1 files changed, 16 insertions, 17 deletions

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 83a01dc0c4c1..0c28ed1eafa6 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -572,9 +572,13 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 			err = build_rdma_write(wqe, wr, &len16);
 			break;
 		case IB_WR_RDMA_READ:
+		case IB_WR_RDMA_READ_WITH_INV:
 			fw_opcode = FW_RI_RDMA_READ_WR;
 			swsqe->opcode = FW_RI_READ_REQ;
-			fw_flags = 0;
+			if (wr->opcode == IB_WR_RDMA_READ_WITH_INV)
+				fw_flags |= FW_RI_RDMA_READ_INVALIDATE;
+			else
+				fw_flags = 0;
 			err = build_rdma_read(wqe, wr, &len16);
 			if (err)
 				break;
@@ -588,6 +592,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 			err = build_fastreg(wqe, wr, &len16);
 			break;
 		case IB_WR_LOCAL_INV:
+			if (wr->send_flags & IB_SEND_FENCE)
+				fw_flags |= FW_RI_LOCAL_FENCE_FLAG;
 			fw_opcode = FW_RI_INV_LSTAG_WR;
 			swsqe->opcode = FW_RI_LOCAL_INV;
 			err = build_inv_stag(wqe, wr, &len16);
@@ -1339,7 +1345,6 @@ int c4iw_destroy_qp(struct ib_qp *ib_qp)
 	wait_event(qhp->wait, !qhp->ep);
 
 	remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
-	remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
 	atomic_dec(&qhp->refcnt);
 	wait_event(qhp->wait, !atomic_read(&qhp->refcnt));
 
@@ -1442,30 +1447,26 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 	if (ret)
 		goto err2;
 
-	ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.rq.qid);
-	if (ret)
-		goto err3;
-
 	if (udata) {
 		mm1 = kmalloc(sizeof *mm1, GFP_KERNEL);
 		if (!mm1) {
 			ret = -ENOMEM;
-			goto err4;
+			goto err3;
 		}
 		mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
 		if (!mm2) {
 			ret = -ENOMEM;
-			goto err5;
+			goto err4;
 		}
 		mm3 = kmalloc(sizeof *mm3, GFP_KERNEL);
 		if (!mm3) {
 			ret = -ENOMEM;
-			goto err6;
+			goto err5;
 		}
 		mm4 = kmalloc(sizeof *mm4, GFP_KERNEL);
 		if (!mm4) {
 			ret = -ENOMEM;
-			goto err7;
+			goto err6;
 		}
 
 		uresp.qid_mask = rhp->rdev.qpmask;
@@ -1487,7 +1488,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 		spin_unlock(&ucontext->mmap_lock);
 		ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
 		if (ret)
-			goto err8;
+			goto err7;
 		mm1->key = uresp.sq_key;
 		mm1->addr = virt_to_phys(qhp->wq.sq.queue);
 		mm1->len = PAGE_ALIGN(qhp->wq.sq.memsize);
@@ -1511,16 +1512,14 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 	     __func__, qhp, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
 	     qhp->wq.sq.qid);
 	return &qhp->ibqp;
-err8:
-	kfree(mm4);
 err7:
-	kfree(mm3);
+	kfree(mm4);
 err6:
-	kfree(mm2);
+	kfree(mm3);
 err5:
-	kfree(mm1);
+	kfree(mm2);
 err4:
-	remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
+	kfree(mm1);
 err3:
 	remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
 err2: