5 files changed, 25 insertions, 8 deletions

diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 57347f1e82c1..7696022f9a4e 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -61,6 +61,7 @@ struct ib_uverbs_event_file {
         int                                     fd;
         int                                     is_async;
         wait_queue_head_t                       poll_wait;
+        struct fasync_struct                   *async_queue;
         struct list_head                        event_list;
 };
 
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fbbe03d8c901..eb99e693dec2 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -257,11 +257,19 @@ static void ib_uverbs_event_release(struct ib_uverbs_event_file *file)
         spin_unlock_irq(&file->lock);
 }
 
+static int ib_uverbs_event_fasync(int fd, struct file *filp, int on)
+{
+        struct ib_uverbs_event_file *file = filp->private_data;
+
+        return fasync_helper(fd, filp, on, &file->async_queue);
+}
+
 static int ib_uverbs_event_close(struct inode *inode, struct file *filp)
 {
         struct ib_uverbs_event_file *file = filp->private_data;
 
         ib_uverbs_event_release(file);
+        ib_uverbs_event_fasync(-1, filp, 0);
         kref_put(&file->uverbs_file->ref, ib_uverbs_release_file);
 
         return 0;
@@ -276,7 +284,8 @@ static struct file_operations uverbs_event_fops = {
          */
         .read    = ib_uverbs_event_read,
         .poll    = ib_uverbs_event_poll,
-        .release = ib_uverbs_event_close
+        .release = ib_uverbs_event_close,
+        .fasync  = ib_uverbs_event_fasync
 };
 
 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
@@ -296,6 +305,7 @@ void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
         spin_unlock_irqrestore(&file->comp_file[0].lock, flags);
 
         wake_up_interruptible(&file->comp_file[0].poll_wait);
+        kill_fasync(&file->comp_file[0].async_queue, SIGIO, POLL_IN);
 }
 
 static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
@@ -316,6 +326,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
         spin_unlock_irqrestore(&file->async_file.lock, flags);
 
         wake_up_interruptible(&file->async_file.poll_wait);
+        kill_fasync(&file->async_file.async_queue, SIGIO, POLL_IN);
 }
 
 void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr)
@@ -350,6 +361,7 @@ static int ib_uverbs_event_init(struct ib_uverbs_event_file *file,
         INIT_LIST_HEAD(&file->event_list);
         init_waitqueue_head(&file->poll_wait);
         file->uverbs_file = uverbs_file;
+        file->async_queue = NULL;
 
         file->fd = get_unused_fd();
         if (file->fd < 0)
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index b5aea7b869f6..5687c3014522 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -373,8 +373,12 @@ static int handle_error_cqe(struct mthca_dev *dev, struct mthca_cq *cq,
          * If we're at the end of the WQE chain, or we've used up our
          * doorbell count, free the CQE.  Otherwise just update it for
          * the next poll operation.
+         *
+         * This does not apply to mem-free HCAs: they don't use the
+         * doorbell count field, and so we should always free the CQE.
          */
-        if (!(new_wqe & cpu_to_be32(0x3f)) || (!cqe->db_cnt && dbd))
+        if (mthca_is_memfree(dev) ||
+            !(new_wqe & cpu_to_be32(0x3f)) || (!cqe->db_cnt && dbd))
                 return 0;
 
         cqe->db_cnt   = cpu_to_be16(be16_to_cpu(cqe->db_cnt) - dbd);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 7a58ce90e179..81919a7b4935 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -349,9 +349,9 @@ static int mthca_mmap_uar(struct ib_ucontext *context,
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
-        if (remap_pfn_range(vma, vma->vm_start,
-                            to_mucontext(context)->uar.pfn,
-                            PAGE_SIZE, vma->vm_page_prot))
+        if (io_remap_pfn_range(vma, vma->vm_start,
+                               to_mucontext(context)->uar.pfn,
+                               PAGE_SIZE, vma->vm_page_prot))
                 return -EAGAIN;
 
         return 0;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 8238766746b2..eee82363167d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -81,7 +81,7 @@ void ipoib_free_ah(struct kref *kref)
 
         unsigned long flags;
 
-        if (ah->last_send <= priv->tx_tail) {
+        if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
                 ipoib_dbg(priv, "Freeing ah %p\n", ah->ah);
                 ib_destroy_ah(ah->ah);
                 kfree(ah);
@@ -355,7 +355,7 @@ static void __ipoib_reap_ah(struct net_device *dev)
 
         spin_lock_irq(&priv->lock);
         list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
-                if (ah->last_send <= priv->tx_tail) {
+                if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
                         list_del(&ah->list);
                         list_add_tail(&ah->list, &remove_list);
                 }
@@ -486,7 +486,7 @@ int ipoib_ib_dev_stop(struct net_device *dev)
                          * assume the HW is wedged and just free up
                          * all our pending work requests.
                          */
-                        while (priv->tx_tail < priv->tx_head) {
+                        while ((int) priv->tx_tail - (int) priv->tx_head < 0) {
                                 tx_req = &priv->tx_ring[priv->tx_tail &
                                                         (IPOIB_TX_RING_SIZE - 1)];
                                 dma_unmap_single(priv->ca->dma_device,