 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
         } else {
                 if (ucmd) {
                         qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+                        if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
+                                return -EINVAL;
                         qp->rq.wqe_shift = ucmd->rq_wqe_shift;
+                        if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig)
+                                return -EINVAL;
                         qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
                         qp->rq.max_post = qp->rq.wqe_cnt;
                 } else {
@@ -2451,18 +2455,18 @@ enum {
 
 static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate)
 {
-        if (rate == IB_RATE_PORT_CURRENT) {
+        if (rate == IB_RATE_PORT_CURRENT)
                 return 0;
-        } else if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS) {
+
+        if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS)
                 return -EINVAL;
-        } else {
-                while (rate != IB_RATE_2_5_GBPS &&
-                       !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
-                         MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
-                        --rate;
-        }
 
-        return rate + MLX5_STAT_RATE_OFFSET;
+        while (rate != IB_RATE_PORT_CURRENT &&
+               !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
+                 MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
+                --rate;
+
+        return rate ? rate + MLX5_STAT_RATE_OFFSET : rate;
 }
 
 static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 0a75164cedea..007d5e8a0121 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -461,7 +461,7 @@ static bool nes_nic_send(struct sk_buff *skb, struct net_device *netdev)
 /**
  * nes_netdev_start_xmit
  */
-static int nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+static netdev_tx_t nes_netdev_start_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         struct nes_vnic *nesvnic = netdev_priv(netdev);
         struct nes_device *nesdev = nesvnic->nesdev;
diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c
index 61927c165b59..4cf11063e0b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_opcode.c
+++ b/drivers/infiniband/sw/rxe/rxe_opcode.c
@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = {
                 .name   = "IB_OPCODE_RC_SEND_ONLY_INV",
                 .mask   = RXE_IETH_MASK | RXE_PAYLOAD_MASK | RXE_REQ_MASK
                                 | RXE_COMP_MASK | RXE_RWR_MASK | RXE_SEND_MASK
-                                | RXE_END_MASK,
+                                | RXE_END_MASK  | RXE_START_MASK,
                 .length = RXE_BTH_BYTES + RXE_IETH_BYTES,
                 .offset = {
                         [RXE_BTH]       = 0,
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 7bdaf71b8221..785199990457 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -728,7 +728,6 @@ next_wqe:
                 rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
 
                 if (ret == -EAGAIN) {
-                        kfree_skb(skb);
                         rxe_run_task(&qp->req.task, 1);
                         goto exit;
                 }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index a65c9969f7fc..955ff3b6da9c 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -742,7 +742,6 @@ static enum resp_states read_reply(struct rxe_qp *qp,
         err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
         if (err) {
                 pr_err("Failed sending RDMA reply.\n");
-                kfree_skb(skb);
                 return RESPST_ERR_RNR;
         }
 
@@ -954,10 +953,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
         }
 
         err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb);
-        if (err) {
+        if (err)
                 pr_err_ratelimited("Failed sending ack\n");
-                kfree_skb(skb);
-        }
 
 err1:
         return err;
@@ -1141,7 +1138,6 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                         if (rc) {
                                 pr_err("Failed resending result. This flow is not handled - skb ignored\n");
                                 rxe_drop_ref(qp);
-                                kfree_skb(skb_copy);
                                 rc = RESPST_CLEANUP;
                                 goto out;
                         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 161ba8c76285..cf291f90b58f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1094,7 +1094,7 @@ drop_and_unlock:
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
         struct rdma_netdev *rn = netdev_priv(dev);
diff --git a/drivers/infiniband/ulp/srp/Kconfig b/drivers/infiniband/ulp/srp/Kconfig
index c74ee9633041..99db8fe5173a 100644
--- a/drivers/infiniband/ulp/srp/Kconfig
+++ b/drivers/infiniband/ulp/srp/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRP
         tristate "InfiniBand SCSI RDMA Protocol"
-        depends on SCSI
+        depends on SCSI && INFINIBAND_ADDR_TRANS
         select SCSI_SRP_ATTRS
         ---help---
           Support for the SCSI RDMA Protocol over InfiniBand.  This
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index 31ee83d528d9..fb8b7182f05e 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
         tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND && TARGET_CORE
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
         ---help---
 
           Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index b979cf3bce65..88a8b5916624 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND && BLOCK
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
         select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 5f4f8b16685f..3c7b61ddb0d1 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 
 config NVME_TARGET_RDMA
         tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
         depends on NVME_TARGET
         select SGL_ALLOC
         help
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 741749a98614..5f132d59dfc2 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -197,7 +197,7 @@ config CIFS_SMB311
 
 config CIFS_SMB_DIRECT
         bool "SMB Direct support (Experimental)"
-        depends on CIFS=m && INFINIBAND || CIFS=y && INFINIBAND=y
+        depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
         help
           Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1.
           SMB Direct allows transferring SMB packets over RDMA. If unsure,
diff --git a/include/uapi/linux/if_infiniband.h b/include/uapi/linux/if_infiniband.h
index 050b92dcf8cf..0fc33bf30e45 100644
--- a/include/uapi/linux/if_infiniband.h
+++ b/include/uapi/linux/if_infiniband.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
 /*
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index a66b213de3d7..20c6bd0b0007 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2008 Oracle.  All rights reserved.
  *
diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h
index c6633e97eca4..ff02287495ac 100644
--- a/include/uapi/linux/tls.h
+++ b/include/uapi/linux/tls.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved.
  *
diff --git a/include/uapi/rdma/cxgb3-abi.h b/include/uapi/rdma/cxgb3-abi.h
index 9acb4b7a6246..85aed672f43e 100644
--- a/include/uapi/rdma/cxgb3-abi.h
+++ b/include/uapi/rdma/cxgb3-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
  *
diff --git a/include/uapi/rdma/cxgb4-abi.h b/include/uapi/rdma/cxgb4-abi.h
index 1fefd0140c26..a159ba8dcf8f 100644
--- a/include/uapi/rdma/cxgb4-abi.h
+++ b/include/uapi/rdma/cxgb4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
  *
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index 7092c8de4bd8..78613b609fa8 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2016 Hisilicon Limited.
  *
diff --git a/include/uapi/rdma/ib_user_cm.h b/include/uapi/rdma/ib_user_cm.h
index 4a8f9562f7cd..e2709bb8cb18 100644
--- a/include/uapi/rdma/ib_user_cm.h
+++ b/include/uapi/rdma/ib_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h
index 04e46ea517d3..625545d862d7 100644
--- a/include/uapi/rdma/ib_user_ioctl_verbs.h
+++ b/include/uapi/rdma/ib_user_ioctl_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2017-2018, Mellanox Technologies inc.  All rights reserved.
  *
diff --git a/include/uapi/rdma/ib_user_mad.h b/include/uapi/rdma/ib_user_mad.h
index ef92118dad97..90c0cf228020 100644
--- a/include/uapi/rdma/ib_user_mad.h
+++ b/include/uapi/rdma/ib_user_mad.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
diff --git a/include/uapi/rdma/ib_user_sa.h b/include/uapi/rdma/ib_user_sa.h
index 0d2607f0cd20..435155d6e1c6 100644
--- a/include/uapi/rdma/ib_user_sa.h
+++ b/include/uapi/rdma/ib_user_sa.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
  *
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 9be07394fdbe..6aeb03315b0b 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/mlx4-abi.h b/include/uapi/rdma/mlx4-abi.h
index 04f64bc4045f..f74557528175 100644
--- a/include/uapi/rdma/mlx4-abi.h
+++ b/include/uapi/rdma/mlx4-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2007 Cisco Systems, Inc. All rights reserved.
  * Copyright (c) 2007, 2008 Mellanox Technologies. All rights reserved.
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index cb4a02c4a1ce..fdaf00e20649 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
  *
diff --git a/include/uapi/rdma/mthca-abi.h b/include/uapi/rdma/mthca-abi.h
index ac756cd9e807..91b12e1a6f43 100644
--- a/include/uapi/rdma/mthca-abi.h
+++ b/include/uapi/rdma/mthca-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
diff --git a/include/uapi/rdma/nes-abi.h b/include/uapi/rdma/nes-abi.h
index 35bfd4015d07..f80495baa969 100644
--- a/include/uapi/rdma/nes-abi.h
+++ b/include/uapi/rdma/nes-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2006 - 2011 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
diff --git a/include/uapi/rdma/qedr-abi.h b/include/uapi/rdma/qedr-abi.h
index 8ba098900e9a..24c658b3c790 100644
--- a/include/uapi/rdma/qedr-abi.h
+++ b/include/uapi/rdma/qedr-abi.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /* QLogic qedr NIC Driver
  * Copyright (c) 2015-2016  QLogic Corporation
  *
diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h
index e1269024af47..0d1e78ebad05 100644
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2005-2006 Intel Corporation.  All rights reserved.
  *
diff --git a/include/uapi/rdma/rdma_user_ioctl.h b/include/uapi/rdma/rdma_user_ioctl.h
index d223f4164a0f..d92d2721b28c 100644
--- a/include/uapi/rdma/rdma_user_ioctl.h
+++ b/include/uapi/rdma/rdma_user_ioctl.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2016 Mellanox Technologies, LTD. All rights reserved.
  *
diff --git a/include/uapi/rdma/rdma_user_rxe.h b/include/uapi/rdma/rdma_user_rxe.h
index 1f8a9e7daea4..44ef6a3b7afc 100644
--- a/include/uapi/rdma/rdma_user_rxe.h
+++ b/include/uapi/rdma/rdma_user_rxe.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
 /*
  * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
  *