Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

Pull infiniband update from Roland Dreier:
 "Main batch of InfiniBand/RDMA changes for 3.9:

   - SRP error handling fixes from Bart Van Assche

   - Implementation of memory windows for mlx4 from Shani Michaeli

   - Lots of cxgb4 HW driver fixes from Vipul Pandya

   - Make iSER work for virtual functions, other fixes from Or Gerlitz

   - Fix for bug in qib HW driver from Mike Marciniszyn

   - IPoIB fixes from me, Itai Garbi, Shlomo Pongratz, Yan Burman

   - Various cleanups and warning fixes from Julia Lawall, Paul Bolle,
     Wei Yongjun"

* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (41 commits)
  IB/mlx4: Advertise MW support
  IB/mlx4: Support memory window binding
  mlx4: Implement memory windows allocation and deallocation
  mlx4_core: Enable memory windows in {INIT, QUERY}_HCA
  mlx4_core: Disable memory windows for virtual functions
  IPoIB: Free ipoib neigh on path record failure so path rec queries are retried
  IB/srp: Fail I/O requests if the transport is offline
  IB/srp: Avoid endless SCSI error handling loop
  IB/srp: Avoid sending a task management function needlessly
  IB/srp: Track connection state properly
  IB/mlx4: Remove redundant NULL check before kfree
  IB/mlx4: Fix compiler warning about uninitialized 'vlan' variable
  IB/mlx4: Convert is_xxx variables in build_mlx_header() to bool
  IB/iser: Enable iser when FMRs are not supported
  IB/iser: Avoid error prints on EAGAIN registration failures
  IB/iser: Use proper define for the commands per LUN value advertised to SCSI ML
  IB/uverbs: Implement memory windows support in uverbs
  IB/core: Add "type 2" memory windows support
  mlx4_core: Propagate MR deregistration failures to caller
  mlx4_core: Rename MPT-related functions to have mpt_ prefix
  ...

19 files changed, 312 insertions, 130 deletions

diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 7275e727e0f5..d53cf519f42a 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1238,15 +1238,4 @@ static struct pci_driver c2_pci_driver = {
         .remove = c2_remove,
 };
 
-static int __init c2_init_module(void)
-{
-        return pci_register_driver(&c2_pci_driver);
-}
-
-static void __exit c2_exit_module(void)
-{
-        pci_unregister_driver(&c2_pci_driver);
-}
-
-module_init(c2_init_module);
-module_exit(c2_exit_module);
+module_pci_driver(c2_pci_driver);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 145d82a64d0a..9c12da0cbd32 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -738,7 +738,7 @@ static struct ib_mr *iwch_get_dma_mr(struct ib_pd *pd, int acc)
         return ibmr;
 }
 
-static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd)
+static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd, enum ib_mw_type type)
 {
         struct iwch_dev *rhp;
         struct iwch_pd *php;
@@ -747,6 +747,9 @@ static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd)
         u32 stag = 0;
         int ret;
 
+        if (type != IB_MW_TYPE_1)
+                return ERR_PTR(-EINVAL);
+
         php = to_iwch_pd(pd);
         rhp = php->rhp;
         mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 6de8463f453b..e5649e8b215d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -567,18 +567,19 @@ int iwch_bind_mw(struct ib_qp *qp,
         if (mw_bind->send_flags & IB_SEND_SIGNALED)
                 t3_wr_flags = T3_COMPLETION_FLAG;
 
-        sgl.addr = mw_bind->addr;
-        sgl.lkey = mw_bind->mr->lkey;
-        sgl.length = mw_bind->length;
+        sgl.addr = mw_bind->bind_info.addr;
+        sgl.lkey = mw_bind->bind_info.mr->lkey;
+        sgl.length = mw_bind->bind_info.length;
         wqe->bind.reserved = 0;
         wqe->bind.type = TPT_VATO;
 
         /* TBD: check perms */
-        wqe->bind.perms = iwch_ib_to_tpt_bind_access(mw_bind->mw_access_flags);
-        wqe->bind.mr_stag = cpu_to_be32(mw_bind->mr->lkey);
+        wqe->bind.perms = iwch_ib_to_tpt_bind_access(
+                mw_bind->bind_info.mw_access_flags);
+        wqe->bind.mr_stag = cpu_to_be32(mw_bind->bind_info.mr->lkey);
         wqe->bind.mw_stag = cpu_to_be32(mw->rkey);
-        wqe->bind.mw_len = cpu_to_be32(mw_bind->length);
-        wqe->bind.mw_va = cpu_to_be64(mw_bind->addr);
+        wqe->bind.mw_len = cpu_to_be32(mw_bind->bind_info.length);
+        wqe->bind.mw_va = cpu_to_be64(mw_bind->bind_info.addr);
         err = iwch_sgl2pbl_map(rhp, &sgl, 1, &pbl_addr, &page_size);
         if (err) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index c13745cde7fa..565bfb161c1a 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -143,14 +143,28 @@ static void connect_reply_upcall(struct c4iw_ep *ep, int status);
 static LIST_HEAD(timeout_list);
 static spinlock_t timeout_lock;
 
+static void deref_qp(struct c4iw_ep *ep)
+{
+        c4iw_qp_rem_ref(&ep->com.qp->ibqp);
+        clear_bit(QP_REFERENCED, &ep->com.flags);
+}
+
+static void ref_qp(struct c4iw_ep *ep)
+{
+        set_bit(QP_REFERENCED, &ep->com.flags);
+        c4iw_qp_add_ref(&ep->com.qp->ibqp);
+}
+
 static void start_ep_timer(struct c4iw_ep *ep)
 {
         PDBG("%s ep %p\n", __func__, ep);
         if (timer_pending(&ep->timer)) {
-                PDBG("%s stopped / restarted timer ep %p\n", __func__, ep);
-                del_timer_sync(&ep->timer);
-        } else
-                c4iw_get_ep(&ep->com);
+                pr_err("%s timer already started! ep %p\n",
+                       __func__, ep);
+                return;
+        }
+        clear_bit(TIMEOUT, &ep->com.flags);
+        c4iw_get_ep(&ep->com);
         ep->timer.expires = jiffies + ep_timeout_secs * HZ;
         ep->timer.data = (unsigned long)ep;
         ep->timer.function = ep_timeout;
@@ -159,14 +173,10 @@ static void start_ep_timer(struct c4iw_ep *ep)
 
 static void stop_ep_timer(struct c4iw_ep *ep)
 {
-        PDBG("%s ep %p\n", __func__, ep);
-        if (!timer_pending(&ep->timer)) {
-                WARN(1, "%s timer stopped when its not running! "
-                       "ep %p state %u\n", __func__, ep, ep->com.state);
-                return;
-        }
+        PDBG("%s ep %p stopping\n", __func__, ep);
         del_timer_sync(&ep->timer);
-        c4iw_put_ep(&ep->com);
+        if (!test_and_set_bit(TIMEOUT, &ep->com.flags))
+                c4iw_put_ep(&ep->com);
 }
 
 static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
@@ -271,11 +281,13 @@ void _c4iw_free_ep(struct kref *kref)
 
         ep = container_of(kref, struct c4iw_ep, com.kref);
         PDBG("%s ep %p state %s\n", __func__, ep, states[state_read(&ep->com)]);
+        if (test_bit(QP_REFERENCED, &ep->com.flags))
+                deref_qp(ep);
         if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
+                remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid);
                 cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, ep->hwtid);
                 dst_release(ep->dst);
                 cxgb4_l2t_release(ep->l2t);
-                remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid);
         }
         kfree(ep);
 }
@@ -687,7 +699,7 @@ static int send_mpa_reject(struct c4iw_ep *ep, const void *pdata, u8 plen)
         memset(mpa, 0, sizeof(*mpa));
         memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
         mpa->flags = MPA_REJECT;
-        mpa->revision = mpa_rev;
+        mpa->revision = ep->mpa_attr.version;
         mpa->private_data_size = htons(plen);
 
         if (ep->mpa_attr.version == 2 && ep->mpa_attr.enhanced_rdma_conn) {
@@ -863,7 +875,6 @@ static void close_complete_upcall(struct c4iw_ep *ep)
                 ep->com.cm_id->event_handler(ep->com.cm_id, &event);
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
                 set_bit(CLOSE_UPCALL, &ep->com.history);
         }
 }
@@ -906,7 +917,6 @@ static void peer_abort_upcall(struct c4iw_ep *ep)
                 ep->com.cm_id->event_handler(ep->com.cm_id, &event);
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
                 set_bit(ABORT_UPCALL, &ep->com.history);
         }
 }
@@ -946,7 +956,6 @@ static void connect_reply_upcall(struct c4iw_ep *ep, int status)
         if (status < 0) {
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
         }
 }
 
@@ -1291,11 +1300,13 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
         if (mpa->revision > mpa_rev) {
                 printk(KERN_ERR MOD "%s MPA version mismatch. Local = %d,"
                        " Received = %d\n", __func__, mpa_rev, mpa->revision);
+                stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
 
         if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
+                stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1306,6 +1317,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
          * Fail if there's too much private data.
          */
         if (plen > MPA_MAX_PRIVATE_DATA) {
+                stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1314,6 +1326,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
          * If plen does not account for pkt size
          */
         if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1391,30 +1404,33 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
         skb_pull(skb, sizeof(*hdr));
         skb_trim(skb, dlen);
 
-        ep->rcv_seq += dlen;
-        BUG_ON(ep->rcv_seq != (ntohl(hdr->seq) + dlen));
-
         /* update RX credits */
         update_rx_credits(ep, dlen);
 
         switch (state_read(&ep->com)) {
         case MPA_REQ_SENT:
+                ep->rcv_seq += dlen;
                 process_mpa_reply(ep, skb);
                 break;
         case MPA_REQ_WAIT:
+                ep->rcv_seq += dlen;
                 process_mpa_request(ep, skb);
                 break;
-        case MPA_REP_SENT:
+        case FPDU_MODE: {
+                struct c4iw_qp_attributes attrs;
+                BUG_ON(!ep->com.qp);
+                if (status)
+                        pr_err("%s Unexpected streaming data." \
+                               " qpid %u ep %p state %d tid %u status %d\n",
+                               __func__, ep->com.qp->wq.sq.qid, ep,
+                               state_read(&ep->com), ep->hwtid, status);
+                attrs.next_state = C4IW_QP_STATE_ERROR;
+                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                c4iw_ep_disconnect(ep, 1, GFP_KERNEL);
                 break;
+        }
         default:
-                pr_err("%s Unexpected streaming data." \
-                       " ep %p state %d tid %u status %d\n",
-                       __func__, ep, state_read(&ep->com), ep->hwtid, status);
-
-                /*
-                 * The ep will timeout and inform the ULP of the failure.
-                 * See ep_timeout().
-                 */
                 break;
         }
         return 0;
@@ -1437,6 +1453,7 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case ABORTING:
+                c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
                 __state_set(&ep->com, DEAD);
                 release = 1;
                 break;
@@ -1475,11 +1492,11 @@ static void send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
                         V_FW_OFLD_CONNECTION_WR_ASTID(atid));
         req->tcb.cplrxdataack_cplpassacceptrpl =
                         htons(F_FW_OFLD_CONNECTION_WR_CPLRXDATAACK);
-        req->tcb.tx_max = jiffies;
+        req->tcb.tx_max = (__force __be32) jiffies;
         req->tcb.rcv_adv = htons(1);
         cxgb4_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx);
         wscale = compute_wscale(rcv_win);
-        req->tcb.opt0 = TCAM_BYPASS(1) |
+        req->tcb.opt0 = (__force __be64) (TCAM_BYPASS(1) |
                 (nocong ? NO_CONG(1) : 0) |
                 KEEP_ALIVE(1) |
                 DELACK(1) |
@@ -1490,20 +1507,20 @@ static void send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
                 SMAC_SEL(ep->smac_idx) |
                 DSCP(ep->tos) |
                 ULP_MODE(ULP_MODE_TCPDDP) |
-                RCV_BUFSIZ(rcv_win >> 10);
-        req->tcb.opt2 = PACE(1) |
+                RCV_BUFSIZ(rcv_win >> 10));
+        req->tcb.opt2 = (__force __be32) (PACE(1) |
                 TX_QUEUE(ep->com.dev->rdev.lldi.tx_modq[ep->tx_chan]) |
                 RX_CHANNEL(0) |
                 CCTRL_ECN(enable_ecn) |
-                RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
+                RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid));
         if (enable_tcp_timestamps)
-                req->tcb.opt2 |= TSTAMPS_EN(1);
+                req->tcb.opt2 |= (__force __be32) TSTAMPS_EN(1);
         if (enable_tcp_sack)
-                req->tcb.opt2 |= SACK_EN(1);
+                req->tcb.opt2 |= (__force __be32) SACK_EN(1);
         if (wscale && enable_tcp_window_scaling)
-                req->tcb.opt2 |= WND_SCALE_EN(1);
-        req->tcb.opt0 = cpu_to_be64(req->tcb.opt0);
-        req->tcb.opt2 = cpu_to_be32(req->tcb.opt2);
+                req->tcb.opt2 |= (__force __be32) WND_SCALE_EN(1);
+        req->tcb.opt0 = cpu_to_be64((__force u64) req->tcb.opt0);
+        req->tcb.opt2 = cpu_to_be32((__force u32) req->tcb.opt2);
         set_wr_txq(skb, CPL_PRIORITY_CONTROL, ep->ctrlq_idx);
         set_bit(ACT_OFLD_CONN, &ep->com.history);
         c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
@@ -1993,6 +2010,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
 
         init_timer(&child_ep->timer);
         cxgb4_insert_tid(t, child_ep, hwtid);
+        insert_handle(dev, &dev->hwtid_idr, child_ep, child_ep->hwtid);
         accept_cr(child_ep, peer_ip, skb, req);
         set_bit(PASS_ACCEPT_REQ, &child_ep->com.history);
         goto out;
@@ -2018,7 +2036,6 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb)
              ntohs(req->tcp_opt));
 
         set_emss(ep, ntohs(req->tcp_opt));
-        insert_handle(dev, &dev->hwtid_idr, ep, ep->hwtid);
 
         dst_confirm(ep->dst);
         state_set(&ep->com, MPA_REQ_WAIT);
@@ -2163,7 +2180,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
                 break;
         case MPA_REQ_SENT:
                 stop_ep_timer(ep);
-                if (mpa_rev == 2 && ep->tried_with_mpa_v1)
+                if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
                         connect_reply_upcall(ep, -ECONNRESET);
                 else {
                         /*
@@ -2235,9 +2252,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
 out:
         if (release)
                 release_ep_resources(ep);
-
-        /* retry with mpa-v1 */
-        if (ep && ep->retry_with_mpa_v1) {
+        else if (ep->retry_with_mpa_v1) {
+                remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid);
                 cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, ep->hwtid);
                 dst_release(ep->dst);
                 cxgb4_l2t_release(ep->l2t);
@@ -2430,6 +2446,7 @@ int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         cm_id->add_ref(cm_id);
         ep->com.cm_id = cm_id;
         ep->com.qp = qp;
+        ref_qp(ep);
 
         /* bind QP to EP and move to RTS */
         attrs.mpa_attr = ep->mpa_attr;
@@ -2460,7 +2477,6 @@ int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         return 0;
 err1:
         ep->com.cm_id = NULL;
-        ep->com.qp = NULL;
         cm_id->rem_ref(cm_id);
 err:
         c4iw_put_ep(&ep->com);
@@ -2501,6 +2517,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         ep->com.cm_id = cm_id;
         ep->com.qp = get_qhp(dev, conn_param->qpn);
         BUG_ON(!ep->com.qp);
+        ref_qp(ep);
         PDBG("%s qpn 0x%x qp %p cm_id %p\n", __func__, conn_param->qpn,
              ep->com.qp, cm_id);
 
@@ -2756,7 +2773,8 @@ static void active_ofld_conn_reply(struct c4iw_dev *dev, struct sk_buff *skb,
         struct c4iw_ep *ep;
         int atid = be32_to_cpu(req->tid);
 
-        ep = (struct c4iw_ep *)lookup_atid(dev->rdev.lldi.tids, req->tid);
+        ep = (struct c4iw_ep *)lookup_atid(dev->rdev.lldi.tids,
+                                           (__force u32) req->tid);
         if (!ep)
                 return;
 
@@ -2800,7 +2818,7 @@ static void passive_ofld_conn_reply(struct c4iw_dev *dev, struct sk_buff *skb,
         struct cpl_pass_accept_req *cpl;
         int ret;
 
-        rpl_skb = (struct sk_buff *)cpu_to_be64(req->cookie);
+        rpl_skb = (struct sk_buff *)(unsigned long)req->cookie;
         BUG_ON(!rpl_skb);
         if (req->retval) {
                 PDBG("%s passive open failure %d\n", __func__, req->retval);
@@ -2811,7 +2829,8 @@ static void passive_ofld_conn_reply(struct c4iw_dev *dev, struct sk_buff *skb,
         } else {
                 cpl = (struct cpl_pass_accept_req *)cplhdr(rpl_skb);
                 OPCODE_TID(cpl) = htonl(MK_OPCODE_TID(CPL_PASS_ACCEPT_REQ,
-                                                      htonl(req->tid)));
+                                        (__force u32) htonl(
+                                        (__force u32) req->tid)));
                 ret = pass_accept_req(dev, rpl_skb);
                 if (!ret)
                         kfree_skb(rpl_skb);
@@ -2857,10 +2876,10 @@ static void build_cpl_pass_accept_req(struct sk_buff *skb, int stid , u8 tos)
         struct tcp_options_received tmp_opt;
 
         /* Store values from cpl_rx_pkt in temporary location. */
-        vlantag = cpl->vlan;
-        len = cpl->len;
-        l2info  = cpl->l2info;
-        hdr_len = cpl->hdr_len;
+        vlantag = (__force u16) cpl->vlan;
+        len = (__force u16) cpl->len;
+        l2info  = (__force u32) cpl->l2info;
+        hdr_len = (__force u16) cpl->hdr_len;
         intf = cpl->iff;
 
         __skb_pull(skb, sizeof(*req) + sizeof(struct rss_header));
@@ -2871,19 +2890,24 @@ static void build_cpl_pass_accept_req(struct sk_buff *skb, int stid , u8 tos)
          */
         memset(&tmp_opt, 0, sizeof(tmp_opt));
         tcp_clear_options(&tmp_opt);
-        tcp_parse_options(skb, &tmp_opt, 0, 0, NULL);
+        tcp_parse_options(skb, &tmp_opt, NULL, 0, NULL);
 
         req = (struct cpl_pass_accept_req *)__skb_push(skb, sizeof(*req));
         memset(req, 0, sizeof(*req));
         req->l2info = cpu_to_be16(V_SYN_INTF(intf) |
-                         V_SYN_MAC_IDX(G_RX_MACIDX(htonl(l2info))) |
+                         V_SYN_MAC_IDX(G_RX_MACIDX(
+                         (__force int) htonl(l2info))) |
                          F_SYN_XACT_MATCH);
-        req->hdr_len = cpu_to_be32(V_SYN_RX_CHAN(G_RX_CHAN(htonl(l2info))) |
-                                V_TCP_HDR_LEN(G_RX_TCPHDR_LEN(htons(hdr_len))) |
-                                V_IP_HDR_LEN(G_RX_IPHDR_LEN(htons(hdr_len))) |
-                                V_ETH_HDR_LEN(G_RX_ETHHDR_LEN(htonl(l2info))));
-        req->vlan = vlantag;
-        req->len = len;
+        req->hdr_len = cpu_to_be32(V_SYN_RX_CHAN(G_RX_CHAN(
+                                        (__force int) htonl(l2info))) |
+                                   V_TCP_HDR_LEN(G_RX_TCPHDR_LEN(
+                                        (__force int) htons(hdr_len))) |
+                                   V_IP_HDR_LEN(G_RX_IPHDR_LEN(
+                                        (__force int) htons(hdr_len))) |
+                                   V_ETH_HDR_LEN(G_RX_ETHHDR_LEN(
+                                        (__force int) htonl(l2info))));
+        req->vlan = (__force __be16) vlantag;
+        req->len = (__force __be16) len;
         req->tos_stid = cpu_to_be32(PASS_OPEN_TID(stid) |
                                     PASS_OPEN_TOS(tos));
         req->tcpopt.mss = htons(tmp_opt.mss_clamp);
@@ -2912,7 +2936,7 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb,
         req->op_compl = htonl(V_WR_OP(FW_OFLD_CONNECTION_WR) | FW_WR_COMPL(1));
         req->len16_pkd = htonl(FW_WR_LEN16(DIV_ROUND_UP(sizeof(*req), 16)));
         req->le.version_cpl = htonl(F_FW_OFLD_CONNECTION_WR_CPL);
-        req->le.filter = filter;
+        req->le.filter = (__force __be32) filter;
         req->le.lport = lport;
         req->le.pport = rport;
         req->le.u.ipv4.lip = laddr;
@@ -2938,7 +2962,7 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb,
          * TP will ignore any value > 0 for MSS index.
          */
         req->tcb.opt0 = cpu_to_be64(V_MSS_IDX(0xF));
-        req->cookie = cpu_to_be64((u64)skb);
+        req->cookie = (unsigned long)skb;
 
         set_wr_txq(req_skb, CPL_PRIORITY_CONTROL, port_id);
         cxgb4_ofld_send(dev->rdev.lldi.ports[0], req_skb);
@@ -2988,7 +3012,8 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
         /*
          * Calculate the server tid from filter hit index from cpl_rx_pkt.
          */
-        stid = cpu_to_be32(rss->hash_val) - dev->rdev.lldi.tids->sftid_base
+        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val)
+                                          - dev->rdev.lldi.tids->sftid_base
                                           + dev->rdev.lldi.tids->nstids;
 
         lep = (struct c4iw_ep *)lookup_stid(dev->rdev.lldi.tids, stid);
@@ -3049,10 +3074,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
 
         step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
         rss_qid = dev->rdev.lldi.rxq_ids[pi->port_id * step];
-        window = htons(tcph->window);
+        window = (__force u16) htons((__force u16)tcph->window);
 
         /* Calcuate filter portion for LE region. */
-        filter = cpu_to_be32(select_ntuple(dev, dst, e));
+        filter = (__force unsigned int) cpu_to_be32(select_ntuple(dev, dst, e));
 
         /*
          * Synthesize the cpl_pass_accept_req. We have everything except the
@@ -3175,11 +3200,16 @@ static DECLARE_WORK(skb_work, process_work);
 static void ep_timeout(unsigned long arg)
 {
         struct c4iw_ep *ep = (struct c4iw_ep *)arg;
+        int kickit = 0;
 
         spin_lock(&timeout_lock);
-        list_add_tail(&ep->entry, &timeout_list);
+        if (!test_and_set_bit(TIMEOUT, &ep->com.flags)) {
+                list_add_tail(&ep->entry, &timeout_list);
+                kickit = 1;
+        }
         spin_unlock(&timeout_lock);
-        queue_work(workq, &skb_work);
+        if (kickit)
+                queue_work(workq, &skb_work);
 }
 
 /*
@@ -3268,8 +3298,14 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
 
         /*
          * Wake up any threads in rdma_init() or rdma_fini().
+         * However, if we are on MPAv2 and want to retry with MPAv1
+         * then, don't wake up yet.
          */
-        c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+        if (mpa_rev == 2 && !ep->tried_with_mpa_v1) {
+                if (ep->com.state != MPA_REQ_SENT)
+                        c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+        } else
+                c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
         sched(dev, skb);
         return 0;
 }
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index ba11c76c0b5a..80069ad595c1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -533,7 +533,7 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p qpshift %lu "
              "qpmask 0x%x cqshift %lu cqmask 0x%x\n",
              (unsigned)pci_resource_len(rdev->lldi.pdev, 2),
-             (void *)pci_resource_start(rdev->lldi.pdev, 2),
+             (void *)(unsigned long)pci_resource_start(rdev->lldi.pdev, 2),
              rdev->lldi.db_reg,
              rdev->lldi.gts_reg,
              rdev->qpshift, rdev->qpmask,
@@ -797,7 +797,8 @@ static int c4iw_uld_rx_handler(void *handle, const __be64 *rsp,
                        "RSS %#llx, FL %#llx, len %u\n",
                        pci_name(ctx->lldi.pdev), gl->va,
                        (unsigned long long)be64_to_cpu(*rsp),
-                       (unsigned long long)be64_to_cpu(*(u64 *)gl->va),
+                       (unsigned long long)be64_to_cpu(
+                       *(__force __be64 *)gl->va),
                        gl->tot_len);
 
                 return 0;
diff --git a/drivers/infiniband/hw/cxgb4/ev.c b/drivers/infiniband/hw/cxgb4/ev.c
index cf2f6b47617a..1a840b2211dd 100644
--- a/drivers/infiniband/hw/cxgb4/ev.c
+++ b/drivers/infiniband/hw/cxgb4/ev.c
@@ -46,9 +46,11 @@ static void post_qp_event(struct c4iw_dev *dev, struct c4iw_cq *chp,
 
         if ((qhp->attr.state == C4IW_QP_STATE_ERROR) ||
             (qhp->attr.state == C4IW_QP_STATE_TERMINATE)) {
-                PDBG("%s AE received after RTS - "
-                     "qp state %d qpid 0x%x status 0x%x\n", __func__,
-                     qhp->attr.state, qhp->wq.sq.qid, CQE_STATUS(err_cqe));
+                pr_err("%s AE after RTS - qpid 0x%x opcode %d status 0x%x "\
+                       "type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+                       __func__, CQE_QPID(err_cqe), CQE_OPCODE(err_cqe),
+                       CQE_STATUS(err_cqe), CQE_TYPE(err_cqe),
+                       CQE_WRID_HI(err_cqe), CQE_WRID_LOW(err_cqe));
                 return;
         }
 
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 9c1644fb0259..4c07fc069766 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -716,6 +716,8 @@ enum c4iw_ep_flags {
         ABORT_REQ_IN_PROGRESS   = 1,
         RELEASE_RESOURCES       = 2,
         CLOSE_SENT              = 3,
+        TIMEOUT                 = 4,
+        QP_REFERENCED           = 5,
 };
 
 enum c4iw_ep_history {
@@ -866,7 +868,7 @@ struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(
                                         int page_list_len);
 struct ib_mr *c4iw_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth);
 int c4iw_dealloc_mw(struct ib_mw *mw);
-struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd);
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd, enum ib_mw_type type);
 struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start,
                                            u64 length, u64 virt, int acc,
                                            struct ib_udata *udata);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index afd81790ab3c..903a92d6f91d 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -650,7 +650,7 @@ err:
         return ERR_PTR(err);
 }
 
-struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd)
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd, enum ib_mw_type type)
 {
         struct c4iw_dev *rhp;
         struct c4iw_pd *php;
@@ -659,6 +659,9 @@ struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd)
         u32 stag = 0;
         int ret;
 
+        if (type != IB_MW_TYPE_1)
+                return ERR_PTR(-EINVAL);
+
         php = to_c4iw_pd(pd);
         rhp = php->rhp;
         mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 05bfe53bff64..17ba4f8bc12d 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1383,6 +1383,7 @@ err:
         qhp->ep = NULL;
         set_state(qhp, C4IW_QP_STATE_ERROR);
         free = 1;
+        abort = 1;
         wake_up(&qhp->wait);
         BUG_ON(!ep);
         flush_qp(qhp);
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 8f7f282ead65..22f79afa7fc1 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -95,7 +95,7 @@ int ehca_query_mr(struct ib_mr *mr, struct ib_mr_attr *mr_attr);
 
 int ehca_dereg_mr(struct ib_mr *mr);
 
-struct ib_mw *ehca_alloc_mw(struct ib_pd *pd);
+struct ib_mw *ehca_alloc_mw(struct ib_pd *pd, enum ib_mw_type type);
 
 int ehca_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
                  struct ib_mw_bind *mw_bind);
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 87844869dcc2..bcfb0c183620 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -688,7 +688,7 @@ dereg_mr_exit0:
 
 /*----------------------------------------------------------------------*/
 
-struct ib_mw *ehca_alloc_mw(struct ib_pd *pd)
+struct ib_mw *ehca_alloc_mw(struct ib_pd *pd, enum ib_mw_type type)
 {
         struct ib_mw *ib_mw;
         u64 h_ret;
@@ -698,6 +698,9 @@ struct ib_mw *ehca_alloc_mw(struct ib_pd *pd)
                 container_of(pd->device, struct ehca_shca, ib_device);
         struct ehca_mw_hipzout_parms hipzout;
 
+        if (type != IB_MW_TYPE_1)
+                return ERR_PTR(-EINVAL);
+
         e_mw = ehca_mw_new();
         if (!e_mw) {
                 ib_mw = ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 0a903c129f0a..934792c477bc 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1999,16 +1999,17 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
                         goto demux_err;
                 err = mlx4_ib_alloc_demux_ctx(dev, &dev->sriov.demux[i], i + 1);
                 if (err)
-                        goto demux_err;
+                        goto free_pv;
         }
         mlx4_ib_master_tunnels(dev, 1);
         return 0;
 
+free_pv:
+        free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
 demux_err:
-        while (i > 0) {
+        while (--i >= 0) {
                 free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
                 mlx4_ib_free_demux_ctx(&dev->sriov.demux[i]);
-                --i;
         }
         mlx4_ib_device_unregister_sysfs(dev);
 
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index e7d81c0d1ac5..23d734349d8e 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -137,6 +137,14 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
                 props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
         if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_XRC)
                 props->device_cap_flags |= IB_DEVICE_XRC;
+        if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_MEM_WINDOW)
+                props->device_cap_flags |= IB_DEVICE_MEM_WINDOW;
+        if (dev->dev->caps.bmme_flags & MLX4_BMME_FLAG_TYPE_2_WIN) {
+                if (dev->dev->caps.bmme_flags & MLX4_BMME_FLAG_WIN_TYPE_2B)
+                        props->device_cap_flags |= IB_DEVICE_MEM_WINDOW_TYPE_2B;
+                else
+                        props->device_cap_flags |= IB_DEVICE_MEM_WINDOW_TYPE_2A;
+        }
 
         props->vendor_id           = be32_to_cpup((__be32 *) (out_mad->data + 36)) &
                 0xffffff;
@@ -1434,6 +1442,17 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                 ibdev->ib_dev.dealloc_fmr       = mlx4_ib_fmr_dealloc;
         }
 
+        if (dev->caps.flags & MLX4_DEV_CAP_FLAG_MEM_WINDOW ||
+            dev->caps.bmme_flags & MLX4_BMME_FLAG_TYPE_2_WIN) {
+                ibdev->ib_dev.alloc_mw = mlx4_ib_alloc_mw;
+                ibdev->ib_dev.bind_mw = mlx4_ib_bind_mw;
+                ibdev->ib_dev.dealloc_mw = mlx4_ib_dealloc_mw;
+
+                ibdev->ib_dev.uverbs_cmd_mask |=
+                        (1ull << IB_USER_VERBS_CMD_ALLOC_MW) |
+                        (1ull << IB_USER_VERBS_CMD_DEALLOC_MW);
+        }
+
         if (dev->caps.flags & MLX4_DEV_CAP_FLAG_XRC) {
                 ibdev->ib_dev.alloc_xrcd = mlx4_ib_alloc_xrcd;
                 ibdev->ib_dev.dealloc_xrcd = mlx4_ib_dealloc_xrcd;
@@ -1601,8 +1620,7 @@ static void do_slave_init(struct mlx4_ib_dev *ibdev, int slave, int do_init)
                 spin_unlock_irqrestore(&ibdev->sriov.going_down_lock, flags);
         }
 out:
-        if (dm)
-                kfree(dm);
+        kfree(dm);
         return;
 }
 
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index dcd845bc30f0..f61ec26500c4 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -116,6 +116,11 @@ struct mlx4_ib_mr {
         struct ib_umem         *umem;
 };
 
+struct mlx4_ib_mw {
+        struct ib_mw            ibmw;
+        struct mlx4_mw          mmw;
+};
+
 struct mlx4_ib_fast_reg_page_list {
         struct ib_fast_reg_page_list    ibfrpl;
         __be64                         *mapped_page_list;
@@ -533,6 +538,11 @@ static inline struct mlx4_ib_mr *to_mmr(struct ib_mr *ibmr)
         return container_of(ibmr, struct mlx4_ib_mr, ibmr);
 }
 
+static inline struct mlx4_ib_mw *to_mmw(struct ib_mw *ibmw)
+{
+        return container_of(ibmw, struct mlx4_ib_mw, ibmw);
+}
+
 static inline struct mlx4_ib_fast_reg_page_list *to_mfrpl(struct ib_fast_reg_page_list *ibfrpl)
 {
         return container_of(ibfrpl, struct mlx4_ib_fast_reg_page_list, ibfrpl);
@@ -581,6 +591,10 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                   u64 virt_addr, int access_flags,
                                   struct ib_udata *udata);
 int mlx4_ib_dereg_mr(struct ib_mr *mr);
+struct ib_mw *mlx4_ib_alloc_mw(struct ib_pd *pd, enum ib_mw_type type);
+int mlx4_ib_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
+                    struct ib_mw_bind *mw_bind);
+int mlx4_ib_dealloc_mw(struct ib_mw *mw);
 struct ib_mr *mlx4_ib_alloc_fast_reg_mr(struct ib_pd *pd,
                                         int max_page_list_len);
 struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device *ibdev,
@@ -652,12 +666,12 @@ int __mlx4_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
 int mlx4_ib_resolve_grh(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah_attr,
                         u8 *mac, int *is_mcast, u8 port);
 
-static inline int mlx4_ib_ah_grh_present(struct mlx4_ib_ah *ah)
+static inline bool mlx4_ib_ah_grh_present(struct mlx4_ib_ah *ah)
 {
         u8 port = be32_to_cpu(ah->av.ib.port_pd) >> 24 & 3;
 
         if (rdma_port_get_link_layer(ah->ibah.device, port) == IB_LINK_LAYER_ETHERNET)
-                return 1;
+                return true;
 
         return !!(ah->av.ib.g_slid & 0x80);
 }
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index bbaf6176f207..e471f089ff00 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -41,9 +41,19 @@ static u32 convert_access(int acc)
                (acc & IB_ACCESS_REMOTE_WRITE  ? MLX4_PERM_REMOTE_WRITE : 0) |
                (acc & IB_ACCESS_REMOTE_READ   ? MLX4_PERM_REMOTE_READ  : 0) |
                (acc & IB_ACCESS_LOCAL_WRITE   ? MLX4_PERM_LOCAL_WRITE  : 0) |
+               (acc & IB_ACCESS_MW_BIND       ? MLX4_PERM_BIND_MW      : 0) |
                MLX4_PERM_LOCAL_READ;
 }
 
+static enum mlx4_mw_type to_mlx4_type(enum ib_mw_type type)
+{
+        switch (type) {
+        case IB_MW_TYPE_1:      return MLX4_MW_TYPE_1;
+        case IB_MW_TYPE_2:      return MLX4_MW_TYPE_2;
+        default:                return -1;
+        }
+}
+
 struct ib_mr *mlx4_ib_get_dma_mr(struct ib_pd *pd, int acc)
 {
         struct mlx4_ib_mr *mr;
@@ -68,7 +78,7 @@ struct ib_mr *mlx4_ib_get_dma_mr(struct ib_pd *pd, int acc)
         return &mr->ibmr;
 
 err_mr:
-        mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
+        (void) mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
 
 err_free:
         kfree(mr);
@@ -163,7 +173,7 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
         return &mr->ibmr;
 
 err_mr:
-        mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
+        (void) mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
 
 err_umem:
         ib_umem_release(mr->umem);
@@ -177,8 +187,11 @@ err_free:
 int mlx4_ib_dereg_mr(struct ib_mr *ibmr)
 {
         struct mlx4_ib_mr *mr = to_mmr(ibmr);
+        int ret;
 
-        mlx4_mr_free(to_mdev(ibmr->device)->dev, &mr->mmr);
+        ret = mlx4_mr_free(to_mdev(ibmr->device)->dev, &mr->mmr);
+        if (ret)
+                return ret;
         if (mr->umem)
                 ib_umem_release(mr->umem);
         kfree(mr);
@@ -186,6 +199,70 @@ int mlx4_ib_dereg_mr(struct ib_mr *ibmr)
         return 0;
 }
 
+struct ib_mw *mlx4_ib_alloc_mw(struct ib_pd *pd, enum ib_mw_type type)
+{
+        struct mlx4_ib_dev *dev = to_mdev(pd->device);
+        struct mlx4_ib_mw *mw;
+        int err;
+
+        mw = kmalloc(sizeof(*mw), GFP_KERNEL);
+        if (!mw)
+                return ERR_PTR(-ENOMEM);
+
+        err = mlx4_mw_alloc(dev->dev, to_mpd(pd)->pdn,
+                            to_mlx4_type(type), &mw->mmw);
+        if (err)
+                goto err_free;
+
+        err = mlx4_mw_enable(dev->dev, &mw->mmw);
+        if (err)
+                goto err_mw;
+
+        mw->ibmw.rkey = mw->mmw.key;
+
+        return &mw->ibmw;
+
+err_mw:
+        mlx4_mw_free(dev->dev, &mw->mmw);
+
+err_free:
+        kfree(mw);
+
+        return ERR_PTR(err);
+}
+
+int mlx4_ib_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
+                    struct ib_mw_bind *mw_bind)
+{
+        struct ib_send_wr  wr;
+        struct ib_send_wr *bad_wr;
+        int ret;
+
+        memset(&wr, 0, sizeof(wr));
+        wr.opcode               = IB_WR_BIND_MW;
+        wr.wr_id                = mw_bind->wr_id;
+        wr.send_flags           = mw_bind->send_flags;
+        wr.wr.bind_mw.mw        = mw;
+        wr.wr.bind_mw.bind_info = mw_bind->bind_info;
+        wr.wr.bind_mw.rkey      = ib_inc_rkey(mw->rkey);
+
+        ret = mlx4_ib_post_send(qp, &wr, &bad_wr);
+        if (!ret)
+                mw->rkey = wr.wr.bind_mw.rkey;
+
+        return ret;
+}
+
+int mlx4_ib_dealloc_mw(struct ib_mw *ibmw)
+{
+        struct mlx4_ib_mw *mw = to_mmw(ibmw);
+
+        mlx4_mw_free(to_mdev(ibmw->device)->dev, &mw->mmw);
+        kfree(mw);
+
+        return 0;
+}
+
 struct ib_mr *mlx4_ib_alloc_fast_reg_mr(struct ib_pd *pd,
                                         int max_page_list_len)
 {
@@ -212,7 +289,7 @@ struct ib_mr *mlx4_ib_alloc_fast_reg_mr(struct ib_pd *pd,
         return &mr->ibmr;
 
 err_mr:
-        mlx4_mr_free(dev->dev, &mr->mmr);
+        (void) mlx4_mr_free(dev->dev, &mr->mmr);
 
 err_free:
         kfree(mr);
@@ -291,7 +368,7 @@ struct ib_fmr *mlx4_ib_fmr_alloc(struct ib_pd *pd, int acc,
         return &fmr->ibfmr;
 
 err_mr:
-        mlx4_mr_free(to_mdev(pd->device)->dev, &fmr->mfmr.mr);
+        (void) mlx4_mr_free(to_mdev(pd->device)->dev, &fmr->mfmr.mr);
 
 err_free:
         kfree(fmr);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 19e0637220b9..35cced2a4da8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -104,6 +104,7 @@ static const __be32 mlx4_ib_opcode[] = {
         [IB_WR_FAST_REG_MR]                     = cpu_to_be32(MLX4_OPCODE_FMR),
         [IB_WR_MASKED_ATOMIC_CMP_AND_SWP]       = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_CS),
         [IB_WR_MASKED_ATOMIC_FETCH_AND_ADD]     = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_FA),
+        [IB_WR_BIND_MW]                         = cpu_to_be32(MLX4_OPCODE_BIND_MW),
 };
 
 static struct mlx4_ib_sqp *to_msqp(struct mlx4_ib_qp *mqp)
@@ -1746,11 +1747,11 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
         int header_size;
         int spc;
         int i;
-        int is_eth;
-        int is_vlan = 0;
-        int is_grh;
-        u16 vlan;
         int err = 0;
+        u16 vlan = 0xffff;
+        bool is_eth;
+        bool is_vlan = false;
+        bool is_grh;
 
         send_size = 0;
         for (i = 0; i < wr->num_sge; ++i)
@@ -1953,9 +1954,12 @@ static int mlx4_wq_overflow(struct mlx4_ib_wq *wq, int nreq, struct ib_cq *ib_cq
 
 static __be32 convert_access(int acc)
 {
-        return (acc & IB_ACCESS_REMOTE_ATOMIC ? cpu_to_be32(MLX4_WQE_FMR_PERM_ATOMIC)       : 0) |
-               (acc & IB_ACCESS_REMOTE_WRITE  ? cpu_to_be32(MLX4_WQE_FMR_PERM_REMOTE_WRITE) : 0) |
-               (acc & IB_ACCESS_REMOTE_READ   ? cpu_to_be32(MLX4_WQE_FMR_PERM_REMOTE_READ)  : 0) |
+        return (acc & IB_ACCESS_REMOTE_ATOMIC ?
+                cpu_to_be32(MLX4_WQE_FMR_AND_BIND_PERM_ATOMIC)       : 0) |
+               (acc & IB_ACCESS_REMOTE_WRITE  ?
+                cpu_to_be32(MLX4_WQE_FMR_AND_BIND_PERM_REMOTE_WRITE) : 0) |
+               (acc & IB_ACCESS_REMOTE_READ   ?
+                cpu_to_be32(MLX4_WQE_FMR_AND_BIND_PERM_REMOTE_READ)  : 0) |
                (acc & IB_ACCESS_LOCAL_WRITE   ? cpu_to_be32(MLX4_WQE_FMR_PERM_LOCAL_WRITE)  : 0) |
                 cpu_to_be32(MLX4_WQE_FMR_PERM_LOCAL_READ);
 }
@@ -1981,12 +1985,28 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
         fseg->reserved[1]       = 0;
 }
 
+static void set_bind_seg(struct mlx4_wqe_bind_seg *bseg, struct ib_send_wr *wr)
+{
+        bseg->flags1 =
+                convert_access(wr->wr.bind_mw.bind_info.mw_access_flags) &
+                cpu_to_be32(MLX4_WQE_FMR_AND_BIND_PERM_REMOTE_READ  |
+                            MLX4_WQE_FMR_AND_BIND_PERM_REMOTE_WRITE |
+                            MLX4_WQE_FMR_AND_BIND_PERM_ATOMIC);
+        bseg->flags2 = 0;
+        if (wr->wr.bind_mw.mw->type == IB_MW_TYPE_2)
+                bseg->flags2 |= cpu_to_be32(MLX4_WQE_BIND_TYPE_2);
+        if (wr->wr.bind_mw.bind_info.mw_access_flags & IB_ZERO_BASED)
+                bseg->flags2 |= cpu_to_be32(MLX4_WQE_BIND_ZERO_BASED);
+        bseg->new_rkey = cpu_to_be32(wr->wr.bind_mw.rkey);
+        bseg->lkey = cpu_to_be32(wr->wr.bind_mw.bind_info.mr->lkey);
+        bseg->addr = cpu_to_be64(wr->wr.bind_mw.bind_info.addr);
+        bseg->length = cpu_to_be64(wr->wr.bind_mw.bind_info.length);
+}
+
 static void set_local_inv_seg(struct mlx4_wqe_local_inval_seg *iseg, u32 rkey)
 {
-        iseg->flags     = 0;
-        iseg->mem_key   = cpu_to_be32(rkey);
-        iseg->guest_id  = 0;
-        iseg->pa        = 0;
+        memset(iseg, 0, sizeof(*iseg));
+        iseg->mem_key = cpu_to_be32(rkey);
 }
 
 static __always_inline void set_raddr_seg(struct mlx4_wqe_raddr_seg *rseg,
@@ -2291,6 +2311,13 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 size += sizeof (struct mlx4_wqe_fmr_seg) / 16;
                                 break;
 
+                        case IB_WR_BIND_MW:
+                                ctrl->srcrb_flags |=
+                                        cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER);
+                                set_bind_seg(wqe, wr);
+                                wqe  += sizeof(struct mlx4_wqe_bind_seg);
+                                size += sizeof(struct mlx4_wqe_bind_seg) / 16;
+                                break;
                         default:
                                 /* No extra segments required for sends */
                                 break;
diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
index 5b2a01dfb907..97516eb363b7 100644
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -732,7 +732,7 @@ int mlx4_ib_device_register_sysfs(struct mlx4_ib_dev *dev)
         dev->ports_parent =
                 kobject_create_and_add("ports",
                                        kobject_get(dev->iov_parent));
-        if (!dev->iov_parent) {
+        if (!dev->ports_parent) {
                 ret = -ENOMEM;
                 goto err_ports;
         }
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 07e4fbad987a..8f67fe2e91e6 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -55,7 +55,8 @@ static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
 /**
  * nes_alloc_mw
  */
-static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
+static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd, enum ib_mw_type type)
+{
         struct nes_pd *nespd = to_nespd(ibpd);
         struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
         struct nes_device *nesdev = nesvnic->nesdev;
@@ -71,6 +72,9 @@ static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
         u32 driver_key = 0;
         u8 stag_key = 0;
 
+        if (type != IB_MW_TYPE_1)
+                return ERR_PTR(-EINVAL);
+
         get_random_bytes(&next_stag_index, sizeof(next_stag_index));
         stag_key = (u8)next_stag_index;
 
@@ -244,20 +248,19 @@ static int nes_bind_mw(struct ib_qp *ibqp, struct ib_mw *ibmw,
         if (ibmw_bind->send_flags & IB_SEND_SIGNALED)
                 wqe_misc |= NES_IWARP_SQ_WQE_SIGNALED_COMPL;
 
-        if (ibmw_bind->mw_access_flags & IB_ACCESS_REMOTE_WRITE) {
+        if (ibmw_bind->bind_info.mw_access_flags & IB_ACCESS_REMOTE_WRITE)
                 wqe_misc |= NES_CQP_STAG_RIGHTS_REMOTE_WRITE;
-        }
-        if (ibmw_bind->mw_access_flags & IB_ACCESS_REMOTE_READ) {
+        if (ibmw_bind->bind_info.mw_access_flags & IB_ACCESS_REMOTE_READ)
                 wqe_misc |= NES_CQP_STAG_RIGHTS_REMOTE_READ;
-        }
 
         set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_MISC_IDX, wqe_misc);
-        set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_BIND_WQE_MR_IDX, ibmw_bind->mr->lkey);
+        set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_BIND_WQE_MR_IDX,
+                            ibmw_bind->bind_info.mr->lkey);
         set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_BIND_WQE_MW_IDX, ibmw->rkey);
         set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_BIND_WQE_LENGTH_LOW_IDX,
-                        ibmw_bind->length);
+                        ibmw_bind->bind_info.length);
         wqe->wqe_words[NES_IWARP_SQ_BIND_WQE_LENGTH_HIGH_IDX] = 0;
-        u64temp = (u64)ibmw_bind->addr;
+        u64temp = (u64)ibmw_bind->bind_info.addr;
         set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_BIND_WQE_VA_FBO_LOW_IDX, u64temp);
 
         head++;
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 35275099cafd..a6a2cc2ba260 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -268,8 +268,9 @@ static void remove_qp(struct qib_ibdev *dev, struct qib_qp *qp)
                                 qpp = &q->next)
                         if (q == qp) {
                                 atomic_dec(&qp->refcount);
-                                *qpp = qp->next;
-                                rcu_assign_pointer(qp->next, NULL);
+                                rcu_assign_pointer(*qpp,
+                                        rcu_dereference_protected(qp->next,
+                                         lockdep_is_held(&dev->qpt_lock)));
                                 break;
                         }
         }