12 files changed, 92 insertions, 73 deletions

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index b10ade92efed..4df405157086 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3759,6 +3759,7 @@ static void cm_remove_one(struct ib_device *device)
                 port = cm_dev->port[i-1];
                 ib_modify_port(device, port->port_num, 0, &port_modify);
                 ib_unregister_mad_agent(port->mad_agent);
+                flush_workqueue(cm.wq);
                 cm_remove_port_fs(port);
         }
         kobject_put(&cm_dev->dev_obj);
@@ -3813,6 +3814,7 @@ static void __exit ib_cm_cleanup(void)
                 cancel_delayed_work(&timewait_info->work.work);
         spin_unlock_irq(&cm.lock);
 
+        ib_unregister_client(&cm_client);
         destroy_workqueue(cm.wq);
 
         list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
@@ -3820,7 +3822,6 @@ static void __exit ib_cm_cleanup(void)
                 kfree(timewait_info);
         }
 
-        ib_unregister_client(&cm_client);
         class_unregister(&cm_class);
         idr_destroy(&cm.local_id_table);
 }
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 7f00347364f7..06d502c06a4d 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -139,7 +139,7 @@ static inline struct ib_pool_fmr *ib_fmr_cache_lookup(struct ib_fmr_pool *pool,
 static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 {
         int                 ret;
-        struct ib_pool_fmr *fmr, *next;
+        struct ib_pool_fmr *fmr;
         LIST_HEAD(unmap_list);
         LIST_HEAD(fmr_list);
 
@@ -158,20 +158,6 @@ static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 #endif
         }
 
-        /*
-         * The free_list may hold FMRs that have been put there
-         * because they haven't reached the max_remap count.
-         * Invalidate their mapping as well.
-         */
-        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
-                if (fmr->remap_count == 0)
-                        continue;
-                hlist_del_init(&fmr->cache_node);
-                fmr->remap_count = 0;
-                list_add_tail(&fmr->fmr->list, &fmr_list);
-                list_move(&fmr->list, &unmap_list);
-        }
-
         list_splice(&pool->dirty_list, &unmap_list);
         INIT_LIST_HEAD(&pool->dirty_list);
         pool->dirty_len = 0;
@@ -384,6 +370,11 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
+                if (fmr->remap_count) {
+                        INIT_LIST_HEAD(&fmr_list);
+                        list_add_tail(&fmr->fmr->list, &fmr_list);
+                        ib_unmap_fmr(&fmr_list);
+                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);
@@ -407,8 +398,23 @@ EXPORT_SYMBOL(ib_destroy_fmr_pool);
  */
 int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
 {
-        int serial = atomic_inc_return(&pool->req_ser);
+        int serial;
+        struct ib_pool_fmr *fmr, *next;
+
+        /*
+         * The free_list holds FMRs that may have been used
+         * but have not been remapped enough times to be dirty.
+         * Put them on the dirty list now so that the cleanup
+         * thread will reap them too.
+         */
+        spin_lock_irq(&pool->pool_lock);
+        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
+                if (fmr->remap_count > 0)
+                        list_move(&fmr->list, &pool->dirty_list);
+        }
+        spin_unlock_irq(&pool->pool_lock);
 
+        serial = atomic_inc_return(&pool->req_ser);
         wake_up_process(pool->thread);
 
         if (wait_event_interruptible(pool->force_wait,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 223b1aa7d92b..81c9195b512a 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -839,6 +839,7 @@ static void cm_work_handler(struct work_struct *_work)
         unsigned long flags;
         int empty;
         int ret = 0;
+        int destroy_id;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         empty = list_empty(&cm_id_priv->work_list);
@@ -857,9 +858,9 @@ static void cm_work_handler(struct work_struct *_work)
                         destroy_cm_id(&cm_id_priv->id);
                 }
                 BUG_ON(atomic_read(&cm_id_priv->refcount)==0);
+                destroy_id = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
                 if (iwcm_deref_id(cm_id_priv)) {
-                        if (test_bit(IWCM_F_CALLBACK_DESTROY,
-                                     &cm_id_priv->flags)) {
+                        if (destroy_id) {
                                 BUG_ON(!list_empty(&cm_id_priv->work_list));
                                 free_cm_id(cm_id_priv);
                         }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
index 73bfd1656f86..b8797c66676d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_mem.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -136,14 +136,8 @@ int build_phys_page_list(struct ib_phys_buf *buffer_list,
 
         /* Find largest page shift we can use to cover buffers */
         for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
-                if (num_phys_buf > 1) {
-                        if ((1ULL << *shift) & mask)
-                                break;
-                } else
-                        if (1ULL << *shift >=
-                            buffer_list[0].size +
-                            (buffer_list[0].addr & ((1ULL << *shift) - 1)))
-                                break;
+                if ((1ULL << *shift) & mask)
+                        break;
 
         buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
         buffer_list[0].addr &= ~0ull << *shift;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index df1838f8f94d..b2ea9210467f 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -189,7 +189,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                 return ERR_PTR(-ENOMEM);
         }
         chp->rhp = rhp;
-        chp->ibcq.cqe = (1 << chp->cq.size_log2) - 1;
+        chp->ibcq.cqe = 1 << chp->cq.size_log2;
         spin_lock_init(&chp->lock);
         atomic_set(&chp->refcnt, 1);
         init_waitqueue_head(&chp->wait);
@@ -819,8 +819,11 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
                 kfree(qhp);
                 return ERR_PTR(-ENOMEM);
         }
+
         attrs->cap.max_recv_wr = rqsize - 1;
         attrs->cap.max_send_wr = sqsize;
+        attrs->cap.max_inline_data = T3_MAX_INLINE;
+
         qhp->rhp = rhp;
         qhp->attr.pd = php->pdid;
         qhp->attr.scq = ((struct iwch_cq *) attrs->send_cq)->cq.cqid;
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 7f8853b44ee1..b2112f5a422f 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -567,12 +567,12 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
 
         /* Init the adapter */
         nesdev->nesadapter = nes_init_adapter(nesdev, hw_rev);
-        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
         if (!nesdev->nesadapter) {
                 printk(KERN_ERR PFX "Unable to initialize adapter.\n");
                 ret = -ENOMEM;
                 goto bail5;
         }
+        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
 
         /* nesdev->base_doorbell_index =
                         nesdev->nesadapter->pd_config_base[PCI_FUNC(nesdev->pcidev->devfn)]; */
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index fd57e8a1582f..a48b288618ec 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -285,6 +285,21 @@ struct nes_device {
 };
 
 
+static inline __le32 get_crc_value(struct nes_v4_quad *nes_quad)
+{
+        u32 crc_value;
+        crc_value = crc32c(~0, (void *)nes_quad, sizeof (struct nes_v4_quad));
+
+        /*
+         * With commit ef19454b ("[LIB] crc32c: Keep intermediate crc
+         * state in cpu order"), behavior of crc32c changes on
+         * big-endian platforms.  Our algorithm expects the previous
+         * behavior; otherwise we have RDMA connection establishment
+         * issue on big-endian.
+         */
+        return cpu_to_le32(crc_value);
+}
+
 static inline void
 set_wqe_64bit_value(__le32 *wqe_words, u32 index, u64 value)
 {
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index bd5cfeaac203..39adb267fb15 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -370,11 +370,11 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
         int ret = 0;
         u32 was_timer_set;
 
+        if (!cm_node)
+                return -EINVAL;
         new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
         if (!new_send)
                 return -1;
-        if (!cm_node)
-                return -EINVAL;
 
         /* new_send->timetosend = currenttime */
         new_send->retrycount = NES_DEFAULT_RETRYS;
@@ -947,6 +947,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
                 nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);
 
                 kfree(listener);
+                listener = NULL;
                 ret = 0;
                 cm_listens_destroyed++;
         } else {
@@ -2319,6 +2320,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
@@ -2435,8 +2437,8 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         nes_quad.TcpPorts[1]   = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & adapter->hte_index_mask);
 
@@ -2750,6 +2752,7 @@ void cm_event_connected(struct nes_cm_event *event)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         /* get all our handles */
@@ -2827,8 +2830,8 @@ void cm_event_connected(struct nes_cm_event *event)
         nes_quad.TcpPorts[1] = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, After CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & nesadapter->hte_index_mask);
 
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 7c4c0fbf0abd..49e53e4c1ebe 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -156,15 +156,14 @@ static void nes_nic_tune_timer(struct nes_device *nesdev)
 
         spin_lock_irqsave(&nesadapter->periodic_timer_lock, flags);
 
-        if (shared_timer->cq_count_old < cq_count) {
-                if (cq_count > shared_timer->threshold_low)
-                        shared_timer->cq_direction_downward=0;
-        }
-        if (shared_timer->cq_count_old >= cq_count)
+        if (shared_timer->cq_count_old <= cq_count)
+                shared_timer->cq_direction_downward = 0;
+        else
                 shared_timer->cq_direction_downward++;
         shared_timer->cq_count_old = cq_count;
         if (shared_timer->cq_direction_downward > NES_NIC_CQ_DOWNWARD_TREND) {
-                if (cq_count <= shared_timer->threshold_low) {
+                if (cq_count <= shared_timer->threshold_low &&
+                    shared_timer->threshold_low > 4) {
                         shared_timer->threshold_low = shared_timer->threshold_low/2;
                         shared_timer->cq_direction_downward=0;
                         nesdev->currcq_count = 0;
@@ -1728,7 +1727,6 @@ int nes_napi_isr(struct nes_device *nesdev)
                         nesdev->int_req &= ~NES_INT_TIMER;
                         nes_write32(nesdev->regs+NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                        nesadapter->tune_timer.timer_in_use_old = 0;
                 }
                 nesdev->deepcq_count = 0;
                 return 1;
@@ -1867,7 +1865,6 @@ void nes_dpc(unsigned long param)
                                         nesdev->int_req &= ~NES_INT_TIMER;
                                         nes_write32(nesdev->regs + NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                                        nesdev->nesadapter->tune_timer.timer_in_use_old = 0;
                                 } else {
                                         nes_write32(nesdev->regs+NES_INT_MASK, 0x0000ffff|(~nesdev->int_req));
                                 }
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index 1e10df550c9e..b7e2844f096b 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -962,7 +962,7 @@ struct nes_arp_entry {
 #define DEFAULT_JUMBO_NES_QL_LOW    12
 #define DEFAULT_JUMBO_NES_QL_TARGET 40
 #define DEFAULT_JUMBO_NES_QL_HIGH   128
-#define NES_NIC_CQ_DOWNWARD_TREND   8
+#define NES_NIC_CQ_DOWNWARD_TREND   16
 
 struct nes_hw_tune_timer {
     //u16 cq_count;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4dafbe16e82a..a651e9d9f0ef 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -929,7 +929,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
                                 NES_MAX_USER_DB_REGIONS, nesucontext->first_free_db);
                 nes_debug(NES_DBG_PD, "find_first_zero_biton doorbells returned %u, mapping pd_id %u.\n",
                                 nespd->mmap_db_index, nespd->pd_id);
-                if (nespd->mmap_db_index > NES_MAX_USER_DB_REGIONS) {
+                if (nespd->mmap_db_index >= NES_MAX_USER_DB_REGIONS) {
                         nes_debug(NES_DBG_PD, "mmap_db_index > MAX\n");
                         nes_free_resource(nesadapter, nesadapter->allocated_pds, pd_num);
                         kfree(nespd);
@@ -1327,7 +1327,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                                                   (long long unsigned int)req.user_wqe_buffers);
                                                         nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
                                                         kfree(nesqp->allocated_buffer);
-                                                        return ERR_PTR(-ENOMEM);
+                                                        return ERR_PTR(-EFAULT);
                                                 }
                                         }
 
@@ -1674,6 +1674,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 }
                 nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
                                 (unsigned long)req.user_cq_buffer, entries);
+                err = 1;
                 list_for_each_entry(nespbl, &nes_ucontext->cq_reg_mem_list, list) {
                         if (nespbl->user_base == (unsigned long )req.user_cq_buffer) {
                                 list_del(&nespbl->list);
@@ -1686,7 +1687,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 if (err) {
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                         kfree(nescq);
-                        return ERR_PTR(err);
+                        return ERR_PTR(-EFAULT);
                 }
 
                 pbl_entries = nespbl->pbl_size >> 3;
@@ -1831,9 +1832,6 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
                         }
                 }
-                nes_debug(NES_DBG_CQ, "iWARP CQ%u create timeout expired, major code = 0x%04X,"
-                                " minor code = 0x%04X\n",
-                                nescq->hw_cq.cq_number, cqp_request->major_code, cqp_request->minor_code);
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 714b8db02b29..993f0a8ff28f 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -237,36 +237,32 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
 static
 struct iser_device *iser_device_find_by_ib_device(struct rdma_cm_id *cma_id)
 {
-        struct list_head    *p_list;
-        struct iser_device  *device = NULL;
+        struct iser_device *device;
 
         mutex_lock(&ig.device_list_mutex);
 
-        p_list = ig.device_list.next;
-        while (p_list != &ig.device_list) {
-                device = list_entry(p_list, struct iser_device, ig_list);
+        list_for_each_entry(device, &ig.device_list, ig_list)
                 /* find if there's a match using the node GUID */
                 if (device->ib_device->node_guid == cma_id->device->node_guid)
-                        break;
-        }
+                        goto inc_refcnt;
 
-        if (device == NULL) {
-                device = kzalloc(sizeof *device, GFP_KERNEL);
-                if (device == NULL)
-                        goto out;
-                /* assign this device to the device */
-                device->ib_device = cma_id->device;
-                /* init the device and link it into ig device list */
-                if (iser_create_device_ib_res(device)) {
-                        kfree(device);
-                        device = NULL;
-                        goto out;
-                }
-                list_add(&device->ig_list, &ig.device_list);
+        device = kzalloc(sizeof *device, GFP_KERNEL);
+        if (device == NULL)
+                goto out;
+
+        /* assign this device to the device */
+        device->ib_device = cma_id->device;
+        /* init the device and link it into ig device list */
+        if (iser_create_device_ib_res(device)) {
+                kfree(device);
+                device = NULL;
+                goto out;
         }
-out:
-        BUG_ON(device == NULL);
+        list_add(&device->ig_list, &ig.device_list);
+
+inc_refcnt:
         device->refcount++;
+out:
         mutex_unlock(&ig.device_list_mutex);
         return device;
 }
@@ -372,6 +368,12 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         int    ret;
 
         device = iser_device_find_by_ib_device(cma_id);
+        if (!device) {
+                iser_err("device lookup/creation failed\n");
+                iser_connect_error(cma_id);
+                return;
+        }
+
         ib_conn = (struct iser_conn *)cma_id->context;
         ib_conn->device = device;
 
@@ -380,7 +382,6 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
                 iser_err("resolve route failed: %d\n", ret);
                 iser_connect_error(cma_id);
         }
-        return;
 }
 
 static void iser_route_handler(struct rdma_cm_id *cma_id)