12 files changed, 85 insertions, 62 deletions

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index a3a2e9c1639b..df0c4f605a21 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -105,6 +105,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
         umem->length    = size;
         umem->offset    = addr & ~PAGE_MASK;
         umem->page_size = PAGE_SIZE;
+        umem->pid       = get_task_pid(current, PIDTYPE_PID);
         /*
          * We ask for writable memory if any access flags other than
          * "remote read" are set.  "Local write" and "remote write"
@@ -198,6 +199,7 @@ out:
         if (ret < 0) {
                 if (need_release)
                         __ib_umem_release(context->device, umem, 0);
+                put_pid(umem->pid);
                 kfree(umem);
         } else
                 current->mm->pinned_vm = locked;
@@ -230,15 +232,19 @@ void ib_umem_release(struct ib_umem *umem)
 {
         struct ib_ucontext *context = umem->context;
         struct mm_struct *mm;
+        struct task_struct *task;
         unsigned long diff;
 
         __ib_umem_release(umem->context->device, umem, 1);
 
-        mm = get_task_mm(current);
-        if (!mm) {
-                kfree(umem);
-                return;
-        }
+        task = get_pid_task(umem->pid, PIDTYPE_PID);
+        put_pid(umem->pid);
+        if (!task)
+                goto out;
+        mm = get_task_mm(task);
+        put_task_struct(task);
+        if (!mm)
+                goto out;
 
         diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;
 
@@ -262,9 +268,10 @@ void ib_umem_release(struct ib_umem *umem)
         } else
                 down_write(&mm->mmap_sem);
 
-        current->mm->pinned_vm -= diff;
+        mm->pinned_vm -= diff;
         up_write(&mm->mmap_sem);
         mmput(mm);
+out:
         kfree(umem);
 }
 EXPORT_SYMBOL(ib_umem_release);
diff --git a/drivers/infiniband/hw/ipath/ipath_user_pages.c b/drivers/infiniband/hw/ipath/ipath_user_pages.c
index dc66c4506916..1da1252dcdb3 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_pages.c
+++ b/drivers/infiniband/hw/ipath/ipath_user_pages.c
@@ -54,7 +54,7 @@ static void __ipath_release_user_pages(struct page **p, size_t num_pages,
 
 /* call with current->mm->mmap_sem held */
 static int __ipath_get_user_pages(unsigned long start_page, size_t num_pages,
-                                  struct page **p, struct vm_area_struct **vma)
+                                  struct page **p)
 {
         unsigned long lock_limit;
         size_t got;
@@ -74,7 +74,7 @@ static int __ipath_get_user_pages(unsigned long start_page, size_t num_pages,
                 ret = get_user_pages(current, current->mm,
                                      start_page + got * PAGE_SIZE,
                                      num_pages - got, 1, 1,
-                                     p + got, vma);
+                                     p + got, NULL);
                 if (ret < 0)
                         goto bail_release;
         }
@@ -165,7 +165,7 @@ int ipath_get_user_pages(unsigned long start_page, size_t num_pages,
 
         down_write(&current->mm->mmap_sem);
 
-        ret = __ipath_get_user_pages(start_page, num_pages, p, NULL);
+        ret = __ipath_get_user_pages(start_page, num_pages, p);
 
         up_write(&current->mm->mmap_sem);
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index 40f8536c10b0..ac02ce4e8040 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -38,7 +38,7 @@
 #define OCRDMA_VID_PCP_SHIFT    0xD
 
 static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
-                                struct ib_ah_attr *attr, int pdid)
+                        struct ib_ah_attr *attr, union ib_gid *sgid, int pdid)
 {
         int status = 0;
         u16 vlan_tag; bool vlan_enabled = false;
@@ -49,8 +49,7 @@ static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
         memset(&eth, 0, sizeof(eth));
         memset(&grh, 0, sizeof(grh));
 
-        ah->sgid_index = attr->grh.sgid_index;
-
+        /* VLAN */
         vlan_tag = attr->vlan_id;
         if (!vlan_tag || (vlan_tag > 0xFFF))
                 vlan_tag = dev->pvid;
@@ -65,15 +64,14 @@ static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
                 eth.eth_type = cpu_to_be16(OCRDMA_ROCE_ETH_TYPE);
                 eth_sz = sizeof(struct ocrdma_eth_basic);
         }
+        /* MAC */
         memcpy(&eth.smac[0], &dev->nic_info.mac_addr[0], ETH_ALEN);
-        memcpy(&eth.dmac[0], attr->dmac, ETH_ALEN);
         status = ocrdma_resolve_dmac(dev, attr, &eth.dmac[0]);
         if (status)
                 return status;
-        status = ocrdma_query_gid(&dev->ibdev, 1, attr->grh.sgid_index,
-                        (union ib_gid *)&grh.sgid[0]);
-        if (status)
-                return status;
+        ah->sgid_index = attr->grh.sgid_index;
+        memcpy(&grh.sgid[0], sgid->raw, sizeof(union ib_gid));
+        memcpy(&grh.dgid[0], attr->grh.dgid.raw, sizeof(attr->grh.dgid.raw));
 
         grh.tclass_flow = cpu_to_be32((6 << 28) |
                         (attr->grh.traffic_class << 24) |
@@ -81,8 +79,7 @@ static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
         /* 0x1b is next header value in GRH */
         grh.pdid_hoplimit = cpu_to_be32((pdid << 16) |
                         (0x1b << 8) | attr->grh.hop_limit);
-
-        memcpy(&grh.dgid[0], attr->grh.dgid.raw, sizeof(attr->grh.dgid.raw));
+        /* Eth HDR */
         memcpy(&ah->av->eth_hdr, &eth, eth_sz);
         memcpy((u8 *)ah->av + eth_sz, &grh, sizeof(struct ocrdma_grh));
         if (vlan_enabled)
@@ -98,6 +95,8 @@ struct ib_ah *ocrdma_create_ah(struct ib_pd *ibpd, struct ib_ah_attr *attr)
         struct ocrdma_ah *ah;
         struct ocrdma_pd *pd = get_ocrdma_pd(ibpd);
         struct ocrdma_dev *dev = get_ocrdma_dev(ibpd->device);
+        union ib_gid sgid;
+        u8 zmac[ETH_ALEN];
 
         if (!(attr->ah_flags & IB_AH_GRH))
                 return ERR_PTR(-EINVAL);
@@ -111,7 +110,27 @@ struct ib_ah *ocrdma_create_ah(struct ib_pd *ibpd, struct ib_ah_attr *attr)
         status = ocrdma_alloc_av(dev, ah);
         if (status)
                 goto av_err;
-        status = set_av_attr(dev, ah, attr, pd->id);
+
+        status = ocrdma_query_gid(&dev->ibdev, 1, attr->grh.sgid_index, &sgid);
+        if (status) {
+                pr_err("%s(): Failed to query sgid, status = %d\n",
+                      __func__, status);
+                goto av_conf_err;
+        }
+
+        memset(&zmac, 0, ETH_ALEN);
+        if (pd->uctx &&
+            memcmp(attr->dmac, &zmac, ETH_ALEN)) {
+                status = rdma_addr_find_dmac_by_grh(&sgid, &attr->grh.dgid,
+                                        attr->dmac, &attr->vlan_id);
+                if (status) {
+                        pr_err("%s(): Failed to resolve dmac from gid." 
+                                "status = %d\n", __func__, status);
+                        goto av_conf_err;
+                }
+        }
+
+        status = set_av_attr(dev, ah, attr, &sgid, pd->id);
         if (status)
                 goto av_conf_err;
 
@@ -145,7 +164,7 @@ int ocrdma_query_ah(struct ib_ah *ibah, struct ib_ah_attr *attr)
         struct ocrdma_av *av = ah->av;
         struct ocrdma_grh *grh;
         attr->ah_flags |= IB_AH_GRH;
-        if (ah->av->valid & Bit(1)) {
+        if (ah->av->valid & OCRDMA_AV_VALID) {
                 grh = (struct ocrdma_grh *)((u8 *)ah->av +
                                 sizeof(struct ocrdma_eth_vlan));
                 attr->sl = be16_to_cpu(av->eth_hdr.vlan_tag) >> 13;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index acb434d16903..8f5f2577f288 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -101,7 +101,7 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr)
         attr->max_srq_sge = dev->attr.max_srq_sge;
         attr->max_srq_wr = dev->attr.max_rqe;
         attr->local_ca_ack_delay = dev->attr.local_ca_ack_delay;
-        attr->max_fast_reg_page_list_len = 0;
+        attr->max_fast_reg_page_list_len = dev->attr.max_pages_per_frmr;
         attr->max_pkeys = 1;
         return 0;
 }
@@ -2846,11 +2846,9 @@ int ocrdma_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags cq_flags)
         if (cq->first_arm) {
                 ocrdma_ring_cq_db(dev, cq_id, arm_needed, sol_needed, 0);
                 cq->first_arm = false;
-                goto skip_defer;
         }
-        cq->deferred_arm = true;
 
-skip_defer:
+        cq->deferred_arm = true;
         cq->deferred_sol = sol_needed;
         spin_unlock_irqrestore(&cq->cq_lock, flags);
 
diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c
index 799a0c3bffc4..6abd3ed3cd51 100644
--- a/drivers/infiniband/hw/qib/qib_debugfs.c
+++ b/drivers/infiniband/hw/qib/qib_debugfs.c
@@ -193,6 +193,7 @@ static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
         struct qib_qp_iter *iter;
         loff_t n = *pos;
 
+        rcu_read_lock();
         iter = qib_qp_iter_init(s->private);
         if (!iter)
                 return NULL;
@@ -224,7 +225,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
 {
-        /* nothing for now */
+        rcu_read_unlock();
 }
 
 static int _qp_stats_seq_show(struct seq_file *s, void *iter_ptr)
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 7fcc150d603c..6ddc0264aad2 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -1325,7 +1325,6 @@ int qib_qp_iter_next(struct qib_qp_iter *iter)
         struct qib_qp *pqp = iter->qp;
         struct qib_qp *qp;
 
-        rcu_read_lock();
         for (; n < dev->qp_table_size; n++) {
                 if (pqp)
                         qp = rcu_dereference(pqp->next);
@@ -1333,18 +1332,11 @@ int qib_qp_iter_next(struct qib_qp_iter *iter)
                         qp = rcu_dereference(dev->qp_table[n]);
                 pqp = qp;
                 if (qp) {
-                        if (iter->qp)
-                                atomic_dec(&iter->qp->refcount);
-                        atomic_inc(&qp->refcount);
-                        rcu_read_unlock();
                         iter->qp = qp;
                         iter->n = n;
                         return 0;
                 }
         }
-        rcu_read_unlock();
-        if (iter->qp)
-                atomic_dec(&iter->qp->refcount);
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c
index 2bc1d2b96298..74f90b2619f6 100644
--- a/drivers/infiniband/hw/qib/qib_user_pages.c
+++ b/drivers/infiniband/hw/qib/qib_user_pages.c
@@ -52,7 +52,7 @@ static void __qib_release_user_pages(struct page **p, size_t num_pages,
  * Call with current->mm->mmap_sem held.
  */
 static int __qib_get_user_pages(unsigned long start_page, size_t num_pages,
-                                struct page **p, struct vm_area_struct **vma)
+                                struct page **p)
 {
         unsigned long lock_limit;
         size_t got;
@@ -69,7 +69,7 @@ static int __qib_get_user_pages(unsigned long start_page, size_t num_pages,
                 ret = get_user_pages(current, current->mm,
                                      start_page + got * PAGE_SIZE,
                                      num_pages - got, 1, 1,
-                                     p + got, vma);
+                                     p + got, NULL);
                 if (ret < 0)
                         goto bail_release;
         }
@@ -136,7 +136,7 @@ int qib_get_user_pages(unsigned long start_page, size_t num_pages,
 
         down_write(&current->mm->mmap_sem);
 
-        ret = __qib_get_user_pages(start_page, num_pages, p, NULL);
+        ret = __qib_get_user_pages(start_page, num_pages, p);
 
         up_write(&current->mm->mmap_sem);
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index d4e005720d01..ffb83b5f7e80 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -529,21 +529,13 @@ void ipoib_mcast_join_task(struct work_struct *work)
                           port_attr.state);
                 return;
         }
+        priv->local_lid = port_attr.lid;
 
         if (ib_query_gid(priv->ca, priv->port, 0, &priv->local_gid))
                 ipoib_warn(priv, "ib_query_gid() failed\n");
         else
                 memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw, sizeof (union ib_gid));
 
-        {
-                struct ib_port_attr attr;
-
-                if (!ib_query_port(priv->ca, priv->port, &attr))
-                        priv->local_lid = attr.lid;
-                else
-                        ipoib_warn(priv, "ib_query_port failed\n");
-        }
-
         if (!priv->broadcast) {
                 struct ipoib_mcast *broadcast;
 
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 61ee91d88380..93ce62fe1594 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -344,7 +344,6 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session,
                      int is_leading)
 {
         struct iscsi_conn *conn = cls_conn->dd_data;
-        struct iscsi_session *session;
         struct iser_conn *ib_conn;
         struct iscsi_endpoint *ep;
         int error;
@@ -363,9 +362,17 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session,
         }
         ib_conn = ep->dd_data;
 
-        session = conn->session;
-        if (iser_alloc_rx_descriptors(ib_conn, session))
-                return -ENOMEM;
+        mutex_lock(&ib_conn->state_mutex);
+        if (ib_conn->state != ISER_CONN_UP) {
+                error = -EINVAL;
+                iser_err("iser_conn %p state is %d, teardown started\n",
+                         ib_conn, ib_conn->state);
+                goto out;
+        }
+
+        error = iser_alloc_rx_descriptors(ib_conn, conn->session);
+        if (error)
+                goto out;
 
         /* binds the iSER connection retrieved from the previously
          * connected ep_handle to the iSCSI layer connection. exchanges
@@ -375,7 +382,9 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session,
         conn->dd_data = ib_conn;
         ib_conn->iscsi_conn = conn;
 
-        return 0;
+out:
+        mutex_unlock(&ib_conn->state_mutex);
+        return error;
 }
 
 static int
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index c877dad381cb..9f0e0e34d6ca 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -69,7 +69,7 @@
 
 #define DRV_NAME        "iser"
 #define PFX             DRV_NAME ": "
-#define DRV_VER         "1.4"
+#define DRV_VER         "1.4.1"
 
 #define iser_dbg(fmt, arg...)                           \
         do {                                            \
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 3ef167f97d6f..3bfec4bbda52 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -73,7 +73,7 @@ static int iser_create_device_ib_res(struct iser_device *device)
 {
         struct iser_cq_desc *cq_desc;
         struct ib_device_attr *dev_attr = &device->dev_attr;
-        int ret, i, j;
+        int ret, i;
 
         ret = ib_query_device(device->ib_device, dev_attr);
         if (ret) {
@@ -125,16 +125,20 @@ static int iser_create_device_ib_res(struct iser_device *device)
                                           iser_cq_event_callback,
                                           (void *)&cq_desc[i],
                                           ISER_MAX_RX_CQ_LEN, i);
-                if (IS_ERR(device->rx_cq[i]))
+                if (IS_ERR(device->rx_cq[i])) {
+                        device->rx_cq[i] = NULL;
                         goto cq_err;
+                }
 
                 device->tx_cq[i] = ib_create_cq(device->ib_device,
                                           NULL, iser_cq_event_callback,
                                           (void *)&cq_desc[i],
                                           ISER_MAX_TX_CQ_LEN, i);
 
-                if (IS_ERR(device->tx_cq[i]))
+                if (IS_ERR(device->tx_cq[i])) {
+                        device->tx_cq[i] = NULL;
                         goto cq_err;
+                }
 
                 if (ib_req_notify_cq(device->rx_cq[i], IB_CQ_NEXT_COMP))
                         goto cq_err;
@@ -160,14 +164,14 @@ static int iser_create_device_ib_res(struct iser_device *device)
 handler_err:
         ib_dereg_mr(device->mr);
 dma_mr_err:
-        for (j = 0; j < device->cqs_used; j++)
-                tasklet_kill(&device->cq_tasklet[j]);
+        for (i = 0; i < device->cqs_used; i++)
+                tasklet_kill(&device->cq_tasklet[i]);
 cq_err:
-        for (j = 0; j < i; j++) {
-                if (device->tx_cq[j])
-                        ib_destroy_cq(device->tx_cq[j]);
-                if (device->rx_cq[j])
-                        ib_destroy_cq(device->rx_cq[j]);
+        for (i = 0; i < device->cqs_used; i++) {
+                if (device->tx_cq[i])
+                        ib_destroy_cq(device->tx_cq[i]);
+                if (device->rx_cq[i])
+                        ib_destroy_cq(device->rx_cq[i]);
         }
         ib_dealloc_pd(device->pd);
 pd_err:
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 1ea0b65c4cfb..a2bf41e0bde9 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -47,6 +47,7 @@ struct ib_umem {
         int                     writable;
         int                     hugetlb;
         struct work_struct      work;
+        struct pid             *pid;
         struct mm_struct       *mm;
         unsigned long           diff;
         struct sg_table sg_head;