7 files changed, 70 insertions, 82 deletions

diff --git a/drivers/infiniband/core/ud_header.c b/drivers/infiniband/core/ud_header.c
index bb7e19280821..9b737ff133e2 100644
--- a/drivers/infiniband/core/ud_header.c
+++ b/drivers/infiniband/core/ud_header.c
@@ -278,36 +278,6 @@ void ib_ud_header_init(int     		    payload_bytes,
 EXPORT_SYMBOL(ib_ud_header_init);
 
 /**
- * ib_lrh_header_pack - Pack LRH header struct into wire format
- * @lrh:unpacked LRH header struct
- * @buf:Buffer to pack into
- *
- * ib_lrh_header_pack() packs the LRH header structure @lrh into
- * wire format in the buffer @buf.
- */
-int ib_lrh_header_pack(struct ib_unpacked_lrh *lrh, void *buf)
-{
-        ib_pack(lrh_table, ARRAY_SIZE(lrh_table), lrh, buf);
-        return 0;
-}
-EXPORT_SYMBOL(ib_lrh_header_pack);
-
-/**
- * ib_lrh_header_unpack - Unpack LRH structure from wire format
- * @lrh:unpacked LRH header struct
- * @buf:Buffer to pack into
- *
- * ib_lrh_header_unpack() unpacks the LRH header structure from
- * wire format (in buf) into @lrh.
- */
-int ib_lrh_header_unpack(void *buf, struct ib_unpacked_lrh *lrh)
-{
-        ib_unpack(lrh_table, ARRAY_SIZE(lrh_table), buf, lrh);
-        return 0;
-}
-EXPORT_SYMBOL(ib_lrh_header_unpack);
-
-/**
  * ib_ud_header_pack - Pack UD header struct into wire format
  * @header:UD header struct
  * @buf:Buffer to pack into
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index b342248aec05..c42699285f8e 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -893,68 +893,81 @@ out:
         return ret ? ret : in_len;
 }
 
+static int copy_wc_to_user(void __user *dest, struct ib_wc *wc)
+{
+        struct ib_uverbs_wc tmp;
+
+        tmp.wr_id               = wc->wr_id;
+        tmp.status              = wc->status;
+        tmp.opcode              = wc->opcode;
+        tmp.vendor_err          = wc->vendor_err;
+        tmp.byte_len            = wc->byte_len;
+        tmp.ex.imm_data         = (__u32 __force) wc->ex.imm_data;
+        tmp.qp_num              = wc->qp->qp_num;
+        tmp.src_qp              = wc->src_qp;
+        tmp.wc_flags            = wc->wc_flags;
+        tmp.pkey_index          = wc->pkey_index;
+        tmp.slid                = wc->slid;
+        tmp.sl                  = wc->sl;
+        tmp.dlid_path_bits      = wc->dlid_path_bits;
+        tmp.port_num            = wc->port_num;
+        tmp.reserved            = 0;
+
+        if (copy_to_user(dest, &tmp, sizeof tmp))
+                return -EFAULT;
+
+        return 0;
+}
+
 ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
                           const char __user *buf, int in_len,
                           int out_len)
 {
         struct ib_uverbs_poll_cq       cmd;
-        struct ib_uverbs_poll_cq_resp *resp;
+        struct ib_uverbs_poll_cq_resp  resp;
+        u8 __user                     *header_ptr;
+        u8 __user                     *data_ptr;
         struct ib_cq                  *cq;
-        struct ib_wc                  *wc;
-        int                            ret = 0;
-        int                            i;
-        int                            rsize;
+        struct ib_wc                   wc;
+        int                            ret;
 
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
 
-        wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
-        if (!wc)
-                return -ENOMEM;
-
-        rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
-        resp = kmalloc(rsize, GFP_KERNEL);
-        if (!resp) {
-                ret = -ENOMEM;
-                goto out_wc;
-        }
-
         cq = idr_read_cq(cmd.cq_handle, file->ucontext, 0);
-        if (!cq) {
-                ret = -EINVAL;
-                goto out;
-        }
+        if (!cq)
+                return -EINVAL;
 
-        resp->count = ib_poll_cq(cq, cmd.ne, wc);
+        /* we copy a struct ib_uverbs_poll_cq_resp to user space */
+        header_ptr = (void __user *)(unsigned long) cmd.response;
+        data_ptr = header_ptr + sizeof resp;
 
-        put_cq_read(cq);
+        memset(&resp, 0, sizeof resp);
+        while (resp.count < cmd.ne) {
+                ret = ib_poll_cq(cq, 1, &wc);
+                if (ret < 0)
+                        goto out_put;
+                if (!ret)
+                        break;
+
+                ret = copy_wc_to_user(data_ptr, &wc);
+                if (ret)
+                        goto out_put;
 
-        for (i = 0; i < resp->count; i++) {
-                resp->wc[i].wr_id          = wc[i].wr_id;
-                resp->wc[i].status         = wc[i].status;
-                resp->wc[i].opcode         = wc[i].opcode;
-                resp->wc[i].vendor_err     = wc[i].vendor_err;
-                resp->wc[i].byte_len       = wc[i].byte_len;
-                resp->wc[i].ex.imm_data    = (__u32 __force) wc[i].ex.imm_data;
-                resp->wc[i].qp_num         = wc[i].qp->qp_num;
-                resp->wc[i].src_qp         = wc[i].src_qp;
-                resp->wc[i].wc_flags       = wc[i].wc_flags;
-                resp->wc[i].pkey_index     = wc[i].pkey_index;
-                resp->wc[i].slid           = wc[i].slid;
-                resp->wc[i].sl             = wc[i].sl;
-                resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
-                resp->wc[i].port_num       = wc[i].port_num;
+                data_ptr += sizeof(struct ib_uverbs_wc);
+                ++resp.count;
         }
 
-        if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
+        if (copy_to_user(header_ptr, &resp, sizeof resp)) {
                 ret = -EFAULT;
+                goto out_put;
+        }
 
-out:
-        kfree(resp);
+        ret = in_len;
 
-out_wc:
-        kfree(wc);
-        return ret ? ret : in_len;
+out_put:
+        put_cq_read(cq);
+        return ret;
 }
 
 ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
index 5440da0e59b4..1b1146f87124 100644
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst,
         dst->grh.sgid_index        = src->grh.sgid_index;
         dst->grh.hop_limit         = src->grh.hop_limit;
         dst->grh.traffic_class     = src->grh.traffic_class;
+        memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
         dst->dlid                  = src->dlid;
         dst->sl                    = src->sl;
         dst->src_path_bits         = src->src_path_bits;
         dst->static_rate           = src->static_rate;
         dst->is_global             = src->ah_flags & IB_AH_GRH ? 1 : 0;
         dst->port_num              = src->port_num;
+        dst->reserved              = 0;
 }
 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
 
 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
                              struct ib_qp_attr *src)
 {
+        dst->qp_state           = src->qp_state;
         dst->cur_qp_state       = src->cur_qp_state;
         dst->path_mtu           = src->path_mtu;
         dst->path_mig_state     = src->path_mig_state;
@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
         dst->rnr_retry          = src->rnr_retry;
         dst->alt_port_num       = src->alt_port_num;
         dst->alt_timeout        = src->alt_timeout;
+        memset(dst->reserved, 0, sizeof(dst->reserved));
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 6078992da3f0..9292a15ad7c4 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -40,7 +40,6 @@
 #include <linux/highmem.h>
 #include <linux/io.h>
 #include <linux/jiffies.h>
-#include <linux/smp_lock.h>
 #include <asm/pgtable.h>
 
 #include "ipath_kernel.h"
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bf3e20cd0298..30e09caf0da9 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -219,7 +219,7 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
         struct net_device *ndev;
         enum ib_mtu tmp;
 
-        props->active_width     = IB_WIDTH_4X;
+        props->active_width     = IB_WIDTH_1X;
         props->active_speed     = 4;
         props->port_cap_flags   = IB_PORT_CM_SUP;
         props->gid_tbl_len      = to_mdev(ibdev)->dev->caps.gid_table_len[port];
@@ -242,7 +242,7 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
         tmp = iboe_get_mtu(ndev->mtu);
         props->active_mtu = tmp ? min(props->max_mtu, tmp) : IB_MTU_256;
 
-        props->state            = netif_running(ndev) &&  netif_oper_up(ndev) ?
+        props->state            = (netif_running(ndev) && netif_carrier_ok(ndev)) ?
                                         IB_PORT_ACTIVE : IB_PORT_DOWN;
         props->phys_state       = state_to_phys_state(props->state);
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 9a7794ac34c1..2001f20a4361 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1816,6 +1816,11 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 ctrl->fence_size = (wr->send_flags & IB_SEND_FENCE ?
                                     MLX4_WQE_CTRL_FENCE : 0) | size;
 
+                if (be16_to_cpu(vlan) < 0x1000) {
+                        ctrl->ins_vlan = 1 << 6;
+                        ctrl->vlan_tag = vlan;
+                }
+
                 /*
                  * Make sure descriptor is fully written before
                  * setting ownership bit (because HW can start
@@ -1831,11 +1836,6 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 ctrl->owner_opcode = mlx4_ib_opcode[wr->opcode] |
                         (ind & qp->sq.wqe_cnt ? cpu_to_be32(1 << 31) : 0) | blh;
 
-                if (be16_to_cpu(vlan) < 0x1000) {
-                        ctrl->ins_vlan = 1 << 6;
-                        ctrl->vlan_tag = vlan;
-                }
-
                 stamp = ind + qp->sq_spare_wqes;
                 ind += DIV_ROUND_UP(size * 16, 1U << qp->sq.wqe_shift);
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index cfc1d65c4577..1e1e347a7715 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1123,7 +1123,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr)
         }
 }
 
-static int srp_queuecommand(struct scsi_cmnd *scmnd,
+static int srp_queuecommand_lck(struct scsi_cmnd *scmnd,
                             void (*done)(struct scsi_cmnd *))
 {
         struct srp_target_port *target = host_to_target(scmnd->device->host);
@@ -1196,6 +1196,8 @@ err:
         return SCSI_MLQUEUE_HOST_BUSY;
 }
 
+static DEF_SCSI_QCMD(srp_queuecommand)
+
 static int srp_alloc_iu_bufs(struct srp_target_port *target)
 {
         int i;