Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:

	Documentation/powerpc/booting-without-of.txt
	drivers/atm/Makefile
	drivers/net/fs_enet/fs_enet-main.c
	drivers/pci/pci-acpi.c
	net/8021q/vlan.c
	net/iucv/iucv.c

64 files changed, 706 insertions, 531 deletions

diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index b1441aeb60c2..dd05c4835642 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -454,7 +454,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
             (IB_DEVICE_RESIZE_MAX_WR |
              IB_DEVICE_CURR_QP_STATE_MOD |
              IB_DEVICE_SYS_IMAGE_GUID |
-             IB_DEVICE_ZERO_STAG |
+             IB_DEVICE_LOCAL_DMA_LKEY |
              IB_DEVICE_MEM_WINDOW);
 
         /* Allocate the qptr_array */
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 3f441fc57c17..f6d5747153a5 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -145,7 +145,9 @@ static int cxio_hal_clear_qp_ctx(struct cxio_rdev *rdev_p, u32 qpid)
         }
         wqe = (struct t3_modify_qp_wr *) skb_put(skb, sizeof(*wqe));
         memset(wqe, 0, sizeof(*wqe));
-        build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_QP_MOD, 3, 0, qpid, 7);
+        build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_QP_MOD,
+                       T3_COMPLETION_FLAG | T3_NOTIFY_FLAG, 0, qpid, 7,
+                       T3_SOPEOP);
         wqe->flags = cpu_to_be32(MODQP_WRITE_EC);
         sge_cmd = qpid << 8 | 3;
         wqe->sge_cmd = cpu_to_be64(sge_cmd);
@@ -276,7 +278,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
         if (!wq->qpid)
                 return -ENOMEM;
 
-        wq->rq = kzalloc(depth * sizeof(u64), GFP_KERNEL);
+        wq->rq = kzalloc(depth * sizeof(struct t3_swrq), GFP_KERNEL);
         if (!wq->rq)
                 goto err1;
 
@@ -300,6 +302,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
         if (!kernel_domain)
                 wq->udb = (u64)rdev_p->rnic_info.udbell_physbase +
                                         (wq->qpid << rdev_p->qpshift);
+        wq->rdev = rdev_p;
         PDBG("%s qpid 0x%x doorbell 0x%p udb 0x%llx\n", __func__,
              wq->qpid, wq->doorbell, (unsigned long long) wq->udb);
         return 0;
@@ -558,7 +561,7 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
         wqe = (struct t3_modify_qp_wr *) skb_put(skb, sizeof(*wqe));
         memset(wqe, 0, sizeof(*wqe));
         build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_QP_MOD, 0, 0,
-                       T3_CTL_QP_TID, 7);
+                       T3_CTL_QP_TID, 7, T3_SOPEOP);
         wqe->flags = cpu_to_be32(MODQP_WRITE_EC);
         sge_cmd = (3ULL << 56) | FW_RI_SGEEC_START << 8 | 3;
         wqe->sge_cmd = cpu_to_be64(sge_cmd);
@@ -674,7 +677,7 @@ static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
                 build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_BP, flag,
                                Q_GENBIT(rdev_p->ctrl_qp.wptr,
                                         T3_CTRL_QP_SIZE_LOG2), T3_CTRL_QP_ID,
-                               wr_len);
+                               wr_len, T3_SOPEOP);
                 if (flag == T3_COMPLETION_FLAG)
                         ring_doorbell(rdev_p->ctrl_qp.doorbell, T3_CTRL_QP_ID);
                 len -= 96;
@@ -816,6 +819,13 @@ int cxio_deallocate_window(struct cxio_rdev *rdev_p, u32 stag)
                              0, 0);
 }
 
+int cxio_allocate_stag(struct cxio_rdev *rdev_p, u32 *stag, u32 pdid, u32 pbl_size, u32 pbl_addr)
+{
+        *stag = T3_STAG_UNSET;
+        return __cxio_tpt_op(rdev_p, 0, stag, 0, pdid, TPT_NON_SHARED_MR,
+                             0, 0, 0ULL, 0, 0, pbl_size, pbl_addr);
+}
+
 int cxio_rdma_init(struct cxio_rdev *rdev_p, struct t3_rdma_init_attr *attr)
 {
         struct t3_rdma_init_wr *wqe;
@@ -1257,13 +1267,16 @@ proc_cqe:
                 wq->sq_rptr = CQE_WRID_SQ_WPTR(*hw_cqe);
                 PDBG("%s completing sq idx %ld\n", __func__,
                      Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2));
-                *cookie = (wq->sq +
-                           Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2))->wr_id;
+                *cookie = wq->sq[Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2)].wr_id;
                 wq->sq_rptr++;
         } else {
                 PDBG("%s completing rq idx %ld\n", __func__,
                      Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2));
-                *cookie = *(wq->rq + Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2));
+                *cookie = wq->rq[Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2)].wr_id;
+                if (wq->rq[Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2)].pbl_addr)
+                        cxio_hal_pblpool_free(wq->rdev,
+                                wq->rq[Q_PTR2IDX(wq->rq_rptr,
+                                wq->rq_size_log2)].pbl_addr, T3_STAG0_PBL_SIZE);
                 wq->rq_rptr++;
         }
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index 6e128f6bab05..656fe47bc84f 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -45,15 +45,17 @@
 #define T3_CTRL_QP_SIZE_LOG2  8
 #define T3_CTRL_CQ_ID    0
 
-/* TBD */
 #define T3_MAX_NUM_RI (1<<15)
 #define T3_MAX_NUM_QP (1<<15)
 #define T3_MAX_NUM_CQ (1<<15)
 #define T3_MAX_NUM_PD (1<<15)
 #define T3_MAX_PBL_SIZE 256
 #define T3_MAX_RQ_SIZE 1024
+#define T3_MAX_QP_DEPTH (T3_MAX_RQ_SIZE-1)
+#define T3_MAX_CQ_DEPTH 8192
 #define T3_MAX_NUM_STAG (1<<15)
 #define T3_MAX_MR_SIZE 0x100000000ULL
+#define T3_PAGESIZE_MASK 0xffff000  /* 4KB-128MB */
 
 #define T3_STAG_UNSET 0xffffffff
 
@@ -165,6 +167,7 @@ int cxio_reregister_phys_mem(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
 int cxio_dereg_mem(struct cxio_rdev *rdev, u32 stag, u32 pbl_size,
                    u32 pbl_addr);
 int cxio_allocate_window(struct cxio_rdev *rdev, u32 * stag, u32 pdid);
+int cxio_allocate_stag(struct cxio_rdev *rdev, u32 *stag, u32 pdid, u32 pbl_size, u32 pbl_addr);
 int cxio_deallocate_window(struct cxio_rdev *rdev, u32 stag);
 int cxio_rdma_init(struct cxio_rdev *rdev, struct t3_rdma_init_attr *attr);
 void cxio_register_ev_cb(cxio_hal_ev_callback_func_t ev_cb);
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
index f1a25a821a45..04618f7bfbb3 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_wr.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -39,6 +39,9 @@
 
 #define T3_MAX_SGE      4
 #define T3_MAX_INLINE   64
+#define T3_STAG0_PBL_SIZE (2 * T3_MAX_SGE << 3)
+#define T3_STAG0_MAX_PBE_LEN (128 * 1024 * 1024)
+#define T3_STAG0_PAGE_SHIFT 15
 
 #define Q_EMPTY(rptr,wptr) ((rptr)==(wptr))
 #define Q_FULL(rptr,wptr,size_log2)  ( (((wptr)-(rptr))>>(size_log2)) && \
@@ -72,7 +75,8 @@ enum t3_wr_opcode {
         T3_WR_BIND = FW_WROPCODE_RI_BIND_MW,
         T3_WR_RCV = FW_WROPCODE_RI_RECEIVE,
         T3_WR_INIT = FW_WROPCODE_RI_RDMA_INIT,
-        T3_WR_QP_MOD = FW_WROPCODE_RI_MODIFY_QP
+        T3_WR_QP_MOD = FW_WROPCODE_RI_MODIFY_QP,
+        T3_WR_FASTREG = FW_WROPCODE_RI_FASTREGISTER_MR
 } __attribute__ ((packed));
 
 enum t3_rdma_opcode {
@@ -89,7 +93,8 @@ enum t3_rdma_opcode {
         T3_FAST_REGISTER,
         T3_LOCAL_INV,
         T3_QP_MOD,
-        T3_BYPASS
+        T3_BYPASS,
+        T3_RDMA_READ_REQ_WITH_INV,
 } __attribute__ ((packed));
 
 static inline enum t3_rdma_opcode wr2opcode(enum t3_wr_opcode wrop)
@@ -103,6 +108,7 @@ static inline enum t3_rdma_opcode wr2opcode(enum t3_wr_opcode wrop)
                 case T3_WR_BIND: return T3_BIND_MW;
                 case T3_WR_INIT: return T3_RDMA_INIT;
                 case T3_WR_QP_MOD: return T3_QP_MOD;
+                case T3_WR_FASTREG: return T3_FAST_REGISTER;
                 default: break;
         }
         return -1;
@@ -170,11 +176,54 @@ struct t3_send_wr {
         struct t3_sge sgl[T3_MAX_SGE];  /* 4+ */
 };
 
+#define T3_MAX_FASTREG_DEPTH 24
+#define T3_MAX_FASTREG_FRAG 10
+
+struct t3_fastreg_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        __be32 stag;            /* 2 */
+        __be32 len;
+        __be32 va_base_hi;      /* 3 */
+        __be32 va_base_lo_fbo;
+        __be32 page_type_perms; /* 4 */
+        __be32 reserved1;
+        __be64 pbl_addrs[0];    /* 5+ */
+};
+
+/*
+ * If a fastreg wr spans multiple wqes, then the 2nd fragment look like this.
+ */
+struct t3_pbl_frag {
+        struct fw_riwrh wrh;    /* 0 */
+        __be64 pbl_addrs[14];   /* 1..14 */
+};
+
+#define S_FR_PAGE_COUNT         24
+#define M_FR_PAGE_COUNT         0xff
+#define V_FR_PAGE_COUNT(x)      ((x) << S_FR_PAGE_COUNT)
+#define G_FR_PAGE_COUNT(x)      ((((x) >> S_FR_PAGE_COUNT)) & M_FR_PAGE_COUNT)
+
+#define S_FR_PAGE_SIZE          16
+#define M_FR_PAGE_SIZE          0x1f
+#define V_FR_PAGE_SIZE(x)       ((x) << S_FR_PAGE_SIZE)
+#define G_FR_PAGE_SIZE(x)       ((((x) >> S_FR_PAGE_SIZE)) & M_FR_PAGE_SIZE)
+
+#define S_FR_TYPE               8
+#define M_FR_TYPE               0x1
+#define V_FR_TYPE(x)            ((x) << S_FR_TYPE)
+#define G_FR_TYPE(x)            ((((x) >> S_FR_TYPE)) & M_FR_TYPE)
+
+#define S_FR_PERMS              0
+#define M_FR_PERMS              0xff
+#define V_FR_PERMS(x)           ((x) << S_FR_PERMS)
+#define G_FR_PERMS(x)           ((((x) >> S_FR_PERMS)) & M_FR_PERMS)
+
 struct t3_local_inv_wr {
         struct fw_riwrh wrh;    /* 0 */
         union t3_wrid wrid;     /* 1 */
         __be32 stag;            /* 2 */
-        __be32 reserved3;
+        __be32 reserved;
 };
 
 struct t3_rdma_write_wr {
@@ -193,7 +242,8 @@ struct t3_rdma_read_wr {
         struct fw_riwrh wrh;    /* 0 */
         union t3_wrid wrid;     /* 1 */
         u8 rdmaop;              /* 2 */
-        u8 reserved[3];
+        u8 local_inv;
+        u8 reserved[2];
         __be32 rem_stag;
         __be64 rem_to;          /* 3 */
         __be32 local_stag;      /* 4 */
@@ -201,18 +251,6 @@ struct t3_rdma_read_wr {
         __be64 local_to;        /* 5 */
 };
 
-enum t3_addr_type {
-        T3_VA_BASED_TO = 0x0,
-        T3_ZERO_BASED_TO = 0x1
-} __attribute__ ((packed));
-
-enum t3_mem_perms {
-        T3_MEM_ACCESS_LOCAL_READ = 0x1,
-        T3_MEM_ACCESS_LOCAL_WRITE = 0x2,
-        T3_MEM_ACCESS_REM_READ = 0x4,
-        T3_MEM_ACCESS_REM_WRITE = 0x8
-} __attribute__ ((packed));
-
 struct t3_bind_mw_wr {
         struct fw_riwrh wrh;    /* 0 */
         union t3_wrid wrid;     /* 1 */
@@ -336,6 +374,11 @@ struct t3_genbit {
         __be64 genbit;
 };
 
+struct t3_wq_in_err {
+        u64 flit[13];
+        u64 err;
+};
+
 enum rdma_init_wr_flags {
         MPA_INITIATOR = (1<<0),
         PRIV_QP = (1<<1),
@@ -346,13 +389,16 @@ union t3_wr {
         struct t3_rdma_write_wr write;
         struct t3_rdma_read_wr read;
         struct t3_receive_wr recv;
+        struct t3_fastreg_wr fastreg;
+        struct t3_pbl_frag pbl_frag;
         struct t3_local_inv_wr local_inv;
         struct t3_bind_mw_wr bind;
         struct t3_bypass_wr bypass;
         struct t3_rdma_init_wr init;
         struct t3_modify_qp_wr qp_mod;
         struct t3_genbit genbit;
-        u64 flit[16];
+        struct t3_wq_in_err wq_in_err;
+        __be64 flit[16];
 };
 
 #define T3_SQ_CQE_FLIT    13
@@ -366,12 +412,18 @@ static inline enum t3_wr_opcode fw_riwrh_opcode(struct fw_riwrh *wqe)
         return G_FW_RIWR_OP(be32_to_cpu(wqe->op_seop_flags));
 }
 
+enum t3_wr_hdr_bits {
+        T3_EOP = 1,
+        T3_SOP = 2,
+        T3_SOPEOP = T3_EOP|T3_SOP,
+};
+
 static inline void build_fw_riwrh(struct fw_riwrh *wqe, enum t3_wr_opcode op,
                                   enum t3_wr_flags flags, u8 genbit, u32 tid,
-                                  u8 len)
+                                  u8 len, u8 sopeop)
 {
         wqe->op_seop_flags = cpu_to_be32(V_FW_RIWR_OP(op) |
-                                         V_FW_RIWR_SOPEOP(M_FW_RIWR_SOPEOP) |
+                                         V_FW_RIWR_SOPEOP(sopeop) |
                                          V_FW_RIWR_FLAGS(flags));
         wmb();
         wqe->gen_tid_len = cpu_to_be32(V_FW_RIWR_GEN(genbit) |
@@ -404,6 +456,7 @@ enum tpt_addr_type {
 };
 
 enum tpt_mem_perm {
+        TPT_MW_BIND = 0x10,
         TPT_LOCAL_READ = 0x8,
         TPT_LOCAL_WRITE = 0x4,
         TPT_REMOTE_READ = 0x2,
@@ -615,6 +668,11 @@ struct t3_swsq {
         int                     signaled;
 };
 
+struct t3_swrq {
+        __u64                   wr_id;
+        __u32                   pbl_addr;
+};
+
 /*
  * A T3 WQ implements both the SQ and RQ.
  */
@@ -631,14 +689,15 @@ struct t3_wq {
         u32 sq_wptr;                    /* sq_wptr - sq_rptr == count of */
         u32 sq_rptr;                    /* pending wrs */
         u32 sq_size_log2;               /* sq size */
-        u64 *rq;                        /* SW RQ (holds consumer wr_ids */
+        struct t3_swrq *rq;             /* SW RQ (holds consumer wr_ids */
         u32 rq_wptr;                    /* rq_wptr - rq_rptr == count of */
         u32 rq_rptr;                    /* pending wrs */
-        u64 *rq_oldest_wr;              /* oldest wr on the SW RQ */
+        struct t3_swrq *rq_oldest_wr;   /* oldest wr on the SW RQ */
         u32 rq_size_log2;               /* rq size */
         u32 rq_addr;                    /* rq adapter address */
         void __iomem *doorbell;         /* kernel db */
         u64 udb;                        /* user db if any */
+        struct cxio_rdev *rdev;
 };
 
 struct t3_cq {
@@ -659,7 +718,7 @@ struct t3_cq {
 
 static inline void cxio_set_wq_in_error(struct t3_wq *wq)
 {
-        wq->queue->flit[13] = 1;
+        wq->queue->wq_in_err.err = 1;
 }
 
 static inline struct t3_cqe *cxio_next_hw_cqe(struct t3_cq *cq)
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
index 71554eacb13c..4489c89d6710 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.c
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -71,18 +71,16 @@ static void rnic_init(struct iwch_dev *rnicp)
         idr_init(&rnicp->mmidr);
         spin_lock_init(&rnicp->lock);
 
-        rnicp->attr.vendor_id = 0x168;
-        rnicp->attr.vendor_part_id = 7;
         rnicp->attr.max_qps = T3_MAX_NUM_QP - 32;
-        rnicp->attr.max_wrs = (1UL << 24) - 1;
+        rnicp->attr.max_wrs = T3_MAX_QP_DEPTH;
         rnicp->attr.max_sge_per_wr = T3_MAX_SGE;
         rnicp->attr.max_sge_per_rdma_write_wr = T3_MAX_SGE;
         rnicp->attr.max_cqs = T3_MAX_NUM_CQ - 1;
-        rnicp->attr.max_cqes_per_cq = (1UL << 24) - 1;
+        rnicp->attr.max_cqes_per_cq = T3_MAX_CQ_DEPTH;
         rnicp->attr.max_mem_regs = cxio_num_stags(&rnicp->rdev);
         rnicp->attr.max_phys_buf_entries = T3_MAX_PBL_SIZE;
         rnicp->attr.max_pds = T3_MAX_NUM_PD - 1;
-        rnicp->attr.mem_pgsizes_bitmask = 0x7FFF;       /* 4KB-128MB */
+        rnicp->attr.mem_pgsizes_bitmask = T3_PAGESIZE_MASK;
         rnicp->attr.max_mr_size = T3_MAX_MR_SIZE;
         rnicp->attr.can_resize_wq = 0;
         rnicp->attr.max_rdma_reads_per_qp = 8;
diff --git a/drivers/infiniband/hw/cxgb3/iwch.h b/drivers/infiniband/hw/cxgb3/iwch.h
index d2409a505e8d..3773453b2cf0 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.h
+++ b/drivers/infiniband/hw/cxgb3/iwch.h
@@ -48,8 +48,6 @@ struct iwch_qp;
 struct iwch_mr;
 
 struct iwch_rnic_attributes {
-        u32 vendor_id;
-        u32 vendor_part_id;
         u32 max_qps;
         u32 max_wrs;                            /* Max for any SQ/RQ */
         u32 max_sge_per_wr;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cq.c b/drivers/infiniband/hw/cxgb3/iwch_cq.c
index 4ee8ccd0a9e5..cf5474ae68ff 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cq.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cq.c
@@ -81,6 +81,7 @@ static int iwch_poll_cq_one(struct iwch_dev *rhp, struct iwch_cq *chp,
         wc->wr_id = cookie;
         wc->qp = &qhp->ibqp;
         wc->vendor_err = CQE_STATUS(cqe);
+        wc->wc_flags = 0;
 
         PDBG("%s qpid 0x%x type %d opcode %d status 0x%x wrid hi 0x%x "
              "lo 0x%x cookie 0x%llx\n", __func__,
@@ -94,6 +95,11 @@ static int iwch_poll_cq_one(struct iwch_dev *rhp, struct iwch_cq *chp,
                 else
                         wc->byte_len = 0;
                 wc->opcode = IB_WC_RECV;
+                if (CQE_OPCODE(cqe) == T3_SEND_WITH_INV ||
+                    CQE_OPCODE(cqe) == T3_SEND_WITH_SE_INV) {
+                        wc->ex.invalidate_rkey = CQE_WRID_STAG(cqe);
+                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
+                }
         } else {
                 switch (CQE_OPCODE(cqe)) {
                 case T3_RDMA_WRITE:
@@ -105,17 +111,20 @@ static int iwch_poll_cq_one(struct iwch_dev *rhp, struct iwch_cq *chp,
                         break;
                 case T3_SEND:
                 case T3_SEND_WITH_SE:
+                case T3_SEND_WITH_INV:
+                case T3_SEND_WITH_SE_INV:
                         wc->opcode = IB_WC_SEND;
                         break;
                 case T3_BIND_MW:
                         wc->opcode = IB_WC_BIND_MW;
                         break;
 
-                /* these aren't supported yet */
-                case T3_SEND_WITH_INV:
-                case T3_SEND_WITH_SE_INV:
                 case T3_LOCAL_INV:
+                        wc->opcode = IB_WC_LOCAL_INV;
+                        break;
                 case T3_FAST_REGISTER:
+                        wc->opcode = IB_WC_FAST_REG_MR;
+                        break;
                 default:
                         printk(KERN_ERR MOD "Unexpected opcode %d "
                                "in the CQE received for QPID=0x%0x\n",
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 8934178a23ee..b89640aa6e10 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -56,6 +56,7 @@
 #include "iwch_provider.h"
 #include "iwch_cm.h"
 #include "iwch_user.h"
+#include "common.h"
 
 static int iwch_modify_port(struct ib_device *ibdev,
                             u8 port, int port_modify_mask,
@@ -747,6 +748,7 @@ static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd)
         mhp->attr.type = TPT_MW;
         mhp->attr.stag = stag;
         mmid = (stag) >> 8;
+        mhp->ibmw.rkey = stag;
         insert_handle(rhp, &rhp->mmidr, mhp, mmid);
         PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
         return &(mhp->ibmw);
@@ -768,6 +770,68 @@ static int iwch_dealloc_mw(struct ib_mw *mw)
         return 0;
 }
 
+static struct ib_mr *iwch_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth)
+{
+        struct iwch_dev *rhp;
+        struct iwch_pd *php;
+        struct iwch_mr *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret;
+
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+        ret = iwch_alloc_pbl(mhp, pbl_depth);
+        if (ret) {
+                kfree(mhp);
+                return ERR_PTR(ret);
+        }
+        mhp->attr.pbl_size = pbl_depth;
+        ret = cxio_allocate_stag(&rhp->rdev, &stag, php->pdid,
+                                 mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret) {
+                iwch_free_pbl(mhp);
+                kfree(mhp);
+                return ERR_PTR(ret);
+        }
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = TPT_NON_SHARED_MR;
+        mhp->attr.stag = stag;
+        mhp->attr.state = 1;
+        mmid = (stag) >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
+        return &(mhp->ibmr);
+}
+
+static struct ib_fast_reg_page_list *iwch_alloc_fastreg_pbl(
+                                        struct ib_device *device,
+                                        int page_list_len)
+{
+        struct ib_fast_reg_page_list *page_list;
+
+        page_list = kmalloc(sizeof *page_list + page_list_len * sizeof(u64),
+                            GFP_KERNEL);
+        if (!page_list)
+                return ERR_PTR(-ENOMEM);
+
+        page_list->page_list = (u64 *)(page_list + 1);
+        page_list->max_page_list_len = page_list_len;
+
+        return page_list;
+}
+
+static void iwch_free_fastreg_pbl(struct ib_fast_reg_page_list *page_list)
+{
+        kfree(page_list);
+}
+
 static int iwch_destroy_qp(struct ib_qp *ib_qp)
 {
         struct iwch_dev *rhp;
@@ -843,6 +907,15 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
          */
         sqsize = roundup_pow_of_two(attrs->cap.max_send_wr);
         wqsize = roundup_pow_of_two(rqsize + sqsize);
+
+        /*
+         * Kernel users need more wq space for fastreg WRs which can take
+         * 2 WR fragments.
+         */
+        ucontext = pd->uobject ? to_iwch_ucontext(pd->uobject->context) : NULL;
+        if (!ucontext && wqsize < (rqsize + (2 * sqsize)))
+                wqsize = roundup_pow_of_two(rqsize +
+                                roundup_pow_of_two(attrs->cap.max_send_wr * 2));
         PDBG("%s wqsize %d sqsize %d rqsize %d\n", __func__,
              wqsize, sqsize, rqsize);
         qhp = kzalloc(sizeof(*qhp), GFP_KERNEL);
@@ -851,7 +924,6 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
         qhp->wq.size_log2 = ilog2(wqsize);
         qhp->wq.rq_size_log2 = ilog2(rqsize);
         qhp->wq.sq_size_log2 = ilog2(sqsize);
-        ucontext = pd->uobject ? to_iwch_ucontext(pd->uobject->context) : NULL;
         if (cxio_create_qp(&rhp->rdev, !udata, &qhp->wq,
                            ucontext ? &ucontext->uctx : &rhp->rdev.uctx)) {
                 kfree(qhp);
@@ -935,10 +1007,10 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
         qhp->ibqp.qp_num = qhp->wq.qpid;
         init_timer(&(qhp->timer));
         PDBG("%s sq_num_entries %d, rq_num_entries %d "
-             "qpid 0x%0x qhp %p dma_addr 0x%llx size %d\n",
+             "qpid 0x%0x qhp %p dma_addr 0x%llx size %d rq_addr 0x%x\n",
              __func__, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
              qhp->wq.qpid, qhp, (unsigned long long) qhp->wq.dma_addr,
-             1 << qhp->wq.size_log2);
+             1 << qhp->wq.size_log2, qhp->wq.rq_addr);
         return &qhp->ibqp;
 }
 
@@ -1023,6 +1095,29 @@ static int iwch_query_gid(struct ib_device *ibdev, u8 port,
         return 0;
 }
 
+static u64 fw_vers_string_to_u64(struct iwch_dev *iwch_dev)
+{
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = iwch_dev->rdev.t3cdev_p->lldev;
+        char *cp, *next;
+        unsigned fw_maj, fw_min, fw_mic;
+
+        rtnl_lock();
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        rtnl_unlock();
+
+        next = info.fw_version + 1;
+        cp = strsep(&next, ".");
+        sscanf(cp, "%i", &fw_maj);
+        cp = strsep(&next, ".");
+        sscanf(cp, "%i", &fw_min);
+        cp = strsep(&next, ".");
+        sscanf(cp, "%i", &fw_mic);
+
+        return (((u64)fw_maj & 0xffff) << 32) | ((fw_min & 0xffff) << 16) |
+               (fw_mic & 0xffff);
+}
+
 static int iwch_query_device(struct ib_device *ibdev,
                              struct ib_device_attr *props)
 {
@@ -1033,7 +1128,10 @@ static int iwch_query_device(struct ib_device *ibdev,
         dev = to_iwch_dev(ibdev);
         memset(props, 0, sizeof *props);
         memcpy(&props->sys_image_guid, dev->rdev.t3cdev_p->lldev->dev_addr, 6);
+        props->hw_ver = dev->rdev.t3cdev_p->type;
+        props->fw_ver = fw_vers_string_to_u64(dev);
         props->device_cap_flags = dev->device_cap_flags;
+        props->page_size_cap = dev->attr.mem_pgsizes_bitmask;
         props->vendor_id = (u32)dev->rdev.rnic_info.pdev->vendor;
         props->vendor_part_id = (u32)dev->rdev.rnic_info.pdev->device;
         props->max_mr_size = dev->attr.max_mr_size;
@@ -1048,6 +1146,7 @@ static int iwch_query_device(struct ib_device *ibdev,
         props->max_mr = dev->attr.max_mem_regs;
         props->max_pd = dev->attr.max_pds;
         props->local_ca_ack_delay = 0;
+        props->max_fast_reg_page_list_len = T3_MAX_FASTREG_DEPTH;
 
         return 0;
 }
@@ -1088,6 +1187,28 @@ static ssize_t show_rev(struct device *dev, struct device_attribute *attr,
         return sprintf(buf, "%d\n", iwch_dev->rdev.t3cdev_p->type);
 }
 
+static int fw_supports_fastreg(struct iwch_dev *iwch_dev)
+{
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = iwch_dev->rdev.t3cdev_p->lldev;
+        char *cp, *next;
+        unsigned fw_maj, fw_min;
+
+        rtnl_lock();
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        rtnl_unlock();
+
+        next = info.fw_version+1;
+        cp = strsep(&next, ".");
+        sscanf(cp, "%i", &fw_maj);
+        cp = strsep(&next, ".");
+        sscanf(cp, "%i", &fw_min);
+
+        PDBG("%s maj %u min %u\n", __func__, fw_maj, fw_min);
+
+        return fw_maj > 6 || (fw_maj == 6 && fw_min > 0);
+}
+
 static ssize_t show_fw_ver(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct iwch_dev *iwch_dev = container_of(dev, struct iwch_dev,
@@ -1096,7 +1217,9 @@ static ssize_t show_fw_ver(struct device *dev, struct device_attribute *attr, ch
         struct net_device *lldev = iwch_dev->rdev.t3cdev_p->lldev;
 
         PDBG("%s dev 0x%p\n", __func__, dev);
+        rtnl_lock();
         lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        rtnl_unlock();
         return sprintf(buf, "%s\n", info.fw_version);
 }
 
@@ -1109,7 +1232,9 @@ static ssize_t show_hca(struct device *dev, struct device_attribute *attr,
         struct net_device *lldev = iwch_dev->rdev.t3cdev_p->lldev;
 
         PDBG("%s dev 0x%p\n", __func__, dev);
+        rtnl_lock();
         lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        rtnl_unlock();
         return sprintf(buf, "%s\n", info.driver);
 }
 
@@ -1123,6 +1248,61 @@ static ssize_t show_board(struct device *dev, struct device_attribute *attr,
                        iwch_dev->rdev.rnic_info.pdev->device);
 }
 
+static int iwch_get_mib(struct ib_device *ibdev,
+                        union rdma_protocol_stats *stats)
+{
+        struct iwch_dev *dev;
+        struct tp_mib_stats m;
+        int ret;
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        dev = to_iwch_dev(ibdev);
+        ret = dev->rdev.t3cdev_p->ctl(dev->rdev.t3cdev_p, RDMA_GET_MIB, &m);
+        if (ret)
+                return -ENOSYS;
+
+        memset(stats, 0, sizeof *stats);
+        stats->iw.ipInReceives = ((u64) m.ipInReceive_hi << 32) +
+                                m.ipInReceive_lo;
+        stats->iw.ipInHdrErrors = ((u64) m.ipInHdrErrors_hi << 32) +
+                                  m.ipInHdrErrors_lo;
+        stats->iw.ipInAddrErrors = ((u64) m.ipInAddrErrors_hi << 32) +
+                                   m.ipInAddrErrors_lo;
+        stats->iw.ipInUnknownProtos = ((u64) m.ipInUnknownProtos_hi << 32) +
+                                      m.ipInUnknownProtos_lo;
+        stats->iw.ipInDiscards = ((u64) m.ipInDiscards_hi << 32) +
+                                 m.ipInDiscards_lo;
+        stats->iw.ipInDelivers = ((u64) m.ipInDelivers_hi << 32) +
+                                 m.ipInDelivers_lo;
+        stats->iw.ipOutRequests = ((u64) m.ipOutRequests_hi << 32) +
+                                  m.ipOutRequests_lo;
+        stats->iw.ipOutDiscards = ((u64) m.ipOutDiscards_hi << 32) +
+                                  m.ipOutDiscards_lo;
+        stats->iw.ipOutNoRoutes = ((u64) m.ipOutNoRoutes_hi << 32) +
+                                  m.ipOutNoRoutes_lo;
+        stats->iw.ipReasmTimeout = (u64) m.ipReasmTimeout;
+        stats->iw.ipReasmReqds = (u64) m.ipReasmReqds;
+        stats->iw.ipReasmOKs = (u64) m.ipReasmOKs;
+        stats->iw.ipReasmFails = (u64) m.ipReasmFails;
+        stats->iw.tcpActiveOpens = (u64) m.tcpActiveOpens;
+        stats->iw.tcpPassiveOpens = (u64) m.tcpPassiveOpens;
+        stats->iw.tcpAttemptFails = (u64) m.tcpAttemptFails;
+        stats->iw.tcpEstabResets = (u64) m.tcpEstabResets;
+        stats->iw.tcpOutRsts = (u64) m.tcpOutRsts;
+        stats->iw.tcpCurrEstab = (u64) m.tcpCurrEstab;
+        stats->iw.tcpInSegs = ((u64) m.tcpInSegs_hi << 32) +
+                              m.tcpInSegs_lo;
+        stats->iw.tcpOutSegs = ((u64) m.tcpOutSegs_hi << 32) +
+                               m.tcpOutSegs_lo;
+        stats->iw.tcpRetransSegs = ((u64) m.tcpRetransSeg_hi << 32) +
+                                  m.tcpRetransSeg_lo;
+        stats->iw.tcpInErrs = ((u64) m.tcpInErrs_hi << 32) +
+                              m.tcpInErrs_lo;
+        stats->iw.tcpRtoMin = (u64) m.tcpRtoMin;
+        stats->iw.tcpRtoMax = (u64) m.tcpRtoMax;
+        return 0;
+}
+
 static DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
 static DEVICE_ATTR(fw_ver, S_IRUGO, show_fw_ver, NULL);
 static DEVICE_ATTR(hca_type, S_IRUGO, show_hca, NULL);
@@ -1132,7 +1312,7 @@ static struct device_attribute *iwch_class_attributes[] = {
         &dev_attr_hw_rev,
         &dev_attr_fw_ver,
         &dev_attr_hca_type,
-        &dev_attr_board_id
+        &dev_attr_board_id,
 };
 
 int iwch_register_device(struct iwch_dev *dev)
@@ -1145,8 +1325,12 @@ int iwch_register_device(struct iwch_dev *dev)
         memset(&dev->ibdev.node_guid, 0, sizeof(dev->ibdev.node_guid));
         memcpy(&dev->ibdev.node_guid, dev->rdev.t3cdev_p->lldev->dev_addr, 6);
         dev->ibdev.owner = THIS_MODULE;
-        dev->device_cap_flags =
-            (IB_DEVICE_ZERO_STAG | IB_DEVICE_MEM_WINDOW);
+        dev->device_cap_flags = IB_DEVICE_LOCAL_DMA_LKEY | IB_DEVICE_MEM_WINDOW;
+
+        /* cxgb3 supports STag 0. */
+        dev->ibdev.local_dma_lkey = 0;
+        if (fw_supports_fastreg(dev))
+                dev->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
 
         dev->ibdev.uverbs_cmd_mask =
             (1ull << IB_USER_VERBS_CMD_GET_CONTEXT) |
@@ -1198,15 +1382,16 @@ int iwch_register_device(struct iwch_dev *dev)
         dev->ibdev.alloc_mw = iwch_alloc_mw;
         dev->ibdev.bind_mw = iwch_bind_mw;
         dev->ibdev.dealloc_mw = iwch_dealloc_mw;
-
+        dev->ibdev.alloc_fast_reg_mr = iwch_alloc_fast_reg_mr;
+        dev->ibdev.alloc_fast_reg_page_list = iwch_alloc_fastreg_pbl;
+        dev->ibdev.free_fast_reg_page_list = iwch_free_fastreg_pbl;
         dev->ibdev.attach_mcast = iwch_multicast_attach;
         dev->ibdev.detach_mcast = iwch_multicast_detach;
         dev->ibdev.process_mad = iwch_process_mad;
-
         dev->ibdev.req_notify_cq = iwch_arm_cq;
         dev->ibdev.post_send = iwch_post_send;
         dev->ibdev.post_recv = iwch_post_receive;
-
+        dev->ibdev.get_protocol_stats = iwch_get_mib;
 
         dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
         if (!dev->ibdev.iwcm)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
index 836163fc5429..f5ceca05c435 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -296,14 +296,6 @@ static inline u32 iwch_ib_to_tpt_access(int acc)
                TPT_LOCAL_READ;
 }
 
-static inline u32 iwch_ib_to_mwbind_access(int acc)
-{
-        return (acc & IB_ACCESS_REMOTE_WRITE ? T3_MEM_ACCESS_REM_WRITE : 0) |
-               (acc & IB_ACCESS_REMOTE_READ ? T3_MEM_ACCESS_REM_READ : 0) |
-               (acc & IB_ACCESS_LOCAL_WRITE ? T3_MEM_ACCESS_LOCAL_WRITE : 0) |
-               T3_MEM_ACCESS_LOCAL_READ;
-}
-
 enum iwch_mmid_state {
         IWCH_STAG_STATE_VALID,
         IWCH_STAG_STATE_INVALID
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 992613799228..9a3be3a9d5dc 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -33,10 +33,11 @@
 #include "iwch.h"
 #include "iwch_cm.h"
 #include "cxio_hal.h"
+#include "cxio_resource.h"
 
 #define NO_SUPPORT -1
 
-static int iwch_build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
                                 u8 * flit_cnt)
 {
         int i;
@@ -44,59 +45,44 @@ static int iwch_build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
 
         switch (wr->opcode) {
         case IB_WR_SEND:
-        case IB_WR_SEND_WITH_IMM:
                 if (wr->send_flags & IB_SEND_SOLICITED)
                         wqe->send.rdmaop = T3_SEND_WITH_SE;
                 else
                         wqe->send.rdmaop = T3_SEND;
                 wqe->send.rem_stag = 0;
                 break;
-#if 0                           /* Not currently supported */
-        case TYPE_SEND_INVALIDATE:
-        case TYPE_SEND_INVALIDATE_IMMEDIATE:
-                wqe->send.rdmaop = T3_SEND_WITH_INV;
-                wqe->send.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
-                break;
-        case TYPE_SEND_SE_INVALIDATE:
-                wqe->send.rdmaop = T3_SEND_WITH_SE_INV;
-                wqe->send.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
+        case IB_WR_SEND_WITH_INV:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.rdmaop = T3_SEND_WITH_SE_INV;
+                else
+                        wqe->send.rdmaop = T3_SEND_WITH_INV;
+                wqe->send.rem_stag = cpu_to_be32(wr->ex.invalidate_rkey);
                 break;
-#endif
         default:
-                break;
+                return -EINVAL;
         }
         if (wr->num_sge > T3_MAX_SGE)
                 return -EINVAL;
         wqe->send.reserved[0] = 0;
         wqe->send.reserved[1] = 0;
         wqe->send.reserved[2] = 0;
-        if (wr->opcode == IB_WR_SEND_WITH_IMM) {
-                plen = 4;
-                wqe->send.sgl[0].stag = wr->ex.imm_data;
-                wqe->send.sgl[0].len = __constant_cpu_to_be32(0);
-                wqe->send.num_sgle = __constant_cpu_to_be32(0);
-                *flit_cnt = 5;
-        } else {
-                plen = 0;
-                for (i = 0; i < wr->num_sge; i++) {
-                        if ((plen + wr->sg_list[i].length) < plen) {
-                                return -EMSGSIZE;
-                        }
-                        plen += wr->sg_list[i].length;
-                        wqe->send.sgl[i].stag =
-                            cpu_to_be32(wr->sg_list[i].lkey);
-                        wqe->send.sgl[i].len =
-                            cpu_to_be32(wr->sg_list[i].length);
-                        wqe->send.sgl[i].to = cpu_to_be64(wr->sg_list[i].addr);
-                }
-                wqe->send.num_sgle = cpu_to_be32(wr->num_sge);
-                *flit_cnt = 4 + ((wr->num_sge) << 1);
+        plen = 0;
+        for (i = 0; i < wr->num_sge; i++) {
+                if ((plen + wr->sg_list[i].length) < plen)
+                        return -EMSGSIZE;
+
+                plen += wr->sg_list[i].length;
+                wqe->send.sgl[i].stag = cpu_to_be32(wr->sg_list[i].lkey);
+                wqe->send.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
+                wqe->send.sgl[i].to = cpu_to_be64(wr->sg_list[i].addr);
         }
+        wqe->send.num_sgle = cpu_to_be32(wr->num_sge);
+        *flit_cnt = 4 + ((wr->num_sge) << 1);
         wqe->send.plen = cpu_to_be32(plen);
         return 0;
 }
 
-static int iwch_build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
                                  u8 *flit_cnt)
 {
         int i;
@@ -137,15 +123,18 @@ static int iwch_build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
-static int iwch_build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
                                 u8 *flit_cnt)
 {
         if (wr->num_sge > 1)
                 return -EINVAL;
         wqe->read.rdmaop = T3_READ_REQ;
+        if (wr->opcode == IB_WR_RDMA_READ_WITH_INV)
+                wqe->read.local_inv = 1;
+        else
+                wqe->read.local_inv = 0;
         wqe->read.reserved[0] = 0;
         wqe->read.reserved[1] = 0;
-        wqe->read.reserved[2] = 0;
         wqe->read.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
         wqe->read.rem_to = cpu_to_be64(wr->wr.rdma.remote_addr);
         wqe->read.local_stag = cpu_to_be32(wr->sg_list[0].lkey);
@@ -155,6 +144,57 @@ static int iwch_build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
+static int build_fastreg(union t3_wr *wqe, struct ib_send_wr *wr,
+                                u8 *flit_cnt, int *wr_cnt, struct t3_wq *wq)
+{
+        int i;
+        __be64 *p;
+
+        if (wr->wr.fast_reg.page_list_len > T3_MAX_FASTREG_DEPTH)
+                return -EINVAL;
+        *wr_cnt = 1;
+        wqe->fastreg.stag = cpu_to_be32(wr->wr.fast_reg.rkey);
+        wqe->fastreg.len = cpu_to_be32(wr->wr.fast_reg.length);
+        wqe->fastreg.va_base_hi = cpu_to_be32(wr->wr.fast_reg.iova_start >> 32);
+        wqe->fastreg.va_base_lo_fbo =
+                                cpu_to_be32(wr->wr.fast_reg.iova_start & 0xffffffff);
+        wqe->fastreg.page_type_perms = cpu_to_be32(
+                V_FR_PAGE_COUNT(wr->wr.fast_reg.page_list_len) |
+                V_FR_PAGE_SIZE(wr->wr.fast_reg.page_shift-12) |
+                V_FR_TYPE(TPT_VATO) |
+                V_FR_PERMS(iwch_ib_to_tpt_access(wr->wr.fast_reg.access_flags)));
+        p = &wqe->fastreg.pbl_addrs[0];
+        for (i = 0; i < wr->wr.fast_reg.page_list_len; i++, p++) {
+
+                /* If we need a 2nd WR, then set it up */
+                if (i == T3_MAX_FASTREG_FRAG) {
+                        *wr_cnt = 2;
+                        wqe = (union t3_wr *)(wq->queue +
+                                Q_PTR2IDX((wq->wptr+1), wq->size_log2));
+                        build_fw_riwrh((void *)wqe, T3_WR_FASTREG, 0,
+                               Q_GENBIT(wq->wptr + 1, wq->size_log2),
+                               0, 1 + wr->wr.fast_reg.page_list_len - T3_MAX_FASTREG_FRAG,
+                               T3_EOP);
+
+                        p = &wqe->pbl_frag.pbl_addrs[0];
+                }
+                *p = cpu_to_be64((u64)wr->wr.fast_reg.page_list->page_list[i]);
+        }
+        *flit_cnt = 5 + wr->wr.fast_reg.page_list_len;
+        if (*flit_cnt > 15)
+                *flit_cnt = 15;
+        return 0;
+}
+
+static int build_inv_stag(union t3_wr *wqe, struct ib_send_wr *wr,
+                                u8 *flit_cnt)
+{
+        wqe->local_inv.stag = cpu_to_be32(wr->ex.invalidate_rkey);
+        wqe->local_inv.reserved = 0;
+        *flit_cnt = sizeof(struct t3_local_inv_wr) >> 3;
+        return 0;
+}
+
 /*
  * TBD: this is going to be moved to firmware. Missing pdid/qpid check for now.
  */
@@ -205,23 +245,106 @@ static int iwch_sgl2pbl_map(struct iwch_dev *rhp, struct ib_sge *sg_list,
         return 0;
 }
 
-static int iwch_build_rdma_recv(struct iwch_dev *rhp, union t3_wr *wqe,
+static int build_rdma_recv(struct iwch_qp *qhp, union t3_wr *wqe,
                                 struct ib_recv_wr *wr)
 {
-        int i;
-        if (wr->num_sge > T3_MAX_SGE)
-                return -EINVAL;
+        int i, err = 0;
+        u32 pbl_addr[T3_MAX_SGE];
+        u8 page_size[T3_MAX_SGE];
+
+        err = iwch_sgl2pbl_map(qhp->rhp, wr->sg_list, wr->num_sge, pbl_addr,
+                               page_size);
+        if (err)
+                return err;
+        wqe->recv.pagesz[0] = page_size[0];
+        wqe->recv.pagesz[1] = page_size[1];
+        wqe->recv.pagesz[2] = page_size[2];
+        wqe->recv.pagesz[3] = page_size[3];
         wqe->recv.num_sgle = cpu_to_be32(wr->num_sge);
         for (i = 0; i < wr->num_sge; i++) {
                 wqe->recv.sgl[i].stag = cpu_to_be32(wr->sg_list[i].lkey);
                 wqe->recv.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
+
+                /* to in the WQE == the offset into the page */
+                wqe->recv.sgl[i].to = cpu_to_be64(((u32) wr->sg_list[i].addr) %
+                                (1UL << (12 + page_size[i])));
+
+                /* pbl_addr is the adapters address in the PBL */
+                wqe->recv.pbl_addr[i] = cpu_to_be32(pbl_addr[i]);
+        }
+        for (; i < T3_MAX_SGE; i++) {
+                wqe->recv.sgl[i].stag = 0;
+                wqe->recv.sgl[i].len = 0;
+                wqe->recv.sgl[i].to = 0;
+                wqe->recv.pbl_addr[i] = 0;
+        }
+        qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                             qhp->wq.rq_size_log2)].wr_id = wr->wr_id;
+        qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                             qhp->wq.rq_size_log2)].pbl_addr = 0;
+        return 0;
+}
+
+static int build_zero_stag_recv(struct iwch_qp *qhp, union t3_wr *wqe,
+                                struct ib_recv_wr *wr)
+{
+        int i;
+        u32 pbl_addr;
+        u32 pbl_offset;
+
+
+        /*
+         * The T3 HW requires the PBL in the HW recv descriptor to reference
+         * a PBL entry.  So we allocate the max needed PBL memory here and pass
+         * it to the uP in the recv WR.  The uP will build the PBL and setup
+         * the HW recv descriptor.
+         */
+        pbl_addr = cxio_hal_pblpool_alloc(&qhp->rhp->rdev, T3_STAG0_PBL_SIZE);
+        if (!pbl_addr)
+                return -ENOMEM;
+
+        /*
+         * Compute the 8B aligned offset.
+         */
+        pbl_offset = (pbl_addr - qhp->rhp->rdev.rnic_info.pbl_base) >> 3;
+
+        wqe->recv.num_sgle = cpu_to_be32(wr->num_sge);
+
+        for (i = 0; i < wr->num_sge; i++) {
+
+                /*
+                 * Use a 128MB page size. This and an imposed 128MB
+                 * sge length limit allows us to require only a 2-entry HW
+                 * PBL for each SGE.  This restriction is acceptable since
+                 * since it is not possible to allocate 128MB of contiguous
+                 * DMA coherent memory!
+                 */
+                if (wr->sg_list[i].length > T3_STAG0_MAX_PBE_LEN)
+                        return -EINVAL;
+                wqe->recv.pagesz[i] = T3_STAG0_PAGE_SHIFT;
+
+                /*
+                 * T3 restricts a recv to all zero-stag or all non-zero-stag.
+                 */
+                if (wr->sg_list[i].lkey != 0)
+                        return -EINVAL;
+                wqe->recv.sgl[i].stag = 0;
+                wqe->recv.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
                 wqe->recv.sgl[i].to = cpu_to_be64(wr->sg_list[i].addr);
+                wqe->recv.pbl_addr[i] = cpu_to_be32(pbl_offset);
+                pbl_offset += 2;
         }
         for (; i < T3_MAX_SGE; i++) {
+                wqe->recv.pagesz[i] = 0;
                 wqe->recv.sgl[i].stag = 0;
                 wqe->recv.sgl[i].len = 0;
                 wqe->recv.sgl[i].to = 0;
+                wqe->recv.pbl_addr[i] = 0;
         }
+        qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                             qhp->wq.rq_size_log2)].wr_id = wr->wr_id;
+        qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                             qhp->wq.rq_size_log2)].pbl_addr = pbl_addr;
         return 0;
 }
 
@@ -238,6 +361,7 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         u32 num_wrs;
         unsigned long flag;
         struct t3_swsq *sqp;
+        int wr_cnt = 1;
 
         qhp = to_iwch_qp(ibqp);
         spin_lock_irqsave(&qhp->lock, flag);
@@ -262,33 +386,45 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 t3_wr_flags = 0;
                 if (wr->send_flags & IB_SEND_SOLICITED)
                         t3_wr_flags |= T3_SOLICITED_EVENT_FLAG;
-                if (wr->send_flags & IB_SEND_FENCE)
-                        t3_wr_flags |= T3_READ_FENCE_FLAG;
                 if (wr->send_flags & IB_SEND_SIGNALED)
                         t3_wr_flags |= T3_COMPLETION_FLAG;
                 sqp = qhp->wq.sq +
                       Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2);
                 switch (wr->opcode) {
                 case IB_WR_SEND:
-                case IB_WR_SEND_WITH_IMM:
+                case IB_WR_SEND_WITH_INV:
+                        if (wr->send_flags & IB_SEND_FENCE)
+                                t3_wr_flags |= T3_READ_FENCE_FLAG;
                         t3_wr_opcode = T3_WR_SEND;
-                        err = iwch_build_rdma_send(wqe, wr, &t3_wr_flit_cnt);
+                        err = build_rdma_send(wqe, wr, &t3_wr_flit_cnt);
                         break;
                 case IB_WR_RDMA_WRITE:
                 case IB_WR_RDMA_WRITE_WITH_IMM:
                         t3_wr_opcode = T3_WR_WRITE;
-                        err = iwch_build_rdma_write(wqe, wr, &t3_wr_flit_cnt);
+                        err = build_rdma_write(wqe, wr, &t3_wr_flit_cnt);
                         break;
                 case IB_WR_RDMA_READ:
+                case IB_WR_RDMA_READ_WITH_INV:
                         t3_wr_opcode = T3_WR_READ;
                         t3_wr_flags = 0; /* T3 reads are always signaled */
-                        err = iwch_build_rdma_read(wqe, wr, &t3_wr_flit_cnt);
+                        err = build_rdma_read(wqe, wr, &t3_wr_flit_cnt);
                         if (err)
                                 break;
                         sqp->read_len = wqe->read.local_len;
                         if (!qhp->wq.oldest_read)
                                 qhp->wq.oldest_read = sqp;
                         break;
+                case IB_WR_FAST_REG_MR:
+                        t3_wr_opcode = T3_WR_FASTREG;
+                        err = build_fastreg(wqe, wr, &t3_wr_flit_cnt,
+                                                 &wr_cnt, &qhp->wq);
+                        break;
+                case IB_WR_LOCAL_INV:
+                        if (wr->send_flags & IB_SEND_FENCE)
+                                t3_wr_flags |= T3_LOCAL_FENCE_FLAG;
+                        t3_wr_opcode = T3_WR_INV_STAG;
+                        err = build_inv_stag(wqe, wr, &t3_wr_flit_cnt);
+                        break;
                 default:
                         PDBG("%s post of type=%d TBD!\n", __func__,
                              wr->opcode);
@@ -307,14 +443,15 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                 build_fw_riwrh((void *) wqe, t3_wr_opcode, t3_wr_flags,
                                Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
-                               0, t3_wr_flit_cnt);
+                               0, t3_wr_flit_cnt,
+                               (wr_cnt == 1) ? T3_SOPEOP : T3_SOP);
                 PDBG("%s cookie 0x%llx wq idx 0x%x swsq idx %ld opcode %d\n",
                      __func__, (unsigned long long) wr->wr_id, idx,
                      Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2),
                      sqp->opcode);
                 wr = wr->next;
                 num_wrs--;
-                ++(qhp->wq.wptr);
+                qhp->wq.wptr += wr_cnt;
                 ++(qhp->wq.sq_wptr);
         }
         spin_unlock_irqrestore(&qhp->lock, flag);
@@ -345,21 +482,27 @@ int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 return -EINVAL;
         }
         while (wr) {
+                if (wr->num_sge > T3_MAX_SGE) {
+                        err = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
                 idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
                 wqe = (union t3_wr *) (qhp->wq.queue + idx);
                 if (num_wrs)
-                        err = iwch_build_rdma_recv(qhp->rhp, wqe, wr);
+                        if (wr->sg_list[0].lkey)
+                                err = build_rdma_recv(qhp, wqe, wr);
+                        else
+                                err = build_zero_stag_recv(qhp, wqe, wr);
                 else
                         err = -ENOMEM;
                 if (err) {
                         *bad_wr = wr;
                         break;
                 }
-                qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr, qhp->wq.rq_size_log2)] =
-                        wr->wr_id;
                 build_fw_riwrh((void *) wqe, T3_WR_RCV, T3_COMPLETION_FLAG,
                                Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
-                               0, sizeof(struct t3_receive_wr) >> 3);
+                               0, sizeof(struct t3_receive_wr) >> 3, T3_SOPEOP);
                 PDBG("%s cookie 0x%llx idx 0x%x rq_wptr 0x%x rw_rptr 0x%x "
                      "wqe %p \n", __func__, (unsigned long long) wr->wr_id,
                      idx, qhp->wq.rq_wptr, qhp->wq.rq_rptr, wqe);
@@ -419,10 +562,10 @@ int iwch_bind_mw(struct ib_qp *qp,
         sgl.lkey = mw_bind->mr->lkey;
         sgl.length = mw_bind->length;
         wqe->bind.reserved = 0;
-        wqe->bind.type = T3_VA_BASED_TO;
+        wqe->bind.type = TPT_VATO;
 
         /* TBD: check perms */
-        wqe->bind.perms = iwch_ib_to_mwbind_access(mw_bind->mw_access_flags);
+        wqe->bind.perms = iwch_ib_to_tpt_access(mw_bind->mw_access_flags);
         wqe->bind.mr_stag = cpu_to_be32(mw_bind->mr->lkey);
         wqe->bind.mw_stag = cpu_to_be32(mw->rkey);
         wqe->bind.mw_len = cpu_to_be32(mw_bind->length);
@@ -430,7 +573,7 @@ int iwch_bind_mw(struct ib_qp *qp,
         err = iwch_sgl2pbl_map(rhp, &sgl, 1, &pbl_addr, &page_size);
         if (err) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
-                return err;
+                return err;
         }
         wqe->send.wrid.id0.hi = qhp->wq.sq_wptr;
         sqp = qhp->wq.sq + Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2);
@@ -441,10 +584,9 @@ int iwch_bind_mw(struct ib_qp *qp,
         sqp->signaled = (mw_bind->send_flags & IB_SEND_SIGNALED);
         wqe->bind.mr_pbl_addr = cpu_to_be32(pbl_addr);
         wqe->bind.mr_pagesz = page_size;
-        wqe->flit[T3_SQ_COOKIE_FLIT] = mw_bind->wr_id;
         build_fw_riwrh((void *)wqe, T3_WR_BIND, t3_wr_flags,
                        Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2), 0,
-                                sizeof(struct t3_bind_mw_wr) >> 3);
+                       sizeof(struct t3_bind_mw_wr) >> 3, T3_SOPEOP);
         ++(qhp->wq.wptr);
         ++(qhp->wq.sq_wptr);
         spin_unlock_irqrestore(&qhp->lock, flag);
@@ -758,7 +900,8 @@ static int rdma_init(struct iwch_dev *rhp, struct iwch_qp *qhp,
         init_attr.qp_dma_size = (1UL << qhp->wq.size_log2);
         init_attr.rqe_count = iwch_rqes_posted(qhp);
         init_attr.flags = qhp->attr.mpa_attr.initiator ? MPA_INITIATOR : 0;
-        init_attr.flags |= capable(CAP_NET_BIND_SERVICE) ? PRIV_QP : 0;
+        if (!qhp->ibqp.uobject)
+                init_attr.flags |= PRIV_QP;
         if (peer2peer) {
                 init_attr.rtr_type = RTR_READ;
                 if (init_attr.ord == 0 && qhp->attr.mpa_attr.initiator)
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index ce1ab0571be3..0792d930c481 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -531,7 +531,7 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
 {
         struct ehca_eq *eq = &shca->eq;
         struct ehca_eqe_cache_entry *eqe_cache = eq->eqe_cache;
-        u64 eqe_value;
+        u64 eqe_value, ret;
         unsigned long flags;
         int eqe_cnt, i;
         int eq_empty = 0;
@@ -583,8 +583,13 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                         ehca_dbg(&shca->ib_device,
                                  "No eqe found for irq event");
                 goto unlock_irq_spinlock;
-        } else if (!is_irq)
+        } else if (!is_irq) {
+                ret = hipz_h_eoi(eq->ist);
+                if (ret != H_SUCCESS)
+                        ehca_err(&shca->ib_device,
+                                 "bad return code EOI -rc = %ld\n", ret);
                 ehca_dbg(&shca->ib_device, "deadman found %x eqe", eqe_cnt);
+        }
         if (unlikely(eqe_cnt == EHCA_EQE_CACHE_SIZE))
                 ehca_dbg(&shca->ib_device, "too many eqes for one irq event");
         /* enable irq for new packets */
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index 482103eb6eac..598844d2edc9 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -923,6 +923,7 @@ static struct of_device_id ehca_device_table[] =
         },
         {},
 };
+MODULE_DEVICE_TABLE(of, ehca_device_table);
 
 static struct of_platform_driver ehca_driver = {
         .name        = "ehca",
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/infiniband/hw/ehca/ehca_reqs.c
index f093b0033daf..dd9bc68f1c7b 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/infiniband/hw/ehca/ehca_reqs.c
@@ -544,8 +544,16 @@ int ehca_post_recv(struct ib_qp *qp,
                    struct ib_recv_wr *recv_wr,
                    struct ib_recv_wr **bad_recv_wr)
 {
-        return internal_post_recv(container_of(qp, struct ehca_qp, ib_qp),
-                                  qp->device, recv_wr, bad_recv_wr);
+        struct ehca_qp *my_qp = container_of(qp, struct ehca_qp, ib_qp);
+
+        /* Reject WR if QP is in RESET state */
+        if (unlikely(my_qp->state == IB_QPS_RESET)) {
+                ehca_err(qp->device, "Invalid QP state  qp_state=%d qpn=%x",
+                         my_qp->state, qp->qp_num);
+                return -EINVAL;
+        }
+
+        return internal_post_recv(my_qp, qp->device, recv_wr, bad_recv_wr);
 }
 
 int ehca_post_srq_recv(struct ib_srq *srq,
@@ -681,7 +689,7 @@ poll_cq_one_read_cqe:
         wc->dlid_path_bits = cqe->dlid;
         wc->src_qp = cqe->remote_qp_number;
         wc->wc_flags = cqe->w_completion_flags;
-        wc->imm_data = cpu_to_be32(cqe->immediate_data);
+        wc->ex.imm_data = cpu_to_be32(cqe->immediate_data);
         wc->sl = cqe->service_level;
 
 poll_cq_one_exit0:
diff --git a/drivers/infiniband/hw/ehca/hcp_if.c b/drivers/infiniband/hw/ehca/hcp_if.c
index 5245e13c3a30..415d3a465de6 100644
--- a/drivers/infiniband/hw/ehca/hcp_if.c
+++ b/drivers/infiniband/hw/ehca/hcp_if.c
@@ -933,3 +933,13 @@ u64 hipz_h_error_data(const struct ipz_adapter_handle adapter_handle,
                                        r_cb,
                                        0, 0, 0, 0);
 }
+
+u64 hipz_h_eoi(int irq)
+{
+        unsigned long xirr;
+
+        iosync();
+        xirr = (0xffULL << 24) | irq;
+
+        return plpar_hcall_norets(H_EOI, xirr);
+}
diff --git a/drivers/infiniband/hw/ehca/hcp_if.h b/drivers/infiniband/hw/ehca/hcp_if.h
index 60ce02b70663..2c3c6e0ea5c2 100644
--- a/drivers/infiniband/hw/ehca/hcp_if.h
+++ b/drivers/infiniband/hw/ehca/hcp_if.h
@@ -260,5 +260,6 @@ u64 hipz_h_error_data(const struct ipz_adapter_handle adapter_handle,
                       const u64 ressource_handle,
                       void *rblock,
                       unsigned long *byte_count);
+u64 hipz_h_eoi(int irq);
 
 #endif /* __HCP_IF_H__ */
diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c
index a03bd28d9b48..d385e4168c97 100644
--- a/drivers/infiniband/hw/ipath/ipath_cq.c
+++ b/drivers/infiniband/hw/ipath/ipath_cq.c
@@ -82,7 +82,7 @@ void ipath_cq_enter(struct ipath_cq *cq, struct ib_wc *entry, int solicited)
                 wc->uqueue[head].opcode = entry->opcode;
                 wc->uqueue[head].vendor_err = entry->vendor_err;
                 wc->uqueue[head].byte_len = entry->byte_len;
-                wc->uqueue[head].imm_data = (__u32 __force)entry->imm_data;
+                wc->uqueue[head].ex.imm_data = (__u32 __force) entry->ex.imm_data;
                 wc->uqueue[head].qp_num = entry->qp->qp_num;
                 wc->uqueue[head].src_qp = entry->src_qp;
                 wc->uqueue[head].wc_flags = entry->wc_flags;
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index b472b15637f0..35f301c88b57 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -39,6 +39,7 @@
 #include <linux/highmem.h>
 #include <linux/io.h>
 #include <linux/jiffies.h>
+#include <linux/smp_lock.h>
 #include <asm/pgtable.h>
 
 #include "ipath_kernel.h"
@@ -1815,6 +1816,7 @@ done:
 static int ipath_open(struct inode *in, struct file *fp)
 {
         /* The real work is performed later in ipath_assign_port() */
+        cycle_kernel_lock();
         fp->private_data = kzalloc(sizeof(struct ipath_filedata), GFP_KERNEL);
         return fp->private_data ? 0 : -ENOMEM;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_iba7220.c b/drivers/infiniband/hw/ipath/ipath_iba7220.c
index 8eee7830f042..fb70712ac85c 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba7220.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba7220.c
@@ -2228,8 +2228,8 @@ static void ipath_autoneg_send(struct ipath_devdata *dd, int which)
                 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
                 0x40000001, 0x1388, 0x15e, /* rest 0's */
                 };
-        dcnt = sizeof(madpayload_start)/sizeof(madpayload_start[0]);
-        hcnt = sizeof(hdr)/sizeof(hdr[0]);
+        dcnt = ARRAY_SIZE(madpayload_start);
+        hcnt = ARRAY_SIZE(hdr);
         if (!swapped) {
                 /* for maintainability, do it at runtime */
                 for (i = 0; i < hcnt; i++) {
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 5f9315d77a43..be4fc9ada8e7 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -111,9 +111,9 @@ static int recv_subn_get_nodeinfo(struct ib_smp *smp,
         nip->revision = cpu_to_be32((majrev << 16) | minrev);
         nip->local_port_num = port;
         vendor = dd->ipath_vendorid;
-        nip->vendor_id[0] = 0;
-        nip->vendor_id[1] = vendor >> 8;
-        nip->vendor_id[2] = vendor;
+        nip->vendor_id[0] = IPATH_SRC_OUI_1;
+        nip->vendor_id[1] = IPATH_SRC_OUI_2;
+        nip->vendor_id[2] = IPATH_SRC_OUI_3;
 
         return reply(smp);
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
index 108df667d2ee..97710522624d 100644
--- a/drivers/infiniband/hw/ipath/ipath_rc.c
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -1703,11 +1703,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         case OP(SEND_LAST_WITH_IMMEDIATE):
         send_last_imm:
                 if (header_in_data) {
-                        wc.imm_data = *(__be32 *) data;
+                        wc.ex.imm_data = *(__be32 *) data;
                         data += sizeof(__be32);
                 } else {
                         /* Immediate data comes after BTH */
-                        wc.imm_data = ohdr->u.imm_data;
+                        wc.ex.imm_data = ohdr->u.imm_data;
                 }
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index a4b5521567fe..af051f757663 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -331,7 +331,7 @@ again:
         switch (wqe->wr.opcode) {
         case IB_WR_SEND_WITH_IMM:
                 wc.wc_flags = IB_WC_WITH_IMM;
-                wc.imm_data = wqe->wr.ex.imm_data;
+                wc.ex.imm_data = wqe->wr.ex.imm_data;
                 /* FALLTHROUGH */
         case IB_WR_SEND:
                 if (!ipath_get_rwqe(qp, 0))
@@ -342,7 +342,7 @@ again:
                 if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_WRITE)))
                         goto inv_err;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                wc.imm_data = wqe->wr.ex.imm_data;
+                wc.ex.imm_data = wqe->wr.ex.imm_data;
                 if (!ipath_get_rwqe(qp, 1))
                         goto rnr_nak;
                 /* FALLTHROUGH */
diff --git a/drivers/infiniband/hw/ipath/ipath_uc.c b/drivers/infiniband/hw/ipath/ipath_uc.c
index 0596ec16fcbd..82cc588b8bf2 100644
--- a/drivers/infiniband/hw/ipath/ipath_uc.c
+++ b/drivers/infiniband/hw/ipath/ipath_uc.c
@@ -379,11 +379,11 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         case OP(SEND_LAST_WITH_IMMEDIATE):
         send_last_imm:
                 if (header_in_data) {
-                        wc.imm_data = *(__be32 *) data;
+                        wc.ex.imm_data = *(__be32 *) data;
                         data += sizeof(__be32);
                 } else {
                         /* Immediate data comes after BTH */
-                        wc.imm_data = ohdr->u.imm_data;
+                        wc.ex.imm_data = ohdr->u.imm_data;
                 }
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
@@ -483,11 +483,11 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         case OP(RDMA_WRITE_LAST_WITH_IMMEDIATE):
         rdma_last_imm:
                 if (header_in_data) {
-                        wc.imm_data = *(__be32 *) data;
+                        wc.ex.imm_data = *(__be32 *) data;
                         data += sizeof(__be32);
                 } else {
                         /* Immediate data comes after BTH */
-                        wc.imm_data = ohdr->u.imm_data;
+                        wc.ex.imm_data = ohdr->u.imm_data;
                 }
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 77ca8ca74e78..36aa242c487c 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -96,7 +96,7 @@ static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_swqe *swqe)
 
         if (swqe->wr.opcode == IB_WR_SEND_WITH_IMM) {
                 wc.wc_flags = IB_WC_WITH_IMM;
-                wc.imm_data = swqe->wr.ex.imm_data;
+                wc.ex.imm_data = swqe->wr.ex.imm_data;
         }
 
         /*
@@ -492,14 +492,14 @@ void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         if (qp->ibqp.qp_num > 1 &&
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 if (header_in_data) {
-                        wc.imm_data = *(__be32 *) data;
+                        wc.ex.imm_data = *(__be32 *) data;
                         data += sizeof(__be32);
                 } else
-                        wc.imm_data = ohdr->u.ud.imm_data;
+                        wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
                 hdrsize += sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
-                wc.imm_data = 0;
+                wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
         } else {
                 dev->n_pkt_drops++;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 7779165b2c2c..55c718828826 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -35,6 +35,7 @@
 #include <rdma/ib_user_verbs.h>
 #include <linux/io.h>
 #include <linux/utsname.h>
+#include <linux/rculist.h>
 
 #include "ipath_kernel.h"
 #include "ipath_verbs.h"
@@ -1497,7 +1498,8 @@ static int ipath_query_device(struct ib_device *ibdev,
                 IB_DEVICE_SYS_IMAGE_GUID | IB_DEVICE_RC_RNR_NAK_GEN |
                 IB_DEVICE_PORT_ACTIVE_EVENT | IB_DEVICE_SRQ_RESIZE;
         props->page_size_cap = PAGE_SIZE;
-        props->vendor_id = dev->dd->ipath_vendorid;
+        props->vendor_id =
+                IPATH_SRC_OUI_1 << 16 | IPATH_SRC_OUI_2 << 8 | IPATH_SRC_OUI_3;
         props->vendor_part_id = dev->dd->ipath_deviceid;
         props->hw_ver = dev->dd->ipath_pcirev;
 
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
index 9e5abf9c309d..d73e32232879 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
@@ -31,8 +31,7 @@
  * SOFTWARE.
  */
 
-#include <linux/list.h>
-#include <linux/rcupdate.h>
+#include <linux/rculist.h>
 
 #include "ipath_verbs.h"
 
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 4521319b1406..299f20832ab6 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -663,18 +663,18 @@ repoll:
 
                 switch (cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) {
                 case MLX4_RECV_OPCODE_RDMA_WRITE_IMM:
-                        wc->opcode   = IB_WC_RECV_RDMA_WITH_IMM;
-                        wc->wc_flags = IB_WC_WITH_IMM;
-                        wc->imm_data = cqe->immed_rss_invalid;
+                        wc->opcode      = IB_WC_RECV_RDMA_WITH_IMM;
+                        wc->wc_flags    = IB_WC_WITH_IMM;
+                        wc->ex.imm_data = cqe->immed_rss_invalid;
                         break;
                 case MLX4_RECV_OPCODE_SEND:
                         wc->opcode   = IB_WC_RECV;
                         wc->wc_flags = 0;
                         break;
                 case MLX4_RECV_OPCODE_SEND_IMM:
-                        wc->opcode   = IB_WC_RECV;
-                        wc->wc_flags = IB_WC_WITH_IMM;
-                        wc->imm_data = cqe->immed_rss_invalid;
+                        wc->opcode      = IB_WC_RECV;
+                        wc->wc_flags    = IB_WC_WITH_IMM;
+                        wc->ex.imm_data = cqe->immed_rss_invalid;
                         break;
                 }
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 4c1e72fc8f57..cdca3a511e1c 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -255,7 +255,8 @@ int mlx4_ib_process_mad(struct ib_device *ibdev, int mad_flags,	u8 port_num,
                         return IB_MAD_RESULT_SUCCESS;
         } else if (in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT ||
                    in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS1   ||
-                   in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS2) {
+                   in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS2   ||
+                   in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_CONG_MGMT) {
                 if (in_mad->mad_hdr.method  != IB_MGMT_METHOD_GET &&
                     in_mad->mad_hdr.method  != IB_MGMT_METHOD_SET)
                         return IB_MAD_RESULT_SUCCESS;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 4d61e32866c6..bcf50648fa18 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -90,7 +90,8 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->device_cap_flags    = IB_DEVICE_CHANGE_PHY_PORT |
                 IB_DEVICE_PORT_ACTIVE_EVENT             |
                 IB_DEVICE_SYS_IMAGE_GUID                |
-                IB_DEVICE_RC_RNR_NAK_GEN;
+                IB_DEVICE_RC_RNR_NAK_GEN                |
+                IB_DEVICE_BLOCK_MULTICAST_LOOPBACK;
         if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_BAD_PKEY_CNTR)
                 props->device_cap_flags |= IB_DEVICE_BAD_PKEY_CNTR;
         if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_BAD_QKEY_CNTR)
@@ -437,7 +438,9 @@ static int mlx4_ib_dealloc_pd(struct ib_pd *pd)
 static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
 {
         return mlx4_multicast_attach(to_mdev(ibqp->device)->dev,
-                                     &to_mqp(ibqp)->mqp, gid->raw);
+                                     &to_mqp(ibqp)->mqp, gid->raw,
+                                     !!(to_mqp(ibqp)->flags &
+                                        MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK));
 }
 
 static int mlx4_ib_mcg_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 5cf994794d25..c4cf5b69eefa 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -101,7 +101,8 @@ struct mlx4_ib_wq {
 };
 
 enum mlx4_ib_qp_flags {
-        MLX4_IB_QP_LSO          = 1 << 0
+        MLX4_IB_QP_LSO                          = 1 << 0,
+        MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK     = 1 << 1,
 };
 
 struct mlx4_ib_qp {
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index a80df22deae8..89eb6cbe592e 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -129,9 +129,10 @@ static void stamp_send_wqe(struct mlx4_ib_qp *qp, int n, int size)
         int ind;
         void *buf;
         __be32 stamp;
+        struct mlx4_wqe_ctrl_seg *ctrl;
 
-        s = roundup(size, 1U << qp->sq.wqe_shift);
         if (qp->sq_max_wqes_per_wr > 1) {
+                s = roundup(size, 1U << qp->sq.wqe_shift);
                 for (i = 0; i < s; i += 64) {
                         ind = (i >> qp->sq.wqe_shift) + n;
                         stamp = ind & qp->sq.wqe_cnt ? cpu_to_be32(0x7fffffff) :
@@ -141,7 +142,8 @@ static void stamp_send_wqe(struct mlx4_ib_qp *qp, int n, int size)
                         *wqe = stamp;
                 }
         } else {
-                buf = get_send_wqe(qp, n & (qp->sq.wqe_cnt - 1));
+                ctrl = buf = get_send_wqe(qp, n & (qp->sq.wqe_cnt - 1));
+                s = (ctrl->fence_size & 0x3f) << 4;
                 for (i = 64; i < s; i += 64) {
                         wqe = buf + i;
                         *wqe = cpu_to_be32(0xffffffff);
@@ -452,19 +454,8 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
         spin_lock_init(&qp->rq.lock);
 
         qp->state        = IB_QPS_RESET;
-        qp->atomic_rd_en = 0;
-        qp->resp_depth   = 0;
-
-        qp->rq.head         = 0;
-        qp->rq.tail         = 0;
-        qp->sq.head         = 0;
-        qp->sq.tail         = 0;
-        qp->sq_next_wqe     = 0;
-
         if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
                 qp->sq_signal_bits = cpu_to_be32(MLX4_WQE_CTRL_CQ_UPDATE);
-        else
-                qp->sq_signal_bits = 0;
 
         err = set_rq_size(dev, &init_attr->cap, !!pd->uobject, !!init_attr->srq, qp);
         if (err)
@@ -509,6 +500,9 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
         } else {
                 qp->sq_no_prefetch = 0;
 
+                if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK)
+                        qp->flags |= MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK;
+
                 if (init_attr->create_flags & IB_QP_CREATE_IPOIB_UD_LSO)
                         qp->flags |= MLX4_IB_QP_LSO;
 
@@ -682,10 +676,15 @@ struct ib_qp *mlx4_ib_create_qp(struct ib_pd *pd,
         struct mlx4_ib_qp *qp;
         int err;
 
-        /* We only support LSO, and only for kernel UD QPs. */
-        if (init_attr->create_flags & ~IB_QP_CREATE_IPOIB_UD_LSO)
+        /*
+         * We only support LSO and multicast loopback blocking, and
+         * only for kernel UD QPs.
+         */
+        if (init_attr->create_flags & ~(IB_QP_CREATE_IPOIB_UD_LSO |
+                                        IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK))
                 return ERR_PTR(-EINVAL);
-        if (init_attr->create_flags & IB_QP_CREATE_IPOIB_UD_LSO &&
+
+        if (init_attr->create_flags &&
             (pd->uobject || init_attr->qp_type != IB_QPT_UD))
                 return ERR_PTR(-EINVAL);
 
@@ -694,7 +693,7 @@ struct ib_qp *mlx4_ib_create_qp(struct ib_pd *pd,
         case IB_QPT_UC:
         case IB_QPT_UD:
         {
-                qp = kmalloc(sizeof *qp, GFP_KERNEL);
+                qp = kzalloc(sizeof *qp, GFP_KERNEL);
                 if (!qp)
                         return ERR_PTR(-ENOMEM);
 
@@ -715,7 +714,7 @@ struct ib_qp *mlx4_ib_create_qp(struct ib_pd *pd,
                 if (pd->uobject)
                         return ERR_PTR(-EINVAL);
 
-                sqp = kmalloc(sizeof *sqp, GFP_KERNEL);
+                sqp = kzalloc(sizeof *sqp, GFP_KERNEL);
                 if (!sqp)
                         return ERR_PTR(-ENOMEM);
 
@@ -906,7 +905,8 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                                attr->path_mtu);
                         goto out;
                 }
-                context->mtu_msgmax = (attr->path_mtu << 5) | 31;
+                context->mtu_msgmax = (attr->path_mtu << 5) |
+                        ilog2(dev->dev->caps.max_msg_sz);
         }
 
         if (qp->rq.wqe_cnt)
@@ -1063,6 +1063,8 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                 for (i = 0; i < qp->sq.wqe_cnt; ++i) {
                         ctrl = get_send_wqe(qp, i);
                         ctrl->owner_opcode = cpu_to_be32(1 << 31);
+                        if (qp->sq_max_wqes_per_wr == 1)
+                                ctrl->fence_size = 1 << (qp->sq.wqe_shift - 4);
 
                         stamp_send_wqe(qp, i, 1 << qp->sq.wqe_shift);
                 }
@@ -1127,23 +1129,6 @@ out:
         return err;
 }
 
-static const struct ib_qp_attr mlx4_ib_qp_attr = { .port_num = 1 };
-static const int mlx4_ib_qp_attr_mask_table[IB_QPT_UD + 1] = {
-                [IB_QPT_UD]  = (IB_QP_PKEY_INDEX                |
-                                IB_QP_PORT                      |
-                                IB_QP_QKEY),
-                [IB_QPT_UC]  = (IB_QP_PKEY_INDEX                |
-                                IB_QP_PORT                      |
-                                IB_QP_ACCESS_FLAGS),
-                [IB_QPT_RC]  = (IB_QP_PKEY_INDEX                |
-                                IB_QP_PORT                      |
-                                IB_QP_ACCESS_FLAGS),
-                [IB_QPT_SMI] = (IB_QP_PKEY_INDEX                |
-                                IB_QP_QKEY),
-                [IB_QPT_GSI] = (IB_QP_PKEY_INDEX                |
-                                IB_QP_QKEY),
-};
-
 int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                       int attr_mask, struct ib_udata *udata)
 {
@@ -1186,15 +1171,6 @@ int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 goto out;
         }
 
-        if (cur_state == IB_QPS_RESET && new_state == IB_QPS_ERR) {
-                err = __mlx4_ib_modify_qp(ibqp, &mlx4_ib_qp_attr,
-                                          mlx4_ib_qp_attr_mask_table[ibqp->qp_type],
-                                          IB_QPS_RESET, IB_QPS_INIT);
-                if (err)
-                        goto out;
-                cur_state = IB_QPS_INIT;
-        }
-
         err = __mlx4_ib_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
 
 out:
@@ -1865,6 +1841,13 @@ done:
 
         qp_init_attr->cap            = qp_attr->cap;
 
+        qp_init_attr->create_flags = 0;
+        if (qp->flags & MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK)
+                qp_init_attr->create_flags |= IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK;
+
+        if (qp->flags & MLX4_IB_QP_LSO)
+                qp_init_attr->create_flags |= IB_QP_CREATE_IPOIB_UD_LSO;
+
 out:
         mutex_unlock(&qp->mutex);
         return err;
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index a76306709618..c5ccc2daab60 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_allocator.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/errno.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index 4b111a852ff6..32f6c6315454 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_av.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/string.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c
index e948158a28d9..cc440f90000b 100644
--- a/drivers/infiniband/hw/mthca/mthca_catas.c
+++ b/drivers/infiniband/hw/mthca/mthca_catas.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id$
  */
 
 #include <linux/jiffies.h>
@@ -128,7 +126,6 @@ static void handle_catas(struct mthca_dev *dev)
 static void poll_catas(unsigned long dev_ptr)
 {
         struct mthca_dev *dev = (struct mthca_dev *) dev_ptr;
-        unsigned long flags;
         int i;
 
         for (i = 0; i < dev->catas_err.size; ++i)
@@ -137,13 +134,8 @@ static void poll_catas(unsigned long dev_ptr)
                         return;
                 }
 
-        spin_lock_irqsave(&catas_lock, flags);
-        if (!dev->catas_err.stop)
-                mod_timer(&dev->catas_err.timer,
-                          jiffies + MTHCA_CATAS_POLL_INTERVAL);
-        spin_unlock_irqrestore(&catas_lock, flags);
-
-        return;
+        mod_timer(&dev->catas_err.timer,
+                  round_jiffies(jiffies + MTHCA_CATAS_POLL_INTERVAL));
 }
 
 void mthca_start_catas_poll(struct mthca_dev *dev)
@@ -151,7 +143,6 @@ void mthca_start_catas_poll(struct mthca_dev *dev)
         unsigned long addr;
 
         init_timer(&dev->catas_err.timer);
-        dev->catas_err.stop = 0;
         dev->catas_err.map  = NULL;
 
         addr = pci_resource_start(dev->pdev, 0) +
@@ -182,10 +173,6 @@ void mthca_start_catas_poll(struct mthca_dev *dev)
 
 void mthca_stop_catas_poll(struct mthca_dev *dev)
 {
-        spin_lock_irq(&catas_lock);
-        dev->catas_err.stop = 1;
-        spin_unlock_irq(&catas_lock);
-
         del_timer_sync(&dev->catas_err.timer);
 
         if (dev->catas_err.map) {
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 54d230ee7d63..c33e1c53c799 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_cmd.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/completion.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.h b/drivers/infiniband/hw/mthca/mthca_cmd.h
index 8928ca4a9325..6efd3265f248 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.h
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.h
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_cmd.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #ifndef MTHCA_CMD_H
diff --git a/drivers/infiniband/hw/mthca/mthca_config_reg.h b/drivers/infiniband/hw/mthca/mthca_config_reg.h
index afa56bfaab2e..75671f75cac4 100644
--- a/drivers/infiniband/hw/mthca/mthca_config_reg.h
+++ b/drivers/infiniband/hw/mthca/mthca_config_reg.h
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_config_reg.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #ifndef MTHCA_CONFIG_REG_H
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 20401d2ba6b2..d9f4735c2b37 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -32,8 +32,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_cq.c 1369 2004-12-20 16:17:07Z roland $
  */
 
 #include <linux/hardirq.h>
@@ -622,13 +620,13 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
                 case IB_OPCODE_SEND_LAST_WITH_IMMEDIATE:
                 case IB_OPCODE_SEND_ONLY_WITH_IMMEDIATE:
                         entry->wc_flags = IB_WC_WITH_IMM;
-                        entry->imm_data = cqe->imm_etype_pkey_eec;
+                        entry->ex.imm_data = cqe->imm_etype_pkey_eec;
                         entry->opcode = IB_WC_RECV;
                         break;
                 case IB_OPCODE_RDMA_WRITE_LAST_WITH_IMMEDIATE:
                 case IB_OPCODE_RDMA_WRITE_ONLY_WITH_IMMEDIATE:
                         entry->wc_flags = IB_WC_WITH_IMM;
-                        entry->imm_data = cqe->imm_etype_pkey_eec;
+                        entry->ex.imm_data = cqe->imm_etype_pkey_eec;
                         entry->opcode = IB_WC_RECV_RDMA_WITH_IMM;
                         break;
                 default:
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 7bc32f8e377e..ee4d073c889f 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -32,8 +32,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_dev.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #ifndef MTHCA_DEV_H
@@ -279,7 +277,6 @@ struct mthca_mcg_table {
 struct mthca_catas_err {
         u64                     addr;
         u32 __iomem            *map;
-        unsigned long           stop;
         u32                     size;
         struct timer_list       timer;
         struct list_head        list;
diff --git a/drivers/infiniband/hw/mthca/mthca_doorbell.h b/drivers/infiniband/hw/mthca/mthca_doorbell.h
index b374dc395be1..14f51ef97d7e 100644
--- a/drivers/infiniband/hw/mthca/mthca_doorbell.h
+++ b/drivers/infiniband/hw/mthca/mthca_doorbell.h
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_doorbell.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/types.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 8bde7f98e58a..4e36aa7cb3d2 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_eq.c 1382 2004-12-24 02:21:02Z roland $
  */
 
 #include <linux/errno.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 8b7e83e6e88f..640449582aba 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_mad.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/string.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 200cf13fc9bb..fb9f91b60f30 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_main.c 1396 2004-12-28 04:10:27Z roland $
  */
 
 #include <linux/module.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index a8ad072be074..3f5f94879208 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_mcg.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/string.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index d5862e5d99a0..1f7d1a29d2a8 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id$
  */
 
 #include <linux/mm.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.h b/drivers/infiniband/hw/mthca/mthca_memfree.h
index a1ab06847b75..da9b8f9b884f 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.h
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.h
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id$
  */
 
 #ifndef MTHCA_MEMFREE_H
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 820205dec560..8489b1e81c0f 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_mr.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/slab.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_pd.c b/drivers/infiniband/hw/mthca/mthca_pd.c
index c1e950764bd8..266f14e47406 100644
--- a/drivers/infiniband/hw/mthca/mthca_pd.c
+++ b/drivers/infiniband/hw/mthca/mthca_pd.c
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_pd.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/errno.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.c b/drivers/infiniband/hw/mthca/mthca_profile.c
index 605a8d57fac6..d168c2540611 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.c
+++ b/drivers/infiniband/hw/mthca/mthca_profile.c
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_profile.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/module.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.h b/drivers/infiniband/hw/mthca/mthca_profile.h
index e76cb62d8e32..62b009cc8730 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.h
+++ b/drivers/infiniband/hw/mthca/mthca_profile.h
@@ -29,8 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_profile.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #ifndef MTHCA_PROFILE_H
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index be34f99ca625..87ad889e367b 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -32,8 +32,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_provider.c 4859 2006-01-09 21:55:10Z roland $
  */
 
 #include <rdma/ib_smi.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 934bf9544037..c621f8794b88 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -30,8 +30,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_provider.h 1349 2004-12-16 21:09:43Z roland $
  */
 
 #ifndef MTHCA_PROVIDER_H
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 09dc3614cf2c..f5081bfde6db 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -31,8 +31,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_qp.c 1355 2004-12-17 15:23:43Z roland $
  */
 
 #include <linux/string.h>
@@ -850,23 +848,6 @@ out:
         return err;
 }
 
-static const struct ib_qp_attr dummy_init_attr = { .port_num = 1 };
-static const int dummy_init_attr_mask[] = {
-        [IB_QPT_UD]  = (IB_QP_PKEY_INDEX                |
-                        IB_QP_PORT                      |
-                        IB_QP_QKEY),
-        [IB_QPT_UC]  = (IB_QP_PKEY_INDEX                |
-                        IB_QP_PORT                      |
-                        IB_QP_ACCESS_FLAGS),
-        [IB_QPT_RC]  = (IB_QP_PKEY_INDEX                |
-                        IB_QP_PORT                      |
-                        IB_QP_ACCESS_FLAGS),
-        [IB_QPT_SMI] = (IB_QP_PKEY_INDEX                |
-                        IB_QP_QKEY),
-        [IB_QPT_GSI] = (IB_QP_PKEY_INDEX                |
-                        IB_QP_QKEY),
-};
-
 int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
                     struct ib_udata *udata)
 {
@@ -928,15 +909,6 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
                 goto out;
         }
 
-        if (cur_state == IB_QPS_RESET && new_state == IB_QPS_ERR) {
-                err = __mthca_modify_qp(ibqp, &dummy_init_attr,
-                                        dummy_init_attr_mask[ibqp->qp_type],
-                                        IB_QPS_RESET, IB_QPS_INIT);
-                if (err)
-                        goto out;
-                cur_state = IB_QPS_INIT;
-        }
-
         err = __mthca_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
 
 out:
@@ -1277,10 +1249,10 @@ static int mthca_set_qp_size(struct mthca_dev *dev, struct ib_qp_cap *cap,
                 return -EINVAL;
 
         /*
-         * For MLX transport we need 2 extra S/G entries:
+         * For MLX transport we need 2 extra send gather entries:
          * one for the header and one for the checksum at the end
          */
-        if (qp->transport == MLX && cap->max_recv_sge + 2 > dev->limits.max_sg)
+        if (qp->transport == MLX && cap->max_send_sge + 2 > dev->limits.max_sg)
                 return -EINVAL;
 
         if (mthca_is_memfree(dev)) {
diff --git a/drivers/infiniband/hw/mthca/mthca_reset.c b/drivers/infiniband/hw/mthca/mthca_reset.c
index 91934f2d9dba..acb6817f6060 100644
--- a/drivers/infiniband/hw/mthca/mthca_reset.c
+++ b/drivers/infiniband/hw/mthca/mthca_reset.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_reset.c 1349 2004-12-16 21:09:43Z roland $
  */
 
 #include <linux/init.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index a5ffff6e1026..4fabe62aab8a 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_srq.c 3047 2005-08-10 03:59:35Z roland $
  */
 
 #include <linux/slab.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_uar.c b/drivers/infiniband/hw/mthca/mthca_uar.c
index 8b728486410d..ca5900c96fcf 100644
--- a/drivers/infiniband/hw/mthca/mthca_uar.c
+++ b/drivers/infiniband/hw/mthca/mthca_uar.c
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id$
  */
 
 #include <asm/page.h>           /* PAGE_SHIFT */
diff --git a/drivers/infiniband/hw/mthca/mthca_user.h b/drivers/infiniband/hw/mthca/mthca_user.h
index e1262c942db8..5fe56e810739 100644
--- a/drivers/infiniband/hw/mthca/mthca_user.h
+++ b/drivers/infiniband/hw/mthca/mthca_user.h
@@ -29,7 +29,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
  */
 
 #ifndef MTHCA_USER_H
diff --git a/drivers/infiniband/hw/mthca/mthca_wqe.h b/drivers/infiniband/hw/mthca/mthca_wqe.h
index b3551a8dea1d..341a5ae881c1 100644
--- a/drivers/infiniband/hw/mthca/mthca_wqe.h
+++ b/drivers/infiniband/hw/mthca/mthca_wqe.h
@@ -28,8 +28,6 @@
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
- *
- * $Id: mthca_wqe.h 3047 2005-08-10 03:59:35Z roland $
  */
 
 #ifndef MTHCA_WQE_H
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index a4e9269a29bd..d2884e778098 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -328,7 +328,7 @@ void nes_rem_ref(struct ib_qp *ibqp)
                 set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_ID_IDX, nesqp->hwqp.qp_id);
                 u64temp = (u64)nesqp->nesqp_context_pbase;
                 set_wqe_64bit_value(cqp_wqe->wqe_words, NES_CQP_QP_WQE_CONTEXT_LOW_IDX, u64temp);
-                nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+                nes_post_cqp_request(nesdev, cqp_request);
         }
 }
 
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index 61b46e9c7d2d..39bd897b40c6 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -94,9 +94,6 @@
 
 #define MAX_DPC_ITERATIONS               128
 
-#define NES_CQP_REQUEST_NO_DOORBELL_RING 0
-#define NES_CQP_REQUEST_RING_DOORBELL    1
-
 #define NES_DRV_OPT_ENABLE_MPA_VER_0     0x00000001
 #define NES_DRV_OPT_DISABLE_MPA_CRC      0x00000002
 #define NES_DRV_OPT_DISABLE_FIRST_WRITE  0x00000004
@@ -538,7 +535,11 @@ void nes_read_1G_phy_reg(struct nes_device *, u8, u8, u16 *);
 void nes_write_10G_phy_reg(struct nes_device *, u16, u8, u16, u16);
 void nes_read_10G_phy_reg(struct nes_device *, u8, u8, u16);
 struct nes_cqp_request *nes_get_cqp_request(struct nes_device *);
-void nes_post_cqp_request(struct nes_device *, struct nes_cqp_request *, int);
+void nes_free_cqp_request(struct nes_device *nesdev,
+                          struct nes_cqp_request *cqp_request);
+void nes_put_cqp_request(struct nes_device *nesdev,
+                         struct nes_cqp_request *cqp_request);
+void nes_post_cqp_request(struct nes_device *, struct nes_cqp_request *);
 int nes_arp_table(struct nes_device *, u32, u8 *, u32);
 void nes_mh_fix(unsigned long);
 void nes_clc(unsigned long);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 9a4b40fae40d..6aa531d5276d 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1603,7 +1603,6 @@ static struct nes_cm_listener *mini_cm_listen(struct nes_cm_core *cm_core,
                         return NULL;
                 }
 
-                memset(listener, 0, sizeof(struct nes_cm_listener));
                 listener->loc_addr = htonl(cm_info->loc_addr);
                 listener->loc_port = htons(cm_info->loc_port);
                 listener->reused_node = 0;
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index d3278f111ca7..85f26d19a32b 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -398,7 +398,7 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
         nesadapter->base_pd = 1;
 
         nesadapter->device_cap_flags =
-                IB_DEVICE_ZERO_STAG | IB_DEVICE_MEM_WINDOW;
+                IB_DEVICE_LOCAL_DMA_LKEY | IB_DEVICE_MEM_WINDOW;
 
         nesadapter->allocated_qps = (unsigned long *)&(((unsigned char *)nesadapter)
                         [(sizeof(struct nes_adapter)+(sizeof(unsigned long)-1))&(~(sizeof(unsigned long)-1))]);
@@ -2710,39 +2710,11 @@ static void nes_cqp_ce_handler(struct nes_device *nesdev, struct nes_hw_cq *cq)
                                         barrier();
                                         cqp_request->request_done = 1;
                                         wake_up(&cqp_request->waitq);
-                                        if (atomic_dec_and_test(&cqp_request->refcount)) {
-                                                nes_debug(NES_DBG_CQP, "CQP request %p (opcode 0x%02X) freed.\n",
-                                                                cqp_request,
-                                                                le32_to_cpu(cqp_request->cqp_wqe.wqe_words[NES_CQP_WQE_OPCODE_IDX])&0x3f);
-                                                if (cqp_request->dynamic) {
-                                                        kfree(cqp_request);
-                                                } else {
-                                                        spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                                        list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                                        spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                                                }
-                                        }
-                                } else if (cqp_request->callback) {
-                                        /* Envoke the callback routine */
-                                        cqp_request->cqp_callback(nesdev, cqp_request);
-                                        if (cqp_request->dynamic) {
-                                                kfree(cqp_request);
-                                        } else {
-                                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                                        }
+                                        nes_put_cqp_request(nesdev, cqp_request);
                                 } else {
-                                        nes_debug(NES_DBG_CQP, "CQP request %p (opcode 0x%02X) freed.\n",
-                                                        cqp_request,
-                                                        le32_to_cpu(cqp_request->cqp_wqe.wqe_words[NES_CQP_WQE_OPCODE_IDX]) & 0x3f);
-                                        if (cqp_request->dynamic) {
-                                                kfree(cqp_request);
-                                        } else {
-                                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                                        }
+                                        if (cqp_request->callback)
+                                                cqp_request->cqp_callback(nesdev, cqp_request);
+                                        nes_free_cqp_request(nesdev, cqp_request);
                                 }
                         } else {
                                 wake_up(&nesdev->cqp.waitq);
@@ -3149,7 +3121,6 @@ int nes_manage_apbvt(struct nes_vnic *nesvnic, u32 accel_local_port,
 {
         struct nes_device *nesdev = nesvnic->nesdev;
         struct nes_hw_cqp_wqe *cqp_wqe;
-        unsigned long flags;
         struct nes_cqp_request *cqp_request;
         int ret = 0;
         u16 major_code;
@@ -3176,7 +3147,7 @@ int nes_manage_apbvt(struct nes_vnic *nesvnic, u32 accel_local_port,
         nes_debug(NES_DBG_QP, "Waiting for CQP completion for APBVT.\n");
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         if (add_port == NES_MANAGE_APBVT_ADD)
                 ret = wait_event_timeout(cqp_request->waitq, (cqp_request->request_done != 0),
@@ -3184,15 +3155,9 @@ int nes_manage_apbvt(struct nes_vnic *nesvnic, u32 accel_local_port,
         nes_debug(NES_DBG_QP, "Completed, ret=%u,  CQP Major:Minor codes = 0x%04X:0x%04X\n",
                         ret, cqp_request->major_code, cqp_request->minor_code);
         major_code = cqp_request->major_code;
-        if (atomic_dec_and_test(&cqp_request->refcount)) {
-                if (cqp_request->dynamic) {
-                        kfree(cqp_request);
-                } else {
-                        spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                        list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                        spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                }
-        }
+
+        nes_put_cqp_request(nesdev, cqp_request);
+
         if (!ret)
                 return -ETIME;
         else if (major_code)
@@ -3252,7 +3217,7 @@ void nes_manage_arp_cache(struct net_device *netdev, unsigned char *mac_addr,
                         nesdev->cqp.sq_head, nesdev->cqp.sq_tail);
 
         atomic_set(&cqp_request->refcount, 1);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 }
 
 
@@ -3262,7 +3227,6 @@ void nes_manage_arp_cache(struct net_device *netdev, unsigned char *mac_addr,
 void flush_wqes(struct nes_device *nesdev, struct nes_qp *nesqp,
                 u32 which_wq, u32 wait_completion)
 {
-        unsigned long flags;
         struct nes_cqp_request *cqp_request;
         struct nes_hw_cqp_wqe *cqp_wqe;
         int ret;
@@ -3285,7 +3249,7 @@ void flush_wqes(struct nes_device *nesdev, struct nes_qp *nesqp,
                         cpu_to_le32(NES_CQP_FLUSH_WQES | which_wq);
         cqp_wqe->wqe_words[NES_CQP_WQE_ID_IDX] = cpu_to_le32(nesqp->hwqp.qp_id);
 
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         if (wait_completion) {
                 /* Wait for CQP */
@@ -3294,14 +3258,6 @@ void flush_wqes(struct nes_device *nesdev, struct nes_qp *nesqp,
                 nes_debug(NES_DBG_QP, "Flush SQ QP WQEs completed, ret=%u,"
                                 " CQP Major:Minor codes = 0x%04X:0x%04X\n",
                                 ret, cqp_request->major_code, cqp_request->minor_code);
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
+                nes_put_cqp_request(nesdev, cqp_request);
         }
 }
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index 745bf94f3f07..7b81e0ae0076 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -1172,7 +1172,7 @@ struct nes_vnic {
         u32    mcrq_qp_id;
         struct nes_ucontext *mcrq_ucontext;
         struct nes_cqp_request* (*get_cqp_request)(struct nes_device *nesdev);
-        void (*post_cqp_request)(struct nes_device*, struct nes_cqp_request *, int);
+        void (*post_cqp_request)(struct nes_device*, struct nes_cqp_request *);
         int (*mcrq_mcast_filter)( struct nes_vnic* nesvnic, __u8* dmi_addr );
         struct net_device_stats netstats;
         /* used to put the netdev on the adapters logical port list */
diff --git a/drivers/infiniband/hw/nes/nes_utils.c b/drivers/infiniband/hw/nes/nes_utils.c
index fe83d1b2b177..fb8cbd71a2ef 100644
--- a/drivers/infiniband/hw/nes/nes_utils.c
+++ b/drivers/infiniband/hw/nes/nes_utils.c
@@ -567,12 +567,36 @@ struct nes_cqp_request *nes_get_cqp_request(struct nes_device *nesdev)
         return cqp_request;
 }
 
+void nes_free_cqp_request(struct nes_device *nesdev,
+                          struct nes_cqp_request *cqp_request)
+{
+        unsigned long flags;
+
+        nes_debug(NES_DBG_CQP, "CQP request %p (opcode 0x%02X) freed.\n",
+                  cqp_request,
+                  le32_to_cpu(cqp_request->cqp_wqe.wqe_words[NES_CQP_WQE_OPCODE_IDX]) & 0x3f);
+
+        if (cqp_request->dynamic) {
+                kfree(cqp_request);
+        } else {
+                spin_lock_irqsave(&nesdev->cqp.lock, flags);
+                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
+                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
+        }
+}
+
+void nes_put_cqp_request(struct nes_device *nesdev,
+                         struct nes_cqp_request *cqp_request)
+{
+        if (atomic_dec_and_test(&cqp_request->refcount))
+                nes_free_cqp_request(nesdev, cqp_request);
+}
 
 /**
  * nes_post_cqp_request
  */
 void nes_post_cqp_request(struct nes_device *nesdev,
-                struct nes_cqp_request *cqp_request, int ring_doorbell)
+                          struct nes_cqp_request *cqp_request)
 {
         struct nes_hw_cqp_wqe *cqp_wqe;
         unsigned long flags;
@@ -600,10 +624,9 @@ void nes_post_cqp_request(struct nes_device *nesdev,
                                 nesdev->cqp.sq_head, nesdev->cqp.sq_tail, nesdev->cqp.sq_size,
                                 cqp_request->waiting, atomic_read(&cqp_request->refcount));
                 barrier();
-                if (ring_doorbell) {
-                        /* Ring doorbell (1 WQEs) */
-                        nes_write32(nesdev->regs+NES_WQE_ALLOC, 0x01800000 | nesdev->cqp.qp_id);
-                }
+
+                /* Ring doorbell (1 WQEs) */
+                nes_write32(nesdev->regs+NES_WQE_ALLOC, 0x01800000 | nesdev->cqp.qp_id);
 
                 barrier();
         } else {
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index d617da9bd351..e3939d13484e 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -55,7 +55,6 @@ static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
  * nes_alloc_mw
  */
 static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
-        unsigned long flags;
         struct nes_pd *nespd = to_nespd(ibpd);
         struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
         struct nes_device *nesdev = nesvnic->nesdev;
@@ -119,7 +118,7 @@ static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
         set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_STAG_IDX, stag);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         ret = wait_event_timeout(cqp_request->waitq, (cqp_request->request_done != 0),
@@ -128,15 +127,7 @@ static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
                         " CQP Major:Minor codes = 0x%04X:0x%04X.\n",
                         stag, ret, cqp_request->major_code, cqp_request->minor_code);
         if ((!ret) || (cqp_request->major_code)) {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
+                nes_put_cqp_request(nesdev, cqp_request);
                 kfree(nesmr);
                 nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
                 if (!ret) {
@@ -144,17 +135,8 @@ static struct ib_mw *nes_alloc_mw(struct ib_pd *ibpd) {
                 } else {
                         return ERR_PTR(-ENOMEM);
                 }
-        } else {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
         }
+        nes_put_cqp_request(nesdev, cqp_request);
 
         nesmr->ibmw.rkey = stag;
         nesmr->mode = IWNES_MEMREG_TYPE_MW;
@@ -178,7 +160,6 @@ static int nes_dealloc_mw(struct ib_mw *ibmw)
         struct nes_hw_cqp_wqe *cqp_wqe;
         struct nes_cqp_request *cqp_request;
         int err = 0;
-        unsigned long flags;
         int ret;
 
         /* Deallocate the window with the adapter */
@@ -194,7 +175,7 @@ static int nes_dealloc_mw(struct ib_mw *ibmw)
         set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_STAG_IDX, ibmw->rkey);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         nes_debug(NES_DBG_MR, "Waiting for deallocate STag 0x%08X to complete.\n",
@@ -204,32 +185,12 @@ static int nes_dealloc_mw(struct ib_mw *ibmw)
         nes_debug(NES_DBG_MR, "Deallocate STag completed, wait_event_timeout ret = %u,"
                         " CQP Major:Minor codes = 0x%04X:0x%04X.\n",
                         ret, cqp_request->major_code, cqp_request->minor_code);
-        if ((!ret) || (cqp_request->major_code)) {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
-                if (!ret) {
-                        err = -ETIME;
-                } else {
-                        err = -EIO;
-                }
-        } else {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
-        }
+        if (!ret)
+                err = -ETIME;
+        else if (cqp_request->major_code)
+                err = -EIO;
+
+        nes_put_cqp_request(nesdev, cqp_request);
 
         nes_free_resource(nesadapter, nesadapter->allocated_mrs,
                         (ibmw->rkey & 0x0fffff00) >> 8);
@@ -516,7 +477,7 @@ static struct ib_fmr *nes_alloc_fmr(struct ib_pd *ibpd,
                         (nesfmr->nesmr.pbls_used-1) : nesfmr->nesmr.pbls_used);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         ret = wait_event_timeout(cqp_request->waitq, (cqp_request->request_done != 0),
@@ -526,29 +487,11 @@ static struct ib_fmr *nes_alloc_fmr(struct ib_pd *ibpd,
                         stag, ret, cqp_request->major_code, cqp_request->minor_code);
 
         if ((!ret) || (cqp_request->major_code)) {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
+                nes_put_cqp_request(nesdev, cqp_request);
                 ret = (!ret) ? -ETIME : -EIO;
                 goto failed_leaf_vpbl_pages_alloc;
-        } else {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
         }
-
+        nes_put_cqp_request(nesdev, cqp_request);
         nesfmr->nesmr.ibfmr.lkey = stag;
         nesfmr->nesmr.ibfmr.rkey = stag;
         nesfmr->attr = *ibfmr_attr;
@@ -1474,7 +1417,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                         set_wqe_64bit_value(cqp_wqe->wqe_words, NES_CQP_QP_WQE_CONTEXT_LOW_IDX, u64temp);
 
                         atomic_set(&cqp_request->refcount, 2);
-                        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+                        nes_post_cqp_request(nesdev, cqp_request);
 
                         /* Wait for CQP */
                         nes_debug(NES_DBG_QP, "Waiting for create iWARP QP%u to complete.\n",
@@ -1487,15 +1430,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                         nesqp->hwqp.qp_id, ret, nesdev->cqp.sq_head, nesdev->cqp.sq_tail,
                                         cqp_request->major_code, cqp_request->minor_code);
                         if ((!ret) || (cqp_request->major_code)) {
-                                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                                        if (cqp_request->dynamic) {
-                                                kfree(cqp_request);
-                                        } else {
-                                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                                        }
-                                }
+                                nes_put_cqp_request(nesdev, cqp_request);
                                 nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
                                 nes_free_qp_mem(nesdev, nesqp,virt_wqs);
                                 kfree(nesqp->allocated_buffer);
@@ -1504,18 +1439,10 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                 } else {
                                         return ERR_PTR(-EIO);
                                 }
-                        } else {
-                                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                                        if (cqp_request->dynamic) {
-                                                kfree(cqp_request);
-                                        } else {
-                                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                                        }
-                                }
                         }
 
+                        nes_put_cqp_request(nesdev, cqp_request);
+
                         if (ibpd->uobject) {
                                 uresp.mmap_sq_db_index = nesqp->mmap_sq_db_index;
                                 uresp.actual_sq_size = sq_size;
@@ -1817,7 +1744,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                         cpu_to_le32(((u32)((u64temp) >> 33)) & 0x7FFFFFFF);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         nes_debug(NES_DBG_CQ, "Waiting for create iWARP CQ%u to complete.\n",
@@ -1827,32 +1754,15 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
         nes_debug(NES_DBG_CQ, "Create iWARP CQ%u completed, wait_event_timeout ret = %d.\n",
                         nescq->hw_cq.cq_number, ret);
         if ((!ret) || (cqp_request->major_code)) {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
+                nes_put_cqp_request(nesdev, cqp_request);
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
                 nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                 kfree(nescq);
                 return ERR_PTR(-EIO);
-        } else {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
         }
+        nes_put_cqp_request(nesdev, cqp_request);
 
         if (context) {
                 /* free the nespbl */
@@ -1931,7 +1841,7 @@ static int nes_destroy_cq(struct ib_cq *ib_cq)
                 (nescq->hw_cq.cq_number | ((u32)PCI_FUNC(nesdev->pcidev->devfn) << 16)));
         nes_free_resource(nesadapter, nesadapter->allocated_cqs, nescq->hw_cq.cq_number);
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         nes_debug(NES_DBG_CQ, "Waiting for destroy iWARP CQ%u to complete.\n",
@@ -1942,37 +1852,18 @@ static int nes_destroy_cq(struct ib_cq *ib_cq)
                         " CQP Major:Minor codes = 0x%04X:0x%04X.\n",
                         nescq->hw_cq.cq_number, ret, cqp_request->major_code,
                         cqp_request->minor_code);
-        if ((!ret) || (cqp_request->major_code)) {
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
-                if (!ret) {
-                        nes_debug(NES_DBG_CQ, "iWARP CQ%u destroy timeout expired\n",
+        if (!ret) {
+                nes_debug(NES_DBG_CQ, "iWARP CQ%u destroy timeout expired\n",
                                         nescq->hw_cq.cq_number);
-                        ret = -ETIME;
-                } else {
-                        nes_debug(NES_DBG_CQ, "iWARP CQ%u destroy failed\n",
+                ret = -ETIME;
+        } else if (cqp_request->major_code) {
+                nes_debug(NES_DBG_CQ, "iWARP CQ%u destroy failed\n",
                                         nescq->hw_cq.cq_number);
-                        ret = -EIO;
-                }
+                ret = -EIO;
         } else {
                 ret = 0;
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
         }
+        nes_put_cqp_request(nesdev, cqp_request);
 
         if (nescq->cq_mem_size)
                 pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size,
@@ -2096,7 +1987,7 @@ static int nes_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
         barrier();
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         ret = wait_event_timeout(cqp_request->waitq, (0 != cqp_request->request_done),
@@ -2105,15 +1996,8 @@ static int nes_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
                         " CQP Major:Minor codes = 0x%04X:0x%04X.\n",
                         stag, ret, cqp_request->major_code, cqp_request->minor_code);
         major_code = cqp_request->major_code;
-        if (atomic_dec_and_test(&cqp_request->refcount)) {
-                if (cqp_request->dynamic) {
-                        kfree(cqp_request);
-                } else {
-                        spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                        list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                        spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                }
-        }
+        nes_put_cqp_request(nesdev, cqp_request);
+
         if (!ret)
                 return -ETIME;
         else if (major_code)
@@ -2754,7 +2638,7 @@ static int nes_dereg_mr(struct ib_mr *ib_mr)
         set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_STAG_IDX, ib_mr->rkey);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         nes_debug(NES_DBG_MR, "Waiting for deallocate STag 0x%08X completed\n", ib_mr->rkey);
@@ -2771,15 +2655,9 @@ static int nes_dereg_mr(struct ib_mr *ib_mr)
 
         major_code = cqp_request->major_code;
         minor_code = cqp_request->minor_code;
-        if (atomic_dec_and_test(&cqp_request->refcount)) {
-                if (cqp_request->dynamic) {
-                        kfree(cqp_request);
-                } else {
-                        spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                        list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                        spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                }
-        }
+
+        nes_put_cqp_request(nesdev, cqp_request);
+
         if (!ret) {
                 nes_debug(NES_DBG_MR, "Timeout waiting to destroy STag,"
                                 " ib_mr=%p, rkey = 0x%08X\n",
@@ -2904,7 +2782,6 @@ int nes_hw_modify_qp(struct nes_device *nesdev, struct nes_qp *nesqp,
         /* struct iw_cm_id *cm_id = nesqp->cm_id; */
         /* struct iw_cm_event cm_event; */
         struct nes_cqp_request *cqp_request;
-        unsigned long flags;
         int ret;
         u16 major_code;
 
@@ -2932,7 +2809,7 @@ int nes_hw_modify_qp(struct nes_device *nesdev, struct nes_qp *nesqp,
         set_wqe_64bit_value(cqp_wqe->wqe_words, NES_CQP_QP_WQE_CONTEXT_LOW_IDX, (u64)nesqp->nesqp_context_pbase);
 
         atomic_set(&cqp_request->refcount, 2);
-        nes_post_cqp_request(nesdev, cqp_request, NES_CQP_REQUEST_RING_DOORBELL);
+        nes_post_cqp_request(nesdev, cqp_request);
 
         /* Wait for CQP */
         if (wait_completion) {
@@ -2950,15 +2827,9 @@ int nes_hw_modify_qp(struct nes_device *nesdev, struct nes_qp *nesqp,
                                         nesqp->hwqp.qp_id, cqp_request->major_code,
                                         cqp_request->minor_code, next_iwarp_state);
                 }
-                if (atomic_dec_and_test(&cqp_request->refcount)) {
-                        if (cqp_request->dynamic) {
-                                kfree(cqp_request);
-                        } else {
-                                spin_lock_irqsave(&nesdev->cqp.lock, flags);
-                                list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
-                                spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
-                        }
-                }
+
+                nes_put_cqp_request(nesdev, cqp_request);
+
                 if (!ret)
                         return -ETIME;
                 else if (major_code)