Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull first round of SCSI updates from James Bottomley:
 "The patch set is mostly driver updates (bnx2fc, ipr, lpfc, qla4) and a
  few bug fixes"

Pull delayed because google hates James, and sneakily considers his pull
requests spam. Why, google, why?

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (60 commits)
  [SCSI] aacraid: 1024 max outstanding command support for Series 7 and above
  [SCSI] bnx2fc: adjust duplicate test
  [SCSI] qla4xxx: Update driver version to 5.03.00-k4
  [SCSI] qla4xxx: Fix return code for qla4xxx_session_get_param.
  [SCSI] qla4xxx: wait for boot target login response during probe.
  [SCSI] qla4xxx: Added support for force firmware dump
  [SCSI] qla4xxx: Re-register IRQ handler while retrying initialize of adapter
  [SCSI] qla4xxx: Throttle active IOCBs to firmware limits
  [SCSI] qla4xxx: Remove unnecessary code from qla4xxx_init_local_data
  [SCSI] qla4xxx: Quiesce driver activities while loopback
  [SCSI] qla4xxx: Rename MBOX_ASTS_IDC_NOTIFY to MBOX_ASTS_IDC_REQUEST_NOTIFICATION
  [SCSI] qla4xxx: Add spurious interrupt messages under debug level 2
  [SCSI] cxgb4i: Remove the scsi host device when removing device
  [SCSI] bfa: fix strncpy() limiter in bfad_start_ops()
  [SCSI] qla4xxx: Update driver version to 5.03.00-k3
  [SCSI] qla4xxx: Correct the validation to check in get_sys_info mailbox
  [SCSI] qla4xxx: Pass correct function param to qla4_8xxx_rd_direct
  [SCSI] lpfc 8.3.37: Update lpfc version for 8.3.37 driver release
  [SCSI] lpfc 8.3.37: Fixed infinite loop in lpfc_sli4_fcf_rr_next_index_get.
  [SCSI] lpfc 8.3.37: Fixed crash due to SLI Port invalid resource count
  ...

13 files changed, 657 insertions, 328 deletions

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index df4c13a5534c..7706c99ec8bb 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -466,11 +466,13 @@ enum intr_type_t {
         MSIX,
 };
 
+#define LPFC_CT_CTX_MAX         64
 struct unsol_rcv_ct_ctx {
         uint32_t ctxt_id;
         uint32_t SID;
-        uint32_t flags;
-#define UNSOL_VALID     0x00000001
+        uint32_t valid;
+#define UNSOL_INVALID           0
+#define UNSOL_VALID             1
         uint16_t oxid;
         uint16_t rxid;
 };
@@ -750,6 +752,15 @@ struct lpfc_hba {
         void __iomem *ctrl_regs_memmap_p;/* Kernel memory mapped address for
                                             PCI BAR2 */
 
+        void __iomem *pci_bar0_memmap_p; /* Kernel memory mapped address for
+                                            PCI BAR0 with dual-ULP support */
+        void __iomem *pci_bar2_memmap_p; /* Kernel memory mapped address for
+                                            PCI BAR2 with dual-ULP support */
+        void __iomem *pci_bar4_memmap_p; /* Kernel memory mapped address for
+                                            PCI BAR4 with dual-ULP support */
+#define PCI_64BIT_BAR0  0
+#define PCI_64BIT_BAR2  2
+#define PCI_64BIT_BAR4  4
         void __iomem *MBslimaddr;       /* virtual address for mbox cmds */
         void __iomem *HAregaddr;        /* virtual address for host attn reg */
         void __iomem *CAregaddr;        /* virtual address for chip attn reg */
@@ -938,7 +949,7 @@ struct lpfc_hba {
 
         spinlock_t ct_ev_lock; /* synchronize access to ct_ev_waiters */
         struct list_head ct_ev_waiters;
-        struct unsol_rcv_ct_ctx ct_ctx[64];
+        struct unsol_rcv_ct_ctx ct_ctx[LPFC_CT_CTX_MAX];
         uint32_t ctx_idx;
 
         uint8_t menlo_flag;     /* menlo generic flags */
diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index f7368eb80415..32d5683e6181 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -955,9 +955,9 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 spin_lock_irqsave(&phba->ct_ev_lock, flags);
                 if (phba->sli_rev == LPFC_SLI_REV4) {
                         evt_dat->immed_dat = phba->ctx_idx;
-                        phba->ctx_idx = (phba->ctx_idx + 1) % 64;
+                        phba->ctx_idx = (phba->ctx_idx + 1) % LPFC_CT_CTX_MAX;
                         /* Provide warning for over-run of the ct_ctx array */
-                        if (phba->ct_ctx[evt_dat->immed_dat].flags &
+                        if (phba->ct_ctx[evt_dat->immed_dat].valid ==
                             UNSOL_VALID)
                                 lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
                                                 "2717 CT context array entry "
@@ -973,7 +973,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                                 piocbq->iocb.unsli3.rcvsli3.ox_id;
                         phba->ct_ctx[evt_dat->immed_dat].SID =
                                 piocbq->iocb.un.rcvels.remoteID;
-                        phba->ct_ctx[evt_dat->immed_dat].flags = UNSOL_VALID;
+                        phba->ct_ctx[evt_dat->immed_dat].valid = UNSOL_VALID;
                 } else
                         evt_dat->immed_dat = piocbq->iocb.ulpContext;
 
@@ -1013,6 +1013,47 @@ error_ct_unsol_exit:
 }
 
 /**
+ * lpfc_bsg_ct_unsol_abort - handler ct abort to management plane
+ * @phba: Pointer to HBA context object.
+ * @dmabuf: pointer to a dmabuf that describes the FC sequence
+ *
+ * This function handles abort to the CT command toward management plane
+ * for SLI4 port.
+ *
+ * If the pending context of a CT command to management plane present, clears
+ * such context and returns 1 for handled; otherwise, it returns 0 indicating
+ * no context exists.
+ **/
+int
+lpfc_bsg_ct_unsol_abort(struct lpfc_hba *phba, struct hbq_dmabuf *dmabuf)
+{
+        struct fc_frame_header fc_hdr;
+        struct fc_frame_header *fc_hdr_ptr = &fc_hdr;
+        int ctx_idx, handled = 0;
+        uint16_t oxid, rxid;
+        uint32_t sid;
+
+        memcpy(fc_hdr_ptr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
+        sid = sli4_sid_from_fc_hdr(fc_hdr_ptr);
+        oxid = be16_to_cpu(fc_hdr_ptr->fh_ox_id);
+        rxid = be16_to_cpu(fc_hdr_ptr->fh_rx_id);
+
+        for (ctx_idx = 0; ctx_idx < LPFC_CT_CTX_MAX; ctx_idx++) {
+                if (phba->ct_ctx[ctx_idx].valid != UNSOL_VALID)
+                        continue;
+                if (phba->ct_ctx[ctx_idx].rxid != rxid)
+                        continue;
+                if (phba->ct_ctx[ctx_idx].oxid != oxid)
+                        continue;
+                if (phba->ct_ctx[ctx_idx].SID != sid)
+                        continue;
+                phba->ct_ctx[ctx_idx].valid = UNSOL_INVALID;
+                handled = 1;
+        }
+        return handled;
+}
+
+/**
  * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
  * @job: SET_EVENT fc_bsg_job
  **/
@@ -1318,7 +1359,7 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
         icmd->ulpClass = CLASS3;
         if (phba->sli_rev == LPFC_SLI_REV4) {
                 /* Do not issue unsol response if oxid not marked as valid */
-                if (!(phba->ct_ctx[tag].flags & UNSOL_VALID)) {
+                if (phba->ct_ctx[tag].valid != UNSOL_VALID) {
                         rc = IOCB_ERROR;
                         goto issue_ct_rsp_exit;
                 }
@@ -1352,7 +1393,7 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
                                 phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
 
                 /* The exchange is done, mark the entry as invalid */
-                phba->ct_ctx[tag].flags &= ~UNSOL_VALID;
+                phba->ct_ctx[tag].valid = UNSOL_INVALID;
         } else
                 icmd->ulpContext = (ushort) tag;
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 69d66e3662cb..76ca65dae781 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -164,8 +164,7 @@ void lpfc_hb_timeout_handler(struct lpfc_hba *);
 
 void lpfc_ct_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *,
                          struct lpfc_iocbq *);
-void lpfc_sli4_ct_abort_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *,
-                                    struct lpfc_iocbq *);
+int lpfc_ct_handle_unsol_abort(struct lpfc_hba *, struct hbq_dmabuf *);
 int lpfc_ns_cmd(struct lpfc_vport *, int, uint8_t, uint32_t);
 int lpfc_fdmi_cmd(struct lpfc_vport *, struct lpfc_nodelist *, int);
 void lpfc_fdmi_tmo(unsigned long);
@@ -427,6 +426,7 @@ int lpfc_bsg_request(struct fc_bsg_job *);
 int lpfc_bsg_timeout(struct fc_bsg_job *);
 int lpfc_bsg_ct_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *,
                              struct lpfc_iocbq *);
+int lpfc_bsg_ct_unsol_abort(struct lpfc_hba *, struct hbq_dmabuf *);
 void __lpfc_sli_ringtx_put(struct lpfc_hba *, struct lpfc_sli_ring *,
         struct lpfc_iocbq *);
 struct lpfc_iocbq *lpfc_sli_ringtx_get(struct lpfc_hba *,
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 65f9fb6862e6..7bff3a19af56 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -164,37 +164,24 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli4_ct_abort_unsol_event - Default handle for sli4 unsol abort
+ * lpfc_ct_handle_unsol_abort - ct upper level protocol abort handler
  * @phba: Pointer to HBA context object.
- * @pring: Pointer to the driver internal I/O ring.
- * @piocbq: Pointer to the IOCBQ.
+ * @dmabuf: pointer to a dmabuf that describes the FC sequence
  *
- * This function serves as the default handler for the sli4 unsolicited
- * abort event. It shall be invoked when there is no application interface
- * registered unsolicited abort handler. This handler does nothing but
- * just simply releases the dma buffer used by the unsol abort event.
+ * This function serves as the upper level protocol abort handler for CT
+ * protocol.
+ *
+ * Return 1 if abort has been handled, 0 otherwise.
  **/
-void
-lpfc_sli4_ct_abort_unsol_event(struct lpfc_hba *phba,
-                               struct lpfc_sli_ring *pring,
-                               struct lpfc_iocbq *piocbq)
+int
+lpfc_ct_handle_unsol_abort(struct lpfc_hba *phba, struct hbq_dmabuf *dmabuf)
 {
-        IOCB_t *icmd = &piocbq->iocb;
-        struct lpfc_dmabuf *bdeBuf;
-        uint32_t size;
+        int handled;
 
-        /* Forward abort event to any process registered to receive ct event */
-        if (lpfc_bsg_ct_unsol_event(phba, pring, piocbq) == 0)
-                return;
+        /* CT upper level goes through BSG */
+        handled = lpfc_bsg_ct_unsol_abort(phba, dmabuf);
 
-        /* If there is no BDE associated with IOCB, there is nothing to do */
-        if (icmd->ulpBdeCount == 0)
-                return;
-        bdeBuf = piocbq->context2;
-        piocbq->context2 = NULL;
-        size  = icmd->un.cont64[0].tus.f.bdeSize;
-        lpfc_ct_unsol_buffer(phba, piocbq, bdeBuf, size);
-        lpfc_in_buf_free(phba, bdeBuf);
+        return handled;
 }
 
 static void
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index b9440deaad45..08d156a9094f 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -3122,6 +3122,13 @@ lpfc_els_retry(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
                 case IOERR_SEQUENCE_TIMEOUT:
                 case IOERR_INVALID_RPI:
+                        if (cmd == ELS_CMD_PLOGI &&
+                            did == NameServer_DID) {
+                                /* Continue forever if plogi to */
+                                /* the nameserver fails */
+                                maxretry = 0;
+                                delay = 100;
+                        }
                         retry = 1;
                         break;
                 }
@@ -6517,7 +6524,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
         struct lpfc_nodelist *ndlp;
         struct ls_rjt stat;
         uint32_t *payload;
-        uint32_t cmd, did, newnode, rjt_err = 0;
+        uint32_t cmd, did, newnode;
+        uint8_t rjt_exp, rjt_err = 0;
         IOCB_t *icmd = &elsiocb->iocb;
 
         if (!vport || !(elsiocb->context2))
@@ -6606,12 +6614,14 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 /* If Nport discovery is delayed, reject PLOGIs */
                 if (vport->fc_flag & FC_DISC_DELAYED) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         if (!(phba->pport->fc_flag & FC_PT2PT) ||
                                 (phba->pport->fc_flag & FC_PT2PT_PLOGI)) {
                                 rjt_err = LSRJT_UNABLE_TPC;
+                                rjt_exp = LSEXP_NOTHING_MORE;
                                 break;
                         }
                         /* We get here, and drop thru, if we are PT2PT with
@@ -6648,6 +6658,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 lpfc_send_els_event(vport, ndlp, payload);
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 lpfc_disc_state_machine(vport, ndlp, elsiocb, NLP_EVT_RCV_LOGO);
@@ -6661,6 +6672,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 lpfc_send_els_event(vport, ndlp, payload);
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 lpfc_disc_state_machine(vport, ndlp, elsiocb, NLP_EVT_RCV_PRLO);
@@ -6680,6 +6692,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 phba->fc_stat.elsRcvADISC++;
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 lpfc_disc_state_machine(vport, ndlp, elsiocb,
@@ -6693,6 +6706,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 phba->fc_stat.elsRcvPDISC++;
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 lpfc_disc_state_machine(vport, ndlp, elsiocb,
@@ -6730,6 +6744,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 phba->fc_stat.elsRcvPRLI++;
                 if (vport->port_state < LPFC_DISC_AUTH) {
                         rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_NOTHING_MORE;
                         break;
                 }
                 lpfc_disc_state_machine(vport, ndlp, elsiocb, NLP_EVT_RCV_PRLI);
@@ -6813,6 +6828,11 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 if (newnode)
                         lpfc_nlp_put(ndlp);
                 break;
+        case ELS_CMD_REC:
+                        /* receive this due to exchange closed */
+                        rjt_err = LSRJT_UNABLE_TPC;
+                        rjt_exp = LSEXP_INVALID_OX_RX;
+                break;
         default:
                 lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_UNSOL,
                         "RCV ELS cmd:     cmd:x%x did:x%x/ste:x%x",
@@ -6820,6 +6840,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 
                 /* Unsupported ELS command, reject */
                 rjt_err = LSRJT_CMD_UNSUPPORTED;
+                rjt_exp = LSEXP_NOTHING_MORE;
 
                 /* Unknown ELS command <elsCmd> received from NPORT <did> */
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
@@ -6834,7 +6855,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
         if (rjt_err) {
                 memset(&stat, 0, sizeof(stat));
                 stat.un.b.lsRjtRsnCode = rjt_err;
-                stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE;
+                stat.un.b.lsRjtRsnCodeExp = rjt_exp;
                 lpfc_els_rsp_reject(vport, stat.un.lsRjtError, elsiocb, ndlp,
                         NULL);
         }
diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
index 7398ca862e97..e8c476031703 100644
--- a/drivers/scsi/lpfc/lpfc_hw.h
+++ b/drivers/scsi/lpfc/lpfc_hw.h
@@ -538,6 +538,7 @@ struct fc_vft_header {
 #define ELS_CMD_ECHO      0x10000000
 #define ELS_CMD_TEST      0x11000000
 #define ELS_CMD_RRQ       0x12000000
+#define ELS_CMD_REC       0x13000000
 #define ELS_CMD_PRLI      0x20100014
 #define ELS_CMD_PRLO      0x21100014
 #define ELS_CMD_PRLO_ACC  0x02100014
@@ -574,6 +575,7 @@ struct fc_vft_header {
 #define ELS_CMD_ECHO      0x10
 #define ELS_CMD_TEST      0x11
 #define ELS_CMD_RRQ       0x12
+#define ELS_CMD_REC       0x13
 #define ELS_CMD_PRLI      0x14001020
 #define ELS_CMD_PRLO      0x14001021
 #define ELS_CMD_PRLO_ACC  0x14001002
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index a47cfbdd05f2..6e93b886cd4d 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -106,6 +106,7 @@ struct lpfc_sli_intf {
 
 #define LPFC_SLI4_MB_WORD_COUNT         64
 #define LPFC_MAX_MQ_PAGE                8
+#define LPFC_MAX_WQ_PAGE_V0             4
 #define LPFC_MAX_WQ_PAGE                8
 #define LPFC_MAX_CQ_PAGE                4
 #define LPFC_MAX_EQ_PAGE                8
@@ -703,24 +704,41 @@ struct lpfc_register {
  * BAR0.  The offsets are the same so the driver must account for
  * any base address difference.
  */
-#define LPFC_RQ_DOORBELL                0x00A0
-#define lpfc_rq_doorbell_num_posted_SHIFT       16
-#define lpfc_rq_doorbell_num_posted_MASK        0x3FFF
-#define lpfc_rq_doorbell_num_posted_WORD        word0
-#define lpfc_rq_doorbell_id_SHIFT               0
-#define lpfc_rq_doorbell_id_MASK                0xFFFF
-#define lpfc_rq_doorbell_id_WORD                word0
-
-#define LPFC_WQ_DOORBELL                0x0040
-#define lpfc_wq_doorbell_num_posted_SHIFT       24
-#define lpfc_wq_doorbell_num_posted_MASK        0x00FF
-#define lpfc_wq_doorbell_num_posted_WORD        word0
-#define lpfc_wq_doorbell_index_SHIFT            16
-#define lpfc_wq_doorbell_index_MASK             0x00FF
-#define lpfc_wq_doorbell_index_WORD             word0
-#define lpfc_wq_doorbell_id_SHIFT               0
-#define lpfc_wq_doorbell_id_MASK                0xFFFF
-#define lpfc_wq_doorbell_id_WORD                word0
+#define LPFC_ULP0_RQ_DOORBELL           0x00A0
+#define LPFC_ULP1_RQ_DOORBELL           0x00C0
+#define lpfc_rq_db_list_fm_num_posted_SHIFT     24
+#define lpfc_rq_db_list_fm_num_posted_MASK      0x00FF
+#define lpfc_rq_db_list_fm_num_posted_WORD      word0
+#define lpfc_rq_db_list_fm_index_SHIFT          16
+#define lpfc_rq_db_list_fm_index_MASK           0x00FF
+#define lpfc_rq_db_list_fm_index_WORD           word0
+#define lpfc_rq_db_list_fm_id_SHIFT             0
+#define lpfc_rq_db_list_fm_id_MASK              0xFFFF
+#define lpfc_rq_db_list_fm_id_WORD              word0
+#define lpfc_rq_db_ring_fm_num_posted_SHIFT     16
+#define lpfc_rq_db_ring_fm_num_posted_MASK      0x3FFF
+#define lpfc_rq_db_ring_fm_num_posted_WORD      word0
+#define lpfc_rq_db_ring_fm_id_SHIFT             0
+#define lpfc_rq_db_ring_fm_id_MASK              0xFFFF
+#define lpfc_rq_db_ring_fm_id_WORD              word0
+
+#define LPFC_ULP0_WQ_DOORBELL           0x0040
+#define LPFC_ULP1_WQ_DOORBELL           0x0060
+#define lpfc_wq_db_list_fm_num_posted_SHIFT     24
+#define lpfc_wq_db_list_fm_num_posted_MASK      0x00FF
+#define lpfc_wq_db_list_fm_num_posted_WORD      word0
+#define lpfc_wq_db_list_fm_index_SHIFT          16
+#define lpfc_wq_db_list_fm_index_MASK           0x00FF
+#define lpfc_wq_db_list_fm_index_WORD           word0
+#define lpfc_wq_db_list_fm_id_SHIFT             0
+#define lpfc_wq_db_list_fm_id_MASK              0xFFFF
+#define lpfc_wq_db_list_fm_id_WORD              word0
+#define lpfc_wq_db_ring_fm_num_posted_SHIFT     16
+#define lpfc_wq_db_ring_fm_num_posted_MASK      0x3FFF
+#define lpfc_wq_db_ring_fm_num_posted_WORD      word0
+#define lpfc_wq_db_ring_fm_id_SHIFT             0
+#define lpfc_wq_db_ring_fm_id_MASK              0xFFFF
+#define lpfc_wq_db_ring_fm_id_WORD              word0
 
 #define LPFC_EQCQ_DOORBELL              0x0120
 #define lpfc_eqcq_doorbell_se_SHIFT             31
@@ -1131,12 +1149,22 @@ struct lpfc_mbx_wq_create {
                 struct {        /* Version 0 Request */
                         uint32_t word0;
 #define lpfc_mbx_wq_create_num_pages_SHIFT      0
-#define lpfc_mbx_wq_create_num_pages_MASK       0x0000FFFF
+#define lpfc_mbx_wq_create_num_pages_MASK       0x000000FF
 #define lpfc_mbx_wq_create_num_pages_WORD       word0
+#define lpfc_mbx_wq_create_dua_SHIFT            8
+#define lpfc_mbx_wq_create_dua_MASK             0x00000001
+#define lpfc_mbx_wq_create_dua_WORD             word0
 #define lpfc_mbx_wq_create_cq_id_SHIFT          16
 #define lpfc_mbx_wq_create_cq_id_MASK           0x0000FFFF
 #define lpfc_mbx_wq_create_cq_id_WORD           word0
-                        struct dma_address page[LPFC_MAX_WQ_PAGE];
+                        struct dma_address page[LPFC_MAX_WQ_PAGE_V0];
+                        uint32_t word9;
+#define lpfc_mbx_wq_create_bua_SHIFT            0
+#define lpfc_mbx_wq_create_bua_MASK             0x00000001
+#define lpfc_mbx_wq_create_bua_WORD             word9
+#define lpfc_mbx_wq_create_ulp_num_SHIFT        8
+#define lpfc_mbx_wq_create_ulp_num_MASK         0x000000FF
+#define lpfc_mbx_wq_create_ulp_num_WORD         word9
                 } request;
                 struct {        /* Version 1 Request */
                         uint32_t word0; /* Word 0 is the same as in v0 */
@@ -1160,6 +1188,17 @@ struct lpfc_mbx_wq_create {
 #define lpfc_mbx_wq_create_q_id_SHIFT   0
 #define lpfc_mbx_wq_create_q_id_MASK    0x0000FFFF
 #define lpfc_mbx_wq_create_q_id_WORD    word0
+                        uint32_t doorbell_offset;
+                        uint32_t word2;
+#define lpfc_mbx_wq_create_bar_set_SHIFT        0
+#define lpfc_mbx_wq_create_bar_set_MASK         0x0000FFFF
+#define lpfc_mbx_wq_create_bar_set_WORD         word2
+#define WQ_PCI_BAR_0_AND_1      0x00
+#define WQ_PCI_BAR_2_AND_3      0x01
+#define WQ_PCI_BAR_4_AND_5      0x02
+#define lpfc_mbx_wq_create_db_format_SHIFT      16
+#define lpfc_mbx_wq_create_db_format_MASK       0x0000FFFF
+#define lpfc_mbx_wq_create_db_format_WORD       word2
                 } response;
         } u;
 };
@@ -1223,14 +1262,31 @@ struct lpfc_mbx_rq_create {
 #define lpfc_mbx_rq_create_num_pages_SHIFT      0
 #define lpfc_mbx_rq_create_num_pages_MASK       0x0000FFFF
 #define lpfc_mbx_rq_create_num_pages_WORD       word0
+#define lpfc_mbx_rq_create_dua_SHIFT            16
+#define lpfc_mbx_rq_create_dua_MASK             0x00000001
+#define lpfc_mbx_rq_create_dua_WORD             word0
+#define lpfc_mbx_rq_create_bqu_SHIFT            17
+#define lpfc_mbx_rq_create_bqu_MASK             0x00000001
+#define lpfc_mbx_rq_create_bqu_WORD             word0
+#define lpfc_mbx_rq_create_ulp_num_SHIFT        24
+#define lpfc_mbx_rq_create_ulp_num_MASK         0x000000FF
+#define lpfc_mbx_rq_create_ulp_num_WORD         word0
                         struct rq_context context;
                         struct dma_address page[LPFC_MAX_WQ_PAGE];
                 } request;
                 struct {
                         uint32_t word0;
-#define lpfc_mbx_rq_create_q_id_SHIFT   0
-#define lpfc_mbx_rq_create_q_id_MASK    0x0000FFFF
-#define lpfc_mbx_rq_create_q_id_WORD    word0
+#define lpfc_mbx_rq_create_q_id_SHIFT           0
+#define lpfc_mbx_rq_create_q_id_MASK            0x0000FFFF
+#define lpfc_mbx_rq_create_q_id_WORD            word0
+                        uint32_t doorbell_offset;
+                        uint32_t word2;
+#define lpfc_mbx_rq_create_bar_set_SHIFT        0
+#define lpfc_mbx_rq_create_bar_set_MASK         0x0000FFFF
+#define lpfc_mbx_rq_create_bar_set_WORD         word2
+#define lpfc_mbx_rq_create_db_format_SHIFT      16
+#define lpfc_mbx_rq_create_db_format_MASK       0x0000FFFF
+#define lpfc_mbx_rq_create_db_format_WORD       word2
                 } response;
         } u;
 };
@@ -1388,6 +1444,33 @@ struct lpfc_mbx_get_rsrc_extent_info {
         } u;
 };
 
+struct lpfc_mbx_query_fw_config {
+        struct mbox_header header;
+        struct {
+                uint32_t config_number;
+#define LPFC_FC_FCOE            0x00000007
+                uint32_t asic_revision;
+                uint32_t physical_port;
+                uint32_t function_mode;
+#define LPFC_FCOE_INI_MODE      0x00000040
+#define LPFC_FCOE_TGT_MODE      0x00000080
+#define LPFC_DUA_MODE           0x00000800
+                uint32_t ulp0_mode;
+#define LPFC_ULP_FCOE_INIT_MODE 0x00000040
+#define LPFC_ULP_FCOE_TGT_MODE  0x00000080
+                uint32_t ulp0_nap_words[12];
+                uint32_t ulp1_mode;
+                uint32_t ulp1_nap_words[12];
+                uint32_t function_capabilities;
+                uint32_t cqid_base;
+                uint32_t cqid_tot;
+                uint32_t eqid_base;
+                uint32_t eqid_tot;
+                uint32_t ulp0_nap2_words[2];
+                uint32_t ulp1_nap2_words[2];
+        } rsp;
+};
+
 struct lpfc_id_range {
         uint32_t word5;
 #define lpfc_mbx_rsrc_id_word4_0_SHIFT  0
@@ -1803,51 +1886,6 @@ struct lpfc_mbx_redisc_fcf_tbl {
 #define lpfc_mbx_redisc_fcf_index_WORD          word12
 };
 
-struct lpfc_mbx_query_fw_cfg {
-        struct mbox_header header;
-        uint32_t config_number;
-        uint32_t asic_rev;
-        uint32_t phys_port;
-        uint32_t function_mode;
-/* firmware Function Mode */
-#define lpfc_function_mode_toe_SHIFT            0
-#define lpfc_function_mode_toe_MASK             0x00000001
-#define lpfc_function_mode_toe_WORD             function_mode
-#define lpfc_function_mode_nic_SHIFT            1
-#define lpfc_function_mode_nic_MASK             0x00000001
-#define lpfc_function_mode_nic_WORD             function_mode
-#define lpfc_function_mode_rdma_SHIFT           2
-#define lpfc_function_mode_rdma_MASK            0x00000001
-#define lpfc_function_mode_rdma_WORD            function_mode
-#define lpfc_function_mode_vm_SHIFT             3
-#define lpfc_function_mode_vm_MASK              0x00000001
-#define lpfc_function_mode_vm_WORD              function_mode
-#define lpfc_function_mode_iscsi_i_SHIFT        4
-#define lpfc_function_mode_iscsi_i_MASK         0x00000001
-#define lpfc_function_mode_iscsi_i_WORD         function_mode
-#define lpfc_function_mode_iscsi_t_SHIFT        5
-#define lpfc_function_mode_iscsi_t_MASK         0x00000001
-#define lpfc_function_mode_iscsi_t_WORD         function_mode
-#define lpfc_function_mode_fcoe_i_SHIFT         6
-#define lpfc_function_mode_fcoe_i_MASK          0x00000001
-#define lpfc_function_mode_fcoe_i_WORD          function_mode
-#define lpfc_function_mode_fcoe_t_SHIFT         7
-#define lpfc_function_mode_fcoe_t_MASK          0x00000001
-#define lpfc_function_mode_fcoe_t_WORD          function_mode
-#define lpfc_function_mode_dal_SHIFT            8
-#define lpfc_function_mode_dal_MASK             0x00000001
-#define lpfc_function_mode_dal_WORD             function_mode
-#define lpfc_function_mode_lro_SHIFT            9
-#define lpfc_function_mode_lro_MASK             0x00000001
-#define lpfc_function_mode_lro_WORD             function_mode
-#define lpfc_function_mode_flex10_SHIFT         10
-#define lpfc_function_mode_flex10_MASK          0x00000001
-#define lpfc_function_mode_flex10_WORD          function_mode
-#define lpfc_function_mode_ncsi_SHIFT           11
-#define lpfc_function_mode_ncsi_MASK            0x00000001
-#define lpfc_function_mode_ncsi_WORD            function_mode
-};
-
 /* Status field for embedded SLI_CONFIG mailbox command */
 #define STATUS_SUCCESS                                  0x0
 #define STATUS_FAILED                                   0x1
@@ -2965,7 +3003,7 @@ struct lpfc_mqe {
                 struct lpfc_mbx_read_config rd_config;
                 struct lpfc_mbx_request_features req_ftrs;
                 struct lpfc_mbx_post_hdr_tmpl hdr_tmpl;
-                struct lpfc_mbx_query_fw_cfg query_fw_cfg;
+                struct lpfc_mbx_query_fw_config query_fw_cfg;
                 struct lpfc_mbx_supp_pages supp_pages;
                 struct lpfc_mbx_pc_sli4_params sli4_params;
                 struct lpfc_mbx_get_sli4_parameters get_sli4_parameters;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7de4ef14698f..314b4f61b9e3 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6229,9 +6229,11 @@ lpfc_sli4_bar0_register_memmap(struct lpfc_hba *phba, uint32_t if_type)
                         phba->sli4_hba.conf_regs_memmap_p +
                                                 LPFC_CTL_PORT_SEM_OFFSET;
                 phba->sli4_hba.RQDBregaddr =
-                        phba->sli4_hba.conf_regs_memmap_p + LPFC_RQ_DOORBELL;
+                        phba->sli4_hba.conf_regs_memmap_p +
+                                                LPFC_ULP0_RQ_DOORBELL;
                 phba->sli4_hba.WQDBregaddr =
-                        phba->sli4_hba.conf_regs_memmap_p + LPFC_WQ_DOORBELL;
+                        phba->sli4_hba.conf_regs_memmap_p +
+                                                LPFC_ULP0_WQ_DOORBELL;
                 phba->sli4_hba.EQCQDBregaddr =
                         phba->sli4_hba.conf_regs_memmap_p + LPFC_EQCQ_DOORBELL;
                 phba->sli4_hba.MQDBregaddr =
@@ -6285,9 +6287,11 @@ lpfc_sli4_bar2_register_memmap(struct lpfc_hba *phba, uint32_t vf)
                 return -ENODEV;
 
         phba->sli4_hba.RQDBregaddr = (phba->sli4_hba.drbl_regs_memmap_p +
-                                vf * LPFC_VFR_PAGE_SIZE + LPFC_RQ_DOORBELL);
+                                vf * LPFC_VFR_PAGE_SIZE +
+                                        LPFC_ULP0_RQ_DOORBELL);
         phba->sli4_hba.WQDBregaddr = (phba->sli4_hba.drbl_regs_memmap_p +
-                                vf * LPFC_VFR_PAGE_SIZE + LPFC_WQ_DOORBELL);
+                                vf * LPFC_VFR_PAGE_SIZE +
+                                        LPFC_ULP0_WQ_DOORBELL);
         phba->sli4_hba.EQCQDBregaddr = (phba->sli4_hba.drbl_regs_memmap_p +
                                 vf * LPFC_VFR_PAGE_SIZE + LPFC_EQCQ_DOORBELL);
         phba->sli4_hba.MQDBregaddr = (phba->sli4_hba.drbl_regs_memmap_p +
@@ -6983,6 +6987,19 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
                 phba->sli4_hba.fcp_wq = NULL;
         }
 
+        if (phba->pci_bar0_memmap_p) {
+                iounmap(phba->pci_bar0_memmap_p);
+                phba->pci_bar0_memmap_p = NULL;
+        }
+        if (phba->pci_bar2_memmap_p) {
+                iounmap(phba->pci_bar2_memmap_p);
+                phba->pci_bar2_memmap_p = NULL;
+        }
+        if (phba->pci_bar4_memmap_p) {
+                iounmap(phba->pci_bar4_memmap_p);
+                phba->pci_bar4_memmap_p = NULL;
+        }
+
         /* Release FCP CQ mapping array */
         if (phba->sli4_hba.fcp_cq_map != NULL) {
                 kfree(phba->sli4_hba.fcp_cq_map);
@@ -7046,6 +7063,53 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
         int rc = -ENOMEM;
         int fcp_eqidx, fcp_cqidx, fcp_wqidx;
         int fcp_cq_index = 0;
+        uint32_t shdr_status, shdr_add_status;
+        union lpfc_sli4_cfg_shdr *shdr;
+        LPFC_MBOXQ_t *mboxq;
+        uint32_t length;
+
+        /* Check for dual-ULP support */
+        mboxq = (LPFC_MBOXQ_t *)mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+        if (!mboxq) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "3249 Unable to allocate memory for "
+                                "QUERY_FW_CFG mailbox command\n");
+                return -ENOMEM;
+        }
+        length = (sizeof(struct lpfc_mbx_query_fw_config) -
+                  sizeof(struct lpfc_sli4_cfg_mhdr));
+        lpfc_sli4_config(phba, mboxq, LPFC_MBOX_SUBSYSTEM_COMMON,
+                         LPFC_MBOX_OPCODE_QUERY_FW_CFG,
+                         length, LPFC_SLI4_MBX_EMBED);
+
+        rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+
+        shdr = (union lpfc_sli4_cfg_shdr *)
+                        &mboxq->u.mqe.un.sli4_config.header.cfg_shdr;
+        shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
+        shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response);
+        if (shdr_status || shdr_add_status || rc) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "3250 QUERY_FW_CFG mailbox failed with status "
+                                "x%x add_status x%x, mbx status x%x\n",
+                                shdr_status, shdr_add_status, rc);
+                if (rc != MBX_TIMEOUT)
+                        mempool_free(mboxq, phba->mbox_mem_pool);
+                rc = -ENXIO;
+                goto out_error;
+        }
+
+        phba->sli4_hba.fw_func_mode =
+                        mboxq->u.mqe.un.query_fw_cfg.rsp.function_mode;
+        phba->sli4_hba.ulp0_mode = mboxq->u.mqe.un.query_fw_cfg.rsp.ulp0_mode;
+        phba->sli4_hba.ulp1_mode = mboxq->u.mqe.un.query_fw_cfg.rsp.ulp1_mode;
+        lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                        "3251 QUERY_FW_CFG: func_mode:x%x, ulp0_mode:x%x, "
+                        "ulp1_mode:x%x\n", phba->sli4_hba.fw_func_mode,
+                        phba->sli4_hba.ulp0_mode, phba->sli4_hba.ulp1_mode);
+
+        if (rc != MBX_TIMEOUT)
+                mempool_free(mboxq, phba->mbox_mem_pool);
 
         /*
          * Set up HBA Event Queues (EQs)
@@ -7660,78 +7724,6 @@ out:
 }
 
 /**
- * lpfc_sli4_send_nop_mbox_cmds - Send sli-4 nop mailbox commands
- * @phba: pointer to lpfc hba data structure.
- * @cnt: number of nop mailbox commands to send.
- *
- * This routine is invoked to send a number @cnt of NOP mailbox command and
- * wait for each command to complete.
- *
- * Return: the number of NOP mailbox command completed.
- **/
-static int
-lpfc_sli4_send_nop_mbox_cmds(struct lpfc_hba *phba, uint32_t cnt)
-{
-        LPFC_MBOXQ_t *mboxq;
-        int length, cmdsent;
-        uint32_t mbox_tmo;
-        uint32_t rc = 0;
-        uint32_t shdr_status, shdr_add_status;
-        union lpfc_sli4_cfg_shdr *shdr;
-
-        if (cnt == 0) {
-                lpfc_printf_log(phba, KERN_WARNING, LOG_INIT,
-                                "2518 Requested to send 0 NOP mailbox cmd\n");
-                return cnt;
-        }
-
-        mboxq = (LPFC_MBOXQ_t *)mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
-        if (!mboxq) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                "2519 Unable to allocate memory for issuing "
-                                "NOP mailbox command\n");
-                return 0;
-        }
-
-        /* Set up NOP SLI4_CONFIG mailbox-ioctl command */
-        length = (sizeof(struct lpfc_mbx_nop) -
-                  sizeof(struct lpfc_sli4_cfg_mhdr));
-
-        for (cmdsent = 0; cmdsent < cnt; cmdsent++) {
-                lpfc_sli4_config(phba, mboxq, LPFC_MBOX_SUBSYSTEM_COMMON,
-                                 LPFC_MBOX_OPCODE_NOP, length,
-                                 LPFC_SLI4_MBX_EMBED);
-                if (!phba->sli4_hba.intr_enable)
-                        rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
-                else {
-                        mbox_tmo = lpfc_mbox_tmo_val(phba, mboxq);
-                        rc = lpfc_sli_issue_mbox_wait(phba, mboxq, mbox_tmo);
-                }
-                if (rc == MBX_TIMEOUT)
-                        break;
-                /* Check return status */
-                shdr = (union lpfc_sli4_cfg_shdr *)
-                        &mboxq->u.mqe.un.sli4_config.header.cfg_shdr;
-                shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
-                shdr_add_status = bf_get(lpfc_mbox_hdr_add_status,
-                                         &shdr->response);
-                if (shdr_status || shdr_add_status || rc) {
-                        lpfc_printf_log(phba, KERN_WARNING, LOG_INIT,
-                                        "2520 NOP mailbox command failed "
-                                        "status x%x add_status x%x mbx "
-                                        "status x%x\n", shdr_status,
-                                        shdr_add_status, rc);
-                        break;
-                }
-        }
-
-        if (rc != MBX_TIMEOUT)
-                mempool_free(mboxq, phba->mbox_mem_pool);
-
-        return cmdsent;
-}
-
-/**
  * lpfc_sli4_pci_mem_setup - Setup SLI4 HBA PCI memory space.
  * @phba: pointer to lpfc hba data structure.
  *
@@ -8499,37 +8491,6 @@ lpfc_unset_hba(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli4_unset_hba - Unset SLI4 hba device initialization.
- * @phba: pointer to lpfc hba data structure.
- *
- * This routine is invoked to unset the HBA device initialization steps to
- * a device with SLI-4 interface spec.
- **/
-static void
-lpfc_sli4_unset_hba(struct lpfc_hba *phba)
-{
-        struct lpfc_vport *vport = phba->pport;
-        struct Scsi_Host  *shost = lpfc_shost_from_vport(vport);
-
-        spin_lock_irq(shost->host_lock);
-        vport->load_flag |= FC_UNLOADING;
-        spin_unlock_irq(shost->host_lock);
-
-        phba->pport->work_port_events = 0;
-
-        /* Stop the SLI4 device port */
-        lpfc_stop_port(phba);
-
-        lpfc_sli4_disable_intr(phba);
-
-        /* Reset SLI4 HBA FCoE function */
-        lpfc_pci_function_reset(phba);
-        lpfc_sli4_queue_destroy(phba);
-
-        return;
-}
-
-/**
  * lpfc_sli4_xri_exchange_busy_wait - Wait for device XRI exchange busy
  * @phba: Pointer to HBA context object.
  *
@@ -9591,7 +9552,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         struct Scsi_Host  *shost = NULL;
         int error, ret;
         uint32_t cfg_mode, intr_mode;
-        int mcnt;
         int adjusted_fcp_io_channel;
 
         /* Allocate memory for HBA structure */
@@ -9680,58 +9640,35 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         shost = lpfc_shost_from_vport(vport); /* save shost for error cleanup */
         /* Now, trying to enable interrupt and bring up the device */
         cfg_mode = phba->cfg_use_msi;
-        while (true) {
-                /* Put device to a known state before enabling interrupt */
-                lpfc_stop_port(phba);
-                /* Configure and enable interrupt */
-                intr_mode = lpfc_sli4_enable_intr(phba, cfg_mode);
-                if (intr_mode == LPFC_INTR_ERROR) {
-                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                        "0426 Failed to enable interrupt.\n");
-                        error = -ENODEV;
-                        goto out_free_sysfs_attr;
-                }
-                /* Default to single EQ for non-MSI-X */
-                if (phba->intr_type != MSIX)
-                        adjusted_fcp_io_channel = 1;
-                else
-                        adjusted_fcp_io_channel = phba->cfg_fcp_io_channel;
-                phba->cfg_fcp_io_channel = adjusted_fcp_io_channel;
-                /* Set up SLI-4 HBA */
-                if (lpfc_sli4_hba_setup(phba)) {
-                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                        "1421 Failed to set up hba\n");
-                        error = -ENODEV;
-                        goto out_disable_intr;
-                }
 
-                /* Send NOP mbx cmds for non-INTx mode active interrupt test */
-                if (intr_mode != 0)
-                        mcnt = lpfc_sli4_send_nop_mbox_cmds(phba,
-                                                            LPFC_ACT_INTR_CNT);
-
-                /* Check active interrupts received only for MSI/MSI-X */
-                if (intr_mode == 0 ||
-                    phba->sli.slistat.sli_intr >= LPFC_ACT_INTR_CNT) {
-                        /* Log the current active interrupt mode */
-                        phba->intr_mode = intr_mode;
-                        lpfc_log_intr_mode(phba, intr_mode);
-                        break;
-                }
-                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-                                "0451 Configure interrupt mode (%d) "
-                                "failed active interrupt test.\n",
-                                intr_mode);
-                /* Unset the previous SLI-4 HBA setup. */
-                /*
-                 * TODO:  Is this operation compatible with IF TYPE 2
-                 * devices?  All port state is deleted and cleared.
-                 */
-                lpfc_sli4_unset_hba(phba);
-                /* Try next level of interrupt mode */
-                cfg_mode = --intr_mode;
+        /* Put device to a known state before enabling interrupt */
+        lpfc_stop_port(phba);
+        /* Configure and enable interrupt */
+        intr_mode = lpfc_sli4_enable_intr(phba, cfg_mode);
+        if (intr_mode == LPFC_INTR_ERROR) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "0426 Failed to enable interrupt.\n");
+                error = -ENODEV;
+                goto out_free_sysfs_attr;
+        }
+        /* Default to single EQ for non-MSI-X */
+        if (phba->intr_type != MSIX)
+                adjusted_fcp_io_channel = 1;
+        else
+                adjusted_fcp_io_channel = phba->cfg_fcp_io_channel;
+        phba->cfg_fcp_io_channel = adjusted_fcp_io_channel;
+        /* Set up SLI-4 HBA */
+        if (lpfc_sli4_hba_setup(phba)) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "1421 Failed to set up hba\n");
+                error = -ENODEV;
+                goto out_disable_intr;
         }
 
+        /* Log the current active interrupt mode */
+        phba->intr_mode = intr_mode;
+        lpfc_log_intr_mode(phba, intr_mode);
+
         /* Perform post initialization setup */
         lpfc_post_init_setup(phba);
 
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index d8fadcb2db73..46128c679202 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1115,6 +1115,13 @@ out:
                                  "0261 Cannot Register NameServer login\n");
         }
 
+        /*
+        ** In case the node reference counter does not go to zero, ensure that
+        ** the stale state for the node is not processed.
+        */
+
+        ndlp->nlp_prev_state = ndlp->nlp_state;
+        lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
         spin_lock_irq(shost->host_lock);
         ndlp->nlp_flag |= NLP_DEFER_RM;
         spin_unlock_irq(shost->host_lock);
@@ -2159,13 +2166,16 @@ lpfc_cmpl_plogi_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 {
         struct lpfc_iocbq *cmdiocb, *rspiocb;
         IOCB_t *irsp;
+        struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
 
         cmdiocb = (struct lpfc_iocbq *) arg;
         rspiocb = cmdiocb->context_un.rsp_iocb;
 
         irsp = &rspiocb->iocb;
         if (irsp->ulpStatus) {
+                spin_lock_irq(shost->host_lock);
                 ndlp->nlp_flag |= NLP_DEFER_RM;
+                spin_unlock_irq(shost->host_lock);
                 return NLP_STE_FREED_NODE;
         }
         return ndlp->nlp_state;
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 60e5a177644c..98af07c6e300 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -288,6 +288,26 @@ lpfc_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
 }
 
 /**
+ * lpfc_change_queue_type() - Change a device's scsi tag queuing type
+ * @sdev: Pointer the scsi device whose queue depth is to change
+ * @tag_type: Identifier for queue tag type
+ */
+static int
+lpfc_change_queue_type(struct scsi_device *sdev, int tag_type)
+{
+        if (sdev->tagged_supported) {
+                scsi_set_tag_type(sdev, tag_type);
+                if (tag_type)
+                        scsi_activate_tcq(sdev, sdev->queue_depth);
+                else
+                        scsi_deactivate_tcq(sdev, sdev->queue_depth);
+        } else
+                tag_type = 0;
+
+        return tag_type;
+}
+
+/**
  * lpfc_rampdown_queue_depth - Post RAMP_DOWN_QUEUE event to worker thread
  * @phba: The Hba for which this call is being executed.
  *
@@ -3972,7 +3992,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
                         break;
                 }
         } else
-                fcp_cmnd->fcpCntl1 = 0;
+                fcp_cmnd->fcpCntl1 = SIMPLE_Q;
 
         sli4 = (phba->sli_rev == LPFC_SLI_REV4);
 
@@ -5150,6 +5170,7 @@ struct scsi_host_template lpfc_template = {
         .max_sectors            = 0xFFFF,
         .vendor_id              = LPFC_NL_VENDOR_ID,
         .change_queue_depth     = lpfc_change_queue_depth,
+        .change_queue_type      = lpfc_change_queue_type,
 };
 
 struct scsi_host_template lpfc_vport_template = {
@@ -5172,4 +5193,5 @@ struct scsi_host_template lpfc_vport_template = {
         .shost_attrs            = lpfc_vport_attrs,
         .max_sectors            = 0xFFFF,
         .change_queue_depth     = lpfc_change_queue_depth,
+        .change_queue_type      = lpfc_change_queue_type,
 };
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 624eab370396..55b6fc83ad71 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -124,10 +124,17 @@ lpfc_sli4_wq_put(struct lpfc_queue *q, union lpfc_wqe *wqe)
 
         /* Ring Doorbell */
         doorbell.word0 = 0;
-        bf_set(lpfc_wq_doorbell_num_posted, &doorbell, 1);
-        bf_set(lpfc_wq_doorbell_index, &doorbell, host_index);
-        bf_set(lpfc_wq_doorbell_id, &doorbell, q->queue_id);
-        writel(doorbell.word0, q->phba->sli4_hba.WQDBregaddr);
+        if (q->db_format == LPFC_DB_LIST_FORMAT) {
+                bf_set(lpfc_wq_db_list_fm_num_posted, &doorbell, 1);
+                bf_set(lpfc_wq_db_list_fm_index, &doorbell, host_index);
+                bf_set(lpfc_wq_db_list_fm_id, &doorbell, q->queue_id);
+        } else if (q->db_format == LPFC_DB_RING_FORMAT) {
+                bf_set(lpfc_wq_db_ring_fm_num_posted, &doorbell, 1);
+                bf_set(lpfc_wq_db_ring_fm_id, &doorbell, q->queue_id);
+        } else {
+                return -EINVAL;
+        }
+        writel(doorbell.word0, q->db_regaddr);
 
         return 0;
 }
@@ -456,10 +463,20 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         /* Ring The Header Receive Queue Doorbell */
         if (!(hq->host_index % hq->entry_repost)) {
                 doorbell.word0 = 0;
-                bf_set(lpfc_rq_doorbell_num_posted, &doorbell,
-                       hq->entry_repost);
-                bf_set(lpfc_rq_doorbell_id, &doorbell, hq->queue_id);
-                writel(doorbell.word0, hq->phba->sli4_hba.RQDBregaddr);
+                if (hq->db_format == LPFC_DB_RING_FORMAT) {
+                        bf_set(lpfc_rq_db_ring_fm_num_posted, &doorbell,
+                               hq->entry_repost);
+                        bf_set(lpfc_rq_db_ring_fm_id, &doorbell, hq->queue_id);
+                } else if (hq->db_format == LPFC_DB_LIST_FORMAT) {
+                        bf_set(lpfc_rq_db_list_fm_num_posted, &doorbell,
+                               hq->entry_repost);
+                        bf_set(lpfc_rq_db_list_fm_index, &doorbell,
+                               hq->host_index);
+                        bf_set(lpfc_rq_db_list_fm_id, &doorbell, hq->queue_id);
+                } else {
+                        return -EINVAL;
+                }
+                writel(doorbell.word0, hq->db_regaddr);
         }
         return put_index;
 }
@@ -4939,7 +4956,7 @@ out_free_mboxq:
 static void
 lpfc_sli4_arm_cqeq_intr(struct lpfc_hba *phba)
 {
-        uint8_t fcp_eqidx;
+        int fcp_eqidx;
 
         lpfc_sli4_cq_release(phba->sli4_hba.mbx_cq, LPFC_QUEUE_REARM);
         lpfc_sli4_cq_release(phba->sli4_hba.els_cq, LPFC_QUEUE_REARM);
@@ -5622,6 +5639,13 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                 }
                 /* RPIs. */
                 count = phba->sli4_hba.max_cfg_param.max_rpi;
+                if (count <= 0) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "3279 Invalid provisioning of "
+                                        "rpi:%d\n", count);
+                        rc = -EINVAL;
+                        goto err_exit;
+                }
                 base = phba->sli4_hba.max_cfg_param.rpi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
                 phba->sli4_hba.rpi_bmask = kzalloc(longs *
@@ -5644,6 +5668,13 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
 
                 /* VPIs. */
                 count = phba->sli4_hba.max_cfg_param.max_vpi;
+                if (count <= 0) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "3280 Invalid provisioning of "
+                                        "vpi:%d\n", count);
+                        rc = -EINVAL;
+                        goto free_rpi_ids;
+                }
                 base = phba->sli4_hba.max_cfg_param.vpi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
                 phba->vpi_bmask = kzalloc(longs *
@@ -5666,6 +5697,13 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
 
                 /* XRIs. */
                 count = phba->sli4_hba.max_cfg_param.max_xri;
+                if (count <= 0) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "3281 Invalid provisioning of "
+                                        "xri:%d\n", count);
+                        rc = -EINVAL;
+                        goto free_vpi_ids;
+                }
                 base = phba->sli4_hba.max_cfg_param.xri_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
                 phba->sli4_hba.xri_bmask = kzalloc(longs *
@@ -5689,6 +5727,13 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
 
                 /* VFIs. */
                 count = phba->sli4_hba.max_cfg_param.max_vfi;
+                if (count <= 0) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "3282 Invalid provisioning of "
+                                        "vfi:%d\n", count);
+                        rc = -EINVAL;
+                        goto free_xri_ids;
+                }
                 base = phba->sli4_hba.max_cfg_param.vfi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
                 phba->sli4_hba.vfi_bmask = kzalloc(longs *
@@ -8370,7 +8415,7 @@ __lpfc_sli_issue_iocb_s4(struct lpfc_hba *phba, uint32_t ring_number,
                  * This is a continuation of a commandi,(CX) so this
                  * sglq is on the active list
                  */
-                sglq = __lpfc_get_active_sglq(phba, piocb->sli4_xritag);
+                sglq = __lpfc_get_active_sglq(phba, piocb->sli4_lxritag);
                 if (!sglq)
                         return IOCB_ERROR;
         }
@@ -8855,12 +8900,6 @@ lpfc_sli_setup(struct lpfc_hba *phba)
                         pring->prt[3].type = FC_TYPE_CT;
                         pring->prt[3].lpfc_sli_rcv_unsol_event =
                             lpfc_ct_unsol_event;
-                        /* abort unsolicited sequence */
-                        pring->prt[4].profile = 0;      /* Mask 4 */
-                        pring->prt[4].rctl = FC_RCTL_BA_ABTS;
-                        pring->prt[4].type = FC_TYPE_BLS;
-                        pring->prt[4].lpfc_sli_rcv_unsol_event =
-                            lpfc_sli4_ct_abort_unsol_event;
                         break;
                 }
                 totiocbsize += (pring->sli.sli3.numCiocb *
@@ -11873,7 +11912,7 @@ lpfc_sli4_hba_intr_handler(int irq, void *dev_id)
         struct lpfc_eqe *eqe;
         unsigned long iflag;
         int ecount = 0;
-        uint32_t fcp_eqidx;
+        int fcp_eqidx;
 
         /* Get the driver's phba structure from the dev_id */
         fcp_eq_hdl = (struct lpfc_fcp_eq_hdl *)dev_id;
@@ -11975,7 +12014,7 @@ lpfc_sli4_intr_handler(int irq, void *dev_id)
         struct lpfc_hba  *phba;
         irqreturn_t hba_irq_rc;
         bool hba_handled = false;
-        uint32_t fcp_eqidx;
+        int fcp_eqidx;
 
         /* Get the driver's phba structure from the dev_id */
         phba = (struct lpfc_hba *)dev_id;
@@ -12097,6 +12136,54 @@ out_fail:
 }
 
 /**
+ * lpfc_dual_chute_pci_bar_map - Map pci base address register to host memory
+ * @phba: HBA structure that indicates port to create a queue on.
+ * @pci_barset: PCI BAR set flag.
+ *
+ * This function shall perform iomap of the specified PCI BAR address to host
+ * memory address if not already done so and return it. The returned host
+ * memory address can be NULL.
+ */
+static void __iomem *
+lpfc_dual_chute_pci_bar_map(struct lpfc_hba *phba, uint16_t pci_barset)
+{
+        struct pci_dev *pdev;
+        unsigned long bar_map, bar_map_len;
+
+        if (!phba->pcidev)
+                return NULL;
+        else
+                pdev = phba->pcidev;
+
+        switch (pci_barset) {
+        case WQ_PCI_BAR_0_AND_1:
+                if (!phba->pci_bar0_memmap_p) {
+                        bar_map = pci_resource_start(pdev, PCI_64BIT_BAR0);
+                        bar_map_len = pci_resource_len(pdev, PCI_64BIT_BAR0);
+                        phba->pci_bar0_memmap_p = ioremap(bar_map, bar_map_len);
+                }
+                return phba->pci_bar0_memmap_p;
+        case WQ_PCI_BAR_2_AND_3:
+                if (!phba->pci_bar2_memmap_p) {
+                        bar_map = pci_resource_start(pdev, PCI_64BIT_BAR2);
+                        bar_map_len = pci_resource_len(pdev, PCI_64BIT_BAR2);
+                        phba->pci_bar2_memmap_p = ioremap(bar_map, bar_map_len);
+                }
+                return phba->pci_bar2_memmap_p;
+        case WQ_PCI_BAR_4_AND_5:
+                if (!phba->pci_bar4_memmap_p) {
+                        bar_map = pci_resource_start(pdev, PCI_64BIT_BAR4);
+                        bar_map_len = pci_resource_len(pdev, PCI_64BIT_BAR4);
+                        phba->pci_bar4_memmap_p = ioremap(bar_map, bar_map_len);
+                }
+                return phba->pci_bar4_memmap_p;
+        default:
+                break;
+        }
+        return NULL;
+}
+
+/**
  * lpfc_modify_fcp_eq_delay - Modify Delay Multiplier on FCP EQs
  * @phba: HBA structure that indicates port to create a queue on.
  * @startq: The starting FCP EQ to modify
@@ -12673,6 +12760,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
         union lpfc_sli4_cfg_shdr *shdr;
         uint32_t hw_page_size = phba->sli4_hba.pc_sli4_params.if_page_sz;
         struct dma_address *page;
+        void __iomem *bar_memmap_p;
+        uint32_t db_offset;
+        uint16_t pci_barset;
 
         /* sanity check on queue memory */
         if (!wq || !cq)
@@ -12696,6 +12786,7 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
                     cq->queue_id);
         bf_set(lpfc_mbox_hdr_version, &shdr->request,
                phba->sli4_hba.pc_sli4_params.wqv);
+
         if (phba->sli4_hba.pc_sli4_params.wqv == LPFC_Q_CREATE_VERSION_1) {
                 bf_set(lpfc_mbx_wq_create_wqe_count, &wq_create->u.request_1,
                        wq->entry_count);
@@ -12723,6 +12814,10 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
                 page[dmabuf->buffer_tag].addr_lo = putPaddrLow(dmabuf->phys);
                 page[dmabuf->buffer_tag].addr_hi = putPaddrHigh(dmabuf->phys);
         }
+
+        if (phba->sli4_hba.fw_func_mode & LPFC_DUA_MODE)
+                bf_set(lpfc_mbx_wq_create_dua, &wq_create->u.request, 1);
+
         rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
         /* The IOCTL status is embedded in the mailbox subheader. */
         shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
@@ -12740,6 +12835,47 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
                 status = -ENXIO;
                 goto out;
         }
+        if (phba->sli4_hba.fw_func_mode & LPFC_DUA_MODE) {
+                wq->db_format = bf_get(lpfc_mbx_wq_create_db_format,
+                                       &wq_create->u.response);
+                if ((wq->db_format != LPFC_DB_LIST_FORMAT) &&
+                    (wq->db_format != LPFC_DB_RING_FORMAT)) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3265 WQ[%d] doorbell format not "
+                                        "supported: x%x\n", wq->queue_id,
+                                        wq->db_format);
+                        status = -EINVAL;
+                        goto out;
+                }
+                pci_barset = bf_get(lpfc_mbx_wq_create_bar_set,
+                                    &wq_create->u.response);
+                bar_memmap_p = lpfc_dual_chute_pci_bar_map(phba, pci_barset);
+                if (!bar_memmap_p) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3263 WQ[%d] failed to memmap pci "
+                                        "barset:x%x\n", wq->queue_id,
+                                        pci_barset);
+                        status = -ENOMEM;
+                        goto out;
+                }
+                db_offset = wq_create->u.response.doorbell_offset;
+                if ((db_offset != LPFC_ULP0_WQ_DOORBELL) &&
+                    (db_offset != LPFC_ULP1_WQ_DOORBELL)) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3252 WQ[%d] doorbell offset not "
+                                        "supported: x%x\n", wq->queue_id,
+                                        db_offset);
+                        status = -EINVAL;
+                        goto out;
+                }
+                wq->db_regaddr = bar_memmap_p + db_offset;
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "3264 WQ[%d]: barset:x%x, offset:x%x\n",
+                                wq->queue_id, pci_barset, db_offset);
+        } else {
+                wq->db_format = LPFC_DB_LIST_FORMAT;
+                wq->db_regaddr = phba->sli4_hba.WQDBregaddr;
+        }
         wq->type = LPFC_WQ;
         wq->assoc_qid = cq->queue_id;
         wq->subtype = subtype;
@@ -12816,6 +12952,9 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         uint32_t shdr_status, shdr_add_status;
         union lpfc_sli4_cfg_shdr *shdr;
         uint32_t hw_page_size = phba->sli4_hba.pc_sli4_params.if_page_sz;
+        void __iomem *bar_memmap_p;
+        uint32_t db_offset;
+        uint16_t pci_barset;
 
         /* sanity check on queue memory */
         if (!hrq || !drq || !cq)
@@ -12894,6 +13033,9 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                 rq_create->u.request.page[dmabuf->buffer_tag].addr_hi =
                                         putPaddrHigh(dmabuf->phys);
         }
+        if (phba->sli4_hba.fw_func_mode & LPFC_DUA_MODE)
+                bf_set(lpfc_mbx_rq_create_dua, &rq_create->u.request, 1);
+
         rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
         /* The IOCTL status is embedded in the mailbox subheader. */
         shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
@@ -12911,6 +13053,50 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                 status = -ENXIO;
                 goto out;
         }
+
+        if (phba->sli4_hba.fw_func_mode & LPFC_DUA_MODE) {
+                hrq->db_format = bf_get(lpfc_mbx_rq_create_db_format,
+                                        &rq_create->u.response);
+                if ((hrq->db_format != LPFC_DB_LIST_FORMAT) &&
+                    (hrq->db_format != LPFC_DB_RING_FORMAT)) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3262 RQ [%d] doorbell format not "
+                                        "supported: x%x\n", hrq->queue_id,
+                                        hrq->db_format);
+                        status = -EINVAL;
+                        goto out;
+                }
+
+                pci_barset = bf_get(lpfc_mbx_rq_create_bar_set,
+                                    &rq_create->u.response);
+                bar_memmap_p = lpfc_dual_chute_pci_bar_map(phba, pci_barset);
+                if (!bar_memmap_p) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3269 RQ[%d] failed to memmap pci "
+                                        "barset:x%x\n", hrq->queue_id,
+                                        pci_barset);
+                        status = -ENOMEM;
+                        goto out;
+                }
+
+                db_offset = rq_create->u.response.doorbell_offset;
+                if ((db_offset != LPFC_ULP0_RQ_DOORBELL) &&
+                    (db_offset != LPFC_ULP1_RQ_DOORBELL)) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "3270 RQ[%d] doorbell offset not "
+                                        "supported: x%x\n", hrq->queue_id,
+                                        db_offset);
+                        status = -EINVAL;
+                        goto out;
+                }
+                hrq->db_regaddr = bar_memmap_p + db_offset;
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "3266 RQ[qid:%d]: barset:x%x, offset:x%x\n",
+                                hrq->queue_id, pci_barset, db_offset);
+        } else {
+                hrq->db_format = LPFC_DB_RING_FORMAT;
+                hrq->db_regaddr = phba->sli4_hba.RQDBregaddr;
+        }
         hrq->type = LPFC_HRQ;
         hrq->assoc_qid = cq->queue_id;
         hrq->subtype = subtype;
@@ -12976,6 +13162,8 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                 rq_create->u.request.page[dmabuf->buffer_tag].addr_hi =
                                         putPaddrHigh(dmabuf->phys);
         }
+        if (phba->sli4_hba.fw_func_mode & LPFC_DUA_MODE)
+                bf_set(lpfc_mbx_rq_create_dua, &rq_create->u.request, 1);
         rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
         /* The IOCTL status is embedded in the mailbox subheader. */
         shdr = (union lpfc_sli4_cfg_shdr *) &rq_create->header.cfg_shdr;
@@ -14063,6 +14251,40 @@ lpfc_sli4_abort_partial_seq(struct lpfc_vport *vport,
 }
 
 /**
+ * lpfc_sli4_abort_ulp_seq - Abort assembled unsol sequence from ulp
+ * @vport: pointer to a vitural port
+ * @dmabuf: pointer to a dmabuf that describes the FC sequence
+ *
+ * This function tries to abort from the assembed sequence from upper level
+ * protocol, described by the information from basic abbort @dmabuf. It
+ * checks to see whether such pending context exists at upper level protocol.
+ * If so, it shall clean up the pending context.
+ *
+ * Return
+ * true  -- if there is matching pending context of the sequence cleaned
+ *          at ulp;
+ * false -- if there is no matching pending context of the sequence present
+ *          at ulp.
+ **/
+static bool
+lpfc_sli4_abort_ulp_seq(struct lpfc_vport *vport, struct hbq_dmabuf *dmabuf)
+{
+        struct lpfc_hba *phba = vport->phba;
+        int handled;
+
+        /* Accepting abort at ulp with SLI4 only */
+        if (phba->sli_rev < LPFC_SLI_REV4)
+                return false;
+
+        /* Register all caring upper level protocols to attend abort */
+        handled = lpfc_ct_handle_unsol_abort(phba, dmabuf);
+        if (handled)
+                return true;
+
+        return false;
+}
+
+/**
  * lpfc_sli4_seq_abort_rsp_cmpl - BLS ABORT RSP seq abort iocb complete handler
  * @phba: Pointer to HBA context object.
  * @cmd_iocbq: pointer to the command iocbq structure.
@@ -14077,8 +14299,14 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba,
                              struct lpfc_iocbq *cmd_iocbq,
                              struct lpfc_iocbq *rsp_iocbq)
 {
-        if (cmd_iocbq)
+        struct lpfc_nodelist *ndlp;
+
+        if (cmd_iocbq) {
+                ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1;
+                lpfc_nlp_put(ndlp);
+                lpfc_nlp_not_used(ndlp);
                 lpfc_sli_release_iocbq(phba, cmd_iocbq);
+        }
 
         /* Failure means BLS ABORT RSP did not get delivered to remote node*/
         if (rsp_iocbq && rsp_iocbq->iocb.ulpStatus)
@@ -14118,9 +14346,10 @@ lpfc_sli4_xri_inrange(struct lpfc_hba *phba,
  * event after aborting the sequence handling.
  **/
 static void
-lpfc_sli4_seq_abort_rsp(struct lpfc_hba *phba,
-                        struct fc_frame_header *fc_hdr)
+lpfc_sli4_seq_abort_rsp(struct lpfc_vport *vport,
+                        struct fc_frame_header *fc_hdr, bool aborted)
 {
+        struct lpfc_hba *phba = vport->phba;
         struct lpfc_iocbq *ctiocb = NULL;
         struct lpfc_nodelist *ndlp;
         uint16_t oxid, rxid, xri, lxri;
@@ -14135,12 +14364,27 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_hba *phba,
         oxid = be16_to_cpu(fc_hdr->fh_ox_id);
         rxid = be16_to_cpu(fc_hdr->fh_rx_id);
 
-        ndlp = lpfc_findnode_did(phba->pport, sid);
+        ndlp = lpfc_findnode_did(vport, sid);
         if (!ndlp) {
-                lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
-                                "1268 Find ndlp returned NULL for oxid:x%x "
-                                "SID:x%x\n", oxid, sid);
-                return;
+                ndlp = mempool_alloc(phba->nlp_mem_pool, GFP_KERNEL);
+                if (!ndlp) {
+                        lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
+                                         "1268 Failed to allocate ndlp for "
+                                         "oxid:x%x SID:x%x\n", oxid, sid);
+                        return;
+                }
+                lpfc_nlp_init(vport, ndlp, sid);
+                /* Put ndlp onto pport node list */
+                lpfc_enqueue_node(vport, ndlp);
+        } else if (!NLP_CHK_NODE_ACT(ndlp)) {
+                /* re-setup ndlp without removing from node list */
+                ndlp = lpfc_enable_node(vport, ndlp, NLP_STE_UNUSED_NODE);
+                if (!ndlp) {
+                        lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
+                                         "3275 Failed to active ndlp found "
+                                         "for oxid:x%x SID:x%x\n", oxid, sid);
+                        return;
+                }
         }
 
         /* Allocate buffer for rsp iocb */
@@ -14164,7 +14408,7 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_hba *phba,
         icmd->ulpLe = 1;
         icmd->ulpClass = CLASS3;
         icmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
-        ctiocb->context1 = ndlp;
+        ctiocb->context1 = lpfc_nlp_get(ndlp);
 
         ctiocb->iocb_cmpl = NULL;
         ctiocb->vport = phba->pport;
@@ -14183,14 +14427,24 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_hba *phba,
         if (lxri != NO_XRI)
                 lpfc_set_rrq_active(phba, ndlp, lxri,
                         (xri == oxid) ? rxid : oxid, 0);
-        /* If the oxid maps to the FCP XRI range or if it is out of range,
-         * send a BLS_RJT.  The driver no longer has that exchange.
-         * Override the IOCB for a BA_RJT.
+        /* For BA_ABTS from exchange responder, if the logical xri with
+         * the oxid maps to the FCP XRI range, the port no longer has
+         * that exchange context, send a BLS_RJT. Override the IOCB for
+         * a BA_RJT.
          */
-        if (xri > (phba->sli4_hba.max_cfg_param.max_xri +
-                    phba->sli4_hba.max_cfg_param.xri_base) ||
-            xri > (lpfc_sli4_get_els_iocb_cnt(phba) +
-                    phba->sli4_hba.max_cfg_param.xri_base)) {
+        if ((fctl & FC_FC_EX_CTX) &&
+            (lxri > lpfc_sli4_get_els_iocb_cnt(phba))) {
+                icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_RJT;
+                bf_set(lpfc_vndr_code, &icmd->un.bls_rsp, 0);
+                bf_set(lpfc_rsn_expln, &icmd->un.bls_rsp, FC_BA_RJT_INV_XID);
+                bf_set(lpfc_rsn_code, &icmd->un.bls_rsp, FC_BA_RJT_UNABLE);
+        }
+
+        /* If BA_ABTS failed to abort a partially assembled receive sequence,
+         * the driver no longer has that exchange, send a BLS_RJT. Override
+         * the IOCB for a BA_RJT.
+         */
+        if (aborted == false) {
                 icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_RJT;
                 bf_set(lpfc_vndr_code, &icmd->un.bls_rsp, 0);
                 bf_set(lpfc_rsn_expln, &icmd->un.bls_rsp, FC_BA_RJT_INV_XID);
@@ -14214,17 +14468,19 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_hba *phba,
         bf_set(lpfc_abts_oxid, &icmd->un.bls_rsp, oxid);
 
         /* Xmit CT abts response on exchange <xid> */
-        lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
-                        "1200 Send BLS cmd x%x on oxid x%x Data: x%x\n",
-                        icmd->un.xseq64.w5.hcsw.Rctl, oxid, phba->link_state);
+        lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+                         "1200 Send BLS cmd x%x on oxid x%x Data: x%x\n",
+                         icmd->un.xseq64.w5.hcsw.Rctl, oxid, phba->link_state);
 
         rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
         if (rc == IOCB_ERROR) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_ELS,
-                                "2925 Failed to issue CT ABTS RSP x%x on "
-                                "xri x%x, Data x%x\n",
-                                icmd->un.xseq64.w5.hcsw.Rctl, oxid,
-                                phba->link_state);
+                lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
+                                 "2925 Failed to issue CT ABTS RSP x%x on "
+                                 "xri x%x, Data x%x\n",
+                                 icmd->un.xseq64.w5.hcsw.Rctl, oxid,
+                                 phba->link_state);
+                lpfc_nlp_put(ndlp);
+                ctiocb->context1 = NULL;
                 lpfc_sli_release_iocbq(phba, ctiocb);
         }
 }
@@ -14249,32 +14505,25 @@ lpfc_sli4_handle_unsol_abort(struct lpfc_vport *vport,
         struct lpfc_hba *phba = vport->phba;
         struct fc_frame_header fc_hdr;
         uint32_t fctl;
-        bool abts_par;
+        bool aborted;
 
         /* Make a copy of fc_hdr before the dmabuf being released */
         memcpy(&fc_hdr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
         fctl = sli4_fctl_from_fc_hdr(&fc_hdr);
 
         if (fctl & FC_FC_EX_CTX) {
-                /*
-                 * ABTS sent by responder to exchange, just free the buffer
-                 */
-                lpfc_in_buf_free(phba, &dmabuf->dbuf);
+                /* ABTS by responder to exchange, no cleanup needed */
+                aborted = true;
         } else {
-                /*
-                 * ABTS sent by initiator to exchange, need to do cleanup
-                 */
-                /* Try to abort partially assembled seq */
-                abts_par = lpfc_sli4_abort_partial_seq(vport, dmabuf);
-
-                /* Send abort to ULP if partially seq abort failed */
-                if (abts_par == false)
-                        lpfc_sli4_send_seq_to_ulp(vport, dmabuf);
-                else
-                        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+                /* ABTS by initiator to exchange, need to do cleanup */
+                aborted = lpfc_sli4_abort_partial_seq(vport, dmabuf);
+                if (aborted == false)
+                        aborted = lpfc_sli4_abort_ulp_seq(vport, dmabuf);
         }
-        /* Send basic accept (BA_ACC) to the abort requester */
-        lpfc_sli4_seq_abort_rsp(phba, &fc_hdr);
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+
+        /* Respond with BA_ACC or BA_RJT accordingly */
+        lpfc_sli4_seq_abort_rsp(vport, &fc_hdr, aborted);
 }
 
 /**
@@ -15307,10 +15556,13 @@ lpfc_sli4_fcf_rr_next_index_get(struct lpfc_hba *phba)
 {
         uint16_t next_fcf_index;
 
+initial_priority:
         /* Search start from next bit of currently registered FCF index */
+        next_fcf_index = phba->fcf.current_rec.fcf_indx;
+
 next_priority:
-        next_fcf_index = (phba->fcf.current_rec.fcf_indx + 1) %
-                                        LPFC_SLI4_FCF_TBL_INDX_MAX;
+        /* Determine the next fcf index to check */
+        next_fcf_index = (next_fcf_index + 1) % LPFC_SLI4_FCF_TBL_INDX_MAX;
         next_fcf_index = find_next_bit(phba->fcf.fcf_rr_bmask,
                                        LPFC_SLI4_FCF_TBL_INDX_MAX,
                                        next_fcf_index);
@@ -15337,7 +15589,7 @@ next_priority:
                  * at that level and continue the selection process.
                  */
                 if (lpfc_check_next_fcf_pri_level(phba))
-                        goto next_priority;
+                        goto initial_priority;
                 lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
                                 "2844 No roundrobin failover FCF available\n");
                 if (next_fcf_index >= LPFC_SLI4_FCF_TBL_INDX_MAX)
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index 44c427a45d66..be02b59ea279 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -139,6 +139,10 @@ struct lpfc_queue {
 
         struct lpfc_sli_ring *pring; /* ptr to io ring associated with q */
 
+        uint16_t db_format;
+#define LPFC_DB_RING_FORMAT     0x01
+#define LPFC_DB_LIST_FORMAT     0x02
+        void __iomem *db_regaddr;
         /* For q stats */
         uint32_t q_cnt_1;
         uint32_t q_cnt_2;
@@ -508,6 +512,10 @@ struct lpfc_sli4_hba {
         struct lpfc_queue *hdr_rq; /* Slow-path Header Receive queue */
         struct lpfc_queue *dat_rq; /* Slow-path Data Receive queue */
 
+        uint8_t fw_func_mode;   /* FW function protocol mode */
+        uint32_t ulp0_mode;     /* ULP0 protocol mode */
+        uint32_t ulp1_mode;     /* ULP1 protocol mode */
+
         /* Setup information for various queue parameters */
         int eq_esize;
         int eq_ecount;
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index ba596e854bbc..f3b7795a296b 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -18,7 +18,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "8.3.36"
+#define LPFC_DRIVER_VERSION "8.3.37"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */