9 files changed, 63 insertions, 74 deletions

diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 2bd8b1cc57c4..e23836d0e21b 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -412,8 +412,8 @@ static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
 
         hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
         data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
-        pad = data_size - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
-        if (pad > data_size || pad < 0)
+        pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (pad > IB_MGMT_RMPP_DATA || pad < 0)
                 pad = 0;
 
         return hdr_size + rmpp_recv->seg_num * data_size - pad;
@@ -583,6 +583,7 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 {
         struct ib_rmpp_mad *rmpp_mad;
         int timeout;
+        u32 paylen;
 
         rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
         ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
@@ -590,11 +591,9 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == 1) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(mad_send_wr->total_seg *
-                                    (sizeof(struct ib_rmpp_mad) -
-                                       offsetof(struct ib_rmpp_mad, data)) -
-                                    mad_send_wr->pad);
+                paylen = mad_send_wr->total_seg * IB_MGMT_RMPP_DATA -
+                         mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
                 mad_send_wr->sg_list[0].length = sizeof(struct ib_rmpp_mad);
         } else {
                 mad_send_wr->send_wr.num_sge = 2;
@@ -608,10 +607,8 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == mad_send_wr->total_seg) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(sizeof(struct ib_rmpp_mad) -
-                                    offsetof(struct ib_rmpp_mad, data) -
-                                    mad_send_wr->pad);
+                paylen = IB_MGMT_RMPP_DATA - mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
         }
 
         /* 2 seconds for an ACK until we can find the packet lifetime */
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 7c2f03057ddb..a64d6b4dcc16 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -334,10 +334,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                         ret = -EINVAL;
                         goto err_ah;
                 }
-                /* Validate that management class can support RMPP */
+
+                /* Validate that the management class can support RMPP */
                 if (rmpp_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_ADM) {
                         hdr_len = offsetof(struct ib_sa_mad, data);
-                        data_len = length;
+                        data_len = length - hdr_len;
                 } else if ((rmpp_mad->mad_hdr.mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
                             (rmpp_mad->mad_hdr.mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)) {
                                 hdr_len = offsetof(struct ib_vendor_mad, data);
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 18f0981eb0c1..78152a8ad17d 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -476,12 +476,8 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         int i;
         u8 status;
 
-        /* Make sure EQ size is aligned to a power of 2 size. */
-        for (i = 1; i < nent; i <<= 1)
-                ; /* nothing */
-        nent = i;
-
-        eq->dev = dev;
+        eq->dev  = dev;
+        eq->nent = roundup_pow_of_two(max(nent, 2));
 
         eq->page_list = kmalloc(npages * sizeof *eq->page_list,
                                 GFP_KERNEL);
@@ -512,7 +508,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
                 memset(eq->page_list[i].buf, 0, PAGE_SIZE);
         }
 
-        for (i = 0; i < nent; ++i)
+        for (i = 0; i < eq->nent; ++i)
                 set_eqe_hw(get_eqe(eq, i));
 
         eq->eqn = mthca_alloc(&dev->eq_table.alloc);
@@ -528,8 +524,6 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (err)
                 goto err_out_free_eq;
 
-        eq->nent = nent;
-
         memset(eq_context, 0, sizeof *eq_context);
         eq_context->flags           = cpu_to_be32(MTHCA_EQ_STATUS_OK   |
                                                   MTHCA_EQ_OWNER_HW    |
@@ -538,7 +532,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (mthca_is_memfree(dev))
                 eq_context->flags  |= cpu_to_be32(MTHCA_EQ_STATE_ARBEL);
 
-        eq_context->logsize_usrpage = cpu_to_be32((ffs(nent) - 1) << 24);
+        eq_context->logsize_usrpage = cpu_to_be32((ffs(eq->nent) - 1) << 24);
         if (mthca_is_memfree(dev)) {
                 eq_context->arbel_pd = cpu_to_be32(dev->driver_pd.pd_num);
         } else {
@@ -569,7 +563,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         dev->eq_table.arm_mask |= eq->eqn_mask;
 
         mthca_dbg(dev, "Allocated EQ %d with %d entries\n",
-                  eq->eqn, nent);
+                  eq->eqn, eq->nent);
 
         return err;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index bcef06bf15e7..5fa00669f9b8 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -227,7 +227,6 @@ static void mthca_wq_init(struct mthca_wq *wq)
         wq->last_comp = wq->max - 1;
         wq->head      = 0;
         wq->tail      = 0;
-        wq->last      = NULL;
 }
 
 void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
@@ -687,7 +686,7 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         }
 
         if (attr_mask & IB_QP_TIMEOUT) {
-                qp_context->pri_path.ackto = attr->timeout;
+                qp_context->pri_path.ackto = attr->timeout << 3;
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_ACK_TIMEOUT);
         }
 
@@ -1103,6 +1102,9 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
                 }
         }
 
+        qp->sq.last = get_send_wqe(qp, qp->sq.max - 1);
+        qp->rq.last = get_recv_wqe(qp, qp->rq.max - 1);
+
         return 0;
 }
 
@@ -1583,15 +1585,13 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (prev_wqe) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
 
                 if (!size0) {
                         size0 = size;
@@ -1688,13 +1688,11 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
                 qp->wrid[ind] = wr->wr_id;
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0)
                         size0 = size;
@@ -1905,15 +1903,13 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0) {
                         size0 = size;
@@ -2127,5 +2123,6 @@ void __devexit mthca_cleanup_qp_table(struct mthca_dev *dev)
         for (i = 0; i < 2; ++i)
                 mthca_CONF_SPECIAL_QP(dev, i, 0, &status);
 
+        mthca_array_cleanup(&dev->qp_table.qp, dev->limits.num_qps);
         mthca_alloc_cleanup(&dev->qp_table.alloc);
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 75cd2d84ef12..18998d48c53e 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -172,6 +172,8 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
                         scatter->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
         }
 
+        srq->last = get_wqe(srq, srq->max - 1);
+
         return 0;
 }
 
@@ -189,7 +191,6 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
 
         srq->max      = attr->max_wr;
         srq->max_gs   = attr->max_sge;
-        srq->last     = NULL;
         srq->counter  = 0;
 
         if (mthca_is_memfree(dev))
@@ -409,7 +410,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -427,7 +428,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         err = -EINVAL;
                         *bad_wr = wr;
                         srq->last = prev_wqe;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
@@ -446,20 +447,16 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         ((struct mthca_data_seg *) wqe)->addr = 0;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << srq->wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << srq->wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD);
 
                 srq->wrid[ind]  = wr->wr_id;
                 srq->first_free = next_ind;
         }
 
-        return nreq;
-
         if (likely(nreq)) {
                 __be32 doorbell[2];
 
@@ -503,7 +500,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -519,7 +516,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                 if (unlikely(wr->num_sge > srq->max_gs)) {
                         err = -EINVAL;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bea960b8191f..4ea1c1ca85bc 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -257,7 +257,7 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
 
 void ipoib_mcast_restart_task(void *dev_ptr);
 int ipoib_mcast_start_thread(struct net_device *dev);
-int ipoib_mcast_stop_thread(struct net_device *dev);
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush);
 
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index ef0e3894863c..f7440096b5ed 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -432,7 +432,7 @@ int ipoib_ib_dev_down(struct net_device *dev)
                 flush_workqueue(ipoib_workqueue);
         }
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /*
          * Flush the multicast groups first so we stop any multicast joins. The
@@ -599,7 +599,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
 
         ipoib_dbg(priv, "cleaning up ib_dev\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /* Delete the broadcast address and the local address */
         ipoib_mcast_dev_down(dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 49d120d2b92c..704f48e0b6a7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1005,6 +1005,7 @@ debug_failed:
 
 register_failed:
         ib_unregister_event_handler(&priv->event_handler);
+        flush_scheduled_work();
 
 event_failed:
         ipoib_dev_cleanup(priv->dev);
@@ -1057,6 +1058,7 @@ static void ipoib_remove_one(struct ib_device *device)
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
                 ib_unregister_event_handler(&priv->event_handler);
+                flush_scheduled_work();
 
                 unregister_netdev(priv->dev);
                 ipoib_dev_cleanup(priv->dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index aca7aea18a69..36ce29836bf2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -145,7 +145,7 @@ static struct ipoib_mcast *ipoib_mcast_alloc(struct net_device *dev,
 
         mcast->dev = dev;
         mcast->created = jiffies;
-        mcast->backoff = HZ;
+        mcast->backoff = 1;
         mcast->logcount = 0;
 
         INIT_LIST_HEAD(&mcast->list);
@@ -396,7 +396,7 @@ static void ipoib_mcast_join_complete(int status,
                         IPOIB_GID_ARG(mcast->mcmember.mgid), status);
 
         if (!status && !ipoib_mcast_join_finish(mcast, mcmember)) {
-                mcast->backoff = HZ;
+                mcast->backoff = 1;
                 down(&mcast_mutex);
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_work(ipoib_workqueue, &priv->mcast_task);
@@ -496,7 +496,7 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_delayed_work(ipoib_workqueue,
                                            &priv->mcast_task,
-                                           mcast->backoff);
+                                           mcast->backoff * HZ);
                 up(&mcast_mutex);
         } else
                 mcast->query_id = ret;
@@ -598,7 +598,7 @@ int ipoib_mcast_start_thread(struct net_device *dev)
         return 0;
 }
 
-int ipoib_mcast_stop_thread(struct net_device *dev)
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_mcast *mcast;
@@ -610,7 +610,8 @@ int ipoib_mcast_stop_thread(struct net_device *dev)
         cancel_delayed_work(&priv->mcast_task);
         up(&mcast_mutex);
 
-        flush_workqueue(ipoib_workqueue);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
 
         if (priv->broadcast && priv->broadcast->query) {
                 ib_sa_cancel_query(priv->broadcast->query_id, priv->broadcast->query);
@@ -832,7 +833,7 @@ void ipoib_mcast_restart_task(void *dev_ptr)
 
         ipoib_dbg_mcast(priv, "restarting multicast task\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 0);
 
         spin_lock_irqsave(&priv->lock, flags);