2 files changed, 8 insertions, 2 deletions

diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index b7e2844f096b..8f36e231bdf5 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -905,7 +905,7 @@ struct nes_hw_qp {
 };
 
 struct nes_hw_cq {
-        struct nes_hw_cqe volatile *cq_vbase;   /* PCI memory for host rings */
+        struct nes_hw_cqe *cq_vbase;    /* PCI memory for host rings */
         void (*ce_handler)(struct nes_device *nesdev, struct nes_hw_cq *cq);
         dma_addr_t cq_pbase;    /* PCI memory for host rings */
         u16 cq_head;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index f9a5d4390892..ee74f7c7a6da 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1976,7 +1976,7 @@ static int nes_destroy_cq(struct ib_cq *ib_cq)
 
         if (nescq->cq_mem_size)
                 pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size,
-                                (void *)nescq->hw_cq.cq_vbase, nescq->hw_cq.cq_pbase);
+                                    nescq->hw_cq.cq_vbase, nescq->hw_cq.cq_pbase);
         kfree(nescq);
 
         return ret;
@@ -3610,6 +3610,12 @@ static int nes_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry)
         while (cqe_count < num_entries) {
                 if (le32_to_cpu(nescq->hw_cq.cq_vbase[head].cqe_words[NES_CQE_OPCODE_IDX]) &
                                 NES_CQE_VALID) {
+                        /*
+                         * Make sure we read CQ entry contents *after*
+                         * we've checked the valid bit.
+                         */
+                        rmb();
+
                         cqe = nescq->hw_cq.cq_vbase[head];
                         nescq->hw_cq.cq_vbase[head].cqe_words[NES_CQE_OPCODE_IDX] = 0;
                         u32temp = le32_to_cpu(cqe.cqe_words[NES_CQE_COMP_COMP_CTX_LOW_IDX]);