Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (76 commits)
  IB: Update MAINTAINERS with Hal's new email address
  IB/mlx4: Implement query SRQ
  IB/mlx4: Implement query QP
  IB/cm: Send no match if a SIDR REQ does not match a listen
  IB/cm: Fix handling of duplicate SIDR REQs
  IB/cm: cm_msgs.h should include ib_cm.h
  IB/cm: Include HCA ACK delay in local ACK timeout
  IB/cm: Use spin_lock_irq() instead of spin_lock_irqsave() when possible
  IB/sa: Make sure SA queries use default P_Key
  IPoIB: Recycle loopback skbs instead of freeing and reallocating
  IB/mthca: Replace memset(<addr>, 0, PAGE_SIZE) with clear_page(<addr>)
  IPoIB/cm: Fix warning if IPV6 is not enabled
  IB/core: Take sizeof the correct pointer when calling kmalloc()
  IB/ehca: Improve latency by unlocking after triggering the hardware
  IB/ehca: Notify consumers of LID/PKEY/SM changes after nondisruptive events
  IB/ehca: Return QP pointer in poll_cq()
  IB/ehca: Change idr spinlocks into rwlocks
  IB/ehca: Refactor sync between completions and destroy_cq using atomic_t
  IB/ehca: Lock renaming, static initializers
  IB/ehca: Report RDMA atomic attributes in query_qp()
  ...

35 files changed, 1237 insertions, 345 deletions

diff --git a/drivers/infiniband/hw/ipath/Kconfig b/drivers/infiniband/hw/ipath/Kconfig
index 90c14543677d..044da5828a78 100644
--- a/drivers/infiniband/hw/ipath/Kconfig
+++ b/drivers/infiniband/hw/ipath/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_IPATH
         tristate "QLogic InfiniPath Driver"
-        depends on (PCI_MSI || HT_IRQ) && 64BIT && INFINIBAND && NET
+        depends on (PCI_MSI || HT_IRQ) && 64BIT && NET
         ---help---
         This is a driver for QLogic InfiniPath host channel adapters,
         including InfiniBand verbs support.  This driver allows these
diff --git a/drivers/infiniband/hw/ipath/ipath_common.h b/drivers/infiniband/hw/ipath/ipath_common.h
index 10c008f22ba6..b4b786d0dfca 100644
--- a/drivers/infiniband/hw/ipath/ipath_common.h
+++ b/drivers/infiniband/hw/ipath/ipath_common.h
@@ -189,8 +189,7 @@ typedef enum _ipath_ureg {
 #define IPATH_RUNTIME_FORCE_WC_ORDER    0x4
 #define IPATH_RUNTIME_RCVHDR_COPY       0x8
 #define IPATH_RUNTIME_MASTER    0x10
-#define IPATH_RUNTIME_PBC_REWRITE 0x20
-#define IPATH_RUNTIME_LOOSE_DMA_ALIGN 0x40
+/* 0x20 and 0x40 are no longer used, but are reserved for ABI compatibility */
 
 /*
  * This structure is returned by ipath_userinit() immediately after
@@ -432,8 +431,15 @@ struct ipath_user_info {
 #define IPATH_CMD_UNUSED_1      25
 #define IPATH_CMD_UNUSED_2      26
 #define IPATH_CMD_PIOAVAILUPD   27      /* force an update of PIOAvail reg */
+#define IPATH_CMD_POLL_TYPE     28      /* set the kind of polling we want */
 
-#define IPATH_CMD_MAX           27
+#define IPATH_CMD_MAX           28
+
+/*
+ * Poll types
+ */
+#define IPATH_POLL_TYPE_URGENT   0x01
+#define IPATH_POLL_TYPE_OVERFLOW 0x02
 
 struct ipath_port_info {
         __u32 num_active;       /* number of active units */
@@ -474,6 +480,8 @@ struct ipath_cmd {
                 __u16 part_key;
                 /* user address of __u32 bitmask of active slaves */
                 __u64 slave_mask_addr;
+                /* type of polling we want */
+                __u16 poll_type;
         } cmd;
 };
 
@@ -502,13 +510,30 @@ struct __ipath_sendpkt {
         struct ipath_iovec sps_iov[4];
 };
 
-/* Passed into diag data special file's ->write method. */
+/*
+ * diagnostics can send a packet by "writing" one of the following
+ * two structs to diag data special file
+ * The first is the legacy version for backward compatibility
+ */
 struct ipath_diag_pkt {
         __u32 unit;
         __u64 data;
         __u32 len;
 };
 
+/* The second diag_pkt struct is the expanded version that allows
+ * more control over the packet, specifically, by allowing a custom
+ * pbc (+ extra) qword, so that special modes and deliberate
+ * changes to CRCs can be used. The elements were also re-ordered
+ * for better alignment and to avoid padding issues.
+ */
+struct ipath_diag_xpkt {
+        __u64 data;
+        __u64 pbc_wd;
+        __u32 unit;
+        __u32 len;
+};
+
 /*
  * Data layout in I2C flash (for GUID, etc.)
  * All fields are little-endian binary unless otherwise stated
diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c
index 3e9241badba0..a6f04d27ec57 100644
--- a/drivers/infiniband/hw/ipath/ipath_cq.c
+++ b/drivers/infiniband/hw/ipath/ipath_cq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -90,6 +90,8 @@ void ipath_cq_enter(struct ipath_cq *cq, struct ib_wc *entry, int solicited)
         wc->queue[head].sl = entry->sl;
         wc->queue[head].dlid_path_bits = entry->dlid_path_bits;
         wc->queue[head].port_num = entry->port_num;
+        /* Make sure queue entry is written before the head index. */
+        smp_wmb();
         wc->head = next;
 
         if (cq->notify == IB_CQ_NEXT_COMP ||
@@ -139,7 +141,8 @@ int ipath_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry)
 
                 if (tail == wc->head)
                         break;
-
+                /* Make sure entry is read after head index is read. */
+                smp_rmb();
                 qp = ipath_lookup_qpn(&to_idev(cq->ibcq.device)->qp_table,
                                       wc->queue[tail].qp_num);
                 entry->qp = &qp->ibqp;
diff --git a/drivers/infiniband/hw/ipath/ipath_debug.h b/drivers/infiniband/hw/ipath/ipath_debug.h
index 42bfbdb0d3e6..19c56e6491eb 100644
--- a/drivers/infiniband/hw/ipath/ipath_debug.h
+++ b/drivers/infiniband/hw/ipath/ipath_debug.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index 63e8368b0e95..a698f1949d10 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -323,13 +323,14 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
 {
         u32 __iomem *piobuf;
         u32 plen, clen, pbufn;
-        struct ipath_diag_pkt dp;
+        struct ipath_diag_pkt odp;
+        struct ipath_diag_xpkt dp;
         u32 *tmpbuf = NULL;
         struct ipath_devdata *dd;
         ssize_t ret = 0;
         u64 val;
 
-        if (count < sizeof(dp)) {
+        if (count != sizeof(dp)) {
                 ret = -EINVAL;
                 goto bail;
         }
@@ -339,6 +340,29 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
                 goto bail;
         }
 
+        /*
+         * Due to padding/alignment issues (lessened with new struct)
+         * the old and new structs are the same length. We need to
+         * disambiguate them, which we can do because odp.len has never
+         * been less than the total of LRH+BTH+DETH so far, while
+         * dp.unit (same offset) unit is unlikely to get that high.
+         * Similarly, dp.data, the pointer to user at the same offset
+         * as odp.unit, is almost certainly at least one (512byte)page
+         * "above" NULL. The if-block below can be omitted if compatibility
+         * between a new driver and older diagnostic code is unimportant.
+         * compatibility the other direction (new diags, old driver) is
+         * handled in the diagnostic code, with a warning.
+         */
+        if (dp.unit >= 20 && dp.data < 512) {
+                /* very probable version mismatch. Fix it up */
+                memcpy(&odp, &dp, sizeof(odp));
+                /* We got a legacy dp, copy elements to dp */
+                dp.unit = odp.unit;
+                dp.data = odp.data;
+                dp.len = odp.len;
+                dp.pbc_wd = 0; /* Indicate we need to compute PBC wd */
+        }
+
         /* send count must be an exact number of dwords */
         if (dp.len & 3) {
                 ret = -EINVAL;
@@ -371,9 +395,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
                 ret = -ENODEV;
                 goto bail;
         }
+        /* Check link state, but not if we have custom PBC */
         val = dd->ipath_lastibcstat & IPATH_IBSTATE_MASK;
-        if (val != IPATH_IBSTATE_INIT && val != IPATH_IBSTATE_ARM &&
-            val != IPATH_IBSTATE_ACTIVE) {
+        if (!dp.pbc_wd && val != IPATH_IBSTATE_INIT &&
+                val != IPATH_IBSTATE_ARM && val != IPATH_IBSTATE_ACTIVE) {
                 ipath_cdbg(VERBOSE, "unit %u not ready (state %llx)\n",
                            dd->ipath_unit, (unsigned long long) val);
                 ret = -EINVAL;
@@ -419,9 +444,13 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
                 ipath_cdbg(VERBOSE, "unit %u 0x%x+1w pio%d\n",
                            dd->ipath_unit, plen - 1, pbufn);
 
+        if (dp.pbc_wd == 0)
+                /* Legacy operation, use computed pbc_wd */
+                dp.pbc_wd = plen;
+
         /* we have to flush after the PBC for correctness on some cpus
          * or WC buffer can be written out of order */
-        writeq(plen, piobuf);
+        writeq(dp.pbc_wd, piobuf);
         ipath_flush_wc();
         /* copy all by the trigger word, then flush, so it's written
          * to chip before trigger word, then write trigger word, then
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 834e86f6c04e..9361f5ab8bd6 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -104,6 +104,9 @@ static int __devinit ipath_init_one(struct pci_dev *,
 #define PCI_DEVICE_ID_INFINIPATH_HT 0xd
 #define PCI_DEVICE_ID_INFINIPATH_PE800 0x10
 
+/* Number of seconds before our card status check...  */
+#define STATUS_TIMEOUT 60
+
 static const struct pci_device_id ipath_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_PATHSCALE, PCI_DEVICE_ID_INFINIPATH_HT) },
         { PCI_DEVICE(PCI_VENDOR_ID_PATHSCALE, PCI_DEVICE_ID_INFINIPATH_PE800) },
@@ -119,6 +122,18 @@ static struct pci_driver ipath_driver = {
         .id_table = ipath_pci_tbl,
 };
 
+static void ipath_check_status(struct work_struct *work)
+{
+        struct ipath_devdata *dd = container_of(work, struct ipath_devdata,
+                                                status_work.work);
+
+        /*
+         * If we don't have any interrupts, let the user know and
+         * don't bother checking again.
+         */
+        if (dd->ipath_int_counter == 0)
+                dev_err(&dd->pcidev->dev, "No interrupts detected.\n");
+}
 
 static inline void read_bars(struct ipath_devdata *dd, struct pci_dev *dev,
                              u32 *bar0, u32 *bar1)
@@ -187,6 +202,8 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
         dd->pcidev = pdev;
         pci_set_drvdata(pdev, dd);
 
+        INIT_DELAYED_WORK(&dd->status_work, ipath_check_status);
+
         list_add(&dd->ipath_list, &ipath_dev_list);
 
 bail_unlock:
@@ -504,6 +521,9 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
         ipath_diag_add(dd);
         ipath_register_ib_device(dd);
 
+        /* Check that card status in STATUS_TIMEOUT seconds. */
+        schedule_delayed_work(&dd->status_work, HZ * STATUS_TIMEOUT);
+
         goto bail;
 
 bail_irqsetup:
@@ -631,6 +651,9 @@ static void __devexit ipath_remove_one(struct pci_dev *pdev)
          */
         ipath_shutdown_device(dd);
 
+        cancel_delayed_work(&dd->status_work);
+        flush_scheduled_work();
+
         if (dd->verbs_dev)
                 ipath_unregister_ib_device(dd->verbs_dev);
 
@@ -699,9 +722,9 @@ void ipath_disarm_piobufs(struct ipath_devdata *dd, unsigned first,
         u64 sendctrl, sendorig;
 
         ipath_cdbg(PKT, "disarm %u PIObufs first=%u\n", cnt, first);
-        sendorig = dd->ipath_sendctrl | INFINIPATH_S_DISARM;
+        sendorig = dd->ipath_sendctrl;
         for (i = first; i < last; i++) {
-                sendctrl = sendorig |
+                sendctrl = sendorig  | INFINIPATH_S_DISARM |
                         (i << INFINIPATH_S_DISARMPIOBUF_SHIFT);
                 ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
                                  sendctrl);
@@ -712,12 +735,12 @@ void ipath_disarm_piobufs(struct ipath_devdata *dd, unsigned first,
          * while we were looping; no critical bits that would require
          * locking.
          *
-         * Write a 0, and then the original value, reading scratch in
+         * disable PIOAVAILUPD, then re-enable, reading scratch in
          * between.  This seems to avoid a chip timing race that causes
          * pioavail updates to memory to stop.
          */
         ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                         0);
+                         sendorig & ~IPATH_S_PIOBUFAVAILUPD);
         sendorig = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
                          dd->ipath_sendctrl);
@@ -1014,14 +1037,10 @@ void ipath_kreceive(struct ipath_devdata *dd)
                 goto bail;
         }
 
-        /* There is already a thread processing this queue. */
-        if (test_and_set_bit(0, &dd->ipath_rcv_pending))
-                goto bail;
-
         l = dd->ipath_port0head;
         hdrqtail = (u32) le64_to_cpu(*dd->ipath_hdrqtailptr);
         if (l == hdrqtail)
-                goto done;
+                goto bail;
 
 reloop:
         for (i = 0; l != hdrqtail; i++) {
@@ -1156,10 +1175,6 @@ reloop:
         ipath_stats.sps_avgpkts_call =
                 ipath_stats.sps_port0pkts / ++totcalls;
 
-done:
-        clear_bit(0, &dd->ipath_rcv_pending);
-        smp_mb__after_clear_bit();
-
 bail:;
 }
 
@@ -1589,6 +1604,35 @@ int ipath_waitfor_mdio_cmdready(struct ipath_devdata *dd)
         return ret;
 }
 
+
+/*
+ * Flush all sends that might be in the ready to send state, as well as any
+ * that are in the process of being sent.   Used whenever we need to be
+ * sure the send side is idle.  Cleans up all buffer state by canceling
+ * all pio buffers, and issuing an abort, which cleans up anything in the
+ * launch fifo.  The cancel is superfluous on some chip versions, but
+ * it's safer to always do it.
+ * PIOAvail bits are updated by the chip as if normal send had happened.
+ */
+void ipath_cancel_sends(struct ipath_devdata *dd)
+{
+        ipath_dbg("Cancelling all in-progress send buffers\n");
+        dd->ipath_lastcancel = jiffies+HZ/2; /* skip armlaunch errs a bit */
+        /*
+         * the abort bit is auto-clearing.  We read scratch to be sure
+         * that cancels and the abort have taken effect in the chip.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                INFINIPATH_S_ABORT);
+        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        ipath_disarm_piobufs(dd, 0,
+                (unsigned)(dd->ipath_piobcnt2k + dd->ipath_piobcnt4k));
+
+        /* and again, be sure all have hit the chip */
+        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+}
+
+
 static void ipath_set_ib_lstate(struct ipath_devdata *dd, int which)
 {
         static const char *what[4] = {
@@ -1610,14 +1654,8 @@ static void ipath_set_ib_lstate(struct ipath_devdata *dd, int which)
                            INFINIPATH_IBCS_LINKTRAININGSTATE_MASK]);
         /* flush all queued sends when going to DOWN or INIT, to be sure that
          * they don't block MAD packets */
-        if (!linkcmd || linkcmd == INFINIPATH_IBCC_LINKCMD_INIT) {
-                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                                 INFINIPATH_S_ABORT);
-                ipath_disarm_piobufs(dd, dd->ipath_lastport_piobuf,
-                                    (unsigned)(dd->ipath_piobcnt2k +
-                                    dd->ipath_piobcnt4k) -
-                                    dd->ipath_lastport_piobuf);
-        }
+        if (!linkcmd || linkcmd == INFINIPATH_IBCC_LINKCMD_INIT)
+                ipath_cancel_sends(dd);
 
         ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
                          dd->ipath_ibcctrl | which);
@@ -1839,6 +1877,87 @@ void ipath_write_kreg_port(const struct ipath_devdata *dd, ipath_kreg regno,
         ipath_write_kreg(dd, where, value);
 }
 
+/*
+ * Following deal with the "obviously simple" task of overriding the state
+ * of the LEDS, which normally indicate link physical and logical status.
+ * The complications arise in dealing with different hardware mappings
+ * and the board-dependent routine being called from interrupts.
+ * and then there's the requirement to _flash_ them.
+ */
+#define LED_OVER_FREQ_SHIFT 8
+#define LED_OVER_FREQ_MASK (0xFF<<LED_OVER_FREQ_SHIFT)
+/* Below is "non-zero" to force override, but both actual LEDs are off */
+#define LED_OVER_BOTH_OFF (8)
+
+void ipath_run_led_override(unsigned long opaque)
+{
+        struct ipath_devdata *dd = (struct ipath_devdata *)opaque;
+        int timeoff;
+        int pidx;
+        u64 lstate, ltstate, val;
+
+        if (!(dd->ipath_flags & IPATH_INITTED))
+                return;
+
+        pidx = dd->ipath_led_override_phase++ & 1;
+        dd->ipath_led_override = dd->ipath_led_override_vals[pidx];
+        timeoff = dd->ipath_led_override_timeoff;
+
+        /*
+         * below potentially restores the LED values per current status,
+         * should also possibly setup the traffic-blink register,
+         * but leave that to per-chip functions.
+         */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_ibcstatus);
+        ltstate = (val >> INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) &
+                  INFINIPATH_IBCS_LINKTRAININGSTATE_MASK;
+        lstate = (val >> INFINIPATH_IBCS_LINKSTATE_SHIFT) &
+                 INFINIPATH_IBCS_LINKSTATE_MASK;
+
+        dd->ipath_f_setextled(dd, lstate, ltstate);
+        mod_timer(&dd->ipath_led_override_timer, jiffies + timeoff);
+}
+
+void ipath_set_led_override(struct ipath_devdata *dd, unsigned int val)
+{
+        int timeoff, freq;
+
+        if (!(dd->ipath_flags & IPATH_INITTED))
+                return;
+
+        /* First check if we are blinking. If not, use 1HZ polling */
+        timeoff = HZ;
+        freq = (val & LED_OVER_FREQ_MASK) >> LED_OVER_FREQ_SHIFT;
+
+        if (freq) {
+                /* For blink, set each phase from one nybble of val */
+                dd->ipath_led_override_vals[0] = val & 0xF;
+                dd->ipath_led_override_vals[1] = (val >> 4) & 0xF;
+                timeoff = (HZ << 4)/freq;
+        } else {
+                /* Non-blink set both phases the same. */
+                dd->ipath_led_override_vals[0] = val & 0xF;
+                dd->ipath_led_override_vals[1] = val & 0xF;
+        }
+        dd->ipath_led_override_timeoff = timeoff;
+
+        /*
+         * If the timer has not already been started, do so. Use a "quick"
+         * timeout so the function will be called soon, to look at our request.
+         */
+        if (atomic_inc_return(&dd->ipath_led_override_timer_active) == 1) {
+                /* Need to start timer */
+                init_timer(&dd->ipath_led_override_timer);
+                dd->ipath_led_override_timer.function =
+                                                 ipath_run_led_override;
+                dd->ipath_led_override_timer.data = (unsigned long) dd;
+                dd->ipath_led_override_timer.expires = jiffies + 1;
+                add_timer(&dd->ipath_led_override_timer);
+        } else {
+                atomic_dec(&dd->ipath_led_override_timer_active);
+        }
+}
+
 /**
  * ipath_shutdown_device - shut down a device
  * @dd: the infinipath device
@@ -1879,17 +1998,9 @@ void ipath_shutdown_device(struct ipath_devdata *dd)
          */
         udelay(5);
 
-        /*
-         * abort any armed or launched PIO buffers that didn't go. (self
-         * clearing).  Will cause any packet currently being transmitted to
-         * go out with an EBP, and may also cause a short packet error on
-         * the receiver.
-         */
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                         INFINIPATH_S_ABORT);
-
         ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKINITCMD_DISABLE <<
                             INFINIPATH_IBCC_LINKINITCMD_SHIFT);
+        ipath_cancel_sends(dd);
 
         /* disable IBC */
         dd->ipath_control &= ~INFINIPATH_C_LINKENABLE;
@@ -1902,7 +2013,6 @@ void ipath_shutdown_device(struct ipath_devdata *dd)
          * Turn the LEDs off explictly for the same reason.
          */
         dd->ipath_f_quiet_serdes(dd);
-        dd->ipath_f_setextled(dd, 0, 0);
 
         if (dd->ipath_stats_timer_active) {
                 del_timer_sync(&dd->ipath_stats_timer);
@@ -1918,6 +2028,9 @@ void ipath_shutdown_device(struct ipath_devdata *dd)
                          ~0ULL & ~INFINIPATH_HWE_MEMBISTFAILED);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear, -1LL);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, -1LL);
+
+        ipath_cdbg(VERBOSE, "Flush time and errors to EEPROM\n");
+        ipath_update_eeprom_log(dd);
 }
 
 /**
@@ -2078,6 +2191,16 @@ int ipath_reset_device(int unit)
                 goto bail;
         }
 
+        if (atomic_read(&dd->ipath_led_override_timer_active)) {
+                /* Need to stop LED timer, _then_ shut off LEDs */
+                del_timer_sync(&dd->ipath_led_override_timer);
+                atomic_set(&dd->ipath_led_override_timer_active, 0);
+        }
+
+        /* Shut off LEDs after we are sure timer is not running */
+        dd->ipath_led_override = LED_OVER_BOTH_OFF;
+        dd->ipath_f_setextled(dd, 0, 0);
+
         dev_info(&dd->pcidev->dev, "Reset on unit %u requested\n", unit);
 
         if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT)) {
diff --git a/drivers/infiniband/hw/ipath/ipath_eeprom.c b/drivers/infiniband/hw/ipath/ipath_eeprom.c
index 030185f90ee2..6b9147964a4f 100644
--- a/drivers/infiniband/hw/ipath/ipath_eeprom.c
+++ b/drivers/infiniband/hw/ipath/ipath_eeprom.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -95,39 +95,37 @@ static int i2c_gpio_set(struct ipath_devdata *dd,
                         enum i2c_type line,
                         enum i2c_state new_line_state)
 {
-        u64 read_val, write_val, mask, *gpioval;
+        u64 out_mask, dir_mask, *gpioval;
+        unsigned long flags = 0;
 
         gpioval = &dd->ipath_gpio_out;
-        read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extctrl);
-        if (line == i2c_line_scl)
-                mask = dd->ipath_gpio_scl;
-        else
-                mask = dd->ipath_gpio_sda;
 
-        if (new_line_state == i2c_line_high)
+        if (line == i2c_line_scl) {
+                dir_mask = dd->ipath_gpio_scl;
+                out_mask = (1UL << dd->ipath_gpio_scl_num);
+        } else {
+                dir_mask = dd->ipath_gpio_sda;
+                out_mask = (1UL << dd->ipath_gpio_sda_num);
+        }
+
+        spin_lock_irqsave(&dd->ipath_gpio_lock, flags);
+        if (new_line_state == i2c_line_high) {
                 /* tri-state the output rather than force high */
-                write_val = read_val & ~mask;
-        else
+                dd->ipath_extctrl &= ~dir_mask;
+        } else {
                 /* config line to be an output */
-                write_val = read_val | mask;
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, write_val);
+                dd->ipath_extctrl |= dir_mask;
+        }
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, dd->ipath_extctrl);
 
-        /* set high and verify */
+        /* set output as well (no real verify) */
         if (new_line_state == i2c_line_high)
-                write_val = 0x1UL;
+                *gpioval |= out_mask;
         else
-                write_val = 0x0UL;
+                *gpioval &= ~out_mask;
 
-        if (line == i2c_line_scl) {
-                write_val <<= dd->ipath_gpio_scl_num;
-                *gpioval = *gpioval & ~(1UL << dd->ipath_gpio_scl_num);
-                *gpioval |= write_val;
-        } else {
-                write_val <<= dd->ipath_gpio_sda_num;
-                *gpioval = *gpioval & ~(1UL << dd->ipath_gpio_sda_num);
-                *gpioval |= write_val;
-        }
         ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_out, *gpioval);
+        spin_unlock_irqrestore(&dd->ipath_gpio_lock, flags);
 
         return 0;
 }
@@ -145,8 +143,9 @@ static int i2c_gpio_get(struct ipath_devdata *dd,
                         enum i2c_type line,
                         enum i2c_state *curr_statep)
 {
-        u64 read_val, write_val, mask;
+        u64 read_val, mask;
         int ret;
+        unsigned long flags = 0;
 
         /* check args */
         if (curr_statep == NULL) {
@@ -154,15 +153,21 @@ static int i2c_gpio_get(struct ipath_devdata *dd,
                 goto bail;
         }
 
-        read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extctrl);
         /* config line to be an input */
         if (line == i2c_line_scl)
                 mask = dd->ipath_gpio_scl;
         else
                 mask = dd->ipath_gpio_sda;
-        write_val = read_val & ~mask;
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, write_val);
+
+        spin_lock_irqsave(&dd->ipath_gpio_lock, flags);
+        dd->ipath_extctrl &= ~mask;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, dd->ipath_extctrl);
+        /*
+         * Below is very unlikely to reflect true input state if Output
+         * Enable actually changed.
+         */
         read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
+        spin_unlock_irqrestore(&dd->ipath_gpio_lock, flags);
 
         if (read_val & mask)
                 *curr_statep = i2c_line_high;
@@ -192,6 +197,7 @@ static void i2c_wait_for_writes(struct ipath_devdata *dd)
 
 static void scl_out(struct ipath_devdata *dd, u8 bit)
 {
+        udelay(1);
         i2c_gpio_set(dd, i2c_line_scl, bit ? i2c_line_high : i2c_line_low);
 
         i2c_wait_for_writes(dd);
@@ -314,12 +320,18 @@ static int eeprom_reset(struct ipath_devdata *dd)
         int clock_cycles_left = 9;
         u64 *gpioval = &dd->ipath_gpio_out;
         int ret;
+        unsigned long flags;
 
-        eeprom_init = 1;
+        spin_lock_irqsave(&dd->ipath_gpio_lock, flags);
+        /* Make sure shadows are consistent */
+        dd->ipath_extctrl = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extctrl);
         *gpioval = ipath_read_kreg64(dd, dd->ipath_kregs->kr_gpio_out);
+        spin_unlock_irqrestore(&dd->ipath_gpio_lock, flags);
+
         ipath_cdbg(VERBOSE, "Resetting i2c eeprom; initial gpioout reg "
                    "is %llx\n", (unsigned long long) *gpioval);
 
+        eeprom_init = 1;
         /*
          * This is to get the i2c into a known state, by first going low,
          * then tristate sda (and then tristate scl as first thing
@@ -355,8 +367,8 @@ bail:
  * @len: number of bytes to receive
  */
 
-int ipath_eeprom_read(struct ipath_devdata *dd, u8 eeprom_offset,
-                      void *buffer, int len)
+static int ipath_eeprom_internal_read(struct ipath_devdata *dd,
+                                        u8 eeprom_offset, void *buffer, int len)
 {
         /* compiler complains unless initialized */
         u8 single_byte = 0;
@@ -406,6 +418,7 @@ bail:
         return ret;
 }
 
+
 /**
  * ipath_eeprom_write - writes data to the eeprom via I2C
  * @dd: the infinipath device
@@ -413,8 +426,8 @@ bail:
  * @buffer: data to write
  * @len: number of bytes to write
  */
-int ipath_eeprom_write(struct ipath_devdata *dd, u8 eeprom_offset,
-                       const void *buffer, int len)
+int ipath_eeprom_internal_write(struct ipath_devdata *dd, u8 eeprom_offset,
+                                const void *buffer, int len)
 {
         u8 single_byte;
         int sub_len;
@@ -488,6 +501,38 @@ bail:
         return ret;
 }
 
+/*
+ * The public entry-points ipath_eeprom_read() and ipath_eeprom_write()
+ * are now just wrappers around the internal functions.
+ */
+int ipath_eeprom_read(struct ipath_devdata *dd, u8 eeprom_offset,
+                        void *buff, int len)
+{
+        int ret;
+
+        ret = down_interruptible(&dd->ipath_eep_sem);
+        if (!ret) {
+                ret = ipath_eeprom_internal_read(dd, eeprom_offset, buff, len);
+                up(&dd->ipath_eep_sem);
+        }
+
+        return ret;
+}
+
+int ipath_eeprom_write(struct ipath_devdata *dd, u8 eeprom_offset,
+                        const void *buff, int len)
+{
+        int ret;
+
+        ret = down_interruptible(&dd->ipath_eep_sem);
+        if (!ret) {
+                ret = ipath_eeprom_internal_write(dd, eeprom_offset, buff, len);
+                up(&dd->ipath_eep_sem);
+        }
+
+        return ret;
+}
+
 static u8 flash_csum(struct ipath_flash *ifp, int adjust)
 {
         u8 *ip = (u8 *) ifp;
@@ -515,7 +560,7 @@ void ipath_get_eeprom_info(struct ipath_devdata *dd)
         void *buf;
         struct ipath_flash *ifp;
         __be64 guid;
-        int len;
+        int len, eep_stat;
         u8 csum, *bguid;
         int t = dd->ipath_unit;
         struct ipath_devdata *dd0 = ipath_lookup(0);
@@ -559,7 +604,11 @@ void ipath_get_eeprom_info(struct ipath_devdata *dd)
                 goto bail;
         }
 
-        if (ipath_eeprom_read(dd, 0, buf, len)) {
+        down(&dd->ipath_eep_sem);
+        eep_stat = ipath_eeprom_internal_read(dd, 0, buf, len);
+        up(&dd->ipath_eep_sem);
+
+        if (eep_stat) {
                 ipath_dev_err(dd, "Failed reading GUID from eeprom\n");
                 goto done;
         }
@@ -634,8 +683,192 @@ void ipath_get_eeprom_info(struct ipath_devdata *dd)
         ipath_cdbg(VERBOSE, "Initted GUID to %llx from eeprom\n",
                    (unsigned long long) be64_to_cpu(dd->ipath_guid));
 
+        memcpy(&dd->ipath_eep_st_errs, &ifp->if_errcntp, IPATH_EEP_LOG_CNT);
+        /*
+         * Power-on (actually "active") hours are kept as little-endian value
+         * in EEPROM, but as seconds in a (possibly as small as 24-bit)
+         * atomic_t while running.
+         */
+        atomic_set(&dd->ipath_active_time, 0);
+        dd->ipath_eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8);
+
 done:
         vfree(buf);
 
 bail:;
 }
+
+/**
+ * ipath_update_eeprom_log - copy active-time and error counters to eeprom
+ * @dd: the infinipath device
+ *
+ * Although the time is kept as seconds in the ipath_devdata struct, it is
+ * rounded to hours for re-write, as we have only 16 bits in EEPROM.
+ * First-cut code reads whole (expected) struct ipath_flash, modifies,
+ * re-writes. Future direction: read/write only what we need, assuming
+ * that the EEPROM had to have been "good enough" for driver init, and
+ * if not, we aren't making it worse.
+ *
+ */
+
+int ipath_update_eeprom_log(struct ipath_devdata *dd)
+{
+        void *buf;
+        struct ipath_flash *ifp;
+        int len, hi_water;
+        uint32_t new_time, new_hrs;
+        u8 csum;
+        int ret, idx;
+        unsigned long flags;
+
+        /* first, check if we actually need to do anything. */
+        ret = 0;
+        for (idx = 0; idx < IPATH_EEP_LOG_CNT; ++idx) {
+                if (dd->ipath_eep_st_new_errs[idx]) {
+                        ret = 1;
+                        break;
+                }
+        }
+        new_time = atomic_read(&dd->ipath_active_time);
+
+        if (ret == 0 && new_time < 3600)
+                return 0;
+
+        /*
+         * The quick-check above determined that there is something worthy
+         * of logging, so get current contents and do a more detailed idea.
+         */
+        len = offsetof(struct ipath_flash, if_future);
+        buf = vmalloc(len);
+        ret = 1;
+        if (!buf) {
+                ipath_dev_err(dd, "Couldn't allocate memory to read %u "
+                                "bytes from eeprom for logging\n", len);
+                goto bail;
+        }
+
+        /* Grab semaphore and read current EEPROM. If we get an
+         * error, let go, but if not, keep it until we finish write.
+         */
+        ret = down_interruptible(&dd->ipath_eep_sem);
+        if (ret) {
+                ipath_dev_err(dd, "Unable to acquire EEPROM for logging\n");
+                goto free_bail;
+        }
+        ret = ipath_eeprom_internal_read(dd, 0, buf, len);
+        if (ret) {
+                up(&dd->ipath_eep_sem);
+                ipath_dev_err(dd, "Unable read EEPROM for logging\n");
+                goto free_bail;
+        }
+        ifp = (struct ipath_flash *)buf;
+
+        csum = flash_csum(ifp, 0);
+        if (csum != ifp->if_csum) {
+                up(&dd->ipath_eep_sem);
+                ipath_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n",
+                                csum, ifp->if_csum);
+                ret = 1;
+                goto free_bail;
+        }
+        hi_water = 0;
+        spin_lock_irqsave(&dd->ipath_eep_st_lock, flags);
+        for (idx = 0; idx < IPATH_EEP_LOG_CNT; ++idx) {
+                int new_val = dd->ipath_eep_st_new_errs[idx];
+                if (new_val) {
+                        /*
+                         * If we have seen any errors, add to EEPROM values
+                         * We need to saturate at 0xFF (255) and we also
+                         * would need to adjust the checksum if we were
+                         * trying to minimize EEPROM traffic
+                         * Note that we add to actual current count in EEPROM,
+                         * in case it was altered while we were running.
+                         */
+                        new_val += ifp->if_errcntp[idx];
+                        if (new_val > 0xFF)
+                                new_val = 0xFF;
+                        if (ifp->if_errcntp[idx] != new_val) {
+                                ifp->if_errcntp[idx] = new_val;
+                                hi_water = offsetof(struct ipath_flash,
+                                                if_errcntp) + idx;
+                        }
+                        /*
+                         * update our shadow (used to minimize EEPROM
+                         * traffic), to match what we are about to write.
+                         */
+                        dd->ipath_eep_st_errs[idx] = new_val;
+                        dd->ipath_eep_st_new_errs[idx] = 0;
+                }
+        }
+        /*
+         * now update active-time. We would like to round to the nearest hour
+         * but unless atomic_t are sure to be proper signed ints we cannot,
+         * because we need to account for what we "transfer" to EEPROM and
+         * if we log an hour at 31 minutes, then we would need to set
+         * active_time to -29 to accurately count the _next_ hour.
+         */
+        if (new_time > 3600) {
+                new_hrs = new_time / 3600;
+                atomic_sub((new_hrs * 3600), &dd->ipath_active_time);
+                new_hrs += dd->ipath_eep_hrs;
+                if (new_hrs > 0xFFFF)
+                        new_hrs = 0xFFFF;
+                dd->ipath_eep_hrs = new_hrs;
+                if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) {
+                        ifp->if_powerhour[0] = new_hrs & 0xFF;
+                        hi_water = offsetof(struct ipath_flash, if_powerhour);
+                }
+                if ((new_hrs >> 8) != ifp->if_powerhour[1]) {
+                        ifp->if_powerhour[1] = new_hrs >> 8;
+                        hi_water = offsetof(struct ipath_flash, if_powerhour)
+                                        + 1;
+                }
+        }
+        /*
+         * There is a tiny possibility that we could somehow fail to write
+         * the EEPROM after updating our shadows, but problems from holding
+         * the spinlock too long are a much bigger issue.
+         */
+        spin_unlock_irqrestore(&dd->ipath_eep_st_lock, flags);
+        if (hi_water) {
+                /* we made some change to the data, uopdate cksum and write */
+                csum = flash_csum(ifp, 1);
+                ret = ipath_eeprom_internal_write(dd, 0, buf, hi_water + 1);
+        }
+        up(&dd->ipath_eep_sem);
+        if (ret)
+                ipath_dev_err(dd, "Failed updating EEPROM\n");
+
+free_bail:
+        vfree(buf);
+bail:
+        return ret;
+
+}
+
+/**
+ * ipath_inc_eeprom_err - increment one of the four error counters
+ * that are logged to EEPROM.
+ * @dd: the infinipath device
+ * @eidx: 0..3, the counter to increment
+ * @incr: how much to add
+ *
+ * Each counter is 8-bits, and saturates at 255 (0xFF). They
+ * are copied to the EEPROM (aka flash) whenever ipath_update_eeprom_log()
+ * is called, but it can only be called in a context that allows sleep.
+ * This function can be called even at interrupt level.
+ */
+
+void ipath_inc_eeprom_err(struct ipath_devdata *dd, u32 eidx, u32 incr)
+{
+        uint new_val;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dd->ipath_eep_st_lock, flags);
+        new_val = dd->ipath_eep_st_new_errs[eidx] + incr;
+        if (new_val > 255)
+                new_val = 255;
+        dd->ipath_eep_st_new_errs[eidx] = new_val;
+        spin_unlock_irqrestore(&dd->ipath_eep_st_lock, flags);
+        return;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 1272aaf2a785..33ab0d6b80ff 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -396,7 +396,8 @@ static int ipath_tid_update(struct ipath_portdata *pd, struct file *fp,
                            "TID %u, vaddr %lx, physaddr %llx pgp %p\n",
                            tid, vaddr, (unsigned long long) physaddr,
                            pagep[i]);
-                dd->ipath_f_put_tid(dd, &tidbase[tid], 1, physaddr);
+                dd->ipath_f_put_tid(dd, &tidbase[tid], RCVHQ_RCV_TYPE_EXPECTED,
+                                    physaddr);
                 /*
                  * don't check this tid in ipath_portshadow, since we
                  * just filled it in; start with the next one.
@@ -422,7 +423,8 @@ static int ipath_tid_update(struct ipath_portdata *pd, struct file *fp,
                         if (dd->ipath_pageshadow[porttid + tid]) {
                                 ipath_cdbg(VERBOSE, "Freeing TID %u\n",
                                            tid);
-                                dd->ipath_f_put_tid(dd, &tidbase[tid], 1,
+                                dd->ipath_f_put_tid(dd, &tidbase[tid],
+                                                    RCVHQ_RCV_TYPE_EXPECTED,
                                                     dd->ipath_tidinvalid);
                                 pci_unmap_page(dd->pcidev,
                                         dd->ipath_physshadow[porttid + tid],
@@ -538,7 +540,8 @@ static int ipath_tid_free(struct ipath_portdata *pd, unsigned subport,
                 if (dd->ipath_pageshadow[porttid + tid]) {
                         ipath_cdbg(VERBOSE, "PID %u freeing TID %u\n",
                                    pd->port_pid, tid);
-                        dd->ipath_f_put_tid(dd, &tidbase[tid], 1,
+                        dd->ipath_f_put_tid(dd, &tidbase[tid],
+                                            RCVHQ_RCV_TYPE_EXPECTED,
                                             dd->ipath_tidinvalid);
                         pci_unmap_page(dd->pcidev,
                                 dd->ipath_physshadow[porttid + tid],
@@ -921,7 +924,8 @@ static int ipath_create_user_egr(struct ipath_portdata *pd)
                                             (u64 __iomem *)
                                             ((char __iomem *)
                                              dd->ipath_kregbase +
-                                             dd->ipath_rcvegrbase), 0, pa);
+                                             dd->ipath_rcvegrbase),
+                                            RCVHQ_RCV_TYPE_EAGER, pa);
                         pa += egrsize;
                 }
                 cond_resched(); /* don't hog the cpu */
@@ -1337,68 +1341,133 @@ bail:
         return ret;
 }
 
-static unsigned int ipath_poll(struct file *fp,
-                               struct poll_table_struct *pt)
+static unsigned int ipath_poll_urgent(struct ipath_portdata *pd,
+                                      struct file *fp,
+                                      struct poll_table_struct *pt)
 {
-        struct ipath_portdata *pd;
-        u32 head, tail;
-        int bit;
         unsigned pollflag = 0;
         struct ipath_devdata *dd;
 
-        pd = port_fp(fp);
-        if (!pd)
-                goto bail;
         dd = pd->port_dd;
 
-        bit = pd->port_port + INFINIPATH_R_INTRAVAIL_SHIFT;
-        set_bit(bit, &dd->ipath_rcvctrl);
+        if (test_bit(IPATH_PORT_WAITING_OVERFLOW, &pd->int_flag)) {
+                pollflag |= POLLERR;
+                clear_bit(IPATH_PORT_WAITING_OVERFLOW, &pd->int_flag);
+        }
 
-        /*
-         * Before blocking, make sure that head is still == tail,
-         * reading from the chip, so we can be sure the interrupt
-         * enable has made it to the chip.  If not equal, disable
-         * interrupt again and return immediately.  This avoids races,
-         * and the overhead of the chip read doesn't matter much at
-         * this point, since we are waiting for something anyway.
-         */
+        if (test_bit(IPATH_PORT_WAITING_URG, &pd->int_flag)) {
+                pollflag |= POLLIN | POLLRDNORM;
+                clear_bit(IPATH_PORT_WAITING_URG, &pd->int_flag);
+        }
 
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
-                         dd->ipath_rcvctrl);
+        if (!pollflag) {
+                set_bit(IPATH_PORT_WAITING_URG, &pd->port_flag);
+                if (pd->poll_type & IPATH_POLL_TYPE_OVERFLOW)
+                        set_bit(IPATH_PORT_WAITING_OVERFLOW,
+                                &pd->port_flag);
+
+                poll_wait(fp, &pd->port_wait, pt);
+        }
+
+        return pollflag;
+}
+
+static unsigned int ipath_poll_next(struct ipath_portdata *pd,
+                                    struct file *fp,
+                                    struct poll_table_struct *pt)
+{
+        u32 head, tail;
+        unsigned pollflag = 0;
+        struct ipath_devdata *dd;
+
+        dd = pd->port_dd;
 
         head = ipath_read_ureg32(dd, ur_rcvhdrhead, pd->port_port);
-        tail = ipath_read_ureg32(dd, ur_rcvhdrtail, pd->port_port);
+        tail = *(volatile u64 *)pd->port_rcvhdrtail_kvaddr;
 
-        if (tail == head) {
+        if (test_bit(IPATH_PORT_WAITING_OVERFLOW, &pd->int_flag)) {
+                pollflag |= POLLERR;
+                clear_bit(IPATH_PORT_WAITING_OVERFLOW, &pd->int_flag);
+        }
+
+        if (tail != head ||
+            test_bit(IPATH_PORT_WAITING_RCV, &pd->int_flag)) {
+                pollflag |= POLLIN | POLLRDNORM;
+                clear_bit(IPATH_PORT_WAITING_RCV, &pd->int_flag);
+        }
+
+        if (!pollflag) {
                 set_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag);
+                if (pd->poll_type & IPATH_POLL_TYPE_OVERFLOW)
+                        set_bit(IPATH_PORT_WAITING_OVERFLOW,
+                                &pd->port_flag);
+
+                set_bit(pd->port_port + INFINIPATH_R_INTRAVAIL_SHIFT,
+                        &dd->ipath_rcvctrl);
+
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                                 dd->ipath_rcvctrl);
+
                 if (dd->ipath_rhdrhead_intr_off) /* arm rcv interrupt */
-                        (void)ipath_write_ureg(dd, ur_rcvhdrhead,
-                                               dd->ipath_rhdrhead_intr_off
-                                               | head, pd->port_port);
-                poll_wait(fp, &pd->port_wait, pt);
+                        ipath_write_ureg(dd, ur_rcvhdrhead,
+                                         dd->ipath_rhdrhead_intr_off | head,
+                                         pd->port_port);
 
-                if (test_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag)) {
-                        /* timed out, no packets received */
-                        clear_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag);
-                        pd->port_rcvwait_to++;
-                }
-                else
-                        pollflag = POLLIN | POLLRDNORM;
-        }
-        else {
-                /* it's already happened; don't do wait_event overhead */
-                pollflag = POLLIN | POLLRDNORM;
-                pd->port_rcvnowait++;
+                poll_wait(fp, &pd->port_wait, pt);
         }
 
-        clear_bit(bit, &dd->ipath_rcvctrl);
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
-                         dd->ipath_rcvctrl);
+        return pollflag;
+}
+
+static unsigned int ipath_poll(struct file *fp,
+                               struct poll_table_struct *pt)
+{
+        struct ipath_portdata *pd;
+        unsigned pollflag;
+
+        pd = port_fp(fp);
+        if (!pd)
+                pollflag = 0;
+        else if (pd->poll_type & IPATH_POLL_TYPE_URGENT)
+                pollflag = ipath_poll_urgent(pd, fp, pt);
+        else
+                pollflag = ipath_poll_next(pd, fp, pt);
 
-bail:
         return pollflag;
 }
 
+static int ipath_supports_subports(int user_swmajor, int user_swminor)
+{
+        /* no subport implementation prior to software version 1.3 */
+        return (user_swmajor > 1) || (user_swminor >= 3);
+}
+
+static int ipath_compatible_subports(int user_swmajor, int user_swminor)
+{
+        /* this code is written long-hand for clarity */
+        if (IPATH_USER_SWMAJOR != user_swmajor) {
+                /* no promise of compatibility if major mismatch */
+                return 0;
+        }
+        if (IPATH_USER_SWMAJOR == 1) {
+                switch (IPATH_USER_SWMINOR) {
+                case 0:
+                case 1:
+                case 2:
+                        /* no subport implementation so cannot be compatible */
+                        return 0;
+                case 3:
+                        /* 3 is only compatible with itself */
+                        return user_swminor == 3;
+                default:
+                        /* >= 4 are compatible (or are expected to be) */
+                        return user_swminor >= 4;
+                }
+        }
+        /* make no promises yet for future major versions */
+        return 0;
+}
+
 static int init_subports(struct ipath_devdata *dd,
                          struct ipath_portdata *pd,
                          const struct ipath_user_info *uinfo)
@@ -1408,20 +1477,32 @@ static int init_subports(struct ipath_devdata *dd,
         size_t size;
 
         /*
-         * If the user is requesting zero or one port,
+         * If the user is requesting zero subports,
          * skip the subport allocation.
          */
-        if (uinfo->spu_subport_cnt <= 1)
+        if (uinfo->spu_subport_cnt <= 0)
+                goto bail;
+
+        /* Self-consistency check for ipath_compatible_subports() */
+        if (ipath_supports_subports(IPATH_USER_SWMAJOR, IPATH_USER_SWMINOR) &&
+            !ipath_compatible_subports(IPATH_USER_SWMAJOR,
+                                       IPATH_USER_SWMINOR)) {
+                dev_info(&dd->pcidev->dev,
+                         "Inconsistent ipath_compatible_subports()\n");
                 goto bail;
+        }
 
-        /* Old user binaries don't know about new subport implementation */
-        if ((uinfo->spu_userversion & 0xffff) != IPATH_USER_SWMINOR) {
+        /* Check for subport compatibility */
+        if (!ipath_compatible_subports(uinfo->spu_userversion >> 16,
+                                       uinfo->spu_userversion & 0xffff)) {
                 dev_info(&dd->pcidev->dev,
-                         "Mismatched user minor version (%d) and driver "
-                         "minor version (%d) while port sharing. Ensure "
+                         "Mismatched user version (%d.%d) and driver "
+                         "version (%d.%d) while port sharing. Ensure "
                          "that driver and library are from the same "
                          "release.\n",
+                         (int) (uinfo->spu_userversion >> 16),
                          (int) (uinfo->spu_userversion & 0xffff),
+                         IPATH_USER_SWMAJOR,
                          IPATH_USER_SWMINOR);
                 goto bail;
         }
@@ -1725,14 +1806,13 @@ static int ipath_open(struct inode *in, struct file *fp)
         return fp->private_data ? 0 : -ENOMEM;
 }
 
-
 /* Get port early, so can set affinity prior to memory allocation */
 static int ipath_assign_port(struct file *fp,
                               const struct ipath_user_info *uinfo)
 {
         int ret;
         int i_minor;
-        unsigned swminor;
+        unsigned swmajor, swminor;
 
         /* Check to be sure we haven't already initialized this file */
         if (port_fp(fp)) {
@@ -1741,7 +1821,8 @@ static int ipath_assign_port(struct file *fp,
         }
 
         /* for now, if major version is different, bail */
-        if ((uinfo->spu_userversion >> 16) != IPATH_USER_SWMAJOR) {
+        swmajor = uinfo->spu_userversion >> 16;
+        if (swmajor != IPATH_USER_SWMAJOR) {
                 ipath_dbg("User major version %d not same as driver "
                           "major %d\n", uinfo->spu_userversion >> 16,
                           IPATH_USER_SWMAJOR);
@@ -1756,7 +1837,8 @@ static int ipath_assign_port(struct file *fp,
 
         mutex_lock(&ipath_mutex);
 
-        if (swminor == IPATH_USER_SWMINOR && uinfo->spu_subport_cnt &&
+        if (ipath_compatible_subports(swmajor, swminor) &&
+            uinfo->spu_subport_cnt &&
             (ret = find_shared_port(fp, uinfo))) {
                 mutex_unlock(&ipath_mutex);
                 if (ret > 0)
@@ -2020,7 +2102,8 @@ static int ipath_port_info(struct ipath_portdata *pd, u16 subport,
         info.port = pd->port_port;
         info.subport = subport;
         /* Don't return new fields if old library opened the port. */
-        if ((pd->userversion & 0xffff) == IPATH_USER_SWMINOR) {
+        if (ipath_supports_subports(pd->userversion >> 16,
+                                    pd->userversion & 0xffff)) {
                 /* Number of user ports available for this device. */
                 info.num_ports = pd->port_dd->ipath_cfgports - 1;
                 info.num_subports = pd->port_subport_cnt;
@@ -2123,6 +2206,11 @@ static ssize_t ipath_write(struct file *fp, const char __user *data,
                 src = NULL;
                 dest = NULL;
                 break;
+        case IPATH_CMD_POLL_TYPE:
+                copy = sizeof(cmd.cmd.poll_type);
+                dest = &cmd.cmd.poll_type;
+                src = &ucmd->cmd.poll_type;
+                break;
         default:
                 ret = -EINVAL;
                 goto bail;
@@ -2195,6 +2283,9 @@ static ssize_t ipath_write(struct file *fp, const char __user *data,
         case IPATH_CMD_PIOAVAILUPD:
                 ret = ipath_force_pio_avail_update(pd->port_dd);
                 break;
+        case IPATH_CMD_POLL_TYPE:
+                pd->poll_type = cmd.cmd.poll_type;
+                break;
         }
 
         if (ret >= 0)
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index ebd5c7bd2cdb..2e689b974e1f 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -257,9 +257,14 @@ static ssize_t atomic_port_info_read(struct file *file, char __user *buf,
                 /* Notimpl InitType (actually, an SMA decision) */
                 /* VLHighLimit is 0 (only one VL) */
                 ; /* VLArbitrationHighCap is 0 (only one VL) */
+        /*
+         * Note: the chips support a maximum MTU of 4096, but the driver
+         * hasn't implemented this feature yet, so set the maximum
+         * to 2048.
+         */
         portinfo[10] =  /* VLArbitrationLowCap is 0 (only one VL) */
                 /* InitTypeReply is SMA decision */
-                (5 << 16)       /* MTUCap 4096 */
+                (4 << 16)       /* MTUCap 2048 */
                 | (7 << 13)     /* VLStallCount */
                 | (0x1f << 8)   /* HOQLife */
                 | (1 << 4)
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6110.c b/drivers/infiniband/hw/ipath/ipath_iba6110.c
index 4171198fc202..650745d83fac 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6110.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6110.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -36,6 +36,7 @@
  * HT chip.
  */
 
+#include <linux/vmalloc.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/htirq.h>
@@ -439,6 +440,7 @@ static void ipath_ht_handle_hwerrors(struct ipath_devdata *dd, char *msg,
         u32 bits, ctrl;
         int isfatal = 0;
         char bitsmsg[64];
+        int log_idx;
 
         hwerrs = ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus);
 
@@ -467,6 +469,11 @@ static void ipath_ht_handle_hwerrors(struct ipath_devdata *dd, char *msg,
 
         hwerrs &= dd->ipath_hwerrmask;
 
+        /* We log some errors to EEPROM, check if we have any of those. */
+        for (log_idx = 0; log_idx < IPATH_EEP_LOG_CNT; ++log_idx)
+                if (hwerrs & dd->ipath_eep_st_masks[log_idx].hwerrs_to_log)
+                        ipath_inc_eeprom_err(dd, log_idx, 1);
+
         /*
          * make sure we get this much out, unless told to be quiet,
          * it's a parity error we may recover from,
@@ -502,9 +509,7 @@ static void ipath_ht_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                 if (!hwerrs) {
                         ipath_dbg("Clearing freezemode on ignored or "
                                   "recovered hardware error\n");
-                        ctrl &= ~INFINIPATH_C_FREEZEMODE;
-                        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
-                                         ctrl);
+                        ipath_clear_freeze(dd);
                 }
         }
 
@@ -672,10 +677,16 @@ static int ipath_ht_boardname(struct ipath_devdata *dd, char *name,
         if (n)
                 snprintf(name, namelen, "%s", n);
 
+        if (dd->ipath_boardrev != 6 && dd->ipath_boardrev != 7 &&
+            dd->ipath_boardrev != 11) {
+                ipath_dev_err(dd, "Unsupported InfiniPath board %s!\n", name);
+                ret = 1;
+                goto bail;
+        }
         if (dd->ipath_majrev != 3 || (dd->ipath_minrev < 2 ||
-                dd->ipath_minrev > 3)) {
+                dd->ipath_minrev > 4)) {
                 /*
-                 * This version of the driver only supports Rev 3.2 and 3.3
+                 * This version of the driver only supports Rev 3.2 - 3.4
                  */
                 ipath_dev_err(dd,
                               "Unsupported InfiniPath hardware revision %u.%u!\n",
@@ -689,36 +700,11 @@ static int ipath_ht_boardname(struct ipath_devdata *dd, char *name,
          * copies
          */
         dd->ipath_flags |= IPATH_32BITCOUNTERS;
+        dd->ipath_flags |= IPATH_GPIO_INTR;
         if (dd->ipath_htspeed != 800)
                 ipath_dev_err(dd,
                               "Incorrectly configured for HT @ %uMHz\n",
                               dd->ipath_htspeed);
-        if (dd->ipath_boardrev == 7 || dd->ipath_boardrev == 11 ||
-            dd->ipath_boardrev == 6)
-                dd->ipath_flags |= IPATH_GPIO_INTR;
-        else
-                dd->ipath_flags |= IPATH_POLL_RX_INTR;
-        if (dd->ipath_boardrev == 8) {  /* LS/X-1 */
-                u64 val;
-                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
-                if (val & INFINIPATH_EXTS_SERDESSEL) {
-                        /*
-                         * hardware disabled
-                         *
-                         * This means that the chip is hardware disabled,
-                         * and will not be able to bring up the link,
-                         * in any case.  We special case this and abort
-                         * early, to avoid later messages.  We also set
-                         * the DISABLED status bit
-                         */
-                        ipath_dbg("Unit %u is hardware-disabled\n",
-                                  dd->ipath_unit);
-                        *dd->ipath_statusp |= IPATH_STATUS_DISABLED;
-                        /* this value is handled differently */
-                        ret = 2;
-                        goto bail;
-                }
-        }
         ret = 0;
 
 bail:
@@ -1058,12 +1044,24 @@ static void ipath_setup_ht_setextled(struct ipath_devdata *dd,
                                      u64 lst, u64 ltst)
 {
         u64 extctl;
+        unsigned long flags = 0;
 
         /* the diags use the LED to indicate diag info, so we leave
          * the external LED alone when the diags are running */
         if (ipath_diag_inuse)
                 return;
 
+        /* Allow override of LED display for, e.g. Locating system in rack */
+        if (dd->ipath_led_override) {
+                ltst = (dd->ipath_led_override & IPATH_LED_PHYS)
+                        ? INFINIPATH_IBCS_LT_STATE_LINKUP
+                        : INFINIPATH_IBCS_LT_STATE_DISABLED;
+                lst = (dd->ipath_led_override & IPATH_LED_LOG)
+                        ? INFINIPATH_IBCS_L_STATE_ACTIVE
+                        : INFINIPATH_IBCS_L_STATE_DOWN;
+        }
+
+        spin_lock_irqsave(&dd->ipath_gpio_lock, flags);
         /*
          * start by setting both LED control bits to off, then turn
          * on the appropriate bit(s).
@@ -1092,6 +1090,7 @@ static void ipath_setup_ht_setextled(struct ipath_devdata *dd,
         }
         dd->ipath_extctrl = extctl;
         ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, extctl);
+        spin_unlock_irqrestore(&dd->ipath_gpio_lock, flags);
 }
 
 static void ipath_init_ht_variables(struct ipath_devdata *dd)
@@ -1157,6 +1156,22 @@ static void ipath_init_ht_variables(struct ipath_devdata *dd)
 
         dd->ipath_i_rcvavail_mask = INFINIPATH_I_RCVAVAIL_MASK;
         dd->ipath_i_rcvurg_mask = INFINIPATH_I_RCVURG_MASK;
+
+        /*
+         * EEPROM error log 0 is TXE Parity errors. 1 is RXE Parity.
+         * 2 is Some Misc, 3 is reserved for future.
+         */
+        dd->ipath_eep_st_masks[0].hwerrs_to_log =
+                INFINIPATH_HWE_TXEMEMPARITYERR_MASK <<
+                INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT;
+
+        dd->ipath_eep_st_masks[1].hwerrs_to_log =
+                INFINIPATH_HWE_RXEMEMPARITYERR_MASK <<
+                INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT;
+
+        dd->ipath_eep_st_masks[2].errs_to_log =
+                INFINIPATH_E_INVALIDADDR | INFINIPATH_E_RESET;
+
 }
 
 /**
@@ -1372,7 +1387,7 @@ static void ipath_ht_quiet_serdes(struct ipath_devdata *dd)
  * ipath_pe_put_tid - write a TID in chip
  * @dd: the infinipath device
  * @tidptr: pointer to the expected TID (in chip) to udpate
- * @tidtype: 0 for eager, 1 for expected
+ * @tidtype: RCVHQ_RCV_TYPE_EAGER (1) for eager, RCVHQ_RCV_TYPE_EXPECTED (0) for expected
  * @pa: physical address of in memory buffer; ipath_tidinvalid if freeing
  *
  * This exists as a separate routine to allow for special locking etc.
@@ -1393,7 +1408,7 @@ static void ipath_ht_put_tid(struct ipath_devdata *dd,
                                  "40 bits, using only 40!!!\n", pa);
                         pa &= INFINIPATH_RT_ADDR_MASK;
                 }
-                if (type == 0)
+                if (type == RCVHQ_RCV_TYPE_EAGER)
                         pa |= dd->ipath_tidtemplate;
                 else {
                         /* in words (fixed, full page).  */
@@ -1433,7 +1448,8 @@ static void ipath_ht_clear_tids(struct ipath_devdata *dd, unsigned port)
                                    port * dd->ipath_rcvtidcnt *
                                    sizeof(*tidbase));
         for (i = 0; i < dd->ipath_rcvtidcnt; i++)
-                ipath_ht_put_tid(dd, &tidbase[i], 1, dd->ipath_tidinvalid);
+                ipath_ht_put_tid(dd, &tidbase[i], RCVHQ_RCV_TYPE_EXPECTED,
+                                 dd->ipath_tidinvalid);
 
         tidbase = (u64 __iomem *) ((char __iomem *)(dd->ipath_kregbase) +
                                    dd->ipath_rcvegrbase +
@@ -1441,7 +1457,8 @@ static void ipath_ht_clear_tids(struct ipath_devdata *dd, unsigned port)
                                    sizeof(*tidbase));
 
         for (i = 0; i < dd->ipath_rcvegrcnt; i++)
-                ipath_ht_put_tid(dd, &tidbase[i], 0, dd->ipath_tidinvalid);
+                ipath_ht_put_tid(dd, &tidbase[i], RCVHQ_RCV_TYPE_EAGER,
+                                 dd->ipath_tidinvalid);
 }
 
 /**
@@ -1528,11 +1545,6 @@ static int ipath_ht_early_init(struct ipath_devdata *dd)
                 writel(16, piobuf);
                 piobuf += pioincr;
         }
-        /*
-         * self-clearing
-         */
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                         INFINIPATH_S_ABORT);
 
         ipath_get_eeprom_info(dd);
         if (dd->ipath_boardrev == 5 && dd->ipath_serial[0] == '1' &&
@@ -1543,8 +1555,10 @@ static int ipath_ht_early_init(struct ipath_devdata *dd)
                  * with 128, rather than 112.
                  */
                 dd->ipath_flags |= IPATH_GPIO_INTR;
-                dd->ipath_flags &= ~IPATH_POLL_RX_INTR;
-        }
+        } else
+                ipath_dev_err(dd, "Unsupported InfiniPath serial "
+                              "number %.16s!\n", dd->ipath_serial);
+
         return 0;
 }
 
@@ -1561,7 +1575,6 @@ static int ipath_ht_txe_recover(struct ipath_devdata *dd)
         }
         dev_info(&dd->pcidev->dev,
                 "Recovering from TXE PIO parity error\n");
-        ipath_disarm_senderrbufs(dd, 1);
         return 1;
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6120.c b/drivers/infiniband/hw/ipath/ipath_iba6120.c
index 4e2e3dfeb2c8..9868ccda5f26 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6120.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6120.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -296,13 +296,6 @@ static const struct ipath_cregs ipath_pe_cregs = {
 #define IPATH_GPIO_SCL (1ULL << \
         (_IPATH_GPIO_SCL_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
 
-/*
- * Rev2 silicon allows suppressing check for ArmLaunch errors.
- * this can speed up short packet sends on systems that do
- * not guaranteee write-order.
- */
-#define INFINIPATH_XGXS_SUPPRESS_ARMLAUNCH_ERR (1ULL<<63)
-
 /* 6120 specific hardware errors... */
 static const struct ipath_hwerror_msgs ipath_6120_hwerror_msgs[] = {
         INFINIPATH_HWE_MSG(PCIEPOISONEDTLP, "PCIe Poisoned TLP"),
@@ -347,6 +340,7 @@ static void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
         u32 bits, ctrl;
         int isfatal = 0;
         char bitsmsg[64];
+        int log_idx;
 
         hwerrs = ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus);
         if (!hwerrs) {
@@ -374,6 +368,11 @@ static void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
 
         hwerrs &= dd->ipath_hwerrmask;
 
+        /* We log some errors to EEPROM, check if we have any of those. */
+        for (log_idx = 0; log_idx < IPATH_EEP_LOG_CNT; ++log_idx)
+                if (hwerrs & dd->ipath_eep_st_masks[log_idx].hwerrs_to_log)
+                        ipath_inc_eeprom_err(dd, log_idx, 1);
+
         /*
          * make sure we get this much out, unless told to be quiet,
          * or it's occurred within the last 5 seconds
@@ -431,10 +430,12 @@ static void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                         *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
                         dd->ipath_flags &= ~IPATH_INITTED;
                 } else {
-                        ipath_dbg("Clearing freezemode on ignored hardware "
-                                  "error\n");
-                        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
-                                         dd->ipath_control);
+                        static u32 freeze_cnt;
+
+                        freeze_cnt++;
+                        ipath_dbg("Clearing freezemode on ignored or recovered "
+                                  "hardware error (%u)\n", freeze_cnt);
+                        ipath_clear_freeze(dd);
                 }
         }
 
@@ -680,17 +681,6 @@ static int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
                 val |= dd->ipath_rx_pol_inv <<
                         INFINIPATH_XGXS_RX_POL_SHIFT;
         }
-        if (dd->ipath_minrev >= 2) {
-                /* Rev 2. can tolerate multiple writes to PBC, and
-                 * allowing them can provide lower latency on some
-                 * CPUs, but this feature is off by default, only
-                 * turned on by setting D63 of XGXSconfig reg.
-                 * May want to make this conditional more
-                 * fine-grained in future. This is not exactly
-                 * related to XGXS, but where the bit ended up.
-                 */
-                val |= INFINIPATH_XGXS_SUPPRESS_ARMLAUNCH_ERR;
-        }
         if (val != prev_val)
                 ipath_write_kreg(dd, dd->ipath_kregs->kr_xgxsconfig, val);
 
@@ -791,12 +781,24 @@ static void ipath_setup_pe_setextled(struct ipath_devdata *dd, u64 lst,
                                      u64 ltst)
 {
         u64 extctl;
+        unsigned long flags = 0;
 
         /* the diags use the LED to indicate diag info, so we leave
          * the external LED alone when the diags are running */
         if (ipath_diag_inuse)
                 return;
 
+        /* Allow override of LED display for, e.g. Locating system in rack */
+        if (dd->ipath_led_override) {
+                ltst = (dd->ipath_led_override & IPATH_LED_PHYS)
+                        ? INFINIPATH_IBCS_LT_STATE_LINKUP
+                        : INFINIPATH_IBCS_LT_STATE_DISABLED;
+                lst = (dd->ipath_led_override & IPATH_LED_LOG)
+                        ? INFINIPATH_IBCS_L_STATE_ACTIVE
+                        : INFINIPATH_IBCS_L_STATE_DOWN;
+        }
+
+        spin_lock_irqsave(&dd->ipath_gpio_lock, flags);
         extctl = dd->ipath_extctrl & ~(INFINIPATH_EXTC_LED1PRIPORT_ON |
                                        INFINIPATH_EXTC_LED2PRIPORT_ON);
 
@@ -806,6 +808,7 @@ static void ipath_setup_pe_setextled(struct ipath_devdata *dd, u64 lst,
                 extctl |= INFINIPATH_EXTC_LED1PRIPORT_ON;
         dd->ipath_extctrl = extctl;
         ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, extctl);
+        spin_unlock_irqrestore(&dd->ipath_gpio_lock, flags);
 }
 
 /**
@@ -955,6 +958,27 @@ static void ipath_init_pe_variables(struct ipath_devdata *dd)
 
         dd->ipath_i_rcvavail_mask = INFINIPATH_I_RCVAVAIL_MASK;
         dd->ipath_i_rcvurg_mask = INFINIPATH_I_RCVURG_MASK;
+
+        /*
+         * EEPROM error log 0 is TXE Parity errors. 1 is RXE Parity.
+         * 2 is Some Misc, 3 is reserved for future.
+         */
+        dd->ipath_eep_st_masks[0].hwerrs_to_log =
+                INFINIPATH_HWE_TXEMEMPARITYERR_MASK <<
+                INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT;
+
+        /* Ignore errors in PIO/PBC on systems with unordered write-combining */
+        if (ipath_unordered_wc())
+                dd->ipath_eep_st_masks[0].hwerrs_to_log &= ~TXE_PIO_PARITY;
+
+        dd->ipath_eep_st_masks[1].hwerrs_to_log =
+                INFINIPATH_HWE_RXEMEMPARITYERR_MASK <<
+                INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT;
+
+        dd->ipath_eep_st_masks[2].errs_to_log =
+                INFINIPATH_E_INVALIDADDR | INFINIPATH_E_RESET;
+
+
 }
 
 /* setup the MSI stuff again after a reset.  I'd like to just call
@@ -1082,7 +1106,7 @@ bail:
  * ipath_pe_put_tid - write a TID in chip
  * @dd: the infinipath device
  * @tidptr: pointer to the expected TID (in chip) to udpate
- * @tidtype: 0 for eager, 1 for expected
+ * @tidtype: RCVHQ_RCV_TYPE_EAGER (1) for eager, RCVHQ_RCV_TYPE_EXPECTED (0) for expected
  * @pa: physical address of in memory buffer; ipath_tidinvalid if freeing
  *
  * This exists as a separate routine to allow for special locking etc.
@@ -1108,7 +1132,7 @@ static void ipath_pe_put_tid(struct ipath_devdata *dd, u64 __iomem *tidptr,
                                       "BUG: Physical page address 0x%lx "
                                       "has bits set in 31-29\n", pa);
 
-                if (type == 0)
+                if (type == RCVHQ_RCV_TYPE_EAGER)
                         pa |= dd->ipath_tidtemplate;
                 else /* for now, always full 4KB page */
                         pa |= 2 << 29;
@@ -1132,7 +1156,7 @@ static void ipath_pe_put_tid(struct ipath_devdata *dd, u64 __iomem *tidptr,
  * ipath_pe_put_tid_2 - write a TID in chip, Revision 2 or higher
  * @dd: the infinipath device
  * @tidptr: pointer to the expected TID (in chip) to udpate
- * @tidtype: 0 for eager, 1 for expected
+ * @tidtype: RCVHQ_RCV_TYPE_EAGER (1) for eager, RCVHQ_RCV_TYPE_EXPECTED (0) for expected
  * @pa: physical address of in memory buffer; ipath_tidinvalid if freeing
  *
  * This exists as a separate routine to allow for selection of the
@@ -1157,7 +1181,7 @@ static void ipath_pe_put_tid_2(struct ipath_devdata *dd, u64 __iomem *tidptr,
                                       "BUG: Physical page address 0x%lx "
                                       "has bits set in 31-29\n", pa);
 
-                if (type == 0)
+                if (type == RCVHQ_RCV_TYPE_EAGER)
                         pa |= dd->ipath_tidtemplate;
                 else /* for now, always full 4KB page */
                         pa |= 2 << 29;
@@ -1196,7 +1220,8 @@ static void ipath_pe_clear_tids(struct ipath_devdata *dd, unsigned port)
                  port * dd->ipath_rcvtidcnt * sizeof(*tidbase));
 
         for (i = 0; i < dd->ipath_rcvtidcnt; i++)
-                ipath_pe_put_tid(dd, &tidbase[i], 0, tidinv);
+                ipath_pe_put_tid(dd, &tidbase[i], RCVHQ_RCV_TYPE_EXPECTED,
+                                 tidinv);
 
         tidbase = (u64 __iomem *)
                 ((char __iomem *)(dd->ipath_kregbase) +
@@ -1204,7 +1229,8 @@ static void ipath_pe_clear_tids(struct ipath_devdata *dd, unsigned port)
                  port * dd->ipath_rcvegrcnt * sizeof(*tidbase));
 
         for (i = 0; i < dd->ipath_rcvegrcnt; i++)
-                ipath_pe_put_tid(dd, &tidbase[i], 1, tidinv);
+                ipath_pe_put_tid(dd, &tidbase[i], RCVHQ_RCV_TYPE_EAGER,
+                                 tidinv);
 }
 
 /**
@@ -1311,13 +1337,6 @@ static int ipath_pe_get_base_info(struct ipath_portdata *pd, void *kbase)
 
         dd = pd->port_dd;
 
-        if (dd != NULL && dd->ipath_minrev >= 2) {
-                ipath_cdbg(PROC, "IBA6120 Rev2, allow multiple PBC write\n");
-                kinfo->spi_runtime_flags |= IPATH_RUNTIME_PBC_REWRITE;
-                ipath_cdbg(PROC, "IBA6120 Rev2, allow loose DMA alignment\n");
-                kinfo->spi_runtime_flags |= IPATH_RUNTIME_LOOSE_DMA_ALIGN;
-        }
-
 done:
         kinfo->spi_runtime_flags |= IPATH_RUNTIME_PCIE;
         return 0;
@@ -1354,7 +1373,6 @@ static int ipath_pe_txe_recover(struct ipath_devdata *dd)
                 dev_info(&dd->pcidev->dev,
                         "Recovering from TXE PIO parity error\n");
         }
-        ipath_disarm_senderrbufs(dd, 1);
         return 1;
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 7045ba689494..49951d583804 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -133,7 +133,8 @@ static int create_port0_egr(struct ipath_devdata *dd)
                                    dd->ipath_ibmaxlen, PCI_DMA_FROMDEVICE);
                 dd->ipath_f_put_tid(dd, e + (u64 __iomem *)
                                     ((char __iomem *) dd->ipath_kregbase +
-                                     dd->ipath_rcvegrbase), 0,
+                                     dd->ipath_rcvegrbase),
+                                    RCVHQ_RCV_TYPE_EAGER,
                                     dd->ipath_port0_skbinfo[e].phys);
         }
 
@@ -310,7 +311,12 @@ static int init_chip_first(struct ipath_devdata *dd,
         val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpiosize);
         dd->ipath_piosize2k = val & ~0U;
         dd->ipath_piosize4k = val >> 32;
-        dd->ipath_ibmtu = 4096; /* default to largest legal MTU */
+        /*
+         * Note: the chips support a maximum MTU of 4096, but the driver
+         * hasn't implemented this feature yet, so set the initial value
+         * to 2048.
+         */
+        dd->ipath_ibmtu = 2048;
         val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpiobufcnt);
         dd->ipath_piobcnt2k = val & ~0U;
         dd->ipath_piobcnt4k = val >> 32;
@@ -340,6 +346,10 @@ static int init_chip_first(struct ipath_devdata *dd,
 
         spin_lock_init(&dd->ipath_tid_lock);
 
+        spin_lock_init(&dd->ipath_gpio_lock);
+        spin_lock_init(&dd->ipath_eep_st_lock);
+        sema_init(&dd->ipath_eep_sem, 1);
+
 done:
         *pdp = pd;
         return ret;
@@ -646,7 +656,7 @@ static int init_housekeeping(struct ipath_devdata *dd,
         ret = dd->ipath_f_get_boardname(dd, boardn, sizeof boardn);
 
         snprintf(dd->ipath_boardversion, sizeof(dd->ipath_boardversion),
-                 "Driver %u.%u, %s, InfiniPath%u %u.%u, PCI %u, "
+                 "ChipABI %u.%u, %s, InfiniPath%u %u.%u, PCI %u, "
                  "SW Compat %u\n",
                  IPATH_CHIP_VERS_MAJ, IPATH_CHIP_VERS_MIN, boardn,
                  (unsigned)(dd->ipath_revision >> INFINIPATH_R_ARCH_SHIFT) &
@@ -727,7 +737,7 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
         uports = dd->ipath_cfgports ? dd->ipath_cfgports - 1 : 0;
         if (ipath_kpiobufs == 0) {
                 /* not set by user (this is default) */
-                if (piobufs >= (uports * IPATH_MIN_USER_PORT_BUFCNT) + 32)
+                if (piobufs > 144)
                         kpiobufs = 32;
                 else
                         kpiobufs = 16;
@@ -767,6 +777,12 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
                    piobufs, dd->ipath_pbufsport, uports);
 
         dd->ipath_f_early_init(dd);
+        /*
+         * cancel any possible active sends from early driver load.
+         * Follows early_init because some chips have to initialize
+         * PIO buffers in early_init to avoid false parity errors.
+         */
+        ipath_cancel_sends(dd);
 
         /* early_init sets rcvhdrentsize and rcvhdrsize, so this must be
          * done after early_init */
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index a90d3b5699c4..47aa43428fbf 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -93,7 +93,8 @@ void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
 
         if (sbuf[0] || sbuf[1] || (piobcnt > 128 && (sbuf[2] || sbuf[3]))) {
                 int i;
-                if (ipath_debug & (__IPATH_PKTDBG|__IPATH_DBG)) {
+                if (ipath_debug & (__IPATH_PKTDBG|__IPATH_DBG) &&
+                        dd->ipath_lastcancel > jiffies) {
                         __IPATH_DBG_WHICH(__IPATH_PKTDBG|__IPATH_DBG,
                                           "SendbufErrs %lx %lx", sbuf[0],
                                           sbuf[1]);
@@ -108,7 +109,8 @@ void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
                                         ipath_clrpiobuf(dd, i);
                                 ipath_disarm_piobufs(dd, i, 1);
                         }
-                dd->ipath_lastcancel = jiffies+3; /* no armlaunch for a bit */
+                /* ignore armlaunch errs for a bit */
+                dd->ipath_lastcancel = jiffies+3;
         }
 }
 
@@ -131,6 +133,17 @@ void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
          INFINIPATH_E_INVALIDADDR)
 
 /*
+ * this is similar to E_SUM_ERRS, but can't ignore armlaunch, don't ignore
+ * errors not related to freeze and cancelling buffers.  Can't ignore
+ * armlaunch because could get more while still cleaning up, and need
+ * to cancel those as they happen.
+ */
+#define E_SPKT_ERRS_IGNORE \
+         (INFINIPATH_E_SDROPPEDDATAPKT | INFINIPATH_E_SDROPPEDSMPPKT | \
+         INFINIPATH_E_SMAXPKTLEN | INFINIPATH_E_SMINPKTLEN | \
+         INFINIPATH_E_SPKTLEN)
+
+/*
  * these are errors that can occur when the link changes state while
  * a packet is being sent or received.  This doesn't cover things
  * like EBP or VCRC that can be the result of a sending having the
@@ -290,12 +303,7 @@ static void handle_e_ibstatuschanged(struct ipath_devdata *dd,
                  * Flush all queued sends when link went to DOWN or INIT,
                  * to be sure that they don't block SMA and other MAD packets
                  */
-                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                                 INFINIPATH_S_ABORT);
-                ipath_disarm_piobufs(dd, dd->ipath_lastport_piobuf,
-                                                        (unsigned)(dd->ipath_piobcnt2k +
-                                        dd->ipath_piobcnt4k) -
-                                        dd->ipath_lastport_piobuf);
+                ipath_cancel_sends(dd);
         }
         else if (lstate == IPATH_IBSTATE_INIT || lstate == IPATH_IBSTATE_ARM ||
             lstate == IPATH_IBSTATE_ACTIVE) {
@@ -505,6 +513,7 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
         int i, iserr = 0;
         int chkerrpkts = 0, noprint = 0;
         unsigned supp_msgs;
+        int log_idx;
 
         supp_msgs = handle_frequent_errors(dd, errs, msg, &noprint);
 
@@ -518,6 +527,13 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
         if (errs & INFINIPATH_E_HARDWARE) {
                 /* reuse same msg buf */
                 dd->ipath_f_handle_hwerrors(dd, msg, sizeof msg);
+        } else {
+                u64 mask;
+                for (log_idx = 0; log_idx < IPATH_EEP_LOG_CNT; ++log_idx) {
+                        mask = dd->ipath_eep_st_masks[log_idx].errs_to_log;
+                        if (errs & mask)
+                                ipath_inc_eeprom_err(dd, log_idx, 1);
+                }
         }
 
         if (!noprint && (errs & ~dd->ipath_e_bitsextant))
@@ -675,6 +691,17 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
                                         chkerrpkts = 1;
                                 dd->ipath_lastrcvhdrqtails[i] = tl;
                                 pd->port_hdrqfull++;
+                                if (test_bit(IPATH_PORT_WAITING_OVERFLOW,
+                                             &pd->port_flag)) {
+                                        clear_bit(
+                                          IPATH_PORT_WAITING_OVERFLOW,
+                                          &pd->port_flag);
+                                        set_bit(
+                                          IPATH_PORT_WAITING_OVERFLOW,
+                                          &pd->int_flag);
+                                        wake_up_interruptible(
+                                          &pd->port_wait);
+                                }
                         }
                 }
         }
@@ -744,6 +771,72 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
         return chkerrpkts;
 }
 
+
+/*
+ * try to cleanup as much as possible for anything that might have gone
+ * wrong while in freeze mode, such as pio buffers being written by user
+ * processes (causing armlaunch), send errors due to going into freeze mode,
+ * etc., and try to avoid causing extra interrupts while doing so.
+ * Forcibly update the in-memory pioavail register copies after cleanup
+ * because the chip won't do it for anything changing while in freeze mode
+ * (we don't want to wait for the next pio buffer state change).
+ * Make sure that we don't lose any important interrupts by using the chip
+ * feature that says that writing 0 to a bit in *clear that is set in
+ * *status will cause an interrupt to be generated again (if allowed by
+ * the *mask value).
+ */
+void ipath_clear_freeze(struct ipath_devdata *dd)
+{
+        int i, im;
+        __le64 val;
+
+        /* disable error interrupts, to avoid confusion */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask, 0ULL);
+
+        /*
+         * clear all sends, because they have may been
+         * completed by usercode while in freeze mode, and
+         * therefore would not be sent, and eventually
+         * might cause the process to run out of bufs
+         */
+        ipath_cancel_sends(dd);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                         dd->ipath_control);
+
+        /* ensure pio avail updates continue */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                 dd->ipath_sendctrl & ~IPATH_S_PIOBUFAVAILUPD);
+        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                 dd->ipath_sendctrl);
+
+        /*
+         * We just enabled pioavailupdate, so dma copy is almost certainly
+         * not yet right, so read the registers directly.  Similar to init
+         */
+        for (i = 0; i < dd->ipath_pioavregs; i++) {
+                /* deal with 6110 chip bug */
+                im = i > 3 ? ((i&1) ? i-1 : i+1) : i;
+                val = ipath_read_kreg64(dd, 0x1000+(im*sizeof(u64)));
+                dd->ipath_pioavailregs_dma[i] = dd->ipath_pioavailshadow[i]
+                        = le64_to_cpu(val);
+        }
+
+        /*
+         * force new interrupt if any hwerr, error or interrupt bits are
+         * still set, and clear "safe" send packet errors related to freeze
+         * and cancelling sends.  Re-enable error interrupts before possible
+         * force of re-interrupt on pending interrupts.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear, 0ULL);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear,
+                E_SPKT_ERRS_IGNORE);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask,
+                ~dd->ipath_maskederrs);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, 0ULL);
+}
+
+
 /* this is separate to allow for better optimization of ipath_intr() */
 
 static void ipath_bad_intr(struct ipath_devdata *dd, u32 * unexpectp)
@@ -872,14 +965,25 @@ static void handle_urcv(struct ipath_devdata *dd, u32 istat)
                    dd->ipath_i_rcvurg_mask);
         for (i = 1; i < dd->ipath_cfgports; i++) {
                 struct ipath_portdata *pd = dd->ipath_pd[i];
-                if (portr & (1 << i) && pd && pd->port_cnt &&
-                        test_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag)) {
-                        clear_bit(IPATH_PORT_WAITING_RCV,
-                                  &pd->port_flag);
-                        clear_bit(i + INFINIPATH_R_INTRAVAIL_SHIFT,
-                                  &dd->ipath_rcvctrl);
-                        wake_up_interruptible(&pd->port_wait);
-                        rcvdint = 1;
+                if (portr & (1 << i) && pd && pd->port_cnt) {
+                        if (test_bit(IPATH_PORT_WAITING_RCV,
+                                     &pd->port_flag)) {
+                                clear_bit(IPATH_PORT_WAITING_RCV,
+                                          &pd->port_flag);
+                                set_bit(IPATH_PORT_WAITING_RCV,
+                                        &pd->int_flag);
+                                clear_bit(i + INFINIPATH_R_INTRAVAIL_SHIFT,
+                                          &dd->ipath_rcvctrl);
+                                wake_up_interruptible(&pd->port_wait);
+                                rcvdint = 1;
+                        } else if (test_bit(IPATH_PORT_WAITING_URG,
+                                            &pd->port_flag)) {
+                                clear_bit(IPATH_PORT_WAITING_URG,
+                                          &pd->port_flag);
+                                set_bit(IPATH_PORT_WAITING_URG,
+                                        &pd->int_flag);
+                                wake_up_interruptible(&pd->port_wait);
+                        }
                 }
         }
         if (rcvdint) {
@@ -905,6 +1009,9 @@ irqreturn_t ipath_intr(int irq, void *data)
 
         ipath_stats.sps_ints++;
 
+        if (dd->ipath_int_counter != (u32) -1)
+                dd->ipath_int_counter++;
+
         if (!(dd->ipath_flags & IPATH_PRESENT)) {
                 /*
                  * This return value is not great, but we do not want the
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 12194f3dd8cc..3105005fc9d2 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -1,7 +1,7 @@
 #ifndef _IPATH_KERNEL_H
 #define _IPATH_KERNEL_H
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -57,6 +57,24 @@
 extern struct infinipath_stats ipath_stats;
 
 #define IPATH_CHIP_SWVERSION IPATH_CHIP_VERS_MAJ
+/*
+ * First-cut critierion for "device is active" is
+ * two thousand dwords combined Tx, Rx traffic per
+ * 5-second interval. SMA packets are 64 dwords,
+ * and occur "a few per second", presumably each way.
+ */
+#define IPATH_TRAFFIC_ACTIVE_THRESHOLD (2000)
+/*
+ * Struct used to indicate which errors are logged in each of the
+ * error-counters that are logged to EEPROM. A counter is incremented
+ * _once_ (saturating at 255) for each event with any bits set in
+ * the error or hwerror register masks below.
+ */
+#define IPATH_EEP_LOG_CNT (4)
+struct ipath_eep_log_mask {
+        u64 errs_to_log;
+        u64 hwerrs_to_log;
+};
 
 struct ipath_portdata {
         void **port_rcvegrbuf;
@@ -109,6 +127,8 @@ struct ipath_portdata {
         u32 port_tidcursor;
         /* next expected TID to check */
         unsigned long port_flag;
+        /* what happened */
+        unsigned long int_flag;
         /* WAIT_RCV that timed out, no interrupt */
         u32 port_rcvwait_to;
         /* WAIT_PIO that timed out, no interrupt */
@@ -137,6 +157,8 @@ struct ipath_portdata {
         u32 userversion;
         /* Bitmask of active slaves */
         u32 active_slaves;
+        /* Type of packets or conditions we want to poll for */
+        u16 poll_type;
 };
 
 struct sk_buff;
@@ -275,6 +297,8 @@ struct ipath_devdata {
         u32 ipath_lastport_piobuf;
         /* is a stats timer active */
         u32 ipath_stats_timer_active;
+        /* number of interrupts for this device -- saturates... */
+        u32 ipath_int_counter;
         /* dwords sent read from counter */
         u32 ipath_lastsword;
         /* dwords received read from counter */
@@ -369,9 +393,6 @@ struct ipath_devdata {
         struct class_device *diag_class_dev;
         /* timer used to prevent stats overflow, error throttling, etc. */
         struct timer_list ipath_stats_timer;
-        /* check for stale messages in rcv queue */
-        /* only allow one intr at a time. */
-        unsigned long ipath_rcv_pending;
         void *ipath_dummy_hdrq; /* used after port close */
         dma_addr_t ipath_dummy_hdrq_phys;
 
@@ -399,6 +420,8 @@ struct ipath_devdata {
         u64 ipath_gpio_out;
         /* shadow the gpio mask register */
         u64 ipath_gpio_mask;
+        /* shadow the gpio output enable, etc... */
+        u64 ipath_extctrl;
         /* kr_revision shadow */
         u64 ipath_revision;
         /*
@@ -473,8 +496,6 @@ struct ipath_devdata {
         u32 ipath_cregbase;
         /* shadow the control register contents */
         u32 ipath_control;
-        /* shadow the gpio output contents */
-        u32 ipath_extctrl;
         /* PCI revision register (HTC rev on FPGA) */
         u32 ipath_pcirev;
 
@@ -552,6 +573,9 @@ struct ipath_devdata {
         u32 ipath_overrun_thresh_errs;
         u32 ipath_lli_errs;
 
+        /* status check work */
+        struct delayed_work status_work;
+
         /*
          * Not all devices managed by a driver instance are the same
          * type, so these fields must be per-device.
@@ -575,6 +599,37 @@ struct ipath_devdata {
         u16 ipath_gpio_scl_num;
         u64 ipath_gpio_sda;
         u64 ipath_gpio_scl;
+
+        /* lock for doing RMW of shadows/regs for ExtCtrl and GPIO */
+        spinlock_t ipath_gpio_lock;
+
+        /* used to override LED behavior */
+        u8 ipath_led_override;  /* Substituted for normal value, if non-zero */
+        u16 ipath_led_override_timeoff; /* delta to next timer event */
+        u8 ipath_led_override_vals[2]; /* Alternates per blink-frame */
+        u8 ipath_led_override_phase; /* Just counts, LSB picks from vals[] */
+        atomic_t ipath_led_override_timer_active;
+        /* Used to flash LEDs in override mode */
+        struct timer_list ipath_led_override_timer;
+
+        /* Support (including locks) for EEPROM logging of errors and time */
+        /* control access to actual counters, timer */
+        spinlock_t ipath_eep_st_lock;
+        /* control high-level access to EEPROM */
+        struct semaphore ipath_eep_sem;
+        /* Below inc'd by ipath_snap_cntrs(), locked by ipath_eep_st_lock */
+        uint64_t ipath_traffic_wds;
+        /* active time is kept in seconds, but logged in hours */
+        atomic_t ipath_active_time;
+        /* Below are nominal shadow of EEPROM, new since last EEPROM update */
+        uint8_t ipath_eep_st_errs[IPATH_EEP_LOG_CNT];
+        uint8_t ipath_eep_st_new_errs[IPATH_EEP_LOG_CNT];
+        uint16_t ipath_eep_hrs;
+        /*
+         * masks for which bits of errs, hwerrs that cause
+         * each of the counters to increment.
+         */
+        struct ipath_eep_log_mask ipath_eep_st_masks[IPATH_EEP_LOG_CNT];
 };
 
 /* Private data for file operations */
@@ -592,6 +647,7 @@ int ipath_enable_wc(struct ipath_devdata *dd);
 void ipath_disable_wc(struct ipath_devdata *dd);
 int ipath_count_units(int *npresentp, int *nupp, u32 *maxportsp);
 void ipath_shutdown_device(struct ipath_devdata *);
+void ipath_clear_freeze(struct ipath_devdata *);
 
 struct file_operations;
 int ipath_cdev_init(int minor, char *name, const struct file_operations *fops,
@@ -627,6 +683,7 @@ int ipath_unordered_wc(void);
 
 void ipath_disarm_piobufs(struct ipath_devdata *, unsigned first,
                           unsigned cnt);
+void ipath_cancel_sends(struct ipath_devdata *);
 
 int ipath_create_rcvhdrq(struct ipath_devdata *, struct ipath_portdata *);
 void ipath_free_pddata(struct ipath_devdata *, struct ipath_portdata *);
@@ -685,7 +742,6 @@ int ipath_set_rx_pol_inv(struct ipath_devdata *dd, u8 new_pol_inv);
                  * are 64bit */
 #define IPATH_32BITCOUNTERS 0x20000
                 /* can miss port0 rx interrupts */
-#define IPATH_POLL_RX_INTR  0x40000
 #define IPATH_DISABLED      0x80000 /* administratively disabled */
                 /* Use GPIO interrupts for new counters */
 #define IPATH_GPIO_ERRINTRS 0x100000
@@ -704,6 +760,10 @@ int ipath_set_rx_pol_inv(struct ipath_devdata *dd, u8 new_pol_inv);
 #define IPATH_PORT_WAITING_PIO   3
                 /* master has not finished initializing */
 #define IPATH_PORT_MASTER_UNINIT 4
+                /* waiting for an urgent packet to arrive */
+#define IPATH_PORT_WAITING_URG 5
+                /* waiting for a header overflow */
+#define IPATH_PORT_WAITING_OVERFLOW 6
 
 /* free up any allocated data at closes */
 void ipath_free_data(struct ipath_portdata *dd);
@@ -713,10 +773,21 @@ u32 __iomem *ipath_getpiobuf(struct ipath_devdata *, u32 *);
 void ipath_init_iba6120_funcs(struct ipath_devdata *);
 void ipath_init_iba6110_funcs(struct ipath_devdata *);
 void ipath_get_eeprom_info(struct ipath_devdata *);
+int ipath_update_eeprom_log(struct ipath_devdata *dd);
+void ipath_inc_eeprom_err(struct ipath_devdata *dd, u32 eidx, u32 incr);
 u64 ipath_snap_cntr(struct ipath_devdata *, ipath_creg);
 void ipath_disarm_senderrbufs(struct ipath_devdata *, int);
 
 /*
+ * Set LED override, only the two LSBs have "public" meaning, but
+ * any non-zero value substitutes them for the Link and LinkTrain
+ * LED states.
+ */
+#define IPATH_LED_PHYS 1 /* Physical (linktraining) GREEN LED */
+#define IPATH_LED_LOG 2  /* Logical (link) YELLOW LED */
+void ipath_set_led_override(struct ipath_devdata *dd, unsigned int val);
+
+/*
  * number of words used for protocol header if not set by ipath_userinit();
  */
 #define IPATH_DFLT_RCVHDRSIZE 9
diff --git a/drivers/infiniband/hw/ipath/ipath_keys.c b/drivers/infiniband/hw/ipath/ipath_keys.c
index dd487c100f5b..85a4aefc6c03 100644
--- a/drivers/infiniband/hw/ipath/ipath_keys.c
+++ b/drivers/infiniband/hw/ipath/ipath_keys.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c
index 05a1d2b01d9d..82616b779e24 100644
--- a/drivers/infiniband/hw/ipath/ipath_layer.c
+++ b/drivers/infiniband/hw/ipath/ipath_layer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.h b/drivers/infiniband/hw/ipath/ipath_layer.h
index 3854a4eae684..415709c4d85b 100644
--- a/drivers/infiniband/hw/ipath/ipath_layer.h
+++ b/drivers/infiniband/hw/ipath/ipath_layer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 25908b02fbe5..d61c03044545 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -103,7 +103,7 @@ static int recv_subn_get_nodeinfo(struct ib_smp *smp,
         /* This is already in network order */
         nip->sys_guid = to_idev(ibdev)->sys_image_guid;
         nip->node_guid = dd->ipath_guid;
-        nip->port_guid = nip->sys_guid;
+        nip->port_guid = dd->ipath_guid;
         nip->partition_cap = cpu_to_be16(ipath_get_npkeys(dd));
         nip->device_id = cpu_to_be16(dd->ipath_deviceid);
         majrev = dd->ipath_majrev;
@@ -292,7 +292,12 @@ static int recv_subn_get_portinfo(struct ib_smp *smp,
         /* pip->vl_arb_high_cap; // only one VL */
         /* pip->vl_arb_low_cap; // only one VL */
         /* InitTypeReply = 0 */
-        pip->inittypereply_mtucap = IB_MTU_4096;
+        /*
+         * Note: the chips support a maximum MTU of 4096, but the driver
+         * hasn't implemented this feature yet, so set the maximum value
+         * to 2048.
+         */
+        pip->inittypereply_mtucap = IB_MTU_2048;
         // HCAs ignore VLStallCount and HOQLife
         /* pip->vlstallcnt_hoqlife; */
         pip->operationalvl_pei_peo_fpi_fpo = 0x10;      /* OVLs = 1 */
diff --git a/drivers/infiniband/hw/ipath/ipath_mmap.c b/drivers/infiniband/hw/ipath/ipath_mmap.c
index 937bc3396b53..fa830e22002f 100644
--- a/drivers/infiniband/hw/ipath/ipath_mmap.c
+++ b/drivers/infiniband/hw/ipath/ipath_mmap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/ipath/ipath_mr.c b/drivers/infiniband/hw/ipath/ipath_mr.c
index bdeef8d4f279..e442470a2375 100644
--- a/drivers/infiniband/hw/ipath/ipath_mr.c
+++ b/drivers/infiniband/hw/ipath/ipath_mr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index bfef08ecd342..1324b35ff1f8 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -336,7 +336,7 @@ static void ipath_reset_qp(struct ipath_qp *qp)
         qp->qkey = 0;
         qp->qp_access_flags = 0;
         qp->s_busy = 0;
-        qp->s_flags &= ~IPATH_S_SIGNAL_REQ_WR;
+        qp->s_flags &= IPATH_S_SIGNAL_REQ_WR;
         qp->s_hdrwords = 0;
         qp->s_psn = 0;
         qp->r_psn = 0;
@@ -507,16 +507,13 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                     attr->port_num > ibqp->device->phys_port_cnt)
                         goto inval;
 
+        /*
+         * Note: the chips support a maximum MTU of 4096, but the driver
+         * hasn't implemented this feature yet, so don't allow Path MTU
+         * values greater than 2048.
+         */
         if (attr_mask & IB_QP_PATH_MTU)
-                if (attr->path_mtu > IB_MTU_4096)
-                        goto inval;
-
-        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
-                if (attr->max_dest_rd_atomic > 1)
-                        goto inval;
-
-        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC)
-                if (attr->max_rd_atomic > 1)
+                if (attr->path_mtu > IB_MTU_2048)
                         goto inval;
 
         if (attr_mask & IB_QP_PATH_MIG_STATE)
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
index 1915771fd038..46744ea2babd 100644
--- a/drivers/infiniband/hw/ipath/ipath_rc.c
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -125,8 +125,10 @@ static int ipath_make_rc_ack(struct ipath_qp *qp,
                         if (len > pmtu) {
                                 len = pmtu;
                                 qp->s_ack_state = OP(RDMA_READ_RESPONSE_FIRST);
-                        } else
+                        } else {
                                 qp->s_ack_state = OP(RDMA_READ_RESPONSE_ONLY);
+                                e->sent = 1;
+                        }
                         ohdr->u.aeth = ipath_compute_aeth(qp);
                         hwords++;
                         qp->s_ack_rdma_psn = e->psn;
@@ -143,6 +145,7 @@ static int ipath_make_rc_ack(struct ipath_qp *qp,
                                 cpu_to_be32(e->atomic_data);
                         hwords += sizeof(ohdr->u.at) / sizeof(u32);
                         bth2 = e->psn;
+                        e->sent = 1;
                 }
                 bth0 = qp->s_ack_state << 24;
                 break;
@@ -158,6 +161,7 @@ static int ipath_make_rc_ack(struct ipath_qp *qp,
                         ohdr->u.aeth = ipath_compute_aeth(qp);
                         hwords++;
                         qp->s_ack_state = OP(RDMA_READ_RESPONSE_LAST);
+                        qp->s_ack_queue[qp->s_tail_ack_queue].sent = 1;
                 }
                 bth0 = qp->s_ack_state << 24;
                 bth2 = qp->s_ack_rdma_psn++ & IPATH_PSN_MASK;
@@ -188,7 +192,7 @@ static int ipath_make_rc_ack(struct ipath_qp *qp,
         }
         qp->s_hdrwords = hwords;
         qp->s_cur_size = len;
-        *bth0p = bth0;
+        *bth0p = bth0 | (1 << 22); /* Set M bit */
         *bth2p = bth2;
         return 1;
 
@@ -240,7 +244,7 @@ int ipath_make_rc_req(struct ipath_qp *qp,
 
         /* header size in 32-bit words LRH+BTH = (8+12)/4. */
         hwords = 5;
-        bth0 = 0;
+        bth0 = 1 << 22; /* Set M bit */
 
         /* Send a request. */
         wqe = get_swqe_ptr(qp, qp->s_cur);
@@ -604,7 +608,7 @@ static void send_rc_ack(struct ipath_qp *qp)
         }
         /* read pkey_index w/o lock (its atomic) */
         bth0 = ipath_get_pkey(dev->dd, qp->s_pkey_index) |
-                OP(ACKNOWLEDGE) << 24;
+                (OP(ACKNOWLEDGE) << 24) | (1 << 22);
         if (qp->r_nak_state)
                 ohdr->u.aeth = cpu_to_be32((qp->r_msn & IPATH_MSN_MASK) |
                                             (qp->r_nak_state <<
@@ -806,13 +810,15 @@ static inline void update_last_psn(struct ipath_qp *qp, u32 psn)
  * Called at interrupt level with the QP s_lock held and interrupts disabled.
  * Returns 1 if OK, 0 if current operation should be aborted (NAK).
  */
-static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode)
+static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
+                     u64 val)
 {
         struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
         struct ib_wc wc;
         struct ipath_swqe *wqe;
         int ret = 0;
         u32 ack_psn;
+        int diff;
 
         /*
          * Remove the QP from the timeout queue (or RNR timeout queue).
@@ -840,7 +846,19 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode)
          * The MSN might be for a later WQE than the PSN indicates so
          * only complete WQEs that the PSN finishes.
          */
-        while (ipath_cmp24(ack_psn, wqe->lpsn) >= 0) {
+        while ((diff = ipath_cmp24(ack_psn, wqe->lpsn)) >= 0) {
+                /*
+                 * RDMA_READ_RESPONSE_ONLY is a special case since
+                 * we want to generate completion events for everything
+                 * before the RDMA read, copy the data, then generate
+                 * the completion for the read.
+                 */
+                if (wqe->wr.opcode == IB_WR_RDMA_READ &&
+                    opcode == OP(RDMA_READ_RESPONSE_ONLY) &&
+                    diff == 0) {
+                        ret = 1;
+                        goto bail;
+                }
                 /*
                  * If this request is a RDMA read or atomic, and the ACK is
                  * for a later operation, this ACK NAKs the RDMA read or
@@ -851,12 +869,10 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode)
                  * is sent but before the response is received.
                  */
                 if ((wqe->wr.opcode == IB_WR_RDMA_READ &&
-                     (opcode != OP(RDMA_READ_RESPONSE_LAST) ||
-                      ipath_cmp24(ack_psn, wqe->lpsn) != 0)) ||
+                     (opcode != OP(RDMA_READ_RESPONSE_LAST) || diff != 0)) ||
                     ((wqe->wr.opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
                       wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) &&
-                     (opcode != OP(ATOMIC_ACKNOWLEDGE) ||
-                      ipath_cmp24(wqe->psn, psn) != 0))) {
+                     (opcode != OP(ATOMIC_ACKNOWLEDGE) || diff != 0))) {
                         /*
                          * The last valid PSN seen is the previous
                          * request's.
@@ -870,6 +886,9 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode)
                          */
                         goto bail;
                 }
+                if (wqe->wr.opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
+                    wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD)
+                        *(u64 *) wqe->sg_list[0].vaddr = val;
                 if (qp->s_num_rd_atomic &&
                     (wqe->wr.opcode == IB_WR_RDMA_READ ||
                      wqe->wr.opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
@@ -1079,6 +1098,7 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
         int diff;
         u32 pad;
         u32 aeth;
+        u64 val;
 
         spin_lock_irqsave(&qp->s_lock, flags);
 
@@ -1118,8 +1138,6 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                         data += sizeof(__be32);
                 }
                 if (opcode == OP(ATOMIC_ACKNOWLEDGE)) {
-                        u64 val;
-
                         if (!header_in_data) {
                                 __be32 *p = ohdr->u.at.atomic_ack_eth;
 
@@ -1127,12 +1145,13 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                                         be32_to_cpu(p[1]);
                         } else
                                 val = be64_to_cpu(((__be64 *) data)[0]);
-                        *(u64 *) wqe->sg_list[0].vaddr = val;
-                }
-                if (!do_rc_ack(qp, aeth, psn, opcode) ||
+                } else
+                        val = 0;
+                if (!do_rc_ack(qp, aeth, psn, opcode, val) ||
                     opcode != OP(RDMA_READ_RESPONSE_FIRST))
                         goto ack_done;
                 hdrsize += 4;
+                wqe = get_swqe_ptr(qp, qp->s_last);
                 if (unlikely(wqe->wr.opcode != IB_WR_RDMA_READ))
                         goto ack_op_err;
                 /*
@@ -1176,13 +1195,12 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                 goto bail;
 
         case OP(RDMA_READ_RESPONSE_ONLY):
-                if (unlikely(ipath_cmp24(psn, qp->s_last_psn + 1))) {
-                        dev->n_rdma_seq++;
-                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                if (!header_in_data)
+                        aeth = be32_to_cpu(ohdr->u.aeth);
+                else
+                        aeth = be32_to_cpu(((__be32 *) data)[0]);
+                if (!do_rc_ack(qp, aeth, psn, opcode, 0))
                         goto ack_done;
-                }
-                if (unlikely(wqe->wr.opcode != IB_WR_RDMA_READ))
-                        goto ack_op_err;
                 /* Get the number of bytes the message was padded by. */
                 pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
                 /*
@@ -1197,6 +1215,7 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                  * have to be careful to copy the data to the right
                  * location.
                  */
+                wqe = get_swqe_ptr(qp, qp->s_last);
                 qp->s_rdma_read_len = restart_sge(&qp->s_rdma_read_sge,
                                                   wqe, psn, pmtu);
                 goto read_last;
@@ -1230,7 +1249,8 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                         data += sizeof(__be32);
                 }
                 ipath_copy_sge(&qp->s_rdma_read_sge, data, tlen);
-                (void) do_rc_ack(qp, aeth, psn, OP(RDMA_READ_RESPONSE_LAST));
+                (void) do_rc_ack(qp, aeth, psn,
+                                 OP(RDMA_READ_RESPONSE_LAST), 0);
                 goto ack_done;
         }
 
@@ -1344,8 +1364,11 @@ static inline int ipath_rc_rcv_error(struct ipath_ibdev *dev,
                         e = NULL;
                         break;
                 }
-                if (ipath_cmp24(psn, e->psn) >= 0)
+                if (ipath_cmp24(psn, e->psn) >= 0) {
+                        if (prev == qp->s_tail_ack_queue)
+                                old_req = 0;
                         break;
+                }
         }
         switch (opcode) {
         case OP(RDMA_READ_REQUEST): {
@@ -1460,6 +1483,22 @@ static void ipath_rc_error(struct ipath_qp *qp, enum ib_wc_status err)
         spin_unlock_irqrestore(&qp->s_lock, flags);
 }
 
+static inline void ipath_update_ack_queue(struct ipath_qp *qp, unsigned n)
+{
+        unsigned long flags;
+        unsigned next;
+
+        next = n + 1;
+        if (next > IPATH_MAX_RDMA_ATOMIC)
+                next = 0;
+        spin_lock_irqsave(&qp->s_lock, flags);
+        if (n == qp->s_tail_ack_queue) {
+                qp->s_tail_ack_queue = next;
+                qp->s_ack_state = OP(ACKNOWLEDGE);
+        }
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+}
+
 /**
  * ipath_rc_rcv - process an incoming RC packet
  * @dev: the device this packet came in on
@@ -1672,6 +1711,9 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         case OP(RDMA_WRITE_FIRST):
         case OP(RDMA_WRITE_ONLY):
         case OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE):
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_WRITE)))
+                        goto nack_inv;
                 /* consume RWQE */
                 /* RETH comes after BTH */
                 if (!header_in_data)
@@ -1701,9 +1743,6 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                         qp->r_sge.sge.length = 0;
                         qp->r_sge.sge.sge_length = 0;
                 }
-                if (unlikely(!(qp->qp_access_flags &
-                               IB_ACCESS_REMOTE_WRITE)))
-                        goto nack_acc;
                 if (opcode == OP(RDMA_WRITE_FIRST))
                         goto send_middle;
                 else if (opcode == OP(RDMA_WRITE_ONLY))
@@ -1717,13 +1756,17 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                 u32 len;
                 u8 next;
 
-                if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_READ)))
-                        goto nack_acc;
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ)))
+                        goto nack_inv;
                 next = qp->r_head_ack_queue + 1;
                 if (next > IPATH_MAX_RDMA_ATOMIC)
                         next = 0;
-                if (unlikely(next == qp->s_tail_ack_queue))
-                        goto nack_inv;
+                if (unlikely(next == qp->s_tail_ack_queue)) {
+                        if (!qp->s_ack_queue[next].sent)
+                                goto nack_inv;
+                        ipath_update_ack_queue(qp, next);
+                }
                 e = &qp->s_ack_queue[qp->r_head_ack_queue];
                 /* RETH comes after BTH */
                 if (!header_in_data)
@@ -1758,6 +1801,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                         e->rdma_sge.sge.sge_length = 0;
                 }
                 e->opcode = opcode;
+                e->sent = 0;
                 e->psn = psn;
                 /*
                  * We need to increment the MSN here instead of when we
@@ -1789,12 +1833,15 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
 
                 if (unlikely(!(qp->qp_access_flags &
                                IB_ACCESS_REMOTE_ATOMIC)))
-                        goto nack_acc;
+                        goto nack_inv;
                 next = qp->r_head_ack_queue + 1;
                 if (next > IPATH_MAX_RDMA_ATOMIC)
                         next = 0;
-                if (unlikely(next == qp->s_tail_ack_queue))
-                        goto nack_inv;
+                if (unlikely(next == qp->s_tail_ack_queue)) {
+                        if (!qp->s_ack_queue[next].sent)
+                                goto nack_inv;
+                        ipath_update_ack_queue(qp, next);
+                }
                 if (!header_in_data)
                         ateth = &ohdr->u.atomic_eth;
                 else
@@ -1819,6 +1866,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                                       be64_to_cpu(ateth->compare_data),
                                       sdata);
                 e->opcode = opcode;
+                e->sent = 0;
                 e->psn = psn & IPATH_PSN_MASK;
                 qp->r_msn++;
                 qp->r_psn++;
diff --git a/drivers/infiniband/hw/ipath/ipath_registers.h b/drivers/infiniband/hw/ipath/ipath_registers.h
index c182bcd62098..708eba3165d7 100644
--- a/drivers/infiniband/hw/ipath/ipath_registers.h
+++ b/drivers/infiniband/hw/ipath/ipath_registers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index d9c2a9b15d86..85256747d8a1 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -194,6 +194,8 @@ int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
                         ret = 0;
                         goto bail;
                 }
+                /* Make sure entry is read after head index is read. */
+                smp_rmb();
                 wqe = get_rwqe_ptr(rq, tail);
                 if (++tail >= rq->size)
                         tail = 0;
@@ -267,7 +269,7 @@ again:
         spin_lock_irqsave(&sqp->s_lock, flags);
 
         if (!(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_SEND_OK) ||
-            qp->s_rnr_timeout) {
+            sqp->s_rnr_timeout) {
                 spin_unlock_irqrestore(&sqp->s_lock, flags);
                 goto done;
         }
@@ -319,12 +321,22 @@ again:
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_WRITE))) {
+                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        goto err;
+                }
                 wc.wc_flags = IB_WC_WITH_IMM;
                 wc.imm_data = wqe->wr.imm_data;
                 if (!ipath_get_rwqe(qp, 1))
                         goto rnr_nak;
                 /* FALLTHROUGH */
         case IB_WR_RDMA_WRITE:
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_WRITE))) {
+                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        goto err;
+                }
                 if (wqe->length == 0)
                         break;
                 if (unlikely(!ipath_rkey_ok(qp, &qp->r_sge, wqe->length,
@@ -354,8 +366,10 @@ again:
 
         case IB_WR_RDMA_READ:
                 if (unlikely(!(qp->qp_access_flags &
-                               IB_ACCESS_REMOTE_READ)))
-                        goto acc_err;
+                               IB_ACCESS_REMOTE_READ))) {
+                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        goto err;
+                }
                 if (unlikely(!ipath_rkey_ok(qp, &sqp->s_sge, wqe->length,
                                             wqe->wr.wr.rdma.remote_addr,
                                             wqe->wr.wr.rdma.rkey,
@@ -369,8 +383,10 @@ again:
         case IB_WR_ATOMIC_CMP_AND_SWP:
         case IB_WR_ATOMIC_FETCH_AND_ADD:
                 if (unlikely(!(qp->qp_access_flags &
-                               IB_ACCESS_REMOTE_ATOMIC)))
-                        goto acc_err;
+                               IB_ACCESS_REMOTE_ATOMIC))) {
+                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        goto err;
+                }
                 if (unlikely(!ipath_rkey_ok(qp, &qp->r_sge, sizeof(u64),
                                             wqe->wr.wr.atomic.remote_addr,
                                             wqe->wr.wr.atomic.rkey,
@@ -396,6 +412,8 @@ again:
 
                 if (len > sge->length)
                         len = sge->length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
                 BUG_ON(len == 0);
                 ipath_copy_sge(&qp->r_sge, sge->vaddr, len);
                 sge->vaddr += len;
@@ -503,11 +521,9 @@ void ipath_no_bufs_available(struct ipath_qp *qp, struct ipath_ibdev *dev)
          * could be called.  If we are still in the tasklet function,
          * tasklet_hi_schedule() will not call us until the next time
          * tasklet_hi_schedule() is called.
-         * We clear the tasklet flag now since we are committing to return
-         * from the tasklet function.
+         * We leave the busy flag set so that another post send doesn't
+         * try to put the same QP on the piowait list again.
          */
-        clear_bit(IPATH_S_BUSY, &qp->s_busy);
-        tasklet_unlock(&qp->s_task);
         want_buffer(dev->dd);
         dev->n_piowait++;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_srq.c b/drivers/infiniband/hw/ipath/ipath_srq.c
index 03acae66ba81..40c36ec19016 100644
--- a/drivers/infiniband/hw/ipath/ipath_srq.c
+++ b/drivers/infiniband/hw/ipath/ipath_srq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -80,6 +80,8 @@ int ipath_post_srq_receive(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                 wqe->num_sge = wr->num_sge;
                 for (i = 0; i < wr->num_sge; i++)
                         wqe->sg_list[i] = wr->sg_list[i];
+                /* Make sure queue entry is written before the head index. */
+                smp_wmb();
                 wq->head = next;
                 spin_unlock_irqrestore(&srq->rq.lock, flags);
         }
diff --git a/drivers/infiniband/hw/ipath/ipath_stats.c b/drivers/infiniband/hw/ipath/ipath_stats.c
index d8b5e4cefe25..73ed17d03188 100644
--- a/drivers/infiniband/hw/ipath/ipath_stats.c
+++ b/drivers/infiniband/hw/ipath/ipath_stats.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -55,6 +55,7 @@ u64 ipath_snap_cntr(struct ipath_devdata *dd, ipath_creg creg)
         u64 val64;
         unsigned long t0, t1;
         u64 ret;
+        unsigned long flags;
 
         t0 = jiffies;
         /* If fast increment counters are only 32 bits, snapshot them,
@@ -91,12 +92,18 @@ u64 ipath_snap_cntr(struct ipath_devdata *dd, ipath_creg creg)
         if (creg == dd->ipath_cregs->cr_wordsendcnt) {
                 if (val != dd->ipath_lastsword) {
                         dd->ipath_sword += val - dd->ipath_lastsword;
+                        spin_lock_irqsave(&dd->ipath_eep_st_lock, flags);
+                        dd->ipath_traffic_wds += val - dd->ipath_lastsword;
+                        spin_unlock_irqrestore(&dd->ipath_eep_st_lock, flags);
                         dd->ipath_lastsword = val;
                 }
                 val64 = dd->ipath_sword;
         } else if (creg == dd->ipath_cregs->cr_wordrcvcnt) {
                 if (val != dd->ipath_lastrword) {
                         dd->ipath_rword += val - dd->ipath_lastrword;
+                        spin_lock_irqsave(&dd->ipath_eep_st_lock, flags);
+                        dd->ipath_traffic_wds += val - dd->ipath_lastrword;
+                        spin_unlock_irqrestore(&dd->ipath_eep_st_lock, flags);
                         dd->ipath_lastrword = val;
                 }
                 val64 = dd->ipath_rword;
@@ -200,6 +207,7 @@ void ipath_get_faststats(unsigned long opaque)
         struct ipath_devdata *dd = (struct ipath_devdata *) opaque;
         u32 val;
         static unsigned cnt;
+        unsigned long flags;
 
         /*
          * don't access the chip while running diags, or memory diags can
@@ -210,9 +218,20 @@ void ipath_get_faststats(unsigned long opaque)
                 /* but re-arm the timer, for diags case; won't hurt other */
                 goto done;
 
+        /*
+         * We now try to maintain a "active timer", based on traffic
+         * exceeding a threshold, so we need to check the word-counts
+         * even if they are 64-bit.
+         */
+        ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordsendcnt);
+        ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordrcvcnt);
+        spin_lock_irqsave(&dd->ipath_eep_st_lock, flags);
+        if (dd->ipath_traffic_wds  >= IPATH_TRAFFIC_ACTIVE_THRESHOLD)
+                atomic_add(5, &dd->ipath_active_time); /* S/B #define */
+        dd->ipath_traffic_wds = 0;
+        spin_unlock_irqrestore(&dd->ipath_eep_st_lock, flags);
+
         if (dd->ipath_flags & IPATH_32BITCOUNTERS) {
-                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordsendcnt);
-                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordrcvcnt);
                 ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktsendcnt);
                 ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktrcvcnt);
         }
diff --git a/drivers/infiniband/hw/ipath/ipath_sysfs.c b/drivers/infiniband/hw/ipath/ipath_sysfs.c
index 4dc398d5e011..16238cd3a036 100644
--- a/drivers/infiniband/hw/ipath/ipath_sysfs.c
+++ b/drivers/infiniband/hw/ipath/ipath_sysfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -596,6 +596,43 @@ bail:
         return ret;
 }
 
+static ssize_t store_led_override(struct device *dev,
+                          struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int ret;
+        u16 val;
+
+        ret = ipath_parse_ushort(buf, &val);
+        if (ret > 0)
+                ipath_set_led_override(dd, val);
+        else
+                ipath_dev_err(dd, "attempt to set invalid LED override\n");
+        return ret;
+}
+
+static ssize_t show_logged_errs(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int idx, count;
+
+        /* force consistency with actual EEPROM */
+        if (ipath_update_eeprom_log(dd) != 0)
+                return -ENXIO;
+
+        count = 0;
+        for (idx = 0; idx < IPATH_EEP_LOG_CNT; ++idx) {
+                count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c",
+                        dd->ipath_eep_st_errs[idx],
+                        idx == (IPATH_EEP_LOG_CNT - 1) ? '\n' : ' ');
+        }
+
+        return count;
+}
 
 static DRIVER_ATTR(num_units, S_IRUGO, show_num_units, NULL);
 static DRIVER_ATTR(version, S_IRUGO, show_version, NULL);
@@ -625,6 +662,8 @@ static DEVICE_ATTR(status_str, S_IRUGO, show_status_str, NULL);
 static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
 static DEVICE_ATTR(unit, S_IRUGO, show_unit, NULL);
 static DEVICE_ATTR(rx_pol_inv, S_IWUSR, NULL, store_rx_pol_inv);
+static DEVICE_ATTR(led_override, S_IWUSR, NULL, store_led_override);
+static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL);
 
 static struct attribute *dev_attributes[] = {
         &dev_attr_guid.attr,
@@ -641,6 +680,8 @@ static struct attribute *dev_attributes[] = {
         &dev_attr_unit.attr,
         &dev_attr_enabled.attr,
         &dev_attr_rx_pol_inv.attr,
+        &dev_attr_led_override.attr,
+        &dev_attr_logged_errors.attr,
         NULL
 };
 
diff --git a/drivers/infiniband/hw/ipath/ipath_uc.c b/drivers/infiniband/hw/ipath/ipath_uc.c
index 1c2b03c2ef5e..8380fbc50d2c 100644
--- a/drivers/infiniband/hw/ipath/ipath_uc.c
+++ b/drivers/infiniband/hw/ipath/ipath_uc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -58,7 +58,6 @@ static void complete_last_send(struct ipath_qp *qp, struct ipath_swqe *wqe,
                 wc->port_num = 0;
                 ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 0);
         }
-        wqe = get_swqe_ptr(qp, qp->s_last);
 }
 
 /**
@@ -87,7 +86,7 @@ int ipath_make_uc_req(struct ipath_qp *qp,
 
         /* header size in 32-bit words LRH+BTH = (8+12)/4. */
         hwords = 5;
-        bth0 = 0;
+        bth0 = 1 << 22; /* Set M bit */
 
         /* Get the next send request. */
         wqe = get_swqe_ptr(qp, qp->s_last);
@@ -97,8 +96,10 @@ int ipath_make_uc_req(struct ipath_qp *qp,
                  * Signal the completion of the last send
                  * (if there is one).
                  */
-                if (qp->s_last != qp->s_tail)
+                if (qp->s_last != qp->s_tail) {
                         complete_last_send(qp, wqe, &wc);
+                        wqe = get_swqe_ptr(qp, qp->s_last);
+                }
 
                 /* Check if send work queue is empty. */
                 if (qp->s_tail == qp->s_head)
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index a518f7c8fa83..f9a3338a5fb7 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -176,6 +176,8 @@ static void ipath_ud_loopback(struct ipath_qp *sqp,
                         dev->n_pkt_drops++;
                         goto bail_sge;
                 }
+                /* Make sure entry is read after head index is read. */
+                smp_rmb();
                 wqe = get_rwqe_ptr(rq, tail);
                 if (++tail >= rq->size)
                         tail = 0;
@@ -231,6 +233,8 @@ static void ipath_ud_loopback(struct ipath_qp *sqp,
 
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
                 BUG_ON(len == 0);
                 ipath_copy_sge(&rsge, sge->vaddr, len);
                 sge->vaddr += len;
diff --git a/drivers/infiniband/hw/ipath/ipath_user_pages.c b/drivers/infiniband/hw/ipath/ipath_user_pages.c
index 8536aeb96af8..27034d38b3dd 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_pages.c
+++ b/drivers/infiniband/hw/ipath/ipath_user_pages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index bb70845279b8..65f7181e9cf8 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -164,9 +164,11 @@ void ipath_copy_sge(struct ipath_sge_state *ss, void *data, u32 length)
         while (length) {
                 u32 len = sge->length;
 
-                BUG_ON(len == 0);
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
+                BUG_ON(len == 0);
                 memcpy(sge->vaddr, data, len);
                 sge->vaddr += len;
                 sge->length -= len;
@@ -202,9 +204,11 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
         while (length) {
                 u32 len = sge->length;
 
-                BUG_ON(len == 0);
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
+                BUG_ON(len == 0);
                 sge->vaddr += len;
                 sge->length -= len;
                 sge->sge_length -= len;
@@ -323,6 +327,8 @@ static int ipath_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 wqe->num_sge = wr->num_sge;
                 for (i = 0; i < wr->num_sge; i++)
                         wqe->sg_list[i] = wr->sg_list[i];
+                /* Make sure queue entry is written before the head index. */
+                smp_wmb();
                 wq->head = next;
                 spin_unlock_irqrestore(&qp->r_rq.lock, flags);
         }
@@ -948,6 +954,7 @@ int ipath_ib_piobufavail(struct ipath_ibdev *dev)
                 qp = list_entry(dev->piowait.next, struct ipath_qp,
                                 piowait);
                 list_del_init(&qp->piowait);
+                clear_bit(IPATH_S_BUSY, &qp->s_busy);
                 tasklet_hi_schedule(&qp->s_task);
         }
         spin_unlock_irqrestore(&dev->pending_lock, flags);
@@ -981,6 +988,8 @@ static int ipath_query_device(struct ib_device *ibdev,
         props->max_ah = ib_ipath_max_ahs;
         props->max_cqe = ib_ipath_max_cqes;
         props->max_mr = dev->lk_table.max;
+        props->max_fmr = dev->lk_table.max;
+        props->max_map_per_fmr = 32767;
         props->max_pd = ib_ipath_max_pds;
         props->max_qp_rd_atom = IPATH_MAX_RDMA_ATOMIC;
         props->max_qp_init_rd_atom = 255;
@@ -1051,7 +1060,12 @@ static int ipath_query_port(struct ib_device *ibdev,
         props->max_vl_num = 1;          /* VLCap = VL0 */
         props->init_type_reply = 0;
 
-        props->max_mtu = IB_MTU_4096;
+        /*
+         * Note: the chips support a maximum MTU of 4096, but the driver
+         * hasn't implemented this feature yet, so set the maximum value
+         * to 2048.
+         */
+        props->max_mtu = IB_MTU_2048;
         switch (dev->dd->ipath_ibmtu) {
         case 4096:
                 mtu = IB_MTU_4096;
@@ -1361,13 +1375,6 @@ static void __verbs_timer(unsigned long arg)
 {
         struct ipath_devdata *dd = (struct ipath_devdata *) arg;
 
-        /*
-         * If port 0 receive packet interrupts are not available, or
-         * can be missed, poll the receive queue
-         */
-        if (dd->ipath_flags & IPATH_POLL_RX_INTR)
-                ipath_kreceive(dd);
-
         /* Handle verbs layer timeouts. */
         ipath_ib_timer(dd->verbs_dev);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
index 088b837ebea8..f3d1f2cee6f8 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.h
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -321,6 +321,7 @@ struct ipath_sge_state {
  */
 struct ipath_ack_entry {
         u8 opcode;
+        u8 sent;
         u32 psn;
         union {
                 struct ipath_sge_state rdma_sge;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
index dd691cfa5079..9e5abf9c309d 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/ipath/ipath_wc_ppc64.c b/drivers/infiniband/hw/ipath/ipath_wc_ppc64.c
index 0095bb70f34e..1d7bd82a1fb1 100644
--- a/drivers/infiniband/hw/ipath/ipath_wc_ppc64.c
+++ b/drivers/infiniband/hw/ipath/ipath_wc_ppc64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c b/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c
index 04696e62da87..3428acb0868c 100644
--- a/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c
+++ b/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 QLogic, Inc. All rights reserved.
+ * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -63,12 +63,29 @@ int ipath_enable_wc(struct ipath_devdata *dd)
          * of 2 address matching the length (which has to be a power of 2).
          * For rev1, that means the base address, for rev2, it will be just
          * the PIO buffers themselves.
+         * For chips with two sets of buffers, the calculations are
+         * somewhat more complicated; we need to sum, and the piobufbase
+         * register has both offsets, 2K in low 32 bits, 4K in high 32 bits.
+         * The buffers are still packed, so a single range covers both.
          */
-        pioaddr = addr + dd->ipath_piobufbase;
-        piolen = (dd->ipath_piobcnt2k +
-                  dd->ipath_piobcnt4k) *
-                ALIGN(dd->ipath_piobcnt2k +
-                      dd->ipath_piobcnt4k, dd->ipath_palign);
+        if (dd->ipath_piobcnt2k && dd->ipath_piobcnt4k) { /* 2 sizes */
+                unsigned long pio2kbase, pio4kbase;
+                pio2kbase = dd->ipath_piobufbase & 0xffffffffUL;
+                pio4kbase = (dd->ipath_piobufbase >> 32) & 0xffffffffUL;
+                if (pio2kbase < pio4kbase) { /* all, for now */
+                        pioaddr = addr + pio2kbase;
+                        piolen = pio4kbase - pio2kbase +
+                                dd->ipath_piobcnt4k * dd->ipath_4kalign;
+                } else {
+                        pioaddr = addr + pio4kbase;
+                        piolen = pio2kbase - pio4kbase +
+                                dd->ipath_piobcnt2k * dd->ipath_palign;
+                }
+        } else {  /* single buffer size (2K, currently) */
+                pioaddr = addr + dd->ipath_piobufbase;
+                piolen = dd->ipath_piobcnt2k * dd->ipath_palign +
+                        dd->ipath_piobcnt4k * dd->ipath_4kalign;
+        }
 
         for (bits = 0; !(piolen & (1ULL << bits)); bits++)
                 /* do nothing */ ;