Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma

Pull more rdma fixes from Doug Ledford:
 "As per my previous pull request, there were two drivers that each had
  a rather large number of legitimate fixes still to be sent.

  As it turned out, I also missed a reasonably large set of fixes from
  one person across the stack that are all important fixes. All in all,
  the bnxt_re, i40iw, and Dan Carpenter are 3/4 to 2/3rds of this pull
  request.

  There were some other random fixes that I didn't send in the last pull
  request that I added to this one. This catches the rdma stack up to
  the fixes from up to about the beginning of this week. Any more fixes
  I'll wait and batch up later in the -rc cycle. This will give us a
  good base to start with for basing a for-next branch on -rc2.

  Summary:

   - i40iw fixes

   - bnxt_re fixes

   - Dan Carpenter bugfixes across stack

   - ten more random fixes, no more than two from any one person"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (37 commits)
  RDMA/core: Initialize port_num in qp_attr
  RDMA/uverbs: Fix the check for port number
  IB/cma: Fix reference count leak when no ipv4 addresses are set
  RDMA/iser: don't send an rkey if all data is written as immadiate-data
  rxe: fix broken receive queue draining
  RDMA/qedr: Prevent memory overrun in verbs' user responses
  iw_cxgb4: don't use WR keys/addrs for 0 byte reads
  IB/mlx4: Fix CM REQ retries in paravirt mode
  IB/rdmavt: Setting of QP timeout can overflow jiffies computation
  IB/core: Fix sparse warnings
  RDMA/bnxt_re: Fix the value reported for local ack delay
  RDMA/bnxt_re: Report MISSED_EVENTS in req_notify_cq
  RDMA/bnxt_re: Fix return value of poll routine
  RDMA/bnxt_re: Enable atomics only if host bios supports
  RDMA/bnxt_re: Specify RDMA component when allocating stats context
  RDMA/bnxt_re: Fixed the max_rd_atomic support for initiator and destination QP
  RDMA/bnxt_re: Report supported value to IB stack in query_device
  RDMA/bnxt_re: Do not free the ctx_tbl entry if delete GID fails
  RDMA/bnxt_re: Fix WQE Size posted to HW to prevent it from throwing error
  RDMA/bnxt_re: Free doorbell page index (DPI) during dealloc ucontext
  ...

1 files changed, 58 insertions, 2 deletions

diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 56d986924a4c..e311ec559f4e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -337,6 +337,7 @@ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait
  */
 void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp_request)
 {
+        struct i40iw_device *iwdev = container_of(cqp, struct i40iw_device, cqp);
         unsigned long flags;
 
         if (cqp_request->dynamic) {
@@ -350,6 +351,7 @@ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp
                 list_add_tail(&cqp_request->list, &cqp->cqp_avail_reqs);
                 spin_unlock_irqrestore(&cqp->req_lock, flags);
         }
+        wake_up(&iwdev->close_wq);
 }
 
 /**
@@ -365,6 +367,56 @@ void i40iw_put_cqp_request(struct i40iw_cqp *cqp,
 }
 
 /**
+ * i40iw_free_pending_cqp_request -free pending cqp request objs
+ * @cqp: cqp ptr
+ * @cqp_request: to be put back in cqp list
+ */
+static void i40iw_free_pending_cqp_request(struct i40iw_cqp *cqp,
+                                           struct i40iw_cqp_request *cqp_request)
+{
+        struct i40iw_device *iwdev = container_of(cqp, struct i40iw_device, cqp);
+
+        if (cqp_request->waiting) {
+                cqp_request->compl_info.error = true;
+                cqp_request->request_done = true;
+                wake_up(&cqp_request->waitq);
+        }
+        i40iw_put_cqp_request(cqp, cqp_request);
+        wait_event_timeout(iwdev->close_wq,
+                           !atomic_read(&cqp_request->refcount),
+                           1000);
+}
+
+/**
+ * i40iw_cleanup_pending_cqp_op - clean-up cqp with no completions
+ * @iwdev: iwarp device
+ */
+void i40iw_cleanup_pending_cqp_op(struct i40iw_device *iwdev)
+{
+        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
+        struct i40iw_cqp *cqp = &iwdev->cqp;
+        struct i40iw_cqp_request *cqp_request = NULL;
+        struct cqp_commands_info *pcmdinfo = NULL;
+        u32 i, pending_work, wqe_idx;
+
+        pending_work = I40IW_RING_WORK_AVAILABLE(cqp->sc_cqp.sq_ring);
+        wqe_idx = I40IW_RING_GETCURRENT_TAIL(cqp->sc_cqp.sq_ring);
+        for (i = 0; i < pending_work; i++) {
+                cqp_request = (struct i40iw_cqp_request *)(unsigned long)cqp->scratch_array[wqe_idx];
+                if (cqp_request)
+                        i40iw_free_pending_cqp_request(cqp, cqp_request);
+                wqe_idx = (wqe_idx + 1) % I40IW_RING_GETSIZE(cqp->sc_cqp.sq_ring);
+        }
+
+        while (!list_empty(&dev->cqp_cmd_head)) {
+                pcmdinfo = (struct cqp_commands_info *)i40iw_remove_head(&dev->cqp_cmd_head);
+                cqp_request = container_of(pcmdinfo, struct i40iw_cqp_request, info);
+                if (cqp_request)
+                        i40iw_free_pending_cqp_request(cqp, cqp_request);
+        }
+}
+
+/**
  * i40iw_free_qp - callback after destroy cqp completes
  * @cqp_request: cqp request for destroy qp
  * @num: not used
@@ -546,8 +598,12 @@ void i40iw_rem_ref(struct ib_qp *ibqp)
         cqp_info->in.u.qp_destroy.scratch = (uintptr_t)cqp_request;
         cqp_info->in.u.qp_destroy.remove_hash_idx = true;
         status = i40iw_handle_cqp_op(iwdev, cqp_request);
-        if (status)
-                i40iw_pr_err("CQP-OP Destroy QP fail");
+        if (!status)
+                return;
+
+        i40iw_rem_pdusecount(iwqp->iwpd, iwdev);
+        i40iw_free_qp_resources(iwdev, iwqp, qp_num);
+        i40iw_rem_devusecount(iwdev);
 }
 
 /**