Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

22 files changed, 133 insertions, 109 deletions

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index b10ade92efed..4df405157086 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3759,6 +3759,7 @@ static void cm_remove_one(struct ib_device *device)
                 port = cm_dev->port[i-1];
                 ib_modify_port(device, port->port_num, 0, &port_modify);
                 ib_unregister_mad_agent(port->mad_agent);
+                flush_workqueue(cm.wq);
                 cm_remove_port_fs(port);
         }
         kobject_put(&cm_dev->dev_obj);
@@ -3813,6 +3814,7 @@ static void __exit ib_cm_cleanup(void)
                 cancel_delayed_work(&timewait_info->work.work);
         spin_unlock_irq(&cm.lock);
 
+        ib_unregister_client(&cm_client);
         destroy_workqueue(cm.wq);
 
         list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
@@ -3820,7 +3822,6 @@ static void __exit ib_cm_cleanup(void)
                 kfree(timewait_info);
         }
 
-        ib_unregister_client(&cm_client);
         class_unregister(&cm_class);
         idr_destroy(&cm.local_id_table);
 }
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 7f00347364f7..06d502c06a4d 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -139,7 +139,7 @@ static inline struct ib_pool_fmr *ib_fmr_cache_lookup(struct ib_fmr_pool *pool,
 static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 {
         int                 ret;
-        struct ib_pool_fmr *fmr, *next;
+        struct ib_pool_fmr *fmr;
         LIST_HEAD(unmap_list);
         LIST_HEAD(fmr_list);
 
@@ -158,20 +158,6 @@ static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 #endif
         }
 
-        /*
-         * The free_list may hold FMRs that have been put there
-         * because they haven't reached the max_remap count.
-         * Invalidate their mapping as well.
-         */
-        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
-                if (fmr->remap_count == 0)
-                        continue;
-                hlist_del_init(&fmr->cache_node);
-                fmr->remap_count = 0;
-                list_add_tail(&fmr->fmr->list, &fmr_list);
-                list_move(&fmr->list, &unmap_list);
-        }
-
         list_splice(&pool->dirty_list, &unmap_list);
         INIT_LIST_HEAD(&pool->dirty_list);
         pool->dirty_len = 0;
@@ -384,6 +370,11 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
+                if (fmr->remap_count) {
+                        INIT_LIST_HEAD(&fmr_list);
+                        list_add_tail(&fmr->fmr->list, &fmr_list);
+                        ib_unmap_fmr(&fmr_list);
+                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);
@@ -407,8 +398,23 @@ EXPORT_SYMBOL(ib_destroy_fmr_pool);
  */
 int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
 {
-        int serial = atomic_inc_return(&pool->req_ser);
+        int serial;
+        struct ib_pool_fmr *fmr, *next;
+
+        /*
+         * The free_list holds FMRs that may have been used
+         * but have not been remapped enough times to be dirty.
+         * Put them on the dirty list now so that the cleanup
+         * thread will reap them too.
+         */
+        spin_lock_irq(&pool->pool_lock);
+        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
+                if (fmr->remap_count > 0)
+                        list_move(&fmr->list, &pool->dirty_list);
+        }
+        spin_unlock_irq(&pool->pool_lock);
 
+        serial = atomic_inc_return(&pool->req_ser);
         wake_up_process(pool->thread);
 
         if (wait_event_interruptible(pool->force_wait,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 223b1aa7d92b..81c9195b512a 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -839,6 +839,7 @@ static void cm_work_handler(struct work_struct *_work)
         unsigned long flags;
         int empty;
         int ret = 0;
+        int destroy_id;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         empty = list_empty(&cm_id_priv->work_list);
@@ -857,9 +858,9 @@ static void cm_work_handler(struct work_struct *_work)
                         destroy_cm_id(&cm_id_priv->id);
                 }
                 BUG_ON(atomic_read(&cm_id_priv->refcount)==0);
+                destroy_id = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
                 if (iwcm_deref_id(cm_id_priv)) {
-                        if (test_bit(IWCM_F_CALLBACK_DESTROY,
-                                     &cm_id_priv->flags)) {
+                        if (destroy_id) {
                                 BUG_ON(!list_empty(&cm_id_priv->work_list));
                                 free_cm_id(cm_id_priv);
                         }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
index 73bfd1656f86..b8797c66676d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_mem.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -136,14 +136,8 @@ int build_phys_page_list(struct ib_phys_buf *buffer_list,
 
         /* Find largest page shift we can use to cover buffers */
         for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
-                if (num_phys_buf > 1) {
-                        if ((1ULL << *shift) & mask)
-                                break;
-                } else
-                        if (1ULL << *shift >=
-                            buffer_list[0].size +
-                            (buffer_list[0].addr & ((1ULL << *shift) - 1)))
-                                break;
+                if ((1ULL << *shift) & mask)
+                        break;
 
         buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
         buffer_list[0].addr &= ~0ull << *shift;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index df1838f8f94d..b2ea9210467f 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -189,7 +189,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                 return ERR_PTR(-ENOMEM);
         }
         chp->rhp = rhp;
-        chp->ibcq.cqe = (1 << chp->cq.size_log2) - 1;
+        chp->ibcq.cqe = 1 << chp->cq.size_log2;
         spin_lock_init(&chp->lock);
         atomic_set(&chp->refcnt, 1);
         init_waitqueue_head(&chp->wait);
@@ -819,8 +819,11 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
                 kfree(qhp);
                 return ERR_PTR(-ENOMEM);
         }
+
         attrs->cap.max_recv_wr = rqsize - 1;
         attrs->cap.max_send_wr = sqsize;
+        attrs->cap.max_inline_data = T3_MAX_INLINE;
+
         qhp->rhp = rhp;
         qhp->attr.pd = php->pdid;
         qhp->attr.scq = ((struct iwch_cq *) attrs->send_cq)->cq.cqid;
diff --git a/drivers/infiniband/hw/ipath/ipath_common.h b/drivers/infiniband/hw/ipath/ipath_common.h
index 414621095540..591901aab6b7 100644
--- a/drivers/infiniband/hw/ipath/ipath_common.h
+++ b/drivers/infiniband/hw/ipath/ipath_common.h
@@ -75,7 +75,7 @@
 #define IPATH_IB_LINKDOWN               0
 #define IPATH_IB_LINKARM                1
 #define IPATH_IB_LINKACTIVE             2
-#define IPATH_IB_LINKINIT               3
+#define IPATH_IB_LINKDOWN_ONLY          3
 #define IPATH_IB_LINKDOWN_SLEEP         4
 #define IPATH_IB_LINKDOWN_DISABLE       5
 #define IPATH_IB_LINK_LOOPBACK  6 /* enable local loopback */
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index d5ff6ca2db30..ca4d0acc6786 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -851,8 +851,7 @@ void ipath_disarm_piobufs(struct ipath_devdata *dd, unsigned first,
  * -ETIMEDOUT state can have multiple states set, for any of several
  * transitions.
  */
-static int ipath_wait_linkstate(struct ipath_devdata *dd, u32 state,
-                                int msecs)
+int ipath_wait_linkstate(struct ipath_devdata *dd, u32 state, int msecs)
 {
         dd->ipath_state_wanted = state;
         wait_event_interruptible_timeout(ipath_state_wait,
@@ -1656,8 +1655,8 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
 static void ipath_set_ib_lstate(struct ipath_devdata *dd, int which)
 {
         static const char *what[4] = {
-                [0] = "DOWN",
-                [INFINIPATH_IBCC_LINKCMD_INIT] = "INIT",
+                [0] = "NOP",
+                [INFINIPATH_IBCC_LINKCMD_DOWN] = "DOWN",
                 [INFINIPATH_IBCC_LINKCMD_ARMED] = "ARMED",
                 [INFINIPATH_IBCC_LINKCMD_ACTIVE] = "ACTIVE"
         };
@@ -1672,9 +1671,9 @@ static void ipath_set_ib_lstate(struct ipath_devdata *dd, int which)
                             (dd, dd->ipath_kregs->kr_ibcstatus) >>
                             INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) &
                            INFINIPATH_IBCS_LINKTRAININGSTATE_MASK]);
-        /* flush all queued sends when going to DOWN or INIT, to be sure that
+        /* flush all queued sends when going to DOWN to be sure that
          * they don't block MAD packets */
-        if (!linkcmd || linkcmd == INFINIPATH_IBCC_LINKCMD_INIT)
+        if (linkcmd == INFINIPATH_IBCC_LINKCMD_DOWN)
                 ipath_cancel_sends(dd, 1);
 
         ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
@@ -1687,6 +1686,13 @@ int ipath_set_linkstate(struct ipath_devdata *dd, u8 newstate)
         int ret;
 
         switch (newstate) {
+        case IPATH_IB_LINKDOWN_ONLY:
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKCMD_DOWN <<
+                                    INFINIPATH_IBCC_LINKCMD_SHIFT);
+                /* don't wait */
+                ret = 0;
+                goto bail;
+
         case IPATH_IB_LINKDOWN:
                 ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKINITCMD_POLL <<
                                     INFINIPATH_IBCC_LINKINITCMD_SHIFT);
@@ -1709,16 +1715,6 @@ int ipath_set_linkstate(struct ipath_devdata *dd, u8 newstate)
                 ret = 0;
                 goto bail;
 
-        case IPATH_IB_LINKINIT:
-                if (dd->ipath_flags & IPATH_LINKINIT) {
-                        ret = 0;
-                        goto bail;
-                }
-                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKCMD_INIT <<
-                                    INFINIPATH_IBCC_LINKCMD_SHIFT);
-                lstate = IPATH_LINKINIT;
-                break;
-
         case IPATH_IB_LINKARM:
                 if (dd->ipath_flags & IPATH_LINKARMED) {
                         ret = 0;
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 4cc0f95ea877..ecf3f7ff7717 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -767,6 +767,7 @@ void ipath_kreceive(struct ipath_portdata *);
 int ipath_setrcvhdrsize(struct ipath_devdata *, unsigned);
 int ipath_reset_device(int);
 void ipath_get_faststats(unsigned long);
+int ipath_wait_linkstate(struct ipath_devdata *, u32, int);
 int ipath_set_linkstate(struct ipath_devdata *, u8);
 int ipath_set_mtu(struct ipath_devdata *, u16);
 int ipath_set_lid(struct ipath_devdata *, u32, u8);
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index d98d5f103700..b34b91d3723a 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -555,10 +555,7 @@ static int recv_subn_set_portinfo(struct ib_smp *smp,
                 /* FALLTHROUGH */
         case IB_PORT_DOWN:
                 if (lstate == 0)
-                        if (get_linkdowndefaultstate(dd))
-                                lstate = IPATH_IB_LINKDOWN_SLEEP;
-                        else
-                                lstate = IPATH_IB_LINKDOWN;
+                        lstate = IPATH_IB_LINKDOWN_ONLY;
                 else if (lstate == 1)
                         lstate = IPATH_IB_LINKDOWN_SLEEP;
                 else if (lstate == 2)
@@ -568,6 +565,8 @@ static int recv_subn_set_portinfo(struct ib_smp *smp,
                 else
                         goto err;
                 ipath_set_linkstate(dd, lstate);
+                ipath_wait_linkstate(dd, IPATH_LINKINIT | IPATH_LINKARMED |
+                                IPATH_LINKACTIVE, 1000);
                 break;
         case IB_PORT_ARMED:
                 ipath_set_linkstate(dd, IPATH_IB_LINKARM);
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index 80dc623cee40..087ed3166479 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -329,8 +329,9 @@ struct ipath_qp *ipath_lookup_qpn(struct ipath_qp_table *qpt, u32 qpn)
 /**
  * ipath_reset_qp - initialize the QP state to the reset state
  * @qp: the QP to reset
+ * @type: the QP type
  */
-static void ipath_reset_qp(struct ipath_qp *qp)
+static void ipath_reset_qp(struct ipath_qp *qp, enum ib_qp_type type)
 {
         qp->remote_qpn = 0;
         qp->qkey = 0;
@@ -342,7 +343,7 @@ static void ipath_reset_qp(struct ipath_qp *qp)
         qp->s_psn = 0;
         qp->r_psn = 0;
         qp->r_msn = 0;
-        if (qp->ibqp.qp_type == IB_QPT_RC) {
+        if (type == IB_QPT_RC) {
                 qp->s_state = IB_OPCODE_RC_SEND_LAST;
                 qp->r_state = IB_OPCODE_RC_SEND_LAST;
         } else {
@@ -414,7 +415,7 @@ int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
                 wc.wr_id = qp->r_wr_id;
                 wc.opcode = IB_WC_RECV;
                 wc.status = err;
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
         }
         wc.status = IB_WC_WR_FLUSH_ERR;
 
@@ -534,7 +535,7 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 
         switch (new_state) {
         case IB_QPS_RESET:
-                ipath_reset_qp(qp);
+                ipath_reset_qp(qp, ibqp->qp_type);
                 break;
 
         case IB_QPS_ERR:
@@ -647,7 +648,7 @@ int ipath_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         attr->port_num = 1;
         attr->timeout = qp->timeout;
         attr->retry_cnt = qp->s_retry_cnt;
-        attr->rnr_retry = qp->s_rnr_retry;
+        attr->rnr_retry = qp->s_rnr_retry_cnt;
         attr->alt_port_num = 0;
         attr->alt_timeout = 0;
 
@@ -839,7 +840,7 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                         goto bail_qp;
                 }
                 qp->ip = NULL;
-                ipath_reset_qp(qp);
+                ipath_reset_qp(qp, init_attr->qp_type);
                 break;
 
         default:
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
index 459e46e2c016..40f3e37d7adc 100644
--- a/drivers/infiniband/hw/ipath/ipath_rc.c
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -1196,6 +1196,10 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                         list_move_tail(&qp->timerwait,
                                        &dev->pending[dev->pending_index]);
                 spin_unlock(&dev->pending_lock);
+
+                if (opcode == OP(RDMA_READ_RESPONSE_MIDDLE))
+                        qp->s_retry = qp->s_retry_cnt;
+
                 /*
                  * Update the RDMA receive state but do the copy w/o
                  * holding the locks and blocking interrupts.
diff --git a/drivers/infiniband/hw/ipath/ipath_registers.h b/drivers/infiniband/hw/ipath/ipath_registers.h
index 6d2a17f9c1da..92ad73a7fff0 100644
--- a/drivers/infiniband/hw/ipath/ipath_registers.h
+++ b/drivers/infiniband/hw/ipath/ipath_registers.h
@@ -185,7 +185,7 @@
 #define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3
 #define INFINIPATH_IBCC_LINKINITCMD_SHIFT 16
 #define INFINIPATH_IBCC_LINKCMD_MASK 0x3ULL
-#define INFINIPATH_IBCC_LINKCMD_INIT 1  /* move to 0x11 */
+#define INFINIPATH_IBCC_LINKCMD_DOWN 1  /* move to 0x11 */
 #define INFINIPATH_IBCC_LINKCMD_ARMED 2 /* move to 0x21 */
 #define INFINIPATH_IBCC_LINKCMD_ACTIVE 3        /* move to 0x31 */
 #define INFINIPATH_IBCC_LINKCMD_SHIFT 18
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 7f8853b44ee1..b2112f5a422f 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -567,12 +567,12 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
 
         /* Init the adapter */
         nesdev->nesadapter = nes_init_adapter(nesdev, hw_rev);
-        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
         if (!nesdev->nesadapter) {
                 printk(KERN_ERR PFX "Unable to initialize adapter.\n");
                 ret = -ENOMEM;
                 goto bail5;
         }
+        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
 
         /* nesdev->base_doorbell_index =
                         nesdev->nesadapter->pd_config_base[PCI_FUNC(nesdev->pcidev->devfn)]; */
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index fd57e8a1582f..a48b288618ec 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -285,6 +285,21 @@ struct nes_device {
 };
 
 
+static inline __le32 get_crc_value(struct nes_v4_quad *nes_quad)
+{
+        u32 crc_value;
+        crc_value = crc32c(~0, (void *)nes_quad, sizeof (struct nes_v4_quad));
+
+        /*
+         * With commit ef19454b ("[LIB] crc32c: Keep intermediate crc
+         * state in cpu order"), behavior of crc32c changes on
+         * big-endian platforms.  Our algorithm expects the previous
+         * behavior; otherwise we have RDMA connection establishment
+         * issue on big-endian.
+         */
+        return cpu_to_le32(crc_value);
+}
+
 static inline void
 set_wqe_64bit_value(__le32 *wqe_words, u32 index, u64 value)
 {
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index bd5cfeaac203..39adb267fb15 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -370,11 +370,11 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
         int ret = 0;
         u32 was_timer_set;
 
+        if (!cm_node)
+                return -EINVAL;
         new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
         if (!new_send)
                 return -1;
-        if (!cm_node)
-                return -EINVAL;
 
         /* new_send->timetosend = currenttime */
         new_send->retrycount = NES_DEFAULT_RETRYS;
@@ -947,6 +947,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
                 nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);
 
                 kfree(listener);
+                listener = NULL;
                 ret = 0;
                 cm_listens_destroyed++;
         } else {
@@ -2319,6 +2320,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
@@ -2435,8 +2437,8 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         nes_quad.TcpPorts[1]   = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & adapter->hte_index_mask);
 
@@ -2750,6 +2752,7 @@ void cm_event_connected(struct nes_cm_event *event)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         /* get all our handles */
@@ -2827,8 +2830,8 @@ void cm_event_connected(struct nes_cm_event *event)
         nes_quad.TcpPorts[1] = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, After CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & nesadapter->hte_index_mask);
 
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 7c4c0fbf0abd..49e53e4c1ebe 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -156,15 +156,14 @@ static void nes_nic_tune_timer(struct nes_device *nesdev)
 
         spin_lock_irqsave(&nesadapter->periodic_timer_lock, flags);
 
-        if (shared_timer->cq_count_old < cq_count) {
-                if (cq_count > shared_timer->threshold_low)
-                        shared_timer->cq_direction_downward=0;
-        }
-        if (shared_timer->cq_count_old >= cq_count)
+        if (shared_timer->cq_count_old <= cq_count)
+                shared_timer->cq_direction_downward = 0;
+        else
                 shared_timer->cq_direction_downward++;
         shared_timer->cq_count_old = cq_count;
         if (shared_timer->cq_direction_downward > NES_NIC_CQ_DOWNWARD_TREND) {
-                if (cq_count <= shared_timer->threshold_low) {
+                if (cq_count <= shared_timer->threshold_low &&
+                    shared_timer->threshold_low > 4) {
                         shared_timer->threshold_low = shared_timer->threshold_low/2;
                         shared_timer->cq_direction_downward=0;
                         nesdev->currcq_count = 0;
@@ -1728,7 +1727,6 @@ int nes_napi_isr(struct nes_device *nesdev)
                         nesdev->int_req &= ~NES_INT_TIMER;
                         nes_write32(nesdev->regs+NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                        nesadapter->tune_timer.timer_in_use_old = 0;
                 }
                 nesdev->deepcq_count = 0;
                 return 1;
@@ -1867,7 +1865,6 @@ void nes_dpc(unsigned long param)
                                         nesdev->int_req &= ~NES_INT_TIMER;
                                         nes_write32(nesdev->regs + NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                                        nesdev->nesadapter->tune_timer.timer_in_use_old = 0;
                                 } else {
                                         nes_write32(nesdev->regs+NES_INT_MASK, 0x0000ffff|(~nesdev->int_req));
                                 }
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index 1e10df550c9e..b7e2844f096b 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -962,7 +962,7 @@ struct nes_arp_entry {
 #define DEFAULT_JUMBO_NES_QL_LOW    12
 #define DEFAULT_JUMBO_NES_QL_TARGET 40
 #define DEFAULT_JUMBO_NES_QL_HIGH   128
-#define NES_NIC_CQ_DOWNWARD_TREND   8
+#define NES_NIC_CQ_DOWNWARD_TREND   16
 
 struct nes_hw_tune_timer {
     //u16 cq_count;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4dafbe16e82a..a651e9d9f0ef 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -929,7 +929,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
                                 NES_MAX_USER_DB_REGIONS, nesucontext->first_free_db);
                 nes_debug(NES_DBG_PD, "find_first_zero_biton doorbells returned %u, mapping pd_id %u.\n",
                                 nespd->mmap_db_index, nespd->pd_id);
-                if (nespd->mmap_db_index > NES_MAX_USER_DB_REGIONS) {
+                if (nespd->mmap_db_index >= NES_MAX_USER_DB_REGIONS) {
                         nes_debug(NES_DBG_PD, "mmap_db_index > MAX\n");
                         nes_free_resource(nesadapter, nesadapter->allocated_pds, pd_num);
                         kfree(nespd);
@@ -1327,7 +1327,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                                                   (long long unsigned int)req.user_wqe_buffers);
                                                         nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
                                                         kfree(nesqp->allocated_buffer);
-                                                        return ERR_PTR(-ENOMEM);
+                                                        return ERR_PTR(-EFAULT);
                                                 }
                                         }
 
@@ -1674,6 +1674,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 }
                 nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
                                 (unsigned long)req.user_cq_buffer, entries);
+                err = 1;
                 list_for_each_entry(nespbl, &nes_ucontext->cq_reg_mem_list, list) {
                         if (nespbl->user_base == (unsigned long )req.user_cq_buffer) {
                                 list_del(&nespbl->list);
@@ -1686,7 +1687,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 if (err) {
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                         kfree(nescq);
-                        return ERR_PTR(err);
+                        return ERR_PTR(-EFAULT);
                 }
 
                 pbl_entries = nespbl->pbl_size >> 3;
@@ -1831,9 +1832,6 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
                         }
                 }
-                nes_debug(NES_DBG_CQ, "iWARP CQ%u create timeout expired, major code = 0x%04X,"
-                                " minor code = 0x%04X\n",
-                                nescq->hw_cq.cq_number, cqp_request->major_code, cqp_request->minor_code);
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 52b1bebfa744..2490b2d79dbb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -38,6 +38,7 @@
 #include <net/icmp.h>
 #include <linux/icmpv6.h>
 #include <linux/delay.h>
+#include <linux/vmalloc.h>
 
 #include "ipoib.h"
 
@@ -637,6 +638,7 @@ static inline int post_send(struct ipoib_dev_priv *priv,
         priv->tx_sge[0].addr          = addr;
         priv->tx_sge[0].length        = len;
 
+        priv->tx_wr.num_sge     = 1;
         priv->tx_wr.wr_id       = wr_id | IPOIB_OP_CM;
 
         return ib_post_send(tx->qp, &priv->tx_wr, &bad_wr);
@@ -1030,13 +1032,13 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         struct ipoib_dev_priv *priv = netdev_priv(p->dev);
         int ret;
 
-        p->tx_ring = kzalloc(ipoib_sendq_size * sizeof *p->tx_ring,
-                                GFP_KERNEL);
+        p->tx_ring = vmalloc(ipoib_sendq_size * sizeof *p->tx_ring);
         if (!p->tx_ring) {
                 ipoib_warn(priv, "failed to allocate tx ring\n");
                 ret = -ENOMEM;
                 goto err_tx;
         }
+        memset(p->tx_ring, 0, ipoib_sendq_size * sizeof *p->tx_ring);
 
         p->qp = ipoib_cm_create_tx_qp(p->dev, p);
         if (IS_ERR(p->qp)) {
@@ -1077,6 +1079,7 @@ err_id:
         ib_destroy_qp(p->qp);
 err_qp:
         p->qp = NULL;
+        vfree(p->tx_ring);
 err_tx:
         return ret;
 }
@@ -1127,7 +1130,7 @@ timeout:
         if (p->qp)
                 ib_destroy_qp(p->qp);
 
-        kfree(p->tx_ring);
+        vfree(p->tx_ring);
         kfree(p);
 }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index f96477a8ca5a..57282048865c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -41,6 +41,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
+#include <linux/vmalloc.h>
 
 #include <linux/if_arp.h>       /* For ARPHRD_xxx */
 
@@ -887,13 +888,13 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
                 goto out;
         }
 
-        priv->tx_ring = kzalloc(ipoib_sendq_size * sizeof *priv->tx_ring,
-                                GFP_KERNEL);
+        priv->tx_ring = vmalloc(ipoib_sendq_size * sizeof *priv->tx_ring);
         if (!priv->tx_ring) {
                 printk(KERN_WARNING "%s: failed to allocate TX ring (%d entries)\n",
                        ca->name, ipoib_sendq_size);
                 goto out_rx_ring_cleanup;
         }
+        memset(priv->tx_ring, 0, ipoib_sendq_size * sizeof *priv->tx_ring);
 
         /* priv->tx_head, tx_tail & tx_outstanding are already 0 */
 
@@ -903,7 +904,7 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         return 0;
 
 out_tx_ring_cleanup:
-        kfree(priv->tx_ring);
+        vfree(priv->tx_ring);
 
 out_rx_ring_cleanup:
         kfree(priv->rx_ring);
@@ -928,7 +929,7 @@ void ipoib_dev_cleanup(struct net_device *dev)
         ipoib_ib_dev_cleanup(dev);
 
         kfree(priv->rx_ring);
-        kfree(priv->tx_ring);
+        vfree(priv->tx_ring);
 
         priv->rx_ring = NULL;
         priv->tx_ring = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 2628339e3a99..31a53c5bcb13 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -650,7 +650,7 @@ void ipoib_mcast_send(struct net_device *dev, void *mgid, struct sk_buff *skb)
          */
         spin_lock(&priv->lock);
 
-        if (!test_bit(IPOIB_MCAST_STARTED, &priv->flags)        ||
+        if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)         ||
             !priv->broadcast                                    ||
             !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &priv->broadcast->flags)) {
                 ++dev->stats.tx_dropped;
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 714b8db02b29..993f0a8ff28f 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -237,36 +237,32 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
 static
 struct iser_device *iser_device_find_by_ib_device(struct rdma_cm_id *cma_id)
 {
-        struct list_head    *p_list;
-        struct iser_device  *device = NULL;
+        struct iser_device *device;
 
         mutex_lock(&ig.device_list_mutex);
 
-        p_list = ig.device_list.next;
-        while (p_list != &ig.device_list) {
-                device = list_entry(p_list, struct iser_device, ig_list);
+        list_for_each_entry(device, &ig.device_list, ig_list)
                 /* find if there's a match using the node GUID */
                 if (device->ib_device->node_guid == cma_id->device->node_guid)
-                        break;
-        }
+                        goto inc_refcnt;
 
-        if (device == NULL) {
-                device = kzalloc(sizeof *device, GFP_KERNEL);
-                if (device == NULL)
-                        goto out;
-                /* assign this device to the device */
-                device->ib_device = cma_id->device;
-                /* init the device and link it into ig device list */
-                if (iser_create_device_ib_res(device)) {
-                        kfree(device);
-                        device = NULL;
-                        goto out;
-                }
-                list_add(&device->ig_list, &ig.device_list);
+        device = kzalloc(sizeof *device, GFP_KERNEL);
+        if (device == NULL)
+                goto out;
+
+        /* assign this device to the device */
+        device->ib_device = cma_id->device;
+        /* init the device and link it into ig device list */
+        if (iser_create_device_ib_res(device)) {
+                kfree(device);
+                device = NULL;
+                goto out;
         }
-out:
-        BUG_ON(device == NULL);
+        list_add(&device->ig_list, &ig.device_list);
+
+inc_refcnt:
         device->refcount++;
+out:
         mutex_unlock(&ig.device_list_mutex);
         return device;
 }
@@ -372,6 +368,12 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         int    ret;
 
         device = iser_device_find_by_ib_device(cma_id);
+        if (!device) {
+                iser_err("device lookup/creation failed\n");
+                iser_connect_error(cma_id);
+                return;
+        }
+
         ib_conn = (struct iser_conn *)cma_id->context;
         ib_conn->device = device;
 
@@ -380,7 +382,6 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
                 iser_err("resolve route failed: %d\n", ret);
                 iser_connect_error(cma_id);
         }
-        return;
 }
 
 static void iser_route_handler(struct rdma_cm_id *cma_id)