42 files changed, 262 insertions, 153 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 63a7cc00bae0..84f077b2b90a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -494,7 +494,10 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv,
         id_priv->id.route.addr.dev_addr.transport =
                 rdma_node_get_transport(cma_dev->device->node_type);
         list_add_tail(&id_priv->list, &cma_dev->id_list);
-        rdma_restrack_kadd(&id_priv->res);
+        if (id_priv->res.kern_name)
+                rdma_restrack_kadd(&id_priv->res);
+        else
+                rdma_restrack_uadd(&id_priv->res);
 }
 
 static void cma_attach_to_dev(struct rdma_id_private *id_priv,
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index e600fc23ae62..3c97a8b6bf1e 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -584,10 +584,6 @@ static int fill_res_pd_entry(struct sk_buff *msg, struct netlink_callback *cb,
         if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_RES_USECNT,
                               atomic_read(&pd->usecnt), RDMA_NLDEV_ATTR_PAD))
                 goto err;
-        if ((pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY,
-                        pd->unsafe_global_rkey))
-                goto err;
 
         if (fill_res_name_pid(msg, res))
                 goto err;
diff --git a/drivers/infiniband/core/rdma_core.h b/drivers/infiniband/core/rdma_core.h
index be6b8e1257d0..69f8db66925e 100644
--- a/drivers/infiniband/core/rdma_core.h
+++ b/drivers/infiniband/core/rdma_core.h
@@ -106,6 +106,8 @@ int uverbs_finalize_object(struct ib_uobject *uobj,
                            enum uverbs_obj_access access,
                            bool commit);
 
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx);
+
 void setup_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 void release_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6b12cc5f97b2..3317300ab036 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -60,6 +60,10 @@ static int uverbs_response(struct uverbs_attr_bundle *attrs, const void *resp,
 {
         int ret;
 
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                return uverbs_copy_to_struct_or_zero(
+                        attrs, UVERBS_ATTR_CORE_OUT, resp, resp_len);
+
         if (copy_to_user(attrs->ucore.outbuf, resp,
                          min(attrs->ucore.outlen, resp_len)))
                 return -EFAULT;
@@ -1181,6 +1185,9 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)
                 goto out_put;
         }
 
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                ret = uverbs_output_written(attrs, UVERBS_ATTR_CORE_OUT);
+
         ret = 0;
 
 out_put:
@@ -2012,8 +2019,10 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)
                 return -ENOMEM;
 
         qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs);
-        if (!qp)
+        if (!qp) {
+                ret = -EINVAL;
                 goto out;
+        }
 
         is_ud = qp->qp_type == IB_QPT_UD;
         sg_ind = 0;
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c81ff698052..0ca04d224015 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -144,6 +144,21 @@ static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr,
                            0, uattr->len - len);
 }
 
+static int uverbs_set_output(const struct uverbs_attr_bundle *bundle,
+                             const struct uverbs_attr *attr)
+{
+        struct bundle_priv *pbundle =
+                container_of(bundle, struct bundle_priv, bundle);
+        u16 flags;
+
+        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+                UVERBS_ATTR_F_VALID_OUTPUT;
+        if (put_user(flags,
+                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
+                return -EFAULT;
+        return 0;
+}
+
 static int uverbs_process_idrs_array(struct bundle_priv *pbundle,
                                      const struct uverbs_api_attr *attr_uapi,
                                      struct uverbs_objs_arr_attr *attr,
@@ -456,6 +471,19 @@ static int ib_uverbs_run_method(struct bundle_priv *pbundle,
         }
 
         /*
+         * Until the drivers are revised to use the bundle directly we have to
+         * assume that the driver wrote to its UHW_OUT and flag userspace
+         * appropriately.
+         */
+        if (!ret && pbundle->method_elm->has_udata) {
+                const struct uverbs_attr *attr =
+                        uverbs_attr_get(&pbundle->bundle, UVERBS_ATTR_UHW_OUT);
+
+                if (!IS_ERR(attr))
+                        ret = uverbs_set_output(&pbundle->bundle, attr);
+        }
+
+        /*
          * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
          * not invoke the method because the request is not supported.  No
          * other cases should return this code.
@@ -706,10 +734,7 @@ void uverbs_fill_udata(struct uverbs_attr_bundle *bundle,
 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
                    const void *from, size_t size)
 {
-        struct bundle_priv *pbundle =
-                container_of(bundle, struct bundle_priv, bundle);
         const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        u16 flags;
         size_t min_size;
 
         if (IS_ERR(attr))
@@ -719,16 +744,25 @@ int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
         if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
                 return -EFAULT;
 
-        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
-                UVERBS_ATTR_F_VALID_OUTPUT;
-        if (put_user(flags,
-                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
-                return -EFAULT;
-
-        return 0;
+        return uverbs_set_output(bundle, attr);
 }
 EXPORT_SYMBOL(uverbs_copy_to);
 
+
+/*
+ * This is only used if the caller has directly used copy_to_use to write the
+ * data.  It signals to user space that the buffer is filled in.
+ */
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx)
+{
+        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
+
+        if (IS_ERR(attr))
+                return PTR_ERR(attr);
+
+        return uverbs_set_output(bundle, attr);
+}
+
 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
                       size_t idx, s64 lower_bound, u64 upper_bound,
                       s64  *def_val)
@@ -757,8 +791,10 @@ int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle,
 {
         const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
 
-        if (clear_user(u64_to_user_ptr(attr->ptr_attr.data),
-                       attr->ptr_attr.len))
-                return -EFAULT;
+        if (size < attr->ptr_attr.len) {
+                if (clear_user(u64_to_user_ptr(attr->ptr_attr.data) + size,
+                               attr->ptr_attr.len - size))
+                        return -EFAULT;
+        }
         return uverbs_copy_to(bundle, idx, from, size);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb0007aa0c27..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -690,6 +693,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
 
         buf += sizeof(hdr);
 
+        memset(bundle.attr_present, 0, sizeof(bundle.attr_present));
         bundle.ufile = file;
         if (!method_elm->is_ex) {
                 size_t in_len = hdr.in_words * 4 - sizeof(hdr);
@@ -963,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1095,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 326805461265..19551aa43850 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -766,8 +766,8 @@ struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
                 return NULL;
 
         sbuf->size = size;
-        sbuf->sb = dma_zalloc_coherent(&rcfw->pdev->dev, sbuf->size,
-                                       &sbuf->dma_addr, GFP_ATOMIC);
+        sbuf->sb = dma_alloc_coherent(&rcfw->pdev->dev, sbuf->size,
+                                      &sbuf->dma_addr, GFP_ATOMIC);
         if (!sbuf->sb)
                 goto bail;
 
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 59eeac55626f..57d4951679cb 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -105,10 +105,10 @@ static int __alloc_pbl(struct pci_dev *pdev, struct bnxt_qplib_pbl *pbl,
 
         if (!sghead) {
                 for (i = 0; i < pages; i++) {
-                        pbl->pg_arr[i] = dma_zalloc_coherent(&pdev->dev,
-                                                             pbl->pg_size,
-                                                             &pbl->pg_map_arr[i],
-                                                             GFP_KERNEL);
+                        pbl->pg_arr[i] = dma_alloc_coherent(&pdev->dev,
+                                                            pbl->pg_size,
+                                                            &pbl->pg_map_arr[i],
+                                                            GFP_KERNEL);
                         if (!pbl->pg_arr[i])
                                 goto fail;
                         pbl->pg_count++;
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index df4f7a3f043d..8ac72ac7cbac 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -291,9 +291,9 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
         if (!wq->sq)
                 goto err3;
 
-        wq->queue = dma_zalloc_coherent(&(rdev_p->rnic_info.pdev->dev),
-                                             depth * sizeof(union t3_wr),
-                                             &(wq->dma_addr), GFP_KERNEL);
+        wq->queue = dma_alloc_coherent(&(rdev_p->rnic_info.pdev->dev),
+                                       depth * sizeof(union t3_wr),
+                                       &(wq->dma_addr), GFP_KERNEL);
         if (!wq->queue)
                 goto err4;
 
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index c13c0ba30f63..d499cd61c0e8 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -783,6 +783,7 @@ void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
 static int c4iw_rdev_open(struct c4iw_rdev *rdev)
 {
         int err;
+        unsigned int factor;
 
         c4iw_init_dev_ucontext(rdev, &rdev->uctx);
 
@@ -806,8 +807,18 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 return -EINVAL;
         }
 
-        rdev->qpmask = rdev->lldi.udb_density - 1;
-        rdev->cqmask = rdev->lldi.ucq_density - 1;
+        /* This implementation requires a sge_host_page_size <= PAGE_SIZE. */
+        if (rdev->lldi.sge_host_page_size > PAGE_SIZE) {
+                pr_err("%s: unsupported sge host page size %u\n",
+                       pci_name(rdev->lldi.pdev),
+                       rdev->lldi.sge_host_page_size);
+                return -EINVAL;
+        }
+
+        factor = PAGE_SIZE / rdev->lldi.sge_host_page_size;
+        rdev->qpmask = (rdev->lldi.udb_density * factor) - 1;
+        rdev->cqmask = (rdev->lldi.ucq_density * factor) - 1;
+
         pr_debug("dev %s stag start 0x%0x size 0x%0x num stags %d pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x qp qid start %u size %u cq qid start %u size %u srq size %u\n",
                  pci_name(rdev->lldi.pdev), rdev->lldi.vr->stag.start,
                  rdev->lldi.vr->stag.size, c4iw_num_stags(rdev),
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 981ff5cfb5d1..504cf525508f 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -2564,9 +2564,8 @@ static int alloc_srq_queue(struct c4iw_srq *srq, struct c4iw_dev_ucontext *uctx,
         wq->rqt_abs_idx = (wq->rqt_hwaddr - rdev->lldi.vr->rq.start) >>
                 T4_RQT_ENTRY_SHIFT;
 
-        wq->queue = dma_zalloc_coherent(&rdev->lldi.pdev->dev,
-                                       wq->memsize, &wq->dma_addr,
-                        GFP_KERNEL);
+        wq->queue = dma_alloc_coherent(&rdev->lldi.pdev->dev, wq->memsize,
+                                       &wq->dma_addr, GFP_KERNEL);
         if (!wq->queue)
                 goto err_free_rqtpool;
 
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                 vmf = 1;
                 break;
         case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                         ret = -EPERM;
                         goto done;
                 }
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 09044905284f..7835eb52e7c5 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -899,10 +899,10 @@ int hfi1_init(struct hfi1_devdata *dd, int reinit)
                 goto done;
 
         /* allocate dummy tail memory for all receive contexts */
-        dd->rcvhdrtail_dummy_kvaddr = dma_zalloc_coherent(
-                &dd->pcidev->dev, sizeof(u64),
-                &dd->rcvhdrtail_dummy_dma,
-                GFP_KERNEL);
+        dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
+                                                         sizeof(u64),
+                                                         &dd->rcvhdrtail_dummy_dma,
+                                                         GFP_KERNEL);
 
         if (!dd->rcvhdrtail_dummy_kvaddr) {
                 dd_dev_err(dd, "cannot allocate dummy tail memory\n");
@@ -1863,9 +1863,9 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd)
                         gfp_flags = GFP_KERNEL;
                 else
                         gfp_flags = GFP_USER;
-                rcd->rcvhdrq = dma_zalloc_coherent(
-                        &dd->pcidev->dev, amt, &rcd->rcvhdrq_dma,
-                        gfp_flags | __GFP_COMP);
+                rcd->rcvhdrq = dma_alloc_coherent(&dd->pcidev->dev, amt,
+                                                  &rcd->rcvhdrq_dma,
+                                                  gfp_flags | __GFP_COMP);
 
                 if (!rcd->rcvhdrq) {
                         dd_dev_err(dd,
@@ -1876,9 +1876,10 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd)
 
                 if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) ||
                     HFI1_CAP_UGET_MASK(rcd->flags, DMA_RTAIL)) {
-                        rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent(
-                                &dd->pcidev->dev, PAGE_SIZE,
-                                &rcd->rcvhdrqtailaddr_dma, gfp_flags);
+                        rcd->rcvhdrtail_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
+                                                                    PAGE_SIZE,
+                                                                    &rcd->rcvhdrqtailaddr_dma,
+                                                                    gfp_flags);
                         if (!rcd->rcvhdrtail_kvaddr)
                                 goto bail_free;
                 }
@@ -1974,10 +1975,10 @@ int hfi1_setup_eagerbufs(struct hfi1_ctxtdata *rcd)
         while (alloced_bytes < rcd->egrbufs.size &&
                rcd->egrbufs.alloced < rcd->egrbufs.count) {
                 rcd->egrbufs.buffers[idx].addr =
-                        dma_zalloc_coherent(&dd->pcidev->dev,
-                                            rcd->egrbufs.rcvtid_size,
-                                            &rcd->egrbufs.buffers[idx].dma,
-                                            gfp_flags);
+                        dma_alloc_coherent(&dd->pcidev->dev,
+                                           rcd->egrbufs.rcvtid_size,
+                                           &rcd->egrbufs.buffers[idx].dma,
+                                           gfp_flags);
                 if (rcd->egrbufs.buffers[idx].addr) {
                         rcd->egrbufs.buffers[idx].len =
                                 rcd->egrbufs.rcvtid_size;
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index dd5a5c030066..04126d7e318d 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -2098,11 +2098,10 @@ int init_credit_return(struct hfi1_devdata *dd)
                 int bytes = TXE_NUM_CONTEXTS * sizeof(struct credit_return);
 
                 set_dev_node(&dd->pcidev->dev, i);
-                dd->cr_base[i].va = dma_zalloc_coherent(
-                                        &dd->pcidev->dev,
-                                        bytes,
-                                        &dd->cr_base[i].dma,
-                                        GFP_KERNEL);
+                dd->cr_base[i].va = dma_alloc_coherent(&dd->pcidev->dev,
+                                                       bytes,
+                                                       &dd->cr_base[i].dma,
+                                                       GFP_KERNEL);
                 if (!dd->cr_base[i].va) {
                         set_dev_node(&dd->pcidev->dev, dd->node);
                         dd_dev_err(dd,
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index b84356e1a4c1..96897a91fb0a 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -1453,12 +1453,9 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
                 timer_setup(&sde->err_progress_check_timer,
                             sdma_err_progress_check, 0);
 
-                sde->descq = dma_zalloc_coherent(
-                        &dd->pcidev->dev,
-                        descq_cnt * sizeof(u64[2]),
-                        &sde->descq_phys,
-                        GFP_KERNEL
-                );
+                sde->descq = dma_alloc_coherent(&dd->pcidev->dev,
+                                                descq_cnt * sizeof(u64[2]),
+                                                &sde->descq_phys, GFP_KERNEL);
                 if (!sde->descq)
                         goto bail;
                 sde->tx_ring =
@@ -1471,24 +1468,18 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
 
         dd->sdma_heads_size = L1_CACHE_BYTES * num_engines;
         /* Allocate memory for DMA of head registers to memory */
-        dd->sdma_heads_dma = dma_zalloc_coherent(
-                &dd->pcidev->dev,
-                dd->sdma_heads_size,
-                &dd->sdma_heads_phys,
-                GFP_KERNEL
-        );
+        dd->sdma_heads_dma = dma_alloc_coherent(&dd->pcidev->dev,
+                                                dd->sdma_heads_size,
+                                                &dd->sdma_heads_phys,
+                                                GFP_KERNEL);
         if (!dd->sdma_heads_dma) {
                 dd_dev_err(dd, "failed to allocate SendDMA head memory\n");
                 goto bail;
         }
 
         /* Allocate memory for pad */
-        dd->sdma_pad_dma = dma_zalloc_coherent(
-                &dd->pcidev->dev,
-                sizeof(u32),
-                &dd->sdma_pad_phys,
-                GFP_KERNEL
-        );
+        dd->sdma_pad_dma = dma_alloc_coherent(&dd->pcidev->dev, sizeof(u32),
+                                              &dd->sdma_pad_phys, GFP_KERNEL);
         if (!dd->sdma_pad_dma) {
                 dd_dev_err(dd, "failed to allocate SendDMA pad memory\n");
                 goto bail;
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c
index 6300033a448f..dac058d3df53 100644
--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c
+++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c
@@ -197,8 +197,8 @@ int hns_roce_buf_alloc(struct hns_roce_dev *hr_dev, u32 size, u32 max_direct,
                 buf->npages = 1 << order;
                 buf->page_shift = page_shift;
                 /* MTT PA must be recorded in 4k alignment, t is 4k aligned */
-                buf->direct.buf = dma_zalloc_coherent(dev,
-                                                      size, &t, GFP_KERNEL);
+                buf->direct.buf = dma_alloc_coherent(dev, size, &t,
+                                                     GFP_KERNEL);
                 if (!buf->direct.buf)
                         return -ENOMEM;
 
@@ -219,9 +219,10 @@ int hns_roce_buf_alloc(struct hns_roce_dev *hr_dev, u32 size, u32 max_direct,
                         return -ENOMEM;
 
                 for (i = 0; i < buf->nbufs; ++i) {
-                        buf->page_list[i].buf = dma_zalloc_coherent(dev,
-                                                                  page_size, &t,
-                                                                  GFP_KERNEL);
+                        buf->page_list[i].buf = dma_alloc_coherent(dev,
+                                                                   page_size,
+                                                                   &t,
+                                                                   GFP_KERNEL);
 
                         if (!buf->page_list[i].buf)
                                 goto err_free;
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 3a669451cf86..543fa1504cd3 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -5091,7 +5091,7 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
                                 eqe_alloc = i * (buf_chk_sz / eq->eqe_size);
                                 size = (eq->entries - eqe_alloc) * eq->eqe_size;
                         }
-                        eq->buf[i] = dma_zalloc_coherent(dev, size,
+                        eq->buf[i] = dma_alloc_coherent(dev, size,
                                                         &(eq->buf_dma[i]),
                                                         GFP_KERNEL);
                         if (!eq->buf[i])
@@ -5126,9 +5126,9 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
                                         size = (eq->entries - eqe_alloc)
                                                 * eq->eqe_size;
                                 }
-                                eq->buf[idx] = dma_zalloc_coherent(dev, size,
-                                                            &(eq->buf_dma[idx]),
-                                                            GFP_KERNEL);
+                                eq->buf[idx] = dma_alloc_coherent(dev, size,
+                                                                  &(eq->buf_dma[idx]),
+                                                                  GFP_KERNEL);
                                 if (!eq->buf[idx])
                                         goto err_dma_alloc_buf;
 
@@ -5241,7 +5241,7 @@ static int hns_roce_v2_create_eq(struct hns_roce_dev *hr_dev,
                         goto free_cmd_mbox;
                 }
 
-                eq->buf_list->buf = dma_zalloc_coherent(dev, buf_chk_sz,
+                eq->buf_list->buf = dma_alloc_coherent(dev, buf_chk_sz,
                                                        &(eq->buf_list->map),
                                                        GFP_KERNEL);
                 if (!eq->buf_list->buf) {
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                    struct ib_udata *udata)
 {
         struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
         struct hns_roce_srq *srq;
         int srq_desc_size;
         int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
 
         srq->event = hns_roce_ib_srq_event;
         srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
 
         if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                         ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                 }
         }
 
         return &srq->ibsrq;
 
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
+
 err_wrid:
         kvfree(srq->wrid);
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index a9ea966877f2..59e978141ad4 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -745,8 +745,8 @@ enum i40iw_status_code i40iw_allocate_dma_mem(struct i40iw_hw *hw,
         if (!mem)
                 return I40IW_ERR_PARAM;
         mem->size = ALIGN(size, alignment);
-        mem->va = dma_zalloc_coherent(&pcidev->dev, mem->size,
-                                      (dma_addr_t *)&mem->pa, GFP_KERNEL);
+        mem->va = dma_alloc_coherent(&pcidev->dev, mem->size,
+                                     (dma_addr_t *)&mem->pa, GFP_KERNEL);
         if (!mem->va)
                 return I40IW_ERR_NO_MEMORY;
         return 0;
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
         sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
         if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
         sqp->tx_ring[wire_tx_ix].ah = ah;
         ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                    sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                 if (wc.status == IB_WC_SUCCESS) {
                         switch (wc.opcode) {
                         case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                  " status = %d, wrid = 0x%llx\n",
                                  ctx->slave, wc.status, wc.wr_id);
                         if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
         UAPI_DEF_CHAIN_OBJ_TREE(
                 UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
+                &mlx5_ib_fs),
         UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                 &mlx5_ib_flow_actions),
         {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
         struct prefetch_mr_work *w =
                 container_of(work, struct prefetch_mr_work, work);
 
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                          w->num_sge);
-
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
         kfree(w);
 }
 
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                 num_sge);
 
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
-
         work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
         if (!work)
                 return -ENOMEM;
 
         memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
 
+        get_device(&dev->ib_dev.dev);
         work->dev = dev;
         work->pf_flags = pf_flags;
         work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
 
                 if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                       MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
-                                              MLX5_QP_FLAG_TYPE_DCT |
-                                              MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
                         return -EINVAL;
 
                 err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index cc9c0c8ccba3..112d2f38e0de 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -623,8 +623,9 @@ int mthca_alloc_db(struct mthca_dev *dev, enum mthca_db_type type,
         page = dev->db_tab->page + end;
 
 alloc:
-        page->db_rec = dma_zalloc_coherent(&dev->pdev->dev, MTHCA_ICM_PAGE_SIZE,
-                                           &page->mapping, GFP_KERNEL);
+        page->db_rec = dma_alloc_coherent(&dev->pdev->dev,
+                                          MTHCA_ICM_PAGE_SIZE, &page->mapping,
+                                          GFP_KERNEL);
         if (!page->db_rec) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 82cb6b71ac7c..e3e9dd54caa2 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -534,7 +534,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
         {
                 struct mthca_ucontext *context;
 
-                qp = kmalloc(sizeof *qp, GFP_KERNEL);
+                qp = kzalloc(sizeof(*qp), GFP_KERNEL);
                 if (!qp)
                         return ERR_PTR(-ENOMEM);
 
@@ -600,7 +600,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                 if (udata)
                         return ERR_PTR(-EINVAL);
 
-                qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
+                qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
                 if (!qp)
                         return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 241a57a07485..097e5ab2a19f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -380,8 +380,8 @@ static int ocrdma_alloc_q(struct ocrdma_dev *dev,
         q->len = len;
         q->entry_size = entry_size;
         q->size = len * entry_size;
-        q->va = dma_zalloc_coherent(&dev->nic_info.pdev->dev, q->size,
-                                    &q->dma, GFP_KERNEL);
+        q->va = dma_alloc_coherent(&dev->nic_info.pdev->dev, q->size, &q->dma,
+                                   GFP_KERNEL);
         if (!q->va)
                 return -ENOMEM;
         return 0;
@@ -1819,7 +1819,7 @@ int ocrdma_mbx_create_cq(struct ocrdma_dev *dev, struct ocrdma_cq *cq,
                 return -ENOMEM;
         ocrdma_init_mch(&cmd->cmd.req, OCRDMA_CMD_CREATE_CQ,
                         OCRDMA_SUBSYS_COMMON, sizeof(*cmd));
-        cq->va = dma_zalloc_coherent(&pdev->dev, cq->len, &cq->pa, GFP_KERNEL);
+        cq->va = dma_alloc_coherent(&pdev->dev, cq->len, &cq->pa, GFP_KERNEL);
         if (!cq->va) {
                 status = -ENOMEM;
                 goto mem_err;
@@ -2209,7 +2209,7 @@ static int ocrdma_set_create_qp_sq_cmd(struct ocrdma_create_qp_req *cmd,
         qp->sq.max_cnt = max_wqe_allocated;
         len = (hw_pages * hw_page_size);
 
-        qp->sq.va = dma_zalloc_coherent(&pdev->dev, len, &pa, GFP_KERNEL);
+        qp->sq.va = dma_alloc_coherent(&pdev->dev, len, &pa, GFP_KERNEL);
         if (!qp->sq.va)
                 return -EINVAL;
         qp->sq.len = len;
@@ -2259,7 +2259,7 @@ static int ocrdma_set_create_qp_rq_cmd(struct ocrdma_create_qp_req *cmd,
         qp->rq.max_cnt = max_rqe_allocated;
         len = (hw_pages * hw_page_size);
 
-        qp->rq.va = dma_zalloc_coherent(&pdev->dev, len, &pa, GFP_KERNEL);
+        qp->rq.va = dma_alloc_coherent(&pdev->dev, len, &pa, GFP_KERNEL);
         if (!qp->rq.va)
                 return -ENOMEM;
         qp->rq.pa = pa;
@@ -2315,8 +2315,8 @@ static int ocrdma_set_create_qp_ird_cmd(struct ocrdma_create_qp_req *cmd,
         if (dev->attr.ird == 0)
                 return 0;
 
-        qp->ird_q_va = dma_zalloc_coherent(&pdev->dev, ird_q_len, &pa,
-                                           GFP_KERNEL);
+        qp->ird_q_va = dma_alloc_coherent(&pdev->dev, ird_q_len, &pa,
+                                          GFP_KERNEL);
         if (!qp->ird_q_va)
                 return -ENOMEM;
         ocrdma_build_q_pages(&cmd->ird_addr[0], dev->attr.num_ird_pages,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index dd15474b19b7..6be0ea109138 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -73,8 +73,8 @@ bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev)
         mem->size = max_t(u32, sizeof(struct ocrdma_rdma_stats_req),
                         sizeof(struct ocrdma_rdma_stats_resp));
 
-        mem->va = dma_zalloc_coherent(&dev->nic_info.pdev->dev, mem->size,
-                                      &mem->pa, GFP_KERNEL);
+        mem->va = dma_alloc_coherent(&dev->nic_info.pdev->dev, mem->size,
+                                     &mem->pa, GFP_KERNEL);
         if (!mem->va) {
                 pr_err("%s: stats mbox allocation failed\n", __func__);
                 return false;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index c46bed0c5513..287c332ff0e6 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -504,8 +504,8 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
         INIT_LIST_HEAD(&ctx->mm_head);
         mutex_init(&ctx->mm_list_lock);
 
-        ctx->ah_tbl.va = dma_zalloc_coherent(&pdev->dev, map_len,
-                                             &ctx->ah_tbl.pa, GFP_KERNEL);
+        ctx->ah_tbl.va = dma_alloc_coherent(&pdev->dev, map_len,
+                                            &ctx->ah_tbl.pa, GFP_KERNEL);
         if (!ctx->ah_tbl.va) {
                 kfree(ctx);
                 return ERR_PTR(-ENOMEM);
@@ -838,7 +838,7 @@ static int ocrdma_build_pbl_tbl(struct ocrdma_dev *dev, struct ocrdma_hw_mr *mr)
                 return -ENOMEM;
 
         for (i = 0; i < mr->num_pbls; i++) {
-                va = dma_zalloc_coherent(&pdev->dev, dma_len, &pa, GFP_KERNEL);
+                va = dma_alloc_coherent(&pdev->dev, dma_len, &pa, GFP_KERNEL);
                 if (!va) {
                         ocrdma_free_mr_pbl_tbl(dev, mr);
                         status = -ENOMEM;
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index b342a70e2814..e1ccf32b1c3d 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -556,8 +556,8 @@ static struct qedr_pbl *qedr_alloc_pbl_tbl(struct qedr_dev *dev,
                 return ERR_PTR(-ENOMEM);
 
         for (i = 0; i < pbl_info->num_pbls; i++) {
-                va = dma_zalloc_coherent(&pdev->dev, pbl_info->pbl_size,
-                                         &pa, flags);
+                va = dma_alloc_coherent(&pdev->dev, pbl_info->pbl_size, &pa,
+                                        flags);
                 if (!va)
                         goto err;
 
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 42b8685c997e..3c633ab58052 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -427,7 +427,40 @@ static inline enum ib_qp_state pvrdma_qp_state_to_ib(enum pvrdma_qp_state state)
 
 static inline enum pvrdma_wr_opcode ib_wr_opcode_to_pvrdma(enum ib_wr_opcode op)
 {
-        return (enum pvrdma_wr_opcode)op;
+        switch (op) {
+        case IB_WR_RDMA_WRITE:
+                return PVRDMA_WR_RDMA_WRITE;
+        case IB_WR_RDMA_WRITE_WITH_IMM:
+                return PVRDMA_WR_RDMA_WRITE_WITH_IMM;
+        case IB_WR_SEND:
+                return PVRDMA_WR_SEND;
+        case IB_WR_SEND_WITH_IMM:
+                return PVRDMA_WR_SEND_WITH_IMM;
+        case IB_WR_RDMA_READ:
+                return PVRDMA_WR_RDMA_READ;
+        case IB_WR_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_ATOMIC_CMP_AND_SWP;
+        case IB_WR_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_LSO:
+                return PVRDMA_WR_LSO;
+        case IB_WR_SEND_WITH_INV:
+                return PVRDMA_WR_SEND_WITH_INV;
+        case IB_WR_RDMA_READ_WITH_INV:
+                return PVRDMA_WR_RDMA_READ_WITH_INV;
+        case IB_WR_LOCAL_INV:
+                return PVRDMA_WR_LOCAL_INV;
+        case IB_WR_REG_MR:
+                return PVRDMA_WR_FAST_REG_MR;
+        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_MASKED_ATOMIC_CMP_AND_SWP;
+        case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_REG_SIG_MR:
+                return PVRDMA_WR_REG_SIG_MR;
+        default:
+                return PVRDMA_WR_ERROR;
+        }
 }
 
 static inline enum ib_wc_status pvrdma_wc_status_to_ib(
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index eaa109dbc96a..39c37b6fd715 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -890,8 +890,8 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "device version %d, driver version %d\n",
                  dev->dsr_version, PVRDMA_VERSION);
 
-        dev->dsr = dma_zalloc_coherent(&pdev->dev, sizeof(*dev->dsr),
-                                       &dev->dsrbase, GFP_KERNEL);
+        dev->dsr = dma_alloc_coherent(&pdev->dev, sizeof(*dev->dsr),
+                                      &dev->dsrbase, GFP_KERNEL);
         if (!dev->dsr) {
                 dev_err(&pdev->dev, "failed to allocate shared region\n");
                 ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index 3acf74cbe266..1ec3646087ba 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -721,6 +721,12 @@ int pvrdma_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
                     wr->opcode == IB_WR_RDMA_WRITE_WITH_IMM)
                         wqe_hdr->ex.imm_data = wr->ex.imm_data;
 
+                if (unlikely(wqe_hdr->opcode == PVRDMA_WR_ERROR)) {
+                        *bad_wr = wr;
+                        ret = -EINVAL;
+                        goto out;
+                }
+
                 switch (qp->ibqp.qp_type) {
                 case IB_QPT_GSI:
                 case IB_QPT_UD:
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                         goto op_err;
                 if (!ret)
                         goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
         goto err;
 
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
         wc.status = IB_WC_LOC_QP_OP_ERR;
         goto err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
         struct list_head     list;
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
         struct ipoib_tx_buf *tx_ring;
         unsigned int         tx_head;
         unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 
         neigh->cm = tx;
         tx->neigh = neigh;
-        tx->path = path;
         tx->dev = dev;
         list_add(&tx->list, &priv->cm.start_list);
         set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                 neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                         goto free_neigh;
                 }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
 
                 spin_unlock_irqrestore(&priv->lock, flags);
                 netif_tx_unlock_bh(dev);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 31d91538bbf4..694324b37480 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -3032,7 +3032,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
 {
         struct srp_target_port *target = host_to_target(scmnd->device->host);
         struct srp_rdma_ch *ch;
-        int i, j;
         u8 status;
 
         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
@@ -3044,15 +3043,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
         if (status)
                 return FAILED;
 
-        for (i = 0; i < target->ch_count; i++) {
-                ch = &target->ch[i];
-                for (j = 0; j < target->req_ring_size; ++j) {
-                        struct srp_request *req = &ch->req_ring[j];
-
-                        srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
-                }
-        }
-
         return SUCCESS;
 }