Merge ../linus

Conflicts:

	drivers/cpufreq/cpufreq.c

69 files changed, 785 insertions, 577 deletions

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 60d3fbdd216c..af939796750d 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -47,6 +47,7 @@ struct addr_req {
         struct sockaddr src_addr;
         struct sockaddr dst_addr;
         struct rdma_dev_addr *addr;
+        struct rdma_addr_client *client;
         void *context;
         void (*callback)(int status, struct sockaddr *src_addr,
                          struct rdma_dev_addr *addr, void *context);
@@ -54,13 +55,33 @@ struct addr_req {
         int status;
 };
 
-static void process_req(void *data);
+static void process_req(struct work_struct *work);
 
 static DEFINE_MUTEX(lock);
 static LIST_HEAD(req_list);
-static DECLARE_WORK(work, process_req, NULL);
+static DECLARE_DELAYED_WORK(work, process_req);
 static struct workqueue_struct *addr_wq;
 
+void rdma_addr_register_client(struct rdma_addr_client *client)
+{
+        atomic_set(&client->refcount, 1);
+        init_completion(&client->comp);
+}
+EXPORT_SYMBOL(rdma_addr_register_client);
+
+static inline void put_client(struct rdma_addr_client *client)
+{
+        if (atomic_dec_and_test(&client->refcount))
+                complete(&client->comp);
+}
+
+void rdma_addr_unregister_client(struct rdma_addr_client *client)
+{
+        put_client(client);
+        wait_for_completion(&client->comp);
+}
+EXPORT_SYMBOL(rdma_addr_unregister_client);
+
 int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev,
                      const unsigned char *dst_dev_addr)
 {
@@ -118,7 +139,7 @@ static void queue_req(struct addr_req *req)
 
         mutex_lock(&lock);
         list_for_each_entry_reverse(temp_req, &req_list, list) {
-                if (time_after(req->timeout, temp_req->timeout))
+                if (time_after_eq(req->timeout, temp_req->timeout))
                         break;
         }
 
@@ -194,7 +215,7 @@ out:
         return ret;
 }
 
-static void process_req(void *data)
+static void process_req(struct work_struct *work)
 {
         struct addr_req *req, *temp_req;
         struct sockaddr_in *src_in, *dst_in;
@@ -204,19 +225,17 @@ static void process_req(void *data)
 
         mutex_lock(&lock);
         list_for_each_entry_safe(req, temp_req, &req_list, list) {
-                if (req->status) {
+                if (req->status == -ENODATA) {
                         src_in = (struct sockaddr_in *) &req->src_addr;
                         dst_in = (struct sockaddr_in *) &req->dst_addr;
                         req->status = addr_resolve_remote(src_in, dst_in,
                                                           req->addr);
+                        if (req->status && time_after_eq(jiffies, req->timeout))
+                                req->status = -ETIMEDOUT;
+                        else if (req->status == -ENODATA)
+                                continue;
                 }
-                if (req->status && time_after(jiffies, req->timeout))
-                        req->status = -ETIMEDOUT;
-                else if (req->status == -ENODATA)
-                        continue;
-
-                list_del(&req->list);
-                list_add_tail(&req->list, &done_list);
+                list_move_tail(&req->list, &done_list);
         }
 
         if (!list_empty(&req_list)) {
@@ -229,6 +248,7 @@ static void process_req(void *data)
                 list_del(&req->list);
                 req->callback(req->status, &req->src_addr, req->addr,
                               req->context);
+                put_client(req->client);
                 kfree(req);
         }
 }
@@ -264,7 +284,8 @@ static int addr_resolve_local(struct sockaddr_in *src_in,
         return ret;
 }
 
-int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
+int rdma_resolve_ip(struct rdma_addr_client *client,
+                    struct sockaddr *src_addr, struct sockaddr *dst_addr,
                     struct rdma_dev_addr *addr, int timeout_ms,
                     void (*callback)(int status, struct sockaddr *src_addr,
                                      struct rdma_dev_addr *addr, void *context),
@@ -285,6 +306,8 @@ int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
         req->addr = addr;
         req->callback = callback;
         req->context = context;
+        req->client = client;
+        atomic_inc(&client->refcount);
 
         src_in = (struct sockaddr_in *) &req->src_addr;
         dst_in = (struct sockaddr_in *) &req->dst_addr;
@@ -305,6 +328,7 @@ int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
                 break;
         default:
                 ret = req->status;
+                atomic_dec(&client->refcount);
                 kfree(req);
                 break;
         }
@@ -321,8 +345,7 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr)
                 if (req->addr == addr) {
                         req->status = -ECANCELED;
                         req->timeout = jiffies;
-                        list_del(&req->list);
-                        list_add(&req->list, &req_list);
+                        list_move(&req->list, &req_list);
                         set_timeout(req->timeout);
                         break;
                 }
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 20e9f64e67a6..98272fbbfb31 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -285,9 +285,10 @@ err:
         kfree(tprops);
 }
 
-static void ib_cache_task(void *work_ptr)
+static void ib_cache_task(struct work_struct *_work)
 {
-        struct ib_update_work *work = work_ptr;
+        struct ib_update_work *work =
+                container_of(_work, struct ib_update_work, work);
 
         ib_cache_update(work->device, work->port_num);
         kfree(work);
@@ -306,7 +307,7 @@ static void ib_cache_event(struct ib_event_handler *handler,
             event->event == IB_EVENT_CLIENT_REREGISTER) {
                 work = kmalloc(sizeof *work, GFP_ATOMIC);
                 if (work) {
-                        INIT_WORK(&work->work, ib_cache_task, work);
+                        INIT_WORK(&work->work, ib_cache_task);
                         work->device   = event->device;
                         work->port_num = event->element.port_num;
                         schedule_work(&work->work);
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 25b1018a476c..79c937bf6962 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -101,7 +101,7 @@ struct cm_av {
 };
 
 struct cm_work {
-        struct work_struct work;
+        struct delayed_work work;
         struct list_head list;
         struct cm_port *port;
         struct ib_mad_recv_wc *mad_recv_wc;     /* Received MADs */
@@ -147,12 +147,12 @@ struct cm_id_private {
         __be32 rq_psn;
         int timeout_ms;
         enum ib_mtu path_mtu;
+        __be16 pkey;
         u8 private_data_len;
         u8 max_cm_retries;
         u8 peer_to_peer;
         u8 responder_resources;
         u8 initiator_depth;
-        u8 local_ack_timeout;
         u8 retry_count;
         u8 rnr_retry_count;
         u8 service_timeout;
@@ -161,7 +161,7 @@ struct cm_id_private {
         atomic_t work_count;
 };
 
-static void cm_work_handler(void *data);
+static void cm_work_handler(struct work_struct *work);
 
 static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
 {
@@ -240,11 +240,10 @@ static void * cm_copy_private_data(const void *private_data,
         if (!private_data || !private_data_len)
                 return NULL;
 
-        data = kmalloc(private_data_len, GFP_KERNEL);
+        data = kmemdup(private_data, private_data_len, GFP_KERNEL);
         if (!data)
                 return ERR_PTR(-ENOMEM);
 
-        memcpy(data, private_data, private_data_len);
         return data;
 }
 
@@ -669,8 +668,7 @@ static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
                 return ERR_PTR(-ENOMEM);
 
         timewait_info->work.local_id = local_id;
-        INIT_WORK(&timewait_info->work.work, cm_work_handler,
-                  &timewait_info->work);
+        INIT_DELAYED_WORK(&timewait_info->work.work, cm_work_handler);
         timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
         return timewait_info;
 }
@@ -691,7 +689,7 @@ static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
          * timewait before notifying the user that we've exited timewait.
          */
         cm_id_priv->id.state = IB_CM_TIMEWAIT;
-        wait_time = cm_convert_to_ms(cm_id_priv->local_ack_timeout);
+        wait_time = cm_convert_to_ms(cm_id_priv->av.packet_life_time + 1);
         queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
                            msecs_to_jiffies(wait_time));
         cm_id_priv->timewait_info = NULL;
@@ -1010,6 +1008,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
         cm_id_priv->responder_resources = param->responder_resources;
         cm_id_priv->retry_count = param->retry_count;
         cm_id_priv->path_mtu = param->primary_path->mtu;
+        cm_id_priv->pkey = param->primary_path->pkey;
         cm_id_priv->qp_type = param->qp_type;
 
         ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
@@ -1024,8 +1023,6 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 
         cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
         cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
-        cm_id_priv->local_ack_timeout =
-                                cm_req_get_primary_local_ack_timeout(req_msg);
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         ret = ib_post_send_mad(cm_id_priv->msg, NULL);
@@ -1410,9 +1407,8 @@ static int cm_req_handler(struct cm_work *work)
         cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
         cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
         cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
+        cm_id_priv->pkey = req_msg->pkey;
         cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
-        cm_id_priv->local_ack_timeout =
-                                cm_req_get_primary_local_ack_timeout(req_msg);
         cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
         cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
         cm_id_priv->qp_type = cm_req_get_qp_type(req_msg);
@@ -1716,7 +1712,7 @@ static int cm_establish_handler(struct cm_work *work)
         unsigned long flags;
         int ret;
 
-        /* See comment in ib_cm_establish about lookup. */
+        /* See comment in cm_establish about lookup. */
         cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
         if (!cm_id_priv)
                 return -EINVAL;
@@ -2402,11 +2398,16 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id,
         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         if (cm_id->state != IB_CM_ESTABLISHED ||
-            cm_id->lap_state != IB_CM_LAP_IDLE) {
+            (cm_id->lap_state != IB_CM_LAP_UNINIT &&
+             cm_id->lap_state != IB_CM_LAP_IDLE)) {
                 ret = -EINVAL;
                 goto out;
         }
 
+        ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
+        if (ret)
+                goto out;
+
         ret = cm_alloc_msg(cm_id_priv, &msg);
         if (ret)
                 goto out;
@@ -2431,7 +2432,8 @@ out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 }
 EXPORT_SYMBOL(ib_send_cm_lap);
 
-static void cm_format_path_from_lap(struct ib_sa_path_rec *path,
+static void cm_format_path_from_lap(struct cm_id_private *cm_id_priv,
+                                    struct ib_sa_path_rec *path,
                                     struct cm_lap_msg *lap_msg)
 {
         memset(path, 0, sizeof *path);
@@ -2443,10 +2445,10 @@ static void cm_format_path_from_lap(struct ib_sa_path_rec *path,
         path->hop_limit = lap_msg->alt_hop_limit;
         path->traffic_class = cm_lap_get_traffic_class(lap_msg);
         path->reversible = 1;
-        /* pkey is same as in REQ */
+        path->pkey = cm_id_priv->pkey;
         path->sl = cm_lap_get_sl(lap_msg);
         path->mtu_selector = IB_SA_EQ;
-        /* mtu is same as in REQ */
+        path->mtu = cm_id_priv->path_mtu;
         path->rate_selector = IB_SA_EQ;
         path->rate = cm_lap_get_packet_rate(lap_msg);
         path->packet_life_time_selector = IB_SA_EQ;
@@ -2472,7 +2474,7 @@ static int cm_lap_handler(struct cm_work *work)
 
         param = &work->cm_event.param.lap_rcvd;
         param->alternate_path = &work->path[0];
-        cm_format_path_from_lap(param->alternate_path, lap_msg);
+        cm_format_path_from_lap(cm_id_priv, param->alternate_path, lap_msg);
         work->cm_event.private_data = &lap_msg->private_data;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
@@ -2480,6 +2482,7 @@ static int cm_lap_handler(struct cm_work *work)
                 goto unlock;
 
         switch (cm_id_priv->id.lap_state) {
+        case IB_CM_LAP_UNINIT:
         case IB_CM_LAP_IDLE:
                 break;
         case IB_CM_MRA_LAP_SENT:
@@ -2502,6 +2505,10 @@ static int cm_lap_handler(struct cm_work *work)
 
         cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
         cm_id_priv->tid = lap_msg->hdr.tid;
+        cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
+                                work->mad_recv_wc->recv_buf.grh,
+                                &cm_id_priv->av);
+        cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
         ret = atomic_inc_and_test(&cm_id_priv->work_count);
         if (!ret)
                 list_add_tail(&work->list, &cm_id_priv->work_list);
@@ -2987,9 +2994,9 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
         }
 }
 
-static void cm_work_handler(void *data)
+static void cm_work_handler(struct work_struct *_work)
 {
-        struct cm_work *work = data;
+        struct cm_work *work = container_of(_work, struct cm_work, work.work);
         int ret;
 
         switch (work->cm_event.event) {
@@ -3040,7 +3047,7 @@ static void cm_work_handler(void *data)
                 cm_free_work(work);
 }
 
-int ib_cm_establish(struct ib_cm_id *cm_id)
+static int cm_establish(struct ib_cm_id *cm_id)
 {
         struct cm_id_private *cm_id_priv;
         struct cm_work *work;
@@ -3079,16 +3086,53 @@ int ib_cm_establish(struct ib_cm_id *cm_id)
          * we need to find the cm_id once we're in the context of the
          * worker thread, rather than holding a reference on it.
          */
-        INIT_WORK(&work->work, cm_work_handler, work);
+        INIT_DELAYED_WORK(&work->work, cm_work_handler);
         work->local_id = cm_id->local_id;
         work->remote_id = cm_id->remote_id;
         work->mad_recv_wc = NULL;
         work->cm_event.event = IB_CM_USER_ESTABLISHED;
-        queue_work(cm.wq, &work->work);
+        queue_delayed_work(cm.wq, &work->work, 0);
 out:
         return ret;
 }
-EXPORT_SYMBOL(ib_cm_establish);
+
+static int cm_migrate(struct ib_cm_id *cm_id)
+{
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+        int ret = 0;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state == IB_CM_ESTABLISHED &&
+            (cm_id->lap_state == IB_CM_LAP_UNINIT ||
+             cm_id->lap_state == IB_CM_LAP_IDLE)) {
+                cm_id->lap_state = IB_CM_LAP_IDLE;
+                cm_id_priv->av = cm_id_priv->alt_av;
+        } else
+                ret = -EINVAL;
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        return ret;
+}
+
+int ib_cm_notify(struct ib_cm_id *cm_id, enum ib_event_type event)
+{
+        int ret;
+
+        switch (event) {
+        case IB_EVENT_COMM_EST:
+                ret = cm_establish(cm_id);
+                break;
+        case IB_EVENT_PATH_MIG:
+                ret = cm_migrate(cm_id);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+        return ret;
+}
+EXPORT_SYMBOL(ib_cm_notify);
 
 static void cm_recv_handler(struct ib_mad_agent *mad_agent,
                             struct ib_mad_recv_wc *mad_recv_wc)
@@ -3146,11 +3190,11 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
                 return;
         }
 
-        INIT_WORK(&work->work, cm_work_handler, work);
+        INIT_DELAYED_WORK(&work->work, cm_work_handler);
         work->cm_event.event = event;
         work->mad_recv_wc = mad_recv_wc;
         work->port = (struct cm_port *)mad_agent->context;
-        queue_work(cm.wq, &work->work);
+        queue_delayed_work(cm.wq, &work->work, 0);
 }
 
 static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
@@ -3173,8 +3217,7 @@ static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
         case IB_CM_ESTABLISHED:
                 *qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
                                 IB_QP_PKEY_INDEX | IB_QP_PORT;
-                qp_attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE |
-                                           IB_ACCESS_REMOTE_WRITE;
+                qp_attr->qp_access_flags = IB_ACCESS_REMOTE_WRITE;
                 if (cm_id_priv->responder_resources)
                         qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_READ |
                                                     IB_ACCESS_REMOTE_ATOMIC;
@@ -3222,6 +3265,9 @@ static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
                 if (cm_id_priv->alt_av.ah_attr.dlid) {
                         *qp_attr_mask |= IB_QP_ALT_PATH;
                         qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
+                        qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
+                        qp_attr->alt_timeout =
+                                        cm_id_priv->alt_av.packet_life_time + 1;
                         qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
                 }
                 ret = 0;
@@ -3248,19 +3294,31 @@ static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
         case IB_CM_REP_SENT:
         case IB_CM_MRA_REP_RCVD:
         case IB_CM_ESTABLISHED:
-                *qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
-                qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
-                if (cm_id_priv->qp_type == IB_QPT_RC) {
-                        *qp_attr_mask |= IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
-                                         IB_QP_RNR_RETRY |
-                                         IB_QP_MAX_QP_RD_ATOMIC;
-                        qp_attr->timeout = cm_id_priv->local_ack_timeout;
-                        qp_attr->retry_cnt = cm_id_priv->retry_count;
-                        qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
-                        qp_attr->max_rd_atomic = cm_id_priv->initiator_depth;
-                }
-                if (cm_id_priv->alt_av.ah_attr.dlid) {
-                        *qp_attr_mask |= IB_QP_PATH_MIG_STATE;
+                if (cm_id_priv->id.lap_state == IB_CM_LAP_UNINIT) {
+                        *qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
+                        qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
+                        if (cm_id_priv->qp_type == IB_QPT_RC) {
+                                *qp_attr_mask |= IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
+                                                 IB_QP_RNR_RETRY |
+                                                 IB_QP_MAX_QP_RD_ATOMIC;
+                                qp_attr->timeout =
+                                        cm_id_priv->av.packet_life_time + 1;
+                                qp_attr->retry_cnt = cm_id_priv->retry_count;
+                                qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
+                                qp_attr->max_rd_atomic =
+                                        cm_id_priv->initiator_depth;
+                        }
+                        if (cm_id_priv->alt_av.ah_attr.dlid) {
+                                *qp_attr_mask |= IB_QP_PATH_MIG_STATE;
+                                qp_attr->path_mig_state = IB_MIG_REARM;
+                        }
+                } else {
+                        *qp_attr_mask = IB_QP_ALT_PATH | IB_QP_PATH_MIG_STATE;
+                        qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
+                        qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
+                        qp_attr->alt_timeout =
+                                cm_id_priv->alt_av.packet_life_time + 1;
+                        qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
                         qp_attr->path_mig_state = IB_MIG_REARM;
                 }
                 ret = 0;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9ae4f3a67c70..985a6b564d8f 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -63,6 +63,7 @@ static struct ib_client cma_client = {
 };
 
 static struct ib_sa_client sa_client;
+static struct rdma_addr_client addr_client;
 static LIST_HEAD(dev_list);
 static LIST_HEAD(listen_any_list);
 static DEFINE_MUTEX(lock);
@@ -343,7 +344,7 @@ static int cma_init_ib_qp(struct rdma_id_private *id_priv, struct ib_qp *qp)
                 return ret;
 
         qp_attr.qp_state = IB_QPS_INIT;
-        qp_attr.qp_access_flags = IB_ACCESS_LOCAL_WRITE;
+        qp_attr.qp_access_flags = 0;
         qp_attr.port_num = id_priv->id.port_num;
         return ib_modify_qp(qp, &qp_attr, IB_QP_STATE | IB_QP_ACCESS_FLAGS |
                                           IB_QP_PKEY_INDEX | IB_QP_PORT);
@@ -934,13 +935,8 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
         mutex_lock(&lock);
         ret = cma_acquire_dev(conn_id);
         mutex_unlock(&lock);
-        if (ret) {
-                ret = -ENODEV;
-                cma_exch(conn_id, CMA_DESTROYING);
-                cma_release_remove(conn_id);
-                rdma_destroy_id(&conn_id->id);
-                goto out;
-        }
+        if (ret)
+                goto release_conn_id;
 
         conn_id->cm_id.ib = cm_id;
         cm_id->context = conn_id;
@@ -950,13 +946,17 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
         ret = cma_notify_user(conn_id, RDMA_CM_EVENT_CONNECT_REQUEST, 0,
                               ib_event->private_data + offset,
                               IB_CM_REQ_PRIVATE_DATA_SIZE - offset);
-        if (ret) {
-                /* Destroy the CM ID by returning a non-zero value. */
-                conn_id->cm_id.ib = NULL;
-                cma_exch(conn_id, CMA_DESTROYING);
-                cma_release_remove(conn_id);
-                rdma_destroy_id(&conn_id->id);
-        }
+        if (!ret)
+                goto out;
+
+        /* Destroy the CM ID by returning a non-zero value. */
+        conn_id->cm_id.ib = NULL;
+
+release_conn_id:
+        cma_exch(conn_id, CMA_DESTROYING);
+        cma_release_remove(conn_id);
+        rdma_destroy_id(&conn_id->id);
+
 out:
         cma_release_remove(listen_id);
         return ret;
@@ -1340,9 +1340,9 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
         return (id_priv->query_id < 0) ? id_priv->query_id : 0;
 }
 
-static void cma_work_handler(void *data)
+static void cma_work_handler(struct work_struct *_work)
 {
-        struct cma_work *work = data;
+        struct cma_work *work = container_of(_work, struct cma_work, work);
         struct rdma_id_private *id_priv = work->id;
         int destroy = 0;
 
@@ -1373,7 +1373,7 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms)
                 return -ENOMEM;
 
         work->id = id_priv;
-        INIT_WORK(&work->work, cma_work_handler, work);
+        INIT_WORK(&work->work, cma_work_handler);
         work->old_state = CMA_ROUTE_QUERY;
         work->new_state = CMA_ROUTE_RESOLVED;
         work->event.event = RDMA_CM_EVENT_ROUTE_RESOLVED;
@@ -1430,7 +1430,7 @@ static int cma_resolve_iw_route(struct rdma_id_private *id_priv, int timeout_ms)
                 return -ENOMEM;
 
         work->id = id_priv;
-        INIT_WORK(&work->work, cma_work_handler, work);
+        INIT_WORK(&work->work, cma_work_handler);
         work->old_state = CMA_ROUTE_QUERY;
         work->new_state = CMA_ROUTE_RESOLVED;
         work->event.event = RDMA_CM_EVENT_ROUTE_RESOLVED;
@@ -1480,19 +1480,18 @@ static int cma_bind_loopback(struct rdma_id_private *id_priv)
         u8 p;
 
         mutex_lock(&lock);
+        if (list_empty(&dev_list)) {
+                ret = -ENODEV;
+                goto out;
+        }
         list_for_each_entry(cma_dev, &dev_list, list)
                 for (p = 1; p <= cma_dev->device->phys_port_cnt; ++p)
-                        if (!ib_query_port (cma_dev->device, p, &port_attr) &&
+                        if (!ib_query_port(cma_dev->device, p, &port_attr) &&
                             port_attr.state == IB_PORT_ACTIVE)
                                 goto port_found;
 
-        if (!list_empty(&dev_list)) {
-                p = 1;
-                cma_dev = list_entry(dev_list.next, struct cma_device, list);
-        } else {
-                ret = -ENODEV;
-                goto out;
-        }
+        p = 1;
+        cma_dev = list_entry(dev_list.next, struct cma_device, list);
 
 port_found:
         ret = ib_get_cached_gid(cma_dev->device, p, 0, &gid);
@@ -1584,7 +1583,7 @@ static int cma_resolve_loopback(struct rdma_id_private *id_priv)
         }
 
         work->id = id_priv;
-        INIT_WORK(&work->work, cma_work_handler, work);
+        INIT_WORK(&work->work, cma_work_handler);
         work->old_state = CMA_ADDR_QUERY;
         work->new_state = CMA_ADDR_RESOLVED;
         work->event.event = RDMA_CM_EVENT_ADDR_RESOLVED;
@@ -1625,8 +1624,8 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
         if (cma_any_addr(dst_addr))
                 ret = cma_resolve_loopback(id_priv);
         else
-                ret = rdma_resolve_ip(&id->route.addr.src_addr, dst_addr,
-                                      &id->route.addr.dev_addr,
+                ret = rdma_resolve_ip(&addr_client, &id->route.addr.src_addr,
+                                      dst_addr, &id->route.addr.dev_addr,
                                       timeout_ms, addr_handler, id_priv);
         if (ret)
                 goto err;
@@ -1762,22 +1761,29 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 
         if (!cma_any_addr(addr)) {
                 ret = rdma_translate_ip(addr, &id->route.addr.dev_addr);
-                if (!ret) {
-                        mutex_lock(&lock);
-                        ret = cma_acquire_dev(id_priv);
-                        mutex_unlock(&lock);
-                }
                 if (ret)
-                        goto err;
+                        goto err1;
+
+                mutex_lock(&lock);
+                ret = cma_acquire_dev(id_priv);
+                mutex_unlock(&lock);
+                if (ret)
+                        goto err1;
         }
 
         memcpy(&id->route.addr.src_addr, addr, ip_addr_size(addr));
         ret = cma_get_port(id_priv);
         if (ret)
-                goto err;
+                goto err2;
 
         return 0;
-err:
+err2:
+        if (!cma_any_addr(addr)) {
+                mutex_lock(&lock);
+                cma_detach_from_dev(id_priv);
+                mutex_unlock(&lock);
+        }
+err1:
         cma_comp_exch(id_priv, CMA_ADDR_BOUND, CMA_IDLE);
         return ret;
 }
@@ -2115,8 +2121,6 @@ static void cma_add_one(struct ib_device *device)
 
         cma_dev->device = device;
         cma_dev->node_guid = device->node_guid;
-        if (!cma_dev->node_guid)
-                goto err;
 
         init_completion(&cma_dev->comp);
         atomic_set(&cma_dev->refcount, 1);
@@ -2128,9 +2132,6 @@ static void cma_add_one(struct ib_device *device)
         list_for_each_entry(id_priv, &listen_any_list, list)
                 cma_listen_on_dev(id_priv, cma_dev);
         mutex_unlock(&lock);
-        return;
-err:
-        kfree(cma_dev);
 }
 
 static int cma_remove_id_dev(struct rdma_id_private *id_priv)
@@ -2210,6 +2211,7 @@ static int cma_init(void)
                 return -ENOMEM;
 
         ib_sa_register_client(&sa_client);
+        rdma_addr_register_client(&addr_client);
 
         ret = ib_register_client(&cma_client);
         if (ret)
@@ -2217,6 +2219,7 @@ static int cma_init(void)
         return 0;
 
 err:
+        rdma_addr_unregister_client(&addr_client);
         ib_sa_unregister_client(&sa_client);
         destroy_workqueue(cma_wq);
         return ret;
@@ -2225,6 +2228,7 @@ err:
 static void cma_cleanup(void)
 {
         ib_unregister_client(&cma_client);
+        rdma_addr_unregister_client(&addr_client);
         ib_sa_unregister_client(&sa_client);
         destroy_workqueue(cma_wq);
         idr_destroy(&sdp_ps);
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c3fb304a4e86..1039ad57d53b 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -80,7 +80,7 @@ struct iwcm_work {
  * 1) in the event upcall, cm_event_handler(), for a listening cm_id.  If
  *    the backlog is exceeded, then no more connection request events will
  *    be processed.  cm_event_handler() returns -ENOMEM in this case.  Its up
- *    to the provider to reject the connectino request.
+ *    to the provider to reject the connection request.
  * 2) in the connection request workqueue handler, cm_conn_req_handler().
  *    If work elements cannot be allocated for the new connect request cm_id,
  *    then IWCM will call the provider reject method.  This is ok since
@@ -131,26 +131,25 @@ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
 }
 
 /*
- * Save private data from incoming connection requests in the
- * cm_id_priv so the low level driver doesn't have to.  Adjust
+ * Save private data from incoming connection requests to
+ * iw_cm_event, so the low level driver doesn't have to. Adjust
  * the event ptr to point to the local copy.
  */
-static int copy_private_data(struct iwcm_id_private *cm_id_priv,
-                       struct iw_cm_event *event)
+static int copy_private_data(struct iw_cm_event *event)
 {
         void *p;
 
-        p = kmalloc(event->private_data_len, GFP_ATOMIC);
+        p = kmemdup(event->private_data, event->private_data_len, GFP_ATOMIC);
         if (!p)
                 return -ENOMEM;
-        memcpy(p, event->private_data, event->private_data_len);
         event->private_data = p;
         return 0;
 }
 
 /*
- * Release a reference on cm_id. If the last reference is being removed
- * and iw_destroy_cm_id is waiting, wake up the waiting thread.
+ * Release a reference on cm_id. If the last reference is being
+ * released, enable the waiting thread (in iw_destroy_cm_id) to
+ * get woken up, and return 1 if a thread is already waiting.
  */
 static int iwcm_deref_id(struct iwcm_id_private *cm_id_priv)
 {
@@ -243,7 +242,7 @@ static int iwcm_modify_qp_sqd(struct ib_qp *qp)
 /*
  * CM_ID <-- CLOSING
  *
- * Block if a passive or active connection is currenlty being processed. Then
+ * Block if a passive or active connection is currently being processed. Then
  * process the event as follows:
  * - If we are ESTABLISHED, move to CLOSING and modify the QP state
  *   based on the abrupt flag
@@ -408,7 +407,7 @@ int iw_cm_listen(struct iw_cm_id *cm_id, int backlog)
 {
         struct iwcm_id_private *cm_id_priv;
         unsigned long flags;
-        int ret = 0;
+        int ret;
 
         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 
@@ -535,7 +534,7 @@ EXPORT_SYMBOL(iw_cm_accept);
 int iw_cm_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *iw_param)
 {
         struct iwcm_id_private *cm_id_priv;
-        int ret = 0;
+        int ret;
         unsigned long flags;
         struct ib_qp *qp;
 
@@ -620,7 +619,7 @@ static void cm_conn_req_handler(struct iwcm_id_private *listen_id_priv,
         spin_lock_irqsave(&listen_id_priv->lock, flags);
         if (listen_id_priv->state != IW_CM_STATE_LISTEN) {
                 spin_unlock_irqrestore(&listen_id_priv->lock, flags);
-                return;
+                goto out;
         }
         spin_unlock_irqrestore(&listen_id_priv->lock, flags);
 
@@ -629,7 +628,7 @@ static void cm_conn_req_handler(struct iwcm_id_private *listen_id_priv,
                                 listen_id_priv->id.context);
         /* If the cm_id could not be created, ignore the request */
         if (IS_ERR(cm_id))
-                return;
+                goto out;
 
         cm_id->provider_data = iw_event->provider_data;
         cm_id->local_addr = iw_event->local_addr;
@@ -642,7 +641,7 @@ static void cm_conn_req_handler(struct iwcm_id_private *listen_id_priv,
         if (ret) {
                 iw_cm_reject(cm_id, NULL, 0);
                 iw_destroy_cm_id(cm_id);
-                return;
+                goto out;
         }
 
         /* Call the client CM handler */
@@ -654,6 +653,7 @@ static void cm_conn_req_handler(struct iwcm_id_private *listen_id_priv,
                         kfree(cm_id);
         }
 
+out:
         if (iw_event->private_data_len)
                 kfree(iw_event->private_data);
 }
@@ -674,7 +674,7 @@ static int cm_conn_est_handler(struct iwcm_id_private *cm_id_priv,
                                struct iw_cm_event *iw_event)
 {
         unsigned long flags;
-        int ret = 0;
+        int ret;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
 
@@ -704,7 +704,7 @@ static int cm_conn_rep_handler(struct iwcm_id_private *cm_id_priv,
                                struct iw_cm_event *iw_event)
 {
         unsigned long flags;
-        int ret = 0;
+        int ret;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         /*
@@ -828,9 +828,10 @@ static int process_event(struct iwcm_id_private *cm_id_priv,
  * thread asleep on the destroy_comp list vs. an object destroyed
  * here synchronously when the last reference is removed.
  */
-static void cm_work_handler(void *arg)
+static void cm_work_handler(struct work_struct *_work)
 {
-        struct iwcm_work *work = arg, lwork;
+        struct iwcm_work *work = container_of(_work, struct iwcm_work, work);
+        struct iw_cm_event levent;
         struct iwcm_id_private *cm_id_priv = work->cm_id;
         unsigned long flags;
         int empty;
@@ -843,11 +844,11 @@ static void cm_work_handler(void *arg)
                                   struct iwcm_work, list);
                 list_del_init(&work->list);
                 empty = list_empty(&cm_id_priv->work_list);
-                lwork = *work;
+                levent = work->event;
                 put_work(work);
                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 
-                ret = process_event(cm_id_priv, &work->event);
+                ret = process_event(cm_id_priv, &levent);
                 if (ret) {
                         set_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
                         destroy_cm_id(&cm_id_priv->id);
@@ -899,14 +900,14 @@ static int cm_event_handler(struct iw_cm_id *cm_id,
                 goto out;
         }
 
-        INIT_WORK(&work->work, cm_work_handler, work);
+        INIT_WORK(&work->work, cm_work_handler);
         work->cm_id = cm_id_priv;
         work->event = *iw_event;
 
         if ((work->event.event == IW_CM_EVENT_CONNECT_REQUEST ||
              work->event.event == IW_CM_EVENT_CONNECT_REPLY) &&
             work->event.private_data_len) {
-                ret = copy_private_data(cm_id_priv, &work->event);
+                ret = copy_private_data(&work->event);
                 if (ret) {
                         put_work(work);
                         goto out;
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 493f4c65c7a2..15f38d94b3a8 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -46,7 +46,7 @@ MODULE_DESCRIPTION("kernel IB MAD API");
 MODULE_AUTHOR("Hal Rosenstock");
 MODULE_AUTHOR("Sean Hefty");
 
-static kmem_cache_t *ib_mad_cache;
+static struct kmem_cache *ib_mad_cache;
 
 static struct list_head ib_mad_port_list;
 static u32 ib_mad_client_id = 0;
@@ -65,8 +65,8 @@ static struct ib_mad_agent_private *find_mad_agent(
 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                                     struct ib_mad_private *mad);
 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
-static void timeout_sends(void *data);
-static void local_completions(void *data);
+static void timeout_sends(struct work_struct *work);
+static void local_completions(struct work_struct *work);
 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
                               struct ib_mad_agent_private *agent_priv,
                               u8 mgmt_class);
@@ -356,10 +356,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         INIT_LIST_HEAD(&mad_agent_priv->wait_list);
         INIT_LIST_HEAD(&mad_agent_priv->done_list);
         INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
-        INIT_WORK(&mad_agent_priv->timed_work, timeout_sends, mad_agent_priv);
+        INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
         INIT_LIST_HEAD(&mad_agent_priv->local_list);
-        INIT_WORK(&mad_agent_priv->local_work, local_completions,
-                   mad_agent_priv);
+        INIT_WORK(&mad_agent_priv->local_work, local_completions);
         atomic_set(&mad_agent_priv->refcount, 1);
         init_completion(&mad_agent_priv->comp);
 
@@ -1750,7 +1749,7 @@ ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
                      */
                     (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
-                        return wr;
+                        return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
         }
 
         /*
@@ -2198,12 +2197,12 @@ static void mad_error_handler(struct ib_mad_port_private *port_priv,
 /*
  * IB MAD completion callback
  */
-static void ib_mad_completion_handler(void *data)
+static void ib_mad_completion_handler(struct work_struct *work)
 {
         struct ib_mad_port_private *port_priv;
         struct ib_wc wc;
 
-        port_priv = (struct ib_mad_port_private *)data;
+        port_priv = container_of(work, struct ib_mad_port_private, work);
         ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
 
         while (ib_poll_cq(port_priv->cq, 1, &wc) == 1) {
@@ -2324,7 +2323,7 @@ void ib_cancel_mad(struct ib_mad_agent *mad_agent,
 }
 EXPORT_SYMBOL(ib_cancel_mad);
 
-static void local_completions(void *data)
+static void local_completions(struct work_struct *work)
 {
         struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_local_private *local;
@@ -2334,7 +2333,8 @@ static void local_completions(void *data)
         struct ib_wc wc;
         struct ib_mad_send_wc mad_send_wc;
 
-        mad_agent_priv = (struct ib_mad_agent_private *)data;
+        mad_agent_priv =
+                container_of(work, struct ib_mad_agent_private, local_work);
 
         spin_lock_irqsave(&mad_agent_priv->lock, flags);
         while (!list_empty(&mad_agent_priv->local_list)) {
@@ -2434,14 +2434,15 @@ static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
         return ret;
 }
 
-static void timeout_sends(void *data)
+static void timeout_sends(struct work_struct *work)
 {
         struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_send_wr_private *mad_send_wr;
         struct ib_mad_send_wc mad_send_wc;
         unsigned long flags, delay;
 
-        mad_agent_priv = (struct ib_mad_agent_private *)data;
+        mad_agent_priv = container_of(work, struct ib_mad_agent_private,
+                                      timed_work.work);
         mad_send_wc.vendor_err = 0;
 
         spin_lock_irqsave(&mad_agent_priv->lock, flags);
@@ -2799,7 +2800,7 @@ static int ib_mad_port_open(struct ib_device *device,
                 ret = -ENOMEM;
                 goto error8;
         }
-        INIT_WORK(&port_priv->work, ib_mad_completion_handler, port_priv);
+        INIT_WORK(&port_priv->work, ib_mad_completion_handler);
 
         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
         list_add_tail(&port_priv->port_list, &ib_mad_port_list);
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h
index d06b59083f6e..d5548e73e068 100644
--- a/drivers/infiniband/core/mad_priv.h
+++ b/drivers/infiniband/core/mad_priv.h
@@ -102,7 +102,7 @@ struct ib_mad_agent_private {
         struct list_head send_list;
         struct list_head wait_list;
         struct list_head done_list;
-        struct work_struct timed_work;
+        struct delayed_work timed_work;
         unsigned long timeout;
         struct list_head local_list;
         struct work_struct local_work;
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 1ef79d015a1e..3663fd7022be 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -45,8 +45,8 @@ enum rmpp_state {
 struct mad_rmpp_recv {
         struct ib_mad_agent_private *agent;
         struct list_head list;
-        struct work_struct timeout_work;
-        struct work_struct cleanup_work;
+        struct delayed_work timeout_work;
+        struct delayed_work cleanup_work;
         struct completion comp;
         enum rmpp_state state;
         spinlock_t lock;
@@ -233,9 +233,10 @@ static void nack_recv(struct ib_mad_agent_private *agent,
         }
 }
 
-static void recv_timeout_handler(void *data)
+static void recv_timeout_handler(struct work_struct *work)
 {
-        struct mad_rmpp_recv *rmpp_recv = data;
+        struct mad_rmpp_recv *rmpp_recv =
+                container_of(work, struct mad_rmpp_recv, timeout_work.work);
         struct ib_mad_recv_wc *rmpp_wc;
         unsigned long flags;
 
@@ -254,9 +255,10 @@ static void recv_timeout_handler(void *data)
         ib_free_recv_mad(rmpp_wc);
 }
 
-static void recv_cleanup_handler(void *data)
+static void recv_cleanup_handler(struct work_struct *work)
 {
-        struct mad_rmpp_recv *rmpp_recv = data;
+        struct mad_rmpp_recv *rmpp_recv =
+                container_of(work, struct mad_rmpp_recv, cleanup_work.work);
         unsigned long flags;
 
         spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
@@ -285,8 +287,8 @@ create_rmpp_recv(struct ib_mad_agent_private *agent,
 
         rmpp_recv->agent = agent;
         init_completion(&rmpp_recv->comp);
-        INIT_WORK(&rmpp_recv->timeout_work, recv_timeout_handler, rmpp_recv);
-        INIT_WORK(&rmpp_recv->cleanup_work, recv_cleanup_handler, rmpp_recv);
+        INIT_DELAYED_WORK(&rmpp_recv->timeout_work, recv_timeout_handler);
+        INIT_DELAYED_WORK(&rmpp_recv->cleanup_work, recv_cleanup_handler);
         spin_lock_init(&rmpp_recv->lock);
         rmpp_recv->state = RMPP_STATE_ACTIVE;
         atomic_set(&rmpp_recv->refcount, 1);
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 1706d3c7e95e..e45afba75341 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -360,9 +360,10 @@ static void free_sm_ah(struct kref *kref)
         kfree(sm_ah);
 }
 
-static void update_sm_ah(void *port_ptr)
+static void update_sm_ah(struct work_struct *work)
 {
-        struct ib_sa_port *port = port_ptr;
+        struct ib_sa_port *port =
+                container_of(work, struct ib_sa_port, update_task);
         struct ib_sa_sm_ah *new_ah, *old_ah;
         struct ib_port_attr port_attr;
         struct ib_ah_attr   ah_attr;
@@ -992,8 +993,7 @@ static void ib_sa_add_one(struct ib_device *device)
                 if (IS_ERR(sa_dev->port[i].agent))
                         goto err;
 
-                INIT_WORK(&sa_dev->port[i].update_task,
-                          update_sm_ah, &sa_dev->port[i]);
+                INIT_WORK(&sa_dev->port[i].update_task, update_sm_ah);
         }
 
         ib_set_client_data(device, &sa_client, sa_dev);
@@ -1010,7 +1010,7 @@ static void ib_sa_add_one(struct ib_device *device)
                 goto err;
 
         for (i = 0; i <= e - s; ++i)
-                update_sm_ah(&sa_dev->port[i]);
+                update_sm_ah(&sa_dev->port[i].update_task);
 
         return;
 
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index ad4f4d5c2924..f15220a0ee75 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -161,12 +161,14 @@ static void ib_ucm_cleanup_events(struct ib_ucm_context *ctx)
                                     struct ib_ucm_event, ctx_list);
                 list_del(&uevent->file_list);
                 list_del(&uevent->ctx_list);
+                mutex_unlock(&ctx->file->file_mutex);
 
                 /* clear incoming connections. */
                 if (ib_ucm_new_cm_id(uevent->resp.event))
                         ib_destroy_cm_id(uevent->cm_id);
 
                 kfree(uevent);
+                mutex_lock(&ctx->file->file_mutex);
         }
         mutex_unlock(&ctx->file->file_mutex);
 }
@@ -328,20 +330,18 @@ static int ib_ucm_event_process(struct ib_cm_event *evt,
         }
 
         if (uvt->data_len) {
-                uvt->data = kmalloc(uvt->data_len, GFP_KERNEL);
+                uvt->data = kmemdup(evt->private_data, uvt->data_len, GFP_KERNEL);
                 if (!uvt->data)
                         goto err1;
 
-                memcpy(uvt->data, evt->private_data, uvt->data_len);
                 uvt->resp.present |= IB_UCM_PRES_DATA;
         }
 
         if (uvt->info_len) {
-                uvt->info = kmalloc(uvt->info_len, GFP_KERNEL);
+                uvt->info = kmemdup(info, uvt->info_len, GFP_KERNEL);
                 if (!uvt->info)
                         goto err2;
 
-                memcpy(uvt->info, info, uvt->info_len);
                 uvt->resp.present |= IB_UCM_PRES_INFO;
         }
         return 0;
@@ -685,11 +685,11 @@ out:
         return result;
 }
 
-static ssize_t ib_ucm_establish(struct ib_ucm_file *file,
-                                const char __user *inbuf,
-                                int in_len, int out_len)
+static ssize_t ib_ucm_notify(struct ib_ucm_file *file,
+                             const char __user *inbuf,
+                             int in_len, int out_len)
 {
-        struct ib_ucm_establish cmd;
+        struct ib_ucm_notify cmd;
         struct ib_ucm_context *ctx;
         int result;
 
@@ -700,7 +700,7 @@ static ssize_t ib_ucm_establish(struct ib_ucm_file *file,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        result = ib_cm_establish(ctx->cm_id);
+        result = ib_cm_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
         ib_ucm_ctx_put(ctx);
         return result;
 }
@@ -1107,7 +1107,7 @@ static ssize_t (*ucm_cmd_table[])(struct ib_ucm_file *file,
         [IB_USER_CM_CMD_DESTROY_ID]    = ib_ucm_destroy_id,
         [IB_USER_CM_CMD_ATTR_ID]       = ib_ucm_attr_id,
         [IB_USER_CM_CMD_LISTEN]        = ib_ucm_listen,
-        [IB_USER_CM_CMD_ESTABLISH]     = ib_ucm_establish,
+        [IB_USER_CM_CMD_NOTIFY]        = ib_ucm_notify,
         [IB_USER_CM_CMD_SEND_REQ]      = ib_ucm_send_req,
         [IB_USER_CM_CMD_SEND_REP]      = ib_ucm_send_rep,
         [IB_USER_CM_CMD_SEND_RTU]      = ib_ucm_send_rtu,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index b72c7f69ca90..743247ec065e 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1214,7 +1214,7 @@ ssize_t ib_uverbs_query_qp(struct ib_uverbs_file *file,
         resp.qp_access_flags        = attr->qp_access_flags;
         resp.pkey_index             = attr->pkey_index;
         resp.alt_pkey_index         = attr->alt_pkey_index;
-        resp.en_sqd_async_notify    = attr->en_sqd_async_notify;
+        resp.sq_draining            = attr->sq_draining;
         resp.max_rd_atomic          = attr->max_rd_atomic;
         resp.max_dest_rd_atomic     = attr->max_dest_rd_atomic;
         resp.min_rnr_timer          = attr->min_rnr_timer;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 4e16314e8e6d..a617ca7b6923 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -534,9 +534,9 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
          * module reference.
          */
         filp->f_op         = fops_get(&uverbs_event_fops);
-        filp->f_vfsmnt     = mntget(uverbs_event_mnt);
-        filp->f_dentry     = dget(uverbs_event_mnt->mnt_root);
-        filp->f_mapping    = filp->f_dentry->d_inode->i_mapping;
+        filp->f_path.mnt           = mntget(uverbs_event_mnt);
+        filp->f_path.dentry        = dget(uverbs_event_mnt->mnt_root);
+        filp->f_mapping    = filp->f_path.dentry->d_inode->i_mapping;
         filp->f_flags      = O_RDONLY;
         filp->f_mode       = FMODE_READ;
         filp->private_data = ev_file;
diff --git a/drivers/infiniband/core/uverbs_mem.c b/drivers/infiniband/core/uverbs_mem.c
index efe147dbeb42..db12cc0841df 100644
--- a/drivers/infiniband/core/uverbs_mem.c
+++ b/drivers/infiniband/core/uverbs_mem.c
@@ -179,9 +179,10 @@ void ib_umem_release(struct ib_device *dev, struct ib_umem *umem)
         up_write(&current->mm->mmap_sem);
 }
 
-static void ib_umem_account(void *work_ptr)
+static void ib_umem_account(struct work_struct *_work)
 {
-        struct ib_umem_account_work *work = work_ptr;
+        struct ib_umem_account_work *work =
+                container_of(_work, struct ib_umem_account_work, work);
 
         down_write(&work->mm->mmap_sem);
         work->mm->locked_vm -= work->diff;
@@ -216,7 +217,7 @@ void ib_umem_release_on_close(struct ib_device *dev, struct ib_umem *umem)
                 return;
         }
 
-        INIT_WORK(&work->work, ib_umem_account, work);
+        INIT_WORK(&work->work, ib_umem_account);
         work->mm   = mm;
         work->diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;
 
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index dc1ebeac35c7..27fe242ed435 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1155,7 +1155,8 @@ static int __devinit c2_probe(struct pci_dev *pcidev,
                 goto bail10;
         }
 
-        c2_register_device(c2dev);
+        if (c2_register_device(c2dev))
+                goto bail10;
 
         return 0;
 
@@ -1243,7 +1244,7 @@ static struct pci_driver c2_pci_driver = {
 
 static int __init c2_init_module(void)
 {
-        return pci_module_init(&c2_pci_driver);
+        return pci_register_driver(&c2_pci_driver);
 }
 
 static void __exit c2_exit_module(void)
diff --git a/drivers/infiniband/hw/amso1100/c2.h b/drivers/infiniband/hw/amso1100/c2.h
index 1b17dcdd0505..04a9db5de881 100644
--- a/drivers/infiniband/hw/amso1100/c2.h
+++ b/drivers/infiniband/hw/amso1100/c2.h
@@ -302,7 +302,7 @@ struct c2_dev {
         unsigned long pa;       /* PA device memory */
         void **qptr_array;
 
-        kmem_cache_t *host_msg_cache;
+        struct kmem_cache *host_msg_cache;
 
         struct list_head cca_link;              /* adapter list */
         struct list_head eh_wakeup_list;        /* event wakeup list */
diff --git a/drivers/infiniband/hw/amso1100/c2_alloc.c b/drivers/infiniband/hw/amso1100/c2_alloc.c
index 028a60bbfca9..0315f99e4191 100644
--- a/drivers/infiniband/hw/amso1100/c2_alloc.c
+++ b/drivers/infiniband/hw/amso1100/c2_alloc.c
@@ -42,13 +42,14 @@ static int c2_alloc_mqsp_chunk(struct c2_dev *c2dev, gfp_t gfp_mask,
 {
         int i;
         struct sp_chunk *new_head;
+        dma_addr_t dma_addr;
 
-        new_head = (struct sp_chunk *) __get_free_page(gfp_mask);
+        new_head = dma_alloc_coherent(&c2dev->pcidev->dev, PAGE_SIZE,
+                                      &dma_addr, gfp_mask);
         if (new_head == NULL)
                 return -ENOMEM;
 
-        new_head->dma_addr = dma_map_single(c2dev->ibdev.dma_device, new_head,
-                                            PAGE_SIZE, DMA_FROM_DEVICE);
+        new_head->dma_addr = dma_addr;
         pci_unmap_addr_set(new_head, mapping, new_head->dma_addr);
 
         new_head->next = NULL;
@@ -80,10 +81,8 @@ void c2_free_mqsp_pool(struct c2_dev *c2dev, struct sp_chunk *root)
 
         while (root) {
                 next = root->next;
-                dma_unmap_single(c2dev->ibdev.dma_device,
-                                 pci_unmap_addr(root, mapping), PAGE_SIZE,
-                                 DMA_FROM_DEVICE);
-                __free_page((struct page *) root);
+                dma_free_coherent(&c2dev->pcidev->dev, PAGE_SIZE, root,
+                                  pci_unmap_addr(root, mapping));
                 root = next;
         }
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_cq.c b/drivers/infiniband/hw/amso1100/c2_cq.c
index 9d7bcc5ade93..05c9154d46f4 100644
--- a/drivers/infiniband/hw/amso1100/c2_cq.c
+++ b/drivers/infiniband/hw/amso1100/c2_cq.c
@@ -246,20 +246,17 @@ int c2_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
 
 static void c2_free_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq)
 {
-
-        dma_unmap_single(c2dev->ibdev.dma_device, pci_unmap_addr(mq, mapping),
-                         mq->q_size * mq->msg_size, DMA_FROM_DEVICE);
-        free_pages((unsigned long) mq->msg_pool.host,
-                   get_order(mq->q_size * mq->msg_size));
+        dma_free_coherent(&c2dev->pcidev->dev, mq->q_size * mq->msg_size,
+                          mq->msg_pool.host, pci_unmap_addr(mq, mapping));
 }
 
 static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                            int msg_size)
 {
-        unsigned long pool_start;
+        u8 *pool_start;
 
-        pool_start = __get_free_pages(GFP_KERNEL,
-                                      get_order(q_size * msg_size));
+        pool_start = dma_alloc_coherent(&c2dev->pcidev->dev, q_size * msg_size,
+                                        &mq->host_dma, GFP_KERNEL);
         if (!pool_start)
                 return -ENOMEM;
 
@@ -267,13 +264,10 @@ static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                        0,               /* index (currently unknown) */
                        q_size,
                        msg_size,
-                       (u8 *) pool_start,
+                       pool_start,
                        NULL,    /* peer (currently unknown) */
                        C2_MQ_HOST_TARGET);
 
-        mq->host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                      (void *)pool_start,
-                                      q_size * msg_size, DMA_FROM_DEVICE);
         pci_unmap_addr_set(mq, mapping, mq->host_dma);
 
         return 0;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.c b/drivers/infiniband/hw/amso1100/c2_provider.c
index da98d9f71429..fef972752912 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.c
+++ b/drivers/infiniband/hw/amso1100/c2_provider.c
@@ -757,20 +757,17 @@ static struct net_device *c2_pseudo_netdev_init(struct c2_dev *c2dev)
 
 int c2_register_device(struct c2_dev *dev)
 {
-        int ret;
+        int ret = -ENOMEM;
         int i;
 
         /* Register pseudo network device */
         dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
-        if (dev->pseudo_netdev) {
-                ret = register_netdev(dev->pseudo_netdev);
-                if (ret) {
-                        printk(KERN_ERR PFX
-                                "Unable to register netdev, ret = %d\n", ret);
-                        free_netdev(dev->pseudo_netdev);
-                        return ret;
-                }
-        }
+        if (!dev->pseudo_netdev)
+                goto out3;
+
+        ret = register_netdev(dev->pseudo_netdev);
+        if (ret)
+                goto out2;
 
         pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
         strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@@ -848,21 +845,25 @@ int c2_register_device(struct c2_dev *dev)
 
         ret = ib_register_device(&dev->ibdev);
         if (ret)
-                return ret;
+                goto out1;
 
         for (i = 0; i < ARRAY_SIZE(c2_class_attributes); ++i) {
                 ret = class_device_create_file(&dev->ibdev.class_dev,
                                                c2_class_attributes[i]);
-                if (ret) {
-                        unregister_netdev(dev->pseudo_netdev);
-                        free_netdev(dev->pseudo_netdev);
-                        ib_unregister_device(&dev->ibdev);
-                        return ret;
-                }
+                if (ret)
+                        goto out0;
         }
+        goto out3;
 
-        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
-        return 0;
+out0:
+        ib_unregister_device(&dev->ibdev);
+out1:
+        unregister_netdev(dev->pseudo_netdev);
+out2:
+        free_netdev(dev->pseudo_netdev);
+out3:
+        pr_debug("%s:%u ret=%d\n", __FUNCTION__, __LINE__, ret);
+        return ret;
 }
 
 void c2_unregister_device(struct c2_dev *dev)
diff --git a/drivers/infiniband/hw/amso1100/c2_qp.c b/drivers/infiniband/hw/amso1100/c2_qp.c
index 5bcf697aa335..179d005ed4a5 100644
--- a/drivers/infiniband/hw/amso1100/c2_qp.c
+++ b/drivers/infiniband/hw/amso1100/c2_qp.c
@@ -564,6 +564,32 @@ int c2_alloc_qp(struct c2_dev *c2dev,
         return err;
 }
 
+static inline void c2_lock_cqs(struct c2_cq *send_cq, struct c2_cq *recv_cq)
+{
+        if (send_cq == recv_cq)
+                spin_lock_irq(&send_cq->lock);
+        else if (send_cq > recv_cq) {
+                spin_lock_irq(&send_cq->lock);
+                spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
+        } else {
+                spin_lock_irq(&recv_cq->lock);
+                spin_lock_nested(&send_cq->lock, SINGLE_DEPTH_NESTING);
+        }
+}
+
+static inline void c2_unlock_cqs(struct c2_cq *send_cq, struct c2_cq *recv_cq)
+{
+        if (send_cq == recv_cq)
+                spin_unlock_irq(&send_cq->lock);
+        else if (send_cq > recv_cq) {
+                spin_unlock(&recv_cq->lock);
+                spin_unlock_irq(&send_cq->lock);
+        } else {
+                spin_unlock(&send_cq->lock);
+                spin_unlock_irq(&recv_cq->lock);
+        }
+}
+
 void c2_free_qp(struct c2_dev *c2dev, struct c2_qp *qp)
 {
         struct c2_cq *send_cq;
@@ -576,15 +602,9 @@ void c2_free_qp(struct c2_dev *c2dev, struct c2_qp *qp)
          * Lock CQs here, so that CQ polling code can do QP lookup
          * without taking a lock.
          */
-        spin_lock_irq(&send_cq->lock);
-        if (send_cq != recv_cq)
-                spin_lock(&recv_cq->lock);
-
+        c2_lock_cqs(send_cq, recv_cq);
         c2_free_qpn(c2dev, qp->qpn);
-
-        if (send_cq != recv_cq)
-                spin_unlock(&recv_cq->lock);
-        spin_unlock_irq(&send_cq->lock);
+        c2_unlock_cqs(send_cq, recv_cq);
 
         /*
          * Destory qp in the rnic...
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index e37c5688c214..1687c511cb2f 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -150,15 +150,15 @@ static int c2_rnic_query(struct c2_dev *c2dev, struct ib_device_attr *props)
             (struct c2wr_rnic_query_rep *) (unsigned long) (vq_req->reply_msg);
         if (!reply)
                 err = -ENOMEM;
-
-        err = c2_errno(reply);
+        else
+                err = c2_errno(reply);
         if (err)
                 goto bail2;
 
         props->fw_ver =
                 ((u64)be32_to_cpu(reply->fw_ver_major) << 32) |
-                ((be32_to_cpu(reply->fw_ver_minor) && 0xFFFF) << 16) |
-                (be32_to_cpu(reply->fw_ver_patch) && 0xFFFF);
+                ((be32_to_cpu(reply->fw_ver_minor) & 0xFFFF) << 16) |
+                (be32_to_cpu(reply->fw_ver_patch) & 0xFFFF);
         memcpy(&props->sys_image_guid, c2dev->netdev->dev_addr, 6);
         props->max_mr_size         = 0xFFFFFFFF;
         props->page_size_cap       = ~(C2_MIN_PAGESIZE-1);
@@ -441,7 +441,7 @@ static int c2_rnic_close(struct c2_dev *c2dev)
  * involves initalizing the various limits and resouce pools that
  * comprise the RNIC instance.
  */
-int c2_rnic_init(struct c2_dev *c2dev)
+int __devinit c2_rnic_init(struct c2_dev *c2dev)
 {
         int err;
         u32 qsize, msgsize;
@@ -517,14 +517,12 @@ int c2_rnic_init(struct c2_dev *c2dev)
         /* Initialize the Verbs Reply Queue */
         qsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q1_QSIZE));
         msgsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q1_MSGSIZE));
-        q1_pages = kmalloc(qsize * msgsize, GFP_KERNEL);
+        q1_pages = dma_alloc_coherent(&c2dev->pcidev->dev, qsize * msgsize,
+                                      &c2dev->rep_vq.host_dma, GFP_KERNEL);
         if (!q1_pages) {
                 err = -ENOMEM;
                 goto bail1;
         }
-        c2dev->rep_vq.host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                                (void *)q1_pages, qsize * msgsize,
-                                                DMA_FROM_DEVICE);
         pci_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
         pr_debug("%s rep_vq va %p dma %llx\n", __FUNCTION__, q1_pages,
                  (unsigned long long) c2dev->rep_vq.host_dma);
@@ -540,17 +538,15 @@ int c2_rnic_init(struct c2_dev *c2dev)
         /* Initialize the Asynchronus Event Queue */
         qsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q2_QSIZE));
         msgsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q2_MSGSIZE));
-        q2_pages = kmalloc(qsize * msgsize, GFP_KERNEL);
+        q2_pages = dma_alloc_coherent(&c2dev->pcidev->dev, qsize * msgsize,
+                                      &c2dev->aeq.host_dma, GFP_KERNEL);
         if (!q2_pages) {
                 err = -ENOMEM;
                 goto bail2;
         }
-        c2dev->aeq.host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                                (void *)q2_pages, qsize * msgsize,
-                                                DMA_FROM_DEVICE);
         pci_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
-        pr_debug("%s aeq va %p dma %llx\n", __FUNCTION__, q1_pages,
-                 (unsigned long long) c2dev->rep_vq.host_dma);
+        pr_debug("%s aeq va %p dma %llx\n", __FUNCTION__, q2_pages,
+                 (unsigned long long) c2dev->aeq.host_dma);
         c2_mq_rep_init(&c2dev->aeq,
                        2,
                        qsize,
@@ -597,17 +593,13 @@ int c2_rnic_init(struct c2_dev *c2dev)
       bail4:
         vq_term(c2dev);
       bail3:
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->aeq, mapping),
-                         c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(q2_pages);
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->aeq.q_size * c2dev->aeq.msg_size,
+                          q2_pages, pci_unmap_addr(&c2dev->aeq, mapping));
       bail2:
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->rep_vq, mapping),
-                         c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(q1_pages);
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
+                          q1_pages, pci_unmap_addr(&c2dev->rep_vq, mapping));
       bail1:
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
       bail0:
@@ -619,7 +611,7 @@ int c2_rnic_init(struct c2_dev *c2dev)
 /*
  * Called by c2_remove to cleanup the RNIC resources.
  */
-void c2_rnic_term(struct c2_dev *c2dev)
+void __devexit c2_rnic_term(struct c2_dev *c2dev)
 {
 
         /* Close the open adapter instance */
@@ -640,19 +632,17 @@ void c2_rnic_term(struct c2_dev *c2dev)
         /* Free the verbs request allocator */
         vq_term(c2dev);
 
-        /* Unmap and free the asynchronus event queue */
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->aeq, mapping),
-                         c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(c2dev->aeq.msg_pool.host);
-
-        /* Unmap and free the verbs reply queue */
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->rep_vq, mapping),
-                         c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(c2dev->rep_vq.msg_pool.host);
+        /* Free the asynchronus event queue */
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->aeq.q_size * c2dev->aeq.msg_size,
+                          c2dev->aeq.msg_pool.host,
+                          pci_unmap_addr(&c2dev->aeq, mapping));
+
+        /* Free the verbs reply queue */
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
+                          c2dev->rep_vq.msg_pool.host,
+                          pci_unmap_addr(&c2dev->rep_vq, mapping));
 
         /* Free the MQ shared pointer pool */
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
diff --git a/drivers/infiniband/hw/amso1100/c2_vq.c b/drivers/infiniband/hw/amso1100/c2_vq.c
index 40caeb5f41b4..36620a22413c 100644
--- a/drivers/infiniband/hw/amso1100/c2_vq.c
+++ b/drivers/infiniband/hw/amso1100/c2_vq.c
@@ -164,7 +164,7 @@ void vq_req_put(struct c2_dev *c2dev, struct c2_vq_req *r)
  */
 void *vq_repbuf_alloc(struct c2_dev *c2dev)
 {
-        return kmem_cache_alloc(c2dev->host_msg_cache, SLAB_ATOMIC);
+        return kmem_cache_alloc(c2dev->host_msg_cache, GFP_ATOMIC);
 }
 
 /*
diff --git a/drivers/infiniband/hw/ehca/Kconfig b/drivers/infiniband/hw/ehca/Kconfig
index 922389b64394..727b10d89686 100644
--- a/drivers/infiniband/hw/ehca/Kconfig
+++ b/drivers/infiniband/hw/ehca/Kconfig
@@ -10,6 +10,7 @@ config INFINIBAND_EHCA
 config INFINIBAND_EHCA_SCALING
         bool "Scaling support (EXPERIMENTAL)"
         depends on IBMEBUS && INFINIBAND_EHCA && HOTPLUG_CPU && EXPERIMENTAL
+        default y
         ---help---
         eHCA scaling support schedules the CQ callbacks to different CPUs.
 
diff --git a/drivers/infiniband/hw/ehca/ehca_av.c b/drivers/infiniband/hw/ehca/ehca_av.c
index 3bac197f9014..0d6e2c4bb245 100644
--- a/drivers/infiniband/hw/ehca/ehca_av.c
+++ b/drivers/infiniband/hw/ehca/ehca_av.c
@@ -57,7 +57,7 @@ struct ib_ah *ehca_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
         struct ehca_shca *shca = container_of(pd->device, struct ehca_shca,
                                               ib_device);
 
-        av = kmem_cache_alloc(av_cache, SLAB_KERNEL);
+        av = kmem_cache_alloc(av_cache, GFP_KERNEL);
         if (!av) {
                 ehca_err(pd->device, "Out of memory pd=%p ah_attr=%p",
                          pd, ah_attr);
@@ -118,8 +118,7 @@ struct ib_ah *ehca_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
                 }
                 memcpy(&av->av.grh.word_1, &gid, sizeof(gid));
         }
-        /* for the time being we use a hard coded PMTU of 2048 Bytes */
-        av->av.pmtu = 4;
+        av->av.pmtu = EHCA_MAX_MTU;
 
         /* dgid comes in grh.word_3 */
         memcpy(&av->av.grh.word_3, &ah_attr->grh.dgid,
@@ -193,7 +192,7 @@ int ehca_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr)
                 memcpy(&new_ehca_av.grh.word_1, &gid, sizeof(gid));
         }
 
-        new_ehca_av.pmtu = 4; /* see also comment in create_ah() */
+        new_ehca_av.pmtu = EHCA_MAX_MTU;
 
         memcpy(&new_ehca_av.grh.word_3, &ah_attr->grh.dgid,
                sizeof(ah_attr->grh.dgid));
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 458fe19648a1..93995b658d94 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -134,7 +134,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe,
         if (cqe >= 0xFFFFFFFF - 64 - additional_cqe)
                 return ERR_PTR(-EINVAL);
 
-        my_cq = kmem_cache_alloc(cq_cache, SLAB_KERNEL);
+        my_cq = kmem_cache_alloc(cq_cache, GFP_KERNEL);
         if (!my_cq) {
                 ehca_err(device, "Out of memory for ehca_cq struct device=%p",
                          device);
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 5eae6ac48425..e1b618c5f685 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -40,6 +40,7 @@
  */
 
 #include "ehca_tools.h"
+#include "ehca_iverbs.h"
 #include "hcp_if.h"
 
 int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
@@ -49,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                               ib_device);
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -96,7 +97,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                 = min_t(int, rblock->max_total_mcast_qp_attach, INT_MAX);
 
 query_device1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -109,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                               ib_device);
         struct hipz_query_port *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -162,7 +163,7 @@ int ehca_query_port(struct ib_device *ibdev,
         props->active_speed    = 0x1;
 
 query_port1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -178,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                 return -EINVAL;
         }
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -193,7 +194,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
         memcpy(pkey, &rblock->pkey_entries + index, sizeof(u16));
 
 query_pkey1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -211,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                 return -EINVAL;
         }
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -227,7 +228,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
         memcpy(&gid->raw[8], &rblock->guid_entries[index], sizeof(u64));
 
 query_gid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 048cc443d1e7..c3ea746e9045 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -45,6 +45,7 @@
 #include "ehca_tools.h"
 #include "hcp_if.h"
 #include "hipz_fns.h"
+#include "ipz_pt_fn.h"
 
 #define EQE_COMPLETION_EVENT   EHCA_BMASK_IBM(1,1)
 #define EQE_CQ_QP_NUMBER       EHCA_BMASK_IBM(8,31)
@@ -137,38 +138,36 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
         u64 *rblock;
         unsigned long block_count;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                 ret = -ENOMEM;
                 goto error_data1;
         }
 
+        /* rblock must be 4K aligned and should be 4K large */
         ret = hipz_h_error_data(shca->ipz_hca_handle,
                                 resource,
                                 rblock,
                                 &block_count);
 
-        if (ret == H_R_STATE) {
+        if (ret == H_R_STATE)
                 ehca_err(&shca->ib_device,
                          "No error data is available: %lx.", resource);
-        }
         else if (ret == H_SUCCESS) {
                 int length;
 
                 length = EHCA_BMASK_GET(ERROR_DATA_LENGTH, rblock[0]);
 
-                if (length > PAGE_SIZE)
-                        length = PAGE_SIZE;
+                if (length > EHCA_PAGESIZE)
+                        length = EHCA_PAGESIZE;
 
                 print_error_data(shca, data, rblock, length);
-        }
-        else {
+        } else
                 ehca_err(&shca->ib_device,
                          "Error data could not be fetched: %lx", resource);
-        }
 
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
 error_data1:
         return ret;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 319c39d47f3a..3720e3032cce 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -179,4 +179,12 @@ int ehca_mmap_register(u64 physical,void **mapped,
 
 int ehca_munmap(unsigned long addr, size_t len);
 
+#ifdef CONFIG_PPC_64K_PAGES
+void *ehca_alloc_fw_ctrlblock(void);
+void ehca_free_fw_ctrlblock(void *ptr);
+#else
+#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
+#endif
+
 #endif
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index 024d511c4b58..cc47e4c13a18 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -40,6 +40,9 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifdef CONFIG_PPC_64K_PAGES
+#include <linux/slab.h>
+#endif
 #include "ehca_classes.h"
 #include "ehca_iverbs.h"
 #include "ehca_mrmw.h"
@@ -49,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0017");
+MODULE_VERSION("SVNEHCA_0019");
 
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -94,11 +97,31 @@ spinlock_t ehca_cq_idr_lock;
 DEFINE_IDR(ehca_qp_idr);
 DEFINE_IDR(ehca_cq_idr);
 
+
 static struct list_head shca_list; /* list of all registered ehcas */
 static spinlock_t shca_list_lock;
 
 static struct timer_list poll_eqs_timer;
 
+#ifdef CONFIG_PPC_64K_PAGES
+static struct kmem_cache *ctblk_cache = NULL;
+
+void *ehca_alloc_fw_ctrlblock(void)
+{
+        void *ret = kmem_cache_zalloc(ctblk_cache, GFP_KERNEL);
+        if (!ret)
+                ehca_gen_err("Out of memory for ctblk");
+        return ret;
+}
+
+void ehca_free_fw_ctrlblock(void *ptr)
+{
+        if (ptr)
+                kmem_cache_free(ctblk_cache, ptr);
+
+}
+#endif
+
 static int ehca_create_slab_caches(void)
 {
         int ret;
@@ -133,6 +156,17 @@ static int ehca_create_slab_caches(void)
                 goto create_slab_caches5;
         }
 
+#ifdef CONFIG_PPC_64K_PAGES
+        ctblk_cache = kmem_cache_create("ehca_cache_ctblk",
+                                        EHCA_PAGESIZE, H_CB_ALIGNMENT,
+                                        SLAB_HWCACHE_ALIGN,
+                                        NULL, NULL);
+        if (!ctblk_cache) {
+                ehca_gen_err("Cannot create ctblk SLAB cache.");
+                ehca_cleanup_mrmw_cache();
+                goto create_slab_caches5;
+        }
+#endif
         return 0;
 
 create_slab_caches5:
@@ -157,6 +191,10 @@ static void ehca_destroy_slab_caches(void)
         ehca_cleanup_qp_cache();
         ehca_cleanup_cq_cache();
         ehca_cleanup_pd_cache();
+#ifdef CONFIG_PPC_64K_PAGES
+        if (ctblk_cache)
+                kmem_cache_destroy(ctblk_cache);
+#endif
 }
 
 #define EHCA_HCAAVER  EHCA_BMASK_IBM(32,39)
@@ -168,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         u64 h_ret;
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_gen_err("Cannot allocate rblock memory.");
                 return -ENOMEM;
@@ -211,7 +249,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         shca->sport[1].rate = IB_RATE_30_GBPS;
 
 num_ports1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
         return ret;
 }
 
@@ -220,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
         int ret = 0;
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -235,7 +273,7 @@ static int init_node_guid(struct ehca_shca *shca)
         memcpy(&shca->ib_device.node_guid, &rblock->node_guid, sizeof(u64));
 
 init_node_guid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
         return ret;
 }
 
@@ -431,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         shca = dev->driver_data;                                           \
                                                                            \
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);                      \
+        rblock = ehca_alloc_fw_ctrlblock();                                \
         if (!rblock) {                                                     \
                 dev_err(dev, "Can't allocate rblock memory.");             \
                 return 0;                                                  \
@@ -439,12 +477,12 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         if (hipz_h_query_hca(shca->ipz_hca_handle, rblock) != H_SUCCESS) { \
                 dev_err(dev, "Can't query device properties");             \
-                kfree(rblock);                                             \
+                ehca_free_fw_ctrlblock(rblock);                            \
                 return 0;                                                  \
         }                                                                  \
                                                                            \
         data = rblock->name;                                               \
-        kfree(rblock);                                                     \
+        ehca_free_fw_ctrlblock(rblock);                                    \
                                                                            \
         if ((strcmp(#name, "num_ports") == 0) && (ehca_nr_ports == 1))     \
                 return snprintf(buf, 256, "1\n");                          \
@@ -752,7 +790,7 @@ int __init ehca_module_init(void)
         int ret;
 
         printk(KERN_INFO "eHCA Infiniband Device Driver "
-                         "(Rel.: SVNEHCA_0017)\n");
+                         "(Rel.: SVNEHCA_0019)\n");
         idr_init(&ehca_qp_idr);
         idr_init(&ehca_cq_idr);
         spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 5ca65441e1da..0a5e2214cc5f 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -53,7 +53,7 @@ static struct ehca_mr *ehca_mr_new(void)
 {
         struct ehca_mr *me;
 
-        me = kmem_cache_alloc(mr_cache, SLAB_KERNEL);
+        me = kmem_cache_alloc(mr_cache, GFP_KERNEL);
         if (me) {
                 memset(me, 0, sizeof(struct ehca_mr));
                 spin_lock_init(&me->mrlock);
@@ -72,7 +72,7 @@ static struct ehca_mw *ehca_mw_new(void)
 {
         struct ehca_mw *me;
 
-        me = kmem_cache_alloc(mw_cache, SLAB_KERNEL);
+        me = kmem_cache_alloc(mw_cache, GFP_KERNEL);
         if (me) {
                 memset(me, 0, sizeof(struct ehca_mw));
                 spin_lock_init(&me->mwlock);
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
         u32 i;
         u64 *kpage;
 
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1092,7 +1092,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
 
 
 ehca_reg_mr_rpages_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_reg_mr_rpages_exit0:
         if (ret)
                 ehca_err(&shca->ib_device, "ret=%x shca=%p e_mr=%p pginfo=%p "
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         ehca_mrmw_map_acl(acl, &hipz_acl);
         ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
 
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1181,7 +1181,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         }
 
 ehca_rereg_mr_rereg1_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_rereg_mr_rereg1_exit0:
         if ( ret && (ret != -EAGAIN) )
                 ehca_err(&shca->ib_device, "ret=%x lkey=%x rkey=%x "
diff --git a/drivers/infiniband/hw/ehca/ehca_pd.c b/drivers/infiniband/hw/ehca/ehca_pd.c
index 2c3cdc6f7b39..d5345e5b3cd6 100644
--- a/drivers/infiniband/hw/ehca/ehca_pd.c
+++ b/drivers/infiniband/hw/ehca/ehca_pd.c
@@ -50,7 +50,7 @@ struct ib_pd *ehca_alloc_pd(struct ib_device *device,
 {
         struct ehca_pd *pd;
 
-        pd = kmem_cache_alloc(pd_cache, SLAB_KERNEL);
+        pd = kmem_cache_alloc(pd_cache, GFP_KERNEL);
         if (!pd) {
                 ehca_err(device, "device=%p context=%p out of memory",
                          device, context);
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 4394123cdbd7..c6c9cef203e3 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -450,7 +450,7 @@ struct ib_qp *ehca_create_qp(struct ib_pd *pd,
         if (pd->uobject && udata)
                 context = pd->uobject->context;
 
-        my_qp = kmem_cache_alloc(qp_cache, SLAB_KERNEL);
+        my_qp = kmem_cache_alloc(qp_cache, GFP_KERNEL);
         if (!my_qp) {
                 ehca_err(pd->device, "pd=%p not enough memory to alloc qp", pd);
                 return ERR_PTR(-ENOMEM);
@@ -732,8 +732,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
         u64 h_ret;
         struct ipz_queue *squeue;
         void *bad_send_wqe_p, *bad_send_wqe_v;
-        void *squeue_start_p, *squeue_end_p;
-        void *squeue_start_v, *squeue_end_v;
+        u64 q_ofs;
         struct ehca_wqe *wqe;
         int qp_num = my_qp->ib_qp.qp_num;
 
@@ -755,26 +754,23 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
         if (ehca_debug_level)
                 ehca_dmp(bad_send_wqe_v, 32, "qp_num=%x bad_wqe", qp_num);
         squeue = &my_qp->ipz_squeue;
-        squeue_start_p = (void*)virt_to_abs(ipz_qeit_calc(squeue, 0L));
-        squeue_end_p = squeue_start_p+squeue->queue_length;
-        squeue_start_v = abs_to_virt((u64)squeue_start_p);
-        squeue_end_v = abs_to_virt((u64)squeue_end_p);
-        ehca_dbg(&shca->ib_device, "qp_num=%x squeue_start_v=%p squeue_end_v=%p",
-                 qp_num, squeue_start_v, squeue_end_v);
+        if (ipz_queue_abs_to_offset(squeue, (u64)bad_send_wqe_p, &q_ofs)) {
+                ehca_err(&shca->ib_device, "failed to get wqe offset qp_num=%x"
+                         " bad_send_wqe_p=%p", qp_num, bad_send_wqe_p);
+                return -EFAULT;
+        }
 
         /* loop sets wqe's purge bit */
-        wqe = (struct ehca_wqe*)bad_send_wqe_v;
+        wqe = (struct ehca_wqe*)ipz_qeit_calc(squeue, q_ofs);
         *bad_wqe_cnt = 0;
         while (wqe->optype != 0xff && wqe->wqef != 0xff) {
                 if (ehca_debug_level)
                         ehca_dmp(wqe, 32, "qp_num=%x wqe", qp_num);
                 wqe->nr_of_data_seg = 0; /* suppress data access */
                 wqe->wqef = WQEF_PURGE; /* WQE to be purged */
-                wqe = (struct ehca_wqe*)((u8*)wqe+squeue->qe_size);
+                q_ofs = ipz_queue_advance_offset(squeue, q_ofs);
+                wqe = (struct ehca_wqe*)ipz_qeit_calc(squeue, q_ofs);
                 *bad_wqe_cnt = (*bad_wqe_cnt)+1;
-                if ((void*)wqe >= squeue_end_v) {
-                        wqe = squeue_start_v;
-                }
         }
         /*
          * bad wqe will be reprocessed and ignored when pol_cq() is called,
@@ -811,8 +807,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
         unsigned long spl_flags = 0;
 
         /* do query_qp to obtain current attr values */
-        mqpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
-        if (mqpcb == NULL) {
+        mqpcb = ehca_alloc_fw_ctrlblock();
+        if (!mqpcb) {
                 ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                          "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
                 return -ENOMEM;
@@ -1225,7 +1221,7 @@ modify_qp_exit2:
         }
 
 modify_qp_exit1:
-        kfree(mqpcb);
+        ehca_free_fw_ctrlblock(mqpcb);
 
         return ret;
 }
@@ -1277,7 +1273,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 return -EINVAL;
         }
 
-        qpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL );
+        qpcb = ehca_alloc_fw_ctrlblock();
         if (!qpcb) {
                 ehca_err(qp->device,"Out of memory for qpcb "
                          "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
@@ -1401,7 +1397,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 
 query_qp_exit1:
-        kfree(qpcb);
+        ehca_free_fw_ctrlblock(qpcb);
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_tools.h b/drivers/infiniband/hw/ehca/ehca_tools.h
index 809da3ef706b..973c4b591545 100644
--- a/drivers/infiniband/hw/ehca/ehca_tools.h
+++ b/drivers/infiniband/hw/ehca/ehca_tools.h
@@ -63,6 +63,7 @@
 #include <asm/ibmebus.h>
 #include <asm/io.h>
 #include <asm/pgtable.h>
+#include <asm/hvcall.h>
 
 extern int ehca_debug_level;
 
diff --git a/drivers/infiniband/hw/ehca/hipz_hw.h b/drivers/infiniband/hw/ehca/hipz_hw.h
index 3fc92b031c50..fad91368dc5a 100644
--- a/drivers/infiniband/hw/ehca/hipz_hw.h
+++ b/drivers/infiniband/hw/ehca/hipz_hw.h
@@ -45,6 +45,8 @@
 
 #include "ehca_tools.h"
 
+#define EHCA_MAX_MTU 4
+
 /* QP Table Entry Memory Map */
 struct hipz_qptemm {
         u64 qpx_hcr;
diff --git a/drivers/infiniband/hw/ehca/ipz_pt_fn.c b/drivers/infiniband/hw/ehca/ipz_pt_fn.c
index e028ff1588cc..bf7a40088f61 100644
--- a/drivers/infiniband/hw/ehca/ipz_pt_fn.c
+++ b/drivers/infiniband/hw/ehca/ipz_pt_fn.c
@@ -70,6 +70,19 @@ void *ipz_qeit_eq_get_inc(struct ipz_queue *queue)
         return ret;
 }
 
+int ipz_queue_abs_to_offset(struct ipz_queue *queue, u64 addr, u64 *q_offset)
+{
+        int i;
+        for (i = 0; i < queue->queue_length / queue->pagesize; i++) {
+                u64 page = (u64)virt_to_abs(queue->queue_pages[i]);
+                if (addr >= page && addr < page + queue->pagesize) {
+                        *q_offset = addr - page + i * queue->pagesize;
+                        return 0;
+                }
+        }
+        return -EINVAL;
+}
+
 int ipz_queue_ctor(struct ipz_queue *queue,
                    const u32 nr_of_pages,
                    const u32 pagesize, const u32 qe_size, const u32 nr_of_sg)
diff --git a/drivers/infiniband/hw/ehca/ipz_pt_fn.h b/drivers/infiniband/hw/ehca/ipz_pt_fn.h
index 2f13509d5257..dc3bda2634b7 100644
--- a/drivers/infiniband/hw/ehca/ipz_pt_fn.h
+++ b/drivers/infiniband/hw/ehca/ipz_pt_fn.h
@@ -150,6 +150,21 @@ static inline void *ipz_qeit_reset(struct ipz_queue *queue)
         return ipz_qeit_get(queue);
 }
 
+/*
+ * return the q_offset corresponding to an absolute address
+ */
+int ipz_queue_abs_to_offset(struct ipz_queue *queue, u64 addr, u64 *q_offset);
+
+/*
+ * return the next queue offset. don't modify the queue.
+ */
+static inline u64 ipz_queue_advance_offset(struct ipz_queue *queue, u64 offset)
+{
+        offset += queue->qe_size;
+        if (offset >= queue->queue_length) offset = 0;
+        return offset;
+}
+
 /* struct generic page table */
 struct ipz_pt {
         u64 entries[EHCA_PT_ENTRIES];
diff --git a/drivers/infiniband/hw/ipath/Kconfig b/drivers/infiniband/hw/ipath/Kconfig
index 574a678e7fdd..90c14543677d 100644
--- a/drivers/infiniband/hw/ipath/Kconfig
+++ b/drivers/infiniband/hw/ipath/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_IPATH
         tristate "QLogic InfiniPath Driver"
-        depends on PCI_MSI && 64BIT && INFINIBAND
+        depends on (PCI_MSI || HT_IRQ) && 64BIT && INFINIBAND && NET
         ---help---
         This is a driver for QLogic InfiniPath host channel adapters,
         including InfiniBand verbs support.  This driver allows these
diff --git a/drivers/infiniband/hw/ipath/Makefile b/drivers/infiniband/hw/ipath/Makefile
index 5e29cb0095e5..7dc10551cf18 100644
--- a/drivers/infiniband/hw/ipath/Makefile
+++ b/drivers/infiniband/hw/ipath/Makefile
@@ -10,8 +10,6 @@ ib_ipath-y := \
         ipath_eeprom.o \
         ipath_file_ops.o \
         ipath_fs.o \
-        ipath_iba6110.o \
-        ipath_iba6120.o \
         ipath_init_chip.o \
         ipath_intr.o \
         ipath_keys.o \
@@ -31,5 +29,8 @@ ib_ipath-y := \
         ipath_verbs_mcast.o \
         ipath_verbs.o
 
+ib_ipath-$(CONFIG_HT_IRQ) += ipath_iba6110.o
+ib_ipath-$(CONFIG_PCI_MSI) += ipath_iba6120.o
+
 ib_ipath-$(CONFIG_X86_64) += ipath_wc_x86_64.o
 ib_ipath-$(CONFIG_PPC64) += ipath_wc_ppc64.o
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index 29958b6e0214..28c087b824c2 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -67,19 +67,54 @@ static struct file_operations diag_file_ops = {
         .release = ipath_diag_release
 };
 
+static ssize_t ipath_diagpkt_write(struct file *fp,
+                                   const char __user *data,
+                                   size_t count, loff_t *off);
+
+static struct file_operations diagpkt_file_ops = {
+        .owner = THIS_MODULE,
+        .write = ipath_diagpkt_write,
+};
+
+static atomic_t diagpkt_count = ATOMIC_INIT(0);
+static struct cdev *diagpkt_cdev;
+static struct class_device *diagpkt_class_dev;
+
 int ipath_diag_add(struct ipath_devdata *dd)
 {
         char name[16];
+        int ret = 0;
+
+        if (atomic_inc_return(&diagpkt_count) == 1) {
+                ret = ipath_cdev_init(IPATH_DIAGPKT_MINOR,
+                                      "ipath_diagpkt", &diagpkt_file_ops,
+                                      &diagpkt_cdev, &diagpkt_class_dev);
+
+                if (ret) {
+                        ipath_dev_err(dd, "Couldn't create ipath_diagpkt "
+                                      "device: %d", ret);
+                        goto done;
+                }
+        }
 
         snprintf(name, sizeof(name), "ipath_diag%d", dd->ipath_unit);
 
-        return ipath_cdev_init(IPATH_DIAG_MINOR_BASE + dd->ipath_unit, name,
-                               &diag_file_ops, &dd->diag_cdev,
-                               &dd->diag_class_dev);
+        ret = ipath_cdev_init(IPATH_DIAG_MINOR_BASE + dd->ipath_unit, name,
+                              &diag_file_ops, &dd->diag_cdev,
+                              &dd->diag_class_dev);
+        if (ret)
+                ipath_dev_err(dd, "Couldn't create %s device: %d",
+                              name, ret);
+
+done:
+        return ret;
 }
 
 void ipath_diag_remove(struct ipath_devdata *dd)
 {
+        if (atomic_dec_and_test(&diagpkt_count))
+                ipath_cdev_cleanup(&diagpkt_cdev, &diagpkt_class_dev);
+
         ipath_cdev_cleanup(&dd->diag_cdev, &dd->diag_class_dev);
 }
 
@@ -275,30 +310,6 @@ bail:
         return ret;
 }
 
-static ssize_t ipath_diagpkt_write(struct file *fp,
-                                   const char __user *data,
-                                   size_t count, loff_t *off);
-
-static struct file_operations diagpkt_file_ops = {
-        .owner = THIS_MODULE,
-        .write = ipath_diagpkt_write,
-};
-
-static struct cdev *diagpkt_cdev;
-static struct class_device *diagpkt_class_dev;
-
-int __init ipath_diagpkt_add(void)
-{
-        return ipath_cdev_init(IPATH_DIAGPKT_MINOR,
-                               "ipath_diagpkt", &diagpkt_file_ops,
-                               &diagpkt_cdev, &diagpkt_class_dev);
-}
-
-void __exit ipath_diagpkt_remove(void)
-{
-        ipath_cdev_cleanup(&diagpkt_cdev, &diagpkt_class_dev);
-}
-
 /**
  * ipath_diagpkt_write - write an IB packet
  * @fp: the diag data device file pointer
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 12cefa658f3b..1aeddb48e355 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -304,7 +304,7 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
         }
         addr = pci_resource_start(pdev, 0);
         len = pci_resource_len(pdev, 0);
-        ipath_cdbg(VERBOSE, "regbase (0) %llx len %d irq %x, vend %x/%x "
+        ipath_cdbg(VERBOSE, "regbase (0) %llx len %d pdev->irq %d, vend %x/%x "
                    "driver_data %lx\n", addr, len, pdev->irq, ent->vendor,
                    ent->device, ent->driver_data);
 
@@ -390,12 +390,16 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
 
         /* setup the chip-specific functions, as early as possible. */
         switch (ent->device) {
+#ifdef CONFIG_HT_IRQ
         case PCI_DEVICE_ID_INFINIPATH_HT:
                 ipath_init_iba6110_funcs(dd);
                 break;
+#endif
+#ifdef CONFIG_PCI_MSI
         case PCI_DEVICE_ID_INFINIPATH_PE800:
                 ipath_init_iba6120_funcs(dd);
                 break;
+#endif
         default:
                 ipath_dev_err(dd, "Found unknown QLogic deviceid 0x%x, "
                               "failing\n", ent->device);
@@ -467,15 +471,15 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
          * check 0 irq after we return from chip-specific bus setup, since
          * that can affect this due to setup
          */
-        if (!pdev->irq)
+        if (!dd->ipath_irq)
                 ipath_dev_err(dd, "irq is 0, BIOS error?  Interrupts won't "
                               "work\n");
         else {
-                ret = request_irq(pdev->irq, ipath_intr, IRQF_SHARED,
+                ret = request_irq(dd->ipath_irq, ipath_intr, IRQF_SHARED,
                                   IPATH_DRV_NAME, dd);
                 if (ret) {
                         ipath_dev_err(dd, "Couldn't setup irq handler, "
-                                      "irq=%u: %d\n", pdev->irq, ret);
+                                      "irq=%d: %d\n", dd->ipath_irq, ret);
                         goto bail_iounmap;
                 }
         }
@@ -637,11 +641,10 @@ static void __devexit ipath_remove_one(struct pci_dev *pdev)
          * free up port 0 (kernel) rcvhdr, egr bufs, and eventually tid bufs
          * for all versions of the driver, if they were allocated
          */
-        if (pdev->irq) {
-                ipath_cdbg(VERBOSE,
-                           "unit %u free_irq of irq %x\n",
-                           dd->ipath_unit, pdev->irq);
-                free_irq(pdev->irq, dd);
+        if (dd->ipath_irq) {
+                ipath_cdbg(VERBOSE, "unit %u free irq %d\n",
+                           dd->ipath_unit, dd->ipath_irq);
+                dd->ipath_f_free_irq(dd);
         } else
                 ipath_dbg("irq is 0, not doing free_irq "
                           "for unit %u\n", dd->ipath_unit);
@@ -2005,18 +2008,8 @@ static int __init infinipath_init(void)
                 goto bail_group;
         }
 
-        ret = ipath_diagpkt_add();
-        if (ret < 0) {
-                printk(KERN_ERR IPATH_DRV_NAME ": Unable to create "
-                       "diag data device: error %d\n", -ret);
-                goto bail_ipathfs;
-        }
-
         goto bail;
 
-bail_ipathfs:
-        ipath_exit_ipathfs();
-
 bail_group:
         ipath_driver_remove_group(&ipath_driver.driver);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index a9ddc6911f66..340f27e3ebff 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -1745,9 +1745,9 @@ static int ipath_assign_port(struct file *fp,
                 goto done;
         }
 
-        i_minor = iminor(fp->f_dentry->d_inode) - IPATH_USER_MINOR_BASE;
+        i_minor = iminor(fp->f_path.dentry->d_inode) - IPATH_USER_MINOR_BASE;
         ipath_cdbg(VERBOSE, "open on dev %lx (minor %d)\n",
-                   (long)fp->f_dentry->d_inode->i_rdev, i_minor);
+                   (long)fp->f_path.dentry->d_inode->i_rdev, i_minor);
 
         if (i_minor)
                 ret = find_free_port(i_minor - 1, fp, uinfo);
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index d9ff283f725e..79a60f020a21 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -118,7 +118,7 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
         u16 i;
         struct ipath_devdata *dd;
 
-        dd = file->f_dentry->d_inode->i_private;
+        dd = file->f_path.dentry->d_inode->i_private;
 
         for (i = 0; i < NUM_COUNTERS; i++)
                 counters[i] = ipath_snap_cntr(dd, i);
@@ -138,7 +138,7 @@ static ssize_t atomic_node_info_read(struct file *file, char __user *buf,
         struct ipath_devdata *dd;
         u64 guid;
 
-        dd = file->f_dentry->d_inode->i_private;
+        dd = file->f_path.dentry->d_inode->i_private;
 
         guid = be64_to_cpu(dd->ipath_guid);
 
@@ -177,7 +177,7 @@ static ssize_t atomic_port_info_read(struct file *file, char __user *buf,
         u32 tmp, tmp2;
         struct ipath_devdata *dd;
 
-        dd = file->f_dentry->d_inode->i_private;
+        dd = file->f_path.dentry->d_inode->i_private;
 
         /* so we only initialize non-zero fields. */
         memset(portinfo, 0, sizeof portinfo);
@@ -324,7 +324,7 @@ static ssize_t flash_read(struct file *file, char __user *buf,
                 goto bail;
         }
 
-        dd = file->f_dentry->d_inode->i_private;
+        dd = file->f_path.dentry->d_inode->i_private;
         if (ipath_eeprom_read(dd, pos, tmp, count)) {
                 ipath_dev_err(dd, "failed to read from flash\n");
                 ret = -ENXIO;
@@ -377,7 +377,7 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
                 goto bail_tmp;
         }
 
-        dd = file->f_dentry->d_inode->i_private;
+        dd = file->f_path.dentry->d_inode->i_private;
         if (ipath_eeprom_write(dd, pos, tmp, count)) {
                 ret = -ENXIO;
                 ipath_dev_err(dd, "failed to write to flash\n");
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6110.c b/drivers/infiniband/hw/ipath/ipath_iba6110.c
index 9e4e8d4c6e20..e57c7a351cb5 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6110.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6110.c
@@ -38,6 +38,7 @@
 
 #include <linux/pci.h>
 #include <linux/delay.h>
+#include <linux/htirq.h>
 
 #include "ipath_kernel.h"
 #include "ipath_registers.h"
@@ -913,49 +914,40 @@ static void slave_or_pri_blk(struct ipath_devdata *dd, struct pci_dev *pdev,
         }
 }
 
-static int set_int_handler(struct ipath_devdata *dd, struct pci_dev *pdev,
-                            int pos)
+static int ipath_ht_intconfig(struct ipath_devdata *dd)
 {
-        u32 int_handler_addr_lower;
-        u32 int_handler_addr_upper;
-        u64 ihandler;
-        u32 intvec;
+        int ret;
 
-        /* use indirection register to get the intr handler */
-        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x10);
-        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_lower);
-        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x11);
-        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_upper);
+        if (dd->ipath_intconfig) {
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_interruptconfig,
+                                 dd->ipath_intconfig);  /* interrupt address */
+                ret = 0;
+        } else {
+                ipath_dev_err(dd, "No interrupts enabled, couldn't setup "
+                              "interrupt address\n");
+                ret = -EINVAL;
+        }
 
-        ihandler = (u64) int_handler_addr_lower |
-                ((u64) int_handler_addr_upper << 32);
+        return ret;
+}
+
+static void ipath_ht_irq_update(struct pci_dev *dev, int irq,
+                                struct ht_irq_msg *msg)
+{
+        struct ipath_devdata *dd = pci_get_drvdata(dev);
+        u64 prev_intconfig = dd->ipath_intconfig;
+
+        dd->ipath_intconfig = msg->address_lo;
+        dd->ipath_intconfig |= ((u64) msg->address_hi) << 32;
 
         /*
-         * kernels with CONFIG_PCI_MSI set the vector in the irq field of
-         * struct pci_device, so we use that to program the internal
-         * interrupt register (not config space) with that value. The BIOS
-         * must still have done the basic MSI setup.
-         */
-        intvec = pdev->irq;
-        /*
-         * clear any vector bits there; normally not set but we'll overload
-         * this for some debug purposes (setting the HTC debug register
-         * value from software, rather than GPIOs), so it might be set on a
-         * driver reload.
+         * If the previous value of dd->ipath_intconfig is zero, we're
+         * getting configured for the first time, and must not program the
+         * intconfig register here (it will be programmed later, when the
+         * hardware is ready).  Otherwise, we should.
          */
-        ihandler &= ~0xff0000;
-        /* x86 vector goes in intrinfo[23:16] */
-        ihandler |= intvec << 16;
-        ipath_cdbg(VERBOSE, "ihandler lower %x, upper %x, intvec %x, "
-                   "interruptconfig %llx\n", int_handler_addr_lower,
-                   int_handler_addr_upper, intvec,
-                   (unsigned long long) ihandler);
-
-        /* can't program yet, so save for interrupt setup */
-        dd->ipath_intconfig = ihandler;
-        /* keep going, so we find link control stuff also */
-
-        return ihandler != 0;
+        if (prev_intconfig)
+                ipath_ht_intconfig(dd);
 }
 
 /**
@@ -971,12 +963,19 @@ static int set_int_handler(struct ipath_devdata *dd, struct pci_dev *pdev,
 static int ipath_setup_ht_config(struct ipath_devdata *dd,
                                  struct pci_dev *pdev)
 {
-        int pos, ret = 0;
-        int ihandler = 0;
+        int pos, ret;
+
+        ret = __ht_create_irq(pdev, 0, ipath_ht_irq_update);
+        if (ret < 0) {
+                ipath_dev_err(dd, "Couldn't create interrupt handler: "
+                              "err %d\n", ret);
+                goto bail;
+        }
+        dd->ipath_irq = ret;
+        ret = 0;
 
         /*
-         * Read the capability info to find the interrupt info, and also
-         * handle clearing CRC errors in linkctrl register if necessary.  We
+         * Handle clearing CRC errors in linkctrl register if necessary.  We
          * do this early, before we ever enable errors or hardware errors,
          * mostly to avoid causing the chip to enter freeze mode.
          */
@@ -1000,17 +999,9 @@ static int ipath_setup_ht_config(struct ipath_devdata *dd,
                 }
                 if (!(cap_type & 0xE0))
                         slave_or_pri_blk(dd, pdev, pos, cap_type);
-                else if (cap_type == HT_INTR_DISC_CONFIG)
-                        ihandler = set_int_handler(dd, pdev, pos);
         } while ((pos = pci_find_next_capability(pdev, pos,
                                                  PCI_CAP_ID_HT)));
 
-        if (!ihandler) {
-                ipath_dev_err(dd, "Couldn't find interrupt handler in "
-                              "config space\n");
-                ret = -ENODEV;
-        }
-
 bail:
         return ret;
 }
@@ -1360,25 +1351,6 @@ static void ipath_ht_quiet_serdes(struct ipath_devdata *dd)
         ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
 }
 
-static int ipath_ht_intconfig(struct ipath_devdata *dd)
-{
-        int ret;
-
-        if (!dd->ipath_intconfig) {
-                ipath_dev_err(dd, "No interrupts enabled, couldn't setup "
-                              "interrupt address\n");
-                ret = 1;
-                goto bail;
-        }
-
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_interruptconfig,
-                         dd->ipath_intconfig);  /* interrupt address */
-        ret = 0;
-
-bail:
-        return ret;
-}
-
 /**
  * ipath_pe_put_tid - write a TID in chip
  * @dd: the infinipath device
@@ -1575,6 +1547,14 @@ static int ipath_ht_get_base_info(struct ipath_portdata *pd, void *kbase)
         return 0;
 }
 
+static void ipath_ht_free_irq(struct ipath_devdata *dd)
+{
+        free_irq(dd->ipath_irq, dd);
+        ht_destroy_irq(dd->ipath_irq);
+        dd->ipath_irq = 0;
+        dd->ipath_intconfig = 0;
+}
+
 /**
  * ipath_init_iba6110_funcs - set up the chip-specific function pointers
  * @dd: the infinipath device
@@ -1598,6 +1578,7 @@ void ipath_init_iba6110_funcs(struct ipath_devdata *dd)
         dd->ipath_f_cleanup = ipath_setup_ht_cleanup;
         dd->ipath_f_setextled = ipath_setup_ht_setextled;
         dd->ipath_f_get_base_info = ipath_ht_get_base_info;
+        dd->ipath_f_free_irq = ipath_ht_free_irq;
 
         /*
          * initialize chip-specific variables
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6120.c b/drivers/infiniband/hw/ipath/ipath_iba6120.c
index a72ab9de386a..6af89683f710 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6120.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6120.c
@@ -851,6 +851,7 @@ static int ipath_setup_pe_config(struct ipath_devdata *dd,
         int pos, ret;
 
         dd->ipath_msi_lo = 0;   /* used as a flag during reset processing */
+        dd->ipath_irq = pdev->irq;
         ret = pci_enable_msi(dd->pcidev);
         if (ret)
                 ipath_dev_err(dd, "pci_enable_msi failed: %d, "
@@ -1323,6 +1324,12 @@ done:
         return 0;
 }
 
+static void ipath_pe_free_irq(struct ipath_devdata *dd)
+{
+        free_irq(dd->ipath_irq, dd);
+        dd->ipath_irq = 0;
+}
+
 /**
  * ipath_init_iba6120_funcs - set up the chip-specific function pointers
  * @dd: the infinipath device
@@ -1349,6 +1356,7 @@ void ipath_init_iba6120_funcs(struct ipath_devdata *dd)
         dd->ipath_f_cleanup = ipath_setup_pe_cleanup;
         dd->ipath_f_setextled = ipath_setup_pe_setextled;
         dd->ipath_f_get_base_info = ipath_pe_get_base_info;
+        dd->ipath_f_free_irq = ipath_pe_free_irq;
 
         /* initialize chip-specific variables */
         dd->ipath_f_tidtemplate = ipath_pe_tidtemplate;
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index d9079ee12030..5652a550d442 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -710,14 +710,14 @@ static void ipath_bad_intr(struct ipath_devdata *dd, u32 * unexpectp)
                          * linuxbios development work, and it may happen in
                          * the future again.
                          */
-                        if (dd->pcidev && dd->pcidev->irq) {
+                        if (dd->pcidev && dd->ipath_irq) {
                                 ipath_dev_err(dd, "Now %u unexpected "
                                               "interrupts, unregistering "
                                               "interrupt handler\n",
                                               *unexpectp);
-                                ipath_dbg("free_irq of irq %x\n",
-                                          dd->pcidev->irq);
-                                free_irq(dd->pcidev->irq, dd);
+                                ipath_dbg("free_irq of irq %d\n",
+                                          dd->ipath_irq);
+                                dd->ipath_f_free_irq(dd);
                         }
                 }
                 if (ipath_read_kreg32(dd, dd->ipath_kregs->kr_intmask)) {
@@ -753,7 +753,7 @@ static void ipath_bad_regread(struct ipath_devdata *dd)
                 if (allbits == 2) {
                         ipath_dev_err(dd, "Still bad interrupt status, "
                                       "unregistering interrupt\n");
-                        free_irq(dd->pcidev->irq, dd);
+                        dd->ipath_f_free_irq(dd);
                 } else if (allbits > 2) {
                         if ((allbits % 10000) == 0)
                                 printk(".");
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 7c436697d0e4..986b2125b8f5 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -213,6 +213,8 @@ struct ipath_devdata {
         void (*ipath_f_setextled)(struct ipath_devdata *, u64, u64);
         /* fill out chip-specific fields */
         int (*ipath_f_get_base_info)(struct ipath_portdata *, void *);
+        /* free irq */
+        void (*ipath_f_free_irq)(struct ipath_devdata *);
         struct ipath_ibdev *verbs_dev;
         struct timer_list verbs_timer;
         /* total dwords sent (summed from counter) */
@@ -328,6 +330,8 @@ struct ipath_devdata {
         /* so we can rewrite it after a chip reset */
         u32 ipath_pcibar1;
 
+        /* interrupt number */
+        int ipath_irq;
         /* HT/PCI Vendor ID (here for NodeInfo) */
         u16 ipath_vendorid;
         /* HT/PCI Device ID (here for NodeInfo) */
@@ -869,9 +873,6 @@ int ipath_device_create_group(struct device *, struct ipath_devdata *);
 void ipath_device_remove_group(struct device *, struct ipath_devdata *);
 int ipath_expose_reset(struct device *);
 
-int ipath_diagpkt_add(void);
-void ipath_diagpkt_remove(void);
-
 int ipath_init_ipathfs(void);
 void ipath_exit_ipathfs(void);
 int ipathfs_add_device(struct ipath_devdata *);
diff --git a/drivers/infiniband/hw/ipath/ipath_user_pages.c b/drivers/infiniband/hw/ipath/ipath_user_pages.c
index 413754b1d8a2..8536aeb96af8 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_pages.c
+++ b/drivers/infiniband/hw/ipath/ipath_user_pages.c
@@ -214,9 +214,10 @@ struct ipath_user_pages_work {
         unsigned long num_pages;
 };
 
-static void user_pages_account(void *ptr)
+static void user_pages_account(struct work_struct *_work)
 {
-        struct ipath_user_pages_work *work = ptr;
+        struct ipath_user_pages_work *work =
+                container_of(_work, struct ipath_user_pages_work, work);
 
         down_write(&work->mm->mmap_sem);
         work->mm->locked_vm -= work->num_pages;
@@ -242,7 +243,7 @@ void ipath_release_user_pages_on_close(struct page **p, size_t num_pages)
 
         goto bail;
 
-        INIT_WORK(&work->work, user_pages_account, work);
+        INIT_WORK(&work->work, user_pages_account);
         work->mm = mm;
         work->num_pages = num_pages;
 
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index a5456108dbad..acdee33ee1f8 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -1487,7 +1487,7 @@ int ipath_register_ib_device(struct ipath_devdata *dd)
         idev->pma_counter_select[1] = IB_PMA_PORT_RCV_DATA;
         idev->pma_counter_select[2] = IB_PMA_PORT_XMIT_PKTS;
         idev->pma_counter_select[3] = IB_PMA_PORT_RCV_PKTS;
-        idev->pma_counter_select[5] = IB_PMA_PORT_XMIT_WAIT;
+        idev->pma_counter_select[4] = IB_PMA_PORT_XMIT_WAIT;
         idev->link_width_enabled = 3;   /* 1x or 4x */
 
         /* Snapshot current HW counters to "clear" them. */
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index 69599455aca2..27caf3b0648a 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -33,7 +33,6 @@
  * $Id: mthca_av.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 
@@ -190,7 +189,7 @@ int mthca_create_ah(struct mthca_dev *dev,
 on_hca_fail:
         if (ah->type == MTHCA_AH_PCI_POOL) {
                 ah->av = pci_pool_alloc(dev->av_table.pool,
-                                        SLAB_ATOMIC, &ah->avdma);
+                                        GFP_ATOMIC, &ah->avdma);
                 if (!ah->av)
                         return -ENOMEM;
 
@@ -323,7 +322,7 @@ int mthca_ah_query(struct ib_ah *ibah, struct ib_ah_attr *attr)
         return 0;
 }
 
-int __devinit mthca_init_av_table(struct mthca_dev *dev)
+int mthca_init_av_table(struct mthca_dev *dev)
 {
         int err;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c
index cd044ea2dfa4..e948158a28d9 100644
--- a/drivers/infiniband/hw/mthca/mthca_catas.c
+++ b/drivers/infiniband/hw/mthca/mthca_catas.c
@@ -57,7 +57,7 @@ static int catas_reset_disable;
 module_param_named(catas_reset_disable, catas_reset_disable, int, 0644);
 MODULE_PARM_DESC(catas_reset_disable, "disable reset on catastrophic event if nonzero");
 
-static void catas_reset(void *work_ptr)
+static void catas_reset(struct work_struct *work)
 {
         struct mthca_dev *dev, *tmpdev;
         LIST_HEAD(tlist);
@@ -203,7 +203,7 @@ void mthca_stop_catas_poll(struct mthca_dev *dev)
 
 int __init mthca_catas_init(void)
 {
-        INIT_WORK(&catas_work, catas_reset, NULL);
+        INIT_WORK(&catas_work, catas_reset);
 
         catas_wq = create_singlethread_workqueue("mthca_catas");
         if (!catas_wq)
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 99a94d710935..768df7265b81 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -1820,11 +1820,11 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
 
 #define MAD_IFC_BOX_SIZE      0x400
 #define MAD_IFC_MY_QPN_OFFSET 0x100
-#define MAD_IFC_RQPN_OFFSET   0x104
-#define MAD_IFC_SL_OFFSET     0x108
-#define MAD_IFC_G_PATH_OFFSET 0x109
-#define MAD_IFC_RLID_OFFSET   0x10a
-#define MAD_IFC_PKEY_OFFSET   0x10e
+#define MAD_IFC_RQPN_OFFSET   0x108
+#define MAD_IFC_SL_OFFSET     0x10c
+#define MAD_IFC_G_PATH_OFFSET 0x10d
+#define MAD_IFC_RLID_OFFSET   0x10e
+#define MAD_IFC_PKEY_OFFSET   0x112
 #define MAD_IFC_GRH_OFFSET    0x140
 
         inmailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
@@ -1862,7 +1862,7 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
 
                 val = in_wc->dlid_path_bits |
                         (in_wc->wc_flags & IB_WC_GRH ? 0x80 : 0);
-                MTHCA_PUT(inbox, val,               MAD_IFC_GRH_OFFSET);
+                MTHCA_PUT(inbox, val,               MAD_IFC_G_PATH_OFFSET);
 
                 MTHCA_PUT(inbox, in_wc->slid,       MAD_IFC_RLID_OFFSET);
                 MTHCA_PUT(inbox, in_wc->pkey_index, MAD_IFC_PKEY_OFFSET);
@@ -1870,7 +1870,7 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
                 if (in_grh)
                         memcpy(inbox + MAD_IFC_GRH_OFFSET, in_grh, 40);
 
-                op_modifier |= 0x10;
+                op_modifier |= 0x4;
 
                 in_modifier |= in_wc->slid << 16;
         }
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index e393681ba7d4..283d50b76c3d 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -36,9 +36,10 @@
  * $Id: mthca_cq.c 1369 2004-12-20 16:17:07Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/hardirq.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_pack.h>
 
 #include "mthca_dev.h"
@@ -210,6 +211,11 @@ static inline void update_cons_index(struct mthca_dev *dev, struct mthca_cq *cq,
                 mthca_write64(doorbell,
                               dev->kar + MTHCA_CQ_DOORBELL,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+                /*
+                 * Make sure doorbells don't leak out of CQ spinlock
+                 * and reach the HCA out of order:
+                 */
+                mmiowb();
         }
 }
 
@@ -963,7 +969,7 @@ void mthca_free_cq(struct mthca_dev *dev,
         mthca_free_mailbox(dev, mailbox);
 }
 
-int __devinit mthca_init_cq_table(struct mthca_dev *dev)
+int mthca_init_cq_table(struct mthca_dev *dev)
 {
         int err;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index e284e0613a94..8ec9fa1ff9ea 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -33,7 +33,6 @@
  * $Id: mthca_eq.c 1382 2004-12-24 02:21:02Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
@@ -479,10 +478,10 @@ static irqreturn_t mthca_arbel_msi_x_interrupt(int irq, void *eq_ptr)
         return IRQ_HANDLED;
 }
 
-static int __devinit mthca_create_eq(struct mthca_dev *dev,
-                                     int nent,
-                                     u8 intr,
-                                     struct mthca_eq *eq)
+static int mthca_create_eq(struct mthca_dev *dev,
+                           int nent,
+                           u8 intr,
+                           struct mthca_eq *eq)
 {
         int npages;
         u64 *dma_list = NULL;
@@ -664,9 +663,9 @@ static void mthca_free_irqs(struct mthca_dev *dev)
                                  dev->eq_table.eq + i);
 }
 
-static int __devinit mthca_map_reg(struct mthca_dev *dev,
-                                   unsigned long offset, unsigned long size,
-                                   void __iomem **map)
+static int mthca_map_reg(struct mthca_dev *dev,
+                         unsigned long offset, unsigned long size,
+                         void __iomem **map)
 {
         unsigned long base = pci_resource_start(dev->pdev, 0);
 
@@ -691,7 +690,7 @@ static void mthca_unmap_reg(struct mthca_dev *dev, unsigned long offset,
         iounmap(map);
 }
 
-static int __devinit mthca_map_eq_regs(struct mthca_dev *dev)
+static int mthca_map_eq_regs(struct mthca_dev *dev)
 {
         if (mthca_is_memfree(dev)) {
                 /*
@@ -781,7 +780,7 @@ static void mthca_unmap_eq_regs(struct mthca_dev *dev)
         }
 }
 
-int __devinit mthca_map_eq_icm(struct mthca_dev *dev, u64 icm_virt)
+int mthca_map_eq_icm(struct mthca_dev *dev, u64 icm_virt)
 {
         int ret;
         u8 status;
@@ -825,7 +824,7 @@ void mthca_unmap_eq_icm(struct mthca_dev *dev)
         __free_page(dev->eq_table.icm_page);
 }
 
-int __devinit mthca_init_eq_table(struct mthca_dev *dev)
+int mthca_init_eq_table(struct mthca_dev *dev)
 {
         int err;
         u8 status;
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 45e106f14807..acfa41d968ee 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -317,7 +317,7 @@ err:
         return ret;
 }
 
-void __devexit mthca_free_agents(struct mthca_dev *dev)
+void mthca_free_agents(struct mthca_dev *dev)
 {
         struct ib_mad_agent *agent;
         int p, q;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 47ea02148368..0491ec7a7c0a 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -98,7 +98,7 @@ static struct mthca_profile default_profile = {
         .uarc_size         = 1 << 18,   /* Arbel only */
 };
 
-static int __devinit mthca_tune_pci(struct mthca_dev *mdev)
+static int mthca_tune_pci(struct mthca_dev *mdev)
 {
         int cap;
         u16 val;
@@ -143,7 +143,7 @@ static int __devinit mthca_tune_pci(struct mthca_dev *mdev)
         return 0;
 }
 
-static int __devinit mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim *dev_lim)
+static int mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim *dev_lim)
 {
         int err;
         u8 status;
@@ -255,7 +255,7 @@ static int __devinit mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim
         return 0;
 }
 
-static int __devinit mthca_init_tavor(struct mthca_dev *mdev)
+static int mthca_init_tavor(struct mthca_dev *mdev)
 {
         u8 status;
         int err;
@@ -333,7 +333,7 @@ err_disable:
         return err;
 }
 
-static int __devinit mthca_load_fw(struct mthca_dev *mdev)
+static int mthca_load_fw(struct mthca_dev *mdev)
 {
         u8 status;
         int err;
@@ -379,10 +379,10 @@ err_free:
         return err;
 }
 
-static int __devinit mthca_init_icm(struct mthca_dev *mdev,
-                                    struct mthca_dev_lim *dev_lim,
-                                    struct mthca_init_hca_param *init_hca,
-                                    u64 icm_size)
+static int mthca_init_icm(struct mthca_dev *mdev,
+                          struct mthca_dev_lim *dev_lim,
+                          struct mthca_init_hca_param *init_hca,
+                          u64 icm_size)
 {
         u64 aux_pages;
         u8 status;
@@ -575,7 +575,7 @@ static void mthca_free_icms(struct mthca_dev *mdev)
         mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
 }
 
-static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
+static int mthca_init_arbel(struct mthca_dev *mdev)
 {
         struct mthca_dev_lim        dev_lim;
         struct mthca_profile        profile;
@@ -683,7 +683,7 @@ static void mthca_close_hca(struct mthca_dev *mdev)
                 mthca_SYS_DIS(mdev, &status);
 }
 
-static int __devinit mthca_init_hca(struct mthca_dev *mdev)
+static int mthca_init_hca(struct mthca_dev *mdev)
 {
         u8 status;
         int err;
@@ -720,7 +720,7 @@ err_close:
         return err;
 }
 
-static int __devinit mthca_setup_hca(struct mthca_dev *dev)
+static int mthca_setup_hca(struct mthca_dev *dev)
 {
         int err;
         u8 status;
@@ -875,8 +875,7 @@ err_uar_table_free:
         return err;
 }
 
-static int __devinit mthca_request_regions(struct pci_dev *pdev,
-                                           int ddr_hidden)
+static int mthca_request_regions(struct pci_dev *pdev, int ddr_hidden)
 {
         int err;
 
@@ -928,7 +927,7 @@ static void mthca_release_regions(struct pci_dev *pdev,
                            MTHCA_HCR_SIZE);
 }
 
-static int __devinit mthca_enable_msi_x(struct mthca_dev *mdev)
+static int mthca_enable_msi_x(struct mthca_dev *mdev)
 {
         struct msix_entry entries[3];
         int err;
@@ -1213,7 +1212,7 @@ int __mthca_restart_one(struct pci_dev *pdev)
 }
 
 static int __devinit mthca_init_one(struct pci_dev *pdev,
-                             const struct pci_device_id *id)
+                                    const struct pci_device_id *id)
 {
         static int mthca_version_printed = 0;
         int ret;
diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index 47ca8a9b7247..a8ad072be074 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -32,7 +32,6 @@
  * $Id: mthca_mcg.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 
@@ -371,7 +370,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
         return err;
 }
 
-int __devinit mthca_init_mcg_table(struct mthca_dev *dev)
+int mthca_init_mcg_table(struct mthca_dev *dev)
 {
         int err;
         int table_size = dev->limits.num_mgms + dev->limits.num_amgms;
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index a486dec1707e..f71ffa88db3a 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -34,7 +34,6 @@
  */
 
 #include <linux/slab.h>
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include "mthca_dev.h"
@@ -135,7 +134,7 @@ static void mthca_buddy_free(struct mthca_buddy *buddy, u32 seg, int order)
         spin_unlock(&buddy->lock);
 }
 
-static int __devinit mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
+static int mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
 {
         int i, s;
 
@@ -759,7 +758,7 @@ void mthca_arbel_fmr_unmap(struct mthca_dev *dev, struct mthca_fmr *fmr)
         *(u8 *) fmr->mem.arbel.mpt = MTHCA_MPT_STATUS_SW;
 }
 
-int __devinit mthca_init_mr_table(struct mthca_dev *dev)
+int mthca_init_mr_table(struct mthca_dev *dev)
 {
         unsigned long addr;
         int err, i;
diff --git a/drivers/infiniband/hw/mthca/mthca_pd.c b/drivers/infiniband/hw/mthca/mthca_pd.c
index 59df51614c85..c1e950764bd8 100644
--- a/drivers/infiniband/hw/mthca/mthca_pd.c
+++ b/drivers/infiniband/hw/mthca/mthca_pd.c
@@ -34,7 +34,6 @@
  * $Id: mthca_pd.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include "mthca_dev.h"
@@ -69,7 +68,7 @@ void mthca_pd_free(struct mthca_dev *dev, struct mthca_pd *pd)
         mthca_free(&dev->pd_table.alloc, pd->pd_num);
 }
 
-int __devinit mthca_init_pd_table(struct mthca_dev *dev)
+int mthca_init_pd_table(struct mthca_dev *dev)
 {
         return mthca_alloc_init(&dev->pd_table.alloc,
                                 dev->limits.num_pds,
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index fc67f780581b..7ec7c4b937f9 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -124,7 +124,7 @@ static int mthca_query_device(struct ib_device *ibdev,
                 props->max_map_per_fmr = 255;
         else
                 props->max_map_per_fmr =
-                        (1 << (32 - long_log2(mdev->limits.num_mpts))) - 1;
+                        (1 << (32 - ilog2(mdev->limits.num_mpts))) - 1;
 
         err = 0;
  out:
@@ -816,7 +816,7 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda
                 lkey = ucmd.lkey;
         }
 
-        ret = mthca_RESIZE_CQ(dev, cq->cqn, lkey, long_log2(entries), &status);
+        ret = mthca_RESIZE_CQ(dev, cq->cqn, lkey, ilog2(entries), &status);
         if (status)
                 ret = -EINVAL;
 
@@ -1100,11 +1100,10 @@ static struct ib_fmr *mthca_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
         struct mthca_fmr *fmr;
         int err;
 
-        fmr = kmalloc(sizeof *fmr, GFP_KERNEL);
+        fmr = kmemdup(fmr_attr, sizeof *fmr, GFP_KERNEL);
         if (!fmr)
                 return ERR_PTR(-ENOMEM);
 
-        memcpy(&fmr->attr, fmr_attr, sizeof *fmr_attr);
         err = mthca_fmr_alloc(to_mdev(pd->device), to_mpd(pd)->pd_num,
                              convert_access(mr_access_flags), fmr);
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 5e5c58b9920b..d844a2569b47 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -35,10 +35,11 @@
  * $Id: mthca_qp.c 1355 2004-12-17 15:23:43Z roland $
  */
 
-#include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
@@ -635,11 +636,11 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
 
         if (mthca_is_memfree(dev)) {
                 if (qp->rq.max)
-                        qp_context->rq_size_stride = long_log2(qp->rq.max) << 3;
+                        qp_context->rq_size_stride = ilog2(qp->rq.max) << 3;
                 qp_context->rq_size_stride |= qp->rq.wqe_shift - 4;
 
                 if (qp->sq.max)
-                        qp_context->sq_size_stride = long_log2(qp->sq.max) << 3;
+                        qp_context->sq_size_stride = ilog2(qp->sq.max) << 3;
                 qp_context->sq_size_stride |= qp->sq.wqe_shift - 4;
         }
 
@@ -1732,6 +1733,11 @@ out:
                 mthca_write64(doorbell,
                               dev->kar + MTHCA_SEND_DOORBELL,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+                /*
+                 * Make sure doorbells don't leak out of SQ spinlock
+                 * and reach the HCA out of order:
+                 */
+                mmiowb();
         }
 
         qp->sq.next_ind = ind;
@@ -1851,6 +1857,12 @@ out:
         qp->rq.next_ind = ind;
         qp->rq.head    += nreq;
 
+        /*
+         * Make sure doorbells don't leak out of RQ spinlock and reach
+         * the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&qp->rq.lock, flags);
         return err;
 }
@@ -2112,6 +2124,12 @@ out:
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
         }
 
+        /*
+         * Make sure doorbells don't leak out of SQ spinlock and reach
+         * the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&qp->sq.lock, flags);
         return err;
 }
@@ -2222,7 +2240,7 @@ void mthca_free_err_wqe(struct mthca_dev *dev, struct mthca_qp *qp, int is_send,
                 *new_wqe = 0;
 }
 
-int __devinit mthca_init_qp_table(struct mthca_dev *dev)
+int mthca_init_qp_table(struct mthca_dev *dev)
 {
         int err;
         u8 status;
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 92a72f521528..10684da33d58 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -35,6 +35,8 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 
+#include <asm/io.h>
+
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
 #include "mthca_memfree.h"
@@ -118,7 +120,7 @@ static void mthca_arbel_init_srq_context(struct mthca_dev *dev,
 
         memset(context, 0, sizeof *context);
 
-        logsize = long_log2(srq->max) + srq->wqe_shift;
+        logsize = ilog2(srq->max);
         context->state_logsize_srqn = cpu_to_be32(logsize << 24 | srq->srqn);
         context->lkey = cpu_to_be32(srq->mr.ibmr.lkey);
         context->db_index = cpu_to_be32(srq->db_index);
@@ -211,7 +213,7 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
         if (!mthca_is_memfree(dev) && (ds > dev->limits.max_desc_sz))
                 return -EINVAL;
 
-        srq->wqe_shift = long_log2(ds);
+        srq->wqe_shift = ilog2(ds);
 
         srq->srqn = mthca_alloc(&dev->srq_table.alloc);
         if (srq->srqn == -1)
@@ -595,6 +597,12 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
         }
 
+        /*
+         * Make sure doorbells don't leak out of SRQ spinlock and
+         * reach the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&srq->lock, flags);
         return err;
 }
@@ -707,7 +715,7 @@ int mthca_max_srq_sge(struct mthca_dev *dev)
                      sizeof (struct mthca_data_seg));
 }
 
-int __devinit mthca_init_srq_table(struct mthca_dev *dev)
+int mthca_init_srq_table(struct mthca_dev *dev)
 {
         int err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 0b8a79d53a00..99547996aba2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -136,11 +136,11 @@ struct ipoib_dev_priv {
         struct list_head multicast_list;
         struct rb_root multicast_tree;
 
-        struct work_struct pkey_task;
-        struct work_struct mcast_task;
+        struct delayed_work pkey_task;
+        struct delayed_work mcast_task;
         struct work_struct flush_task;
         struct work_struct restart_task;
-        struct work_struct ah_reap_task;
+        struct delayed_work ah_reap_task;
 
         struct ib_device *ca;
         u8                port;
@@ -233,7 +233,7 @@ static inline struct ipoib_neigh **to_ipoib_neigh(struct neighbour *neigh)
 }
 
 struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neigh);
-void ipoib_neigh_free(struct ipoib_neigh *neigh);
+void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh);
 
 extern struct workqueue_struct *ipoib_workqueue;
 
@@ -254,13 +254,13 @@ int ipoib_add_pkey_attr(struct net_device *dev);
 
 void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 struct ipoib_ah *address, u32 qpn);
-void ipoib_reap_ah(void *dev_ptr);
+void ipoib_reap_ah(struct work_struct *work);
 
 void ipoib_flush_paths(struct net_device *dev);
 struct ipoib_dev_priv *ipoib_intf_alloc(const char *format);
 
 int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
-void ipoib_ib_dev_flush(void *dev);
+void ipoib_ib_dev_flush(struct work_struct *work);
 void ipoib_ib_dev_cleanup(struct net_device *dev);
 
 int ipoib_ib_dev_open(struct net_device *dev);
@@ -271,10 +271,10 @@ int ipoib_ib_dev_stop(struct net_device *dev);
 int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_dev_cleanup(struct net_device *dev);
 
-void ipoib_mcast_join_task(void *dev_ptr);
+void ipoib_mcast_join_task(struct work_struct *work);
 void ipoib_mcast_send(struct net_device *dev, void *mgid, struct sk_buff *skb);
 
-void ipoib_mcast_restart_task(void *dev_ptr);
+void ipoib_mcast_restart_task(struct work_struct *work);
 int ipoib_mcast_start_thread(struct net_device *dev);
 int ipoib_mcast_stop_thread(struct net_device *dev, int flush);
 
@@ -312,7 +312,7 @@ void ipoib_event(struct ib_event_handler *handler,
 int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey);
 int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey);
 
-void ipoib_pkey_poll(void *dev);
+void ipoib_pkey_poll(struct work_struct *work);
 int ipoib_pkey_dev_delay_open(struct net_device *dev);
 
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 8bf5e9ec7c95..f10fba5d3265 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -400,10 +400,11 @@ static void __ipoib_reap_ah(struct net_device *dev)
         spin_unlock_irq(&priv->tx_lock);
 }
 
-void ipoib_reap_ah(void *dev_ptr)
+void ipoib_reap_ah(struct work_struct *work)
 {
-        struct net_device *dev = dev_ptr;
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, ah_reap_task.work);
+        struct net_device *dev = priv->dev;
 
         __ipoib_reap_ah(dev);
 
@@ -613,10 +614,11 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         return 0;
 }
 
-void ipoib_ib_dev_flush(void *_dev)
+void ipoib_ib_dev_flush(struct work_struct *work)
 {
-        struct net_device *dev = (struct net_device *)_dev;
-        struct ipoib_dev_priv *priv = netdev_priv(dev), *cpriv;
+        struct ipoib_dev_priv *cpriv, *priv =
+                container_of(work, struct ipoib_dev_priv, flush_task);
+        struct net_device *dev = priv->dev;
 
         if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags) ) {
                 ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_INITIALIZED not set.\n");
@@ -638,14 +640,14 @@ void ipoib_ib_dev_flush(void *_dev)
          */
         if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) {
                 ipoib_ib_dev_up(dev);
-                ipoib_mcast_restart_task(dev);
+                ipoib_mcast_restart_task(&priv->restart_task);
         }
 
         mutex_lock(&priv->vlan_mutex);
 
         /* Flush any child interfaces too */
         list_for_each_entry(cpriv, &priv->child_intfs, list)
-                ipoib_ib_dev_flush(cpriv->dev);
+                ipoib_ib_dev_flush(&cpriv->flush_task);
 
         mutex_unlock(&priv->vlan_mutex);
 }
@@ -672,10 +674,11 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
  * change async notification is available.
  */
 
-void ipoib_pkey_poll(void *dev_ptr)
+void ipoib_pkey_poll(struct work_struct *work)
 {
-        struct net_device *dev = dev_ptr;
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, pkey_task.work);
+        struct net_device *dev = priv->dev;
 
         ipoib_pkey_dev_check_presence(dev);
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1eaf00e9862c..c09280243726 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -49,6 +49,8 @@
 
 #include <net/dst.h>
 
+#define IPOIB_QPN(ha) (be32_to_cpup((__be32 *) ha) & 0xffffff)
+
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("IP-over-InfiniBand net driver");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -262,7 +264,7 @@ static void path_free(struct net_device *dev, struct ipoib_path *path)
                 if (neigh->ah)
                         ipoib_put_ah(neigh->ah);
 
-                ipoib_neigh_free(neigh);
+                ipoib_neigh_free(dev, neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -520,14 +522,14 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                 memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
                        sizeof(union ib_gid));
 
-                ipoib_send(dev, skb, path->ah,
-                           be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+                ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb->dst->neighbour->ha));
         } else {
                 neigh->ah  = NULL;
-                __skb_queue_tail(&neigh->queue, skb);
 
                 if (!path->query && path_rec_start(dev, path))
                         goto err_list;
+
+                __skb_queue_tail(&neigh->queue, skb);
         }
 
         spin_unlock(&priv->lock);
@@ -537,7 +539,7 @@ err_list:
         list_del(&neigh->list);
 
 err_path:
-        ipoib_neigh_free(neigh);
+        ipoib_neigh_free(dev, neigh);
         ++priv->stats.tx_dropped;
         dev_kfree_skb_any(skb);
 
@@ -599,8 +601,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
                 ipoib_dbg(priv, "Send unicast ARP to %04x\n",
                           be16_to_cpu(path->pathrec.dlid));
 
-                ipoib_send(dev, skb, path->ah,
-                           be32_to_cpup((__be32 *) phdr->hwaddr));
+                ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
         } else if ((path->query || !path_rec_start(dev, path)) &&
                    skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
                 /* put pseudoheader back on for next time */
@@ -655,14 +656,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                  */
                                 ipoib_put_ah(neigh->ah);
                                 list_del(&neigh->list);
-                                ipoib_neigh_free(neigh);
+                                ipoib_neigh_free(dev, neigh);
                                 spin_unlock(&priv->lock);
                                 ipoib_path_lookup(skb, dev);
                                 goto out;
                         }
 
-                        ipoib_send(dev, skb, neigh->ah,
-                                   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+                        ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(skb->dst->neighbour->ha));
                         goto out;
                 }
 
@@ -694,7 +694,7 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                            IPOIB_GID_FMT "\n",
                                            skb->dst ? "neigh" : "dst",
                                            be16_to_cpup((__be16 *) skb->data),
-                                           be32_to_cpup((__be32 *) phdr->hwaddr),
+                                           IPOIB_QPN(phdr->hwaddr),
                                            IPOIB_GID_RAW_ARG(phdr->hwaddr + 4));
                                 dev_kfree_skb_any(skb);
                                 ++priv->stats.tx_dropped;
@@ -777,7 +777,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
 
         ipoib_dbg(priv,
                   "neigh_destructor for %06x " IPOIB_GID_FMT "\n",
-                  be32_to_cpup((__be32 *) n->ha),
+                  IPOIB_QPN(n->ha),
                   IPOIB_GID_RAW_ARG(n->ha + 4));
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -787,7 +787,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
                 if (neigh->ah)
                         ah = neigh->ah;
                 list_del(&neigh->list);
-                ipoib_neigh_free(neigh);
+                ipoib_neigh_free(n->dev, neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -810,9 +810,15 @@ struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neighbour)
         return neigh;
 }
 
-void ipoib_neigh_free(struct ipoib_neigh *neigh)
+void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
 {
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct sk_buff *skb;
         *to_ipoib_neigh(neigh->neighbour) = NULL;
+        while ((skb = __skb_dequeue(&neigh->queue))) {
+                ++priv->stats.tx_dropped;
+                dev_kfree_skb_any(skb);
+        }
         kfree(neigh);
 }
 
@@ -934,11 +940,11 @@ static void ipoib_setup(struct net_device *dev)
         INIT_LIST_HEAD(&priv->dead_ahs);
         INIT_LIST_HEAD(&priv->multicast_list);
 
-        INIT_WORK(&priv->pkey_task,    ipoib_pkey_poll,          priv->dev);
-        INIT_WORK(&priv->mcast_task,   ipoib_mcast_join_task,    priv->dev);
-        INIT_WORK(&priv->flush_task,   ipoib_ib_dev_flush,       priv->dev);
-        INIT_WORK(&priv->restart_task, ipoib_mcast_restart_task, priv->dev);
-        INIT_WORK(&priv->ah_reap_task, ipoib_reap_ah,            priv->dev);
+        INIT_DELAYED_WORK(&priv->pkey_task,    ipoib_pkey_poll);
+        INIT_DELAYED_WORK(&priv->mcast_task,   ipoib_mcast_join_task);
+        INIT_WORK(&priv->flush_task,   ipoib_ib_dev_flush);
+        INIT_WORK(&priv->restart_task, ipoib_mcast_restart_task);
+        INIT_DELAYED_WORK(&priv->ah_reap_task, ipoib_reap_ah);
 }
 
 struct ipoib_dev_priv *ipoib_intf_alloc(const char *name)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 3faa1820f0e9..b04b72ca32ed 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -114,7 +114,7 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
                  */
                 if (neigh->ah)
                         ipoib_put_ah(neigh->ah);
-                ipoib_neigh_free(neigh);
+                ipoib_neigh_free(dev, neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -399,7 +399,8 @@ static void ipoib_mcast_join_complete(int status,
                 mcast->backoff = 1;
                 mutex_lock(&mcast_mutex);
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
-                        queue_work(ipoib_workqueue, &priv->mcast_task);
+                        queue_delayed_work(ipoib_workqueue,
+                                           &priv->mcast_task, 0);
                 mutex_unlock(&mcast_mutex);
                 complete(&mcast->done);
                 return;
@@ -435,7 +436,8 @@ static void ipoib_mcast_join_complete(int status,
 
         if (test_bit(IPOIB_MCAST_RUN, &priv->flags)) {
                 if (status == -ETIMEDOUT)
-                        queue_work(ipoib_workqueue, &priv->mcast_task);
+                        queue_delayed_work(ipoib_workqueue, &priv->mcast_task,
+                                           0);
                 else
                         queue_delayed_work(ipoib_workqueue, &priv->mcast_task,
                                            mcast->backoff * HZ);
@@ -517,10 +519,11 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                 mcast->query_id = ret;
 }
 
-void ipoib_mcast_join_task(void *dev_ptr)
+void ipoib_mcast_join_task(struct work_struct *work)
 {
-        struct net_device *dev = dev_ptr;
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, mcast_task.work);
+        struct net_device *dev = priv->dev;
 
         if (!test_bit(IPOIB_MCAST_RUN, &priv->flags))
                 return;
@@ -610,7 +613,7 @@ int ipoib_mcast_start_thread(struct net_device *dev)
 
         mutex_lock(&mcast_mutex);
         if (!test_and_set_bit(IPOIB_MCAST_RUN, &priv->flags))
-                queue_work(ipoib_workqueue, &priv->mcast_task);
+                queue_delayed_work(ipoib_workqueue, &priv->mcast_task, 0);
         mutex_unlock(&mcast_mutex);
 
         spin_lock_irq(&priv->lock);
@@ -818,10 +821,11 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
         }
 }
 
-void ipoib_mcast_restart_task(void *dev_ptr)
+void ipoib_mcast_restart_task(struct work_struct *work)
 {
-        struct net_device *dev = dev_ptr;
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, restart_task);
+        struct net_device *dev = priv->dev;
         struct dev_mc_list *mclist;
         struct ipoib_mcast *mcast, *tmcast;
         LIST_HEAD(remove_list);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index eb6f98d82289..9b2041e25d59 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -363,11 +363,11 @@ iscsi_iser_conn_start(struct iscsi_cls_conn *cls_conn)
         struct iscsi_conn *conn = cls_conn->dd_data;
         int err;
 
-        err = iscsi_conn_start(cls_conn);
+        err = iser_conn_set_full_featured_mode(conn);
         if (err)
                 return err;
 
-        return iser_conn_set_full_featured_mode(conn);
+        return iscsi_conn_start(cls_conn);
 }
 
 static struct iscsi_transport iscsi_iser_transport;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 9c53916f28c2..234e5b061a75 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -283,7 +283,7 @@ struct iser_global {
         struct mutex      connlist_mutex;
         struct list_head  connlist;             /* all iSER IB connections */
 
-        kmem_cache_t *desc_cache;
+        struct kmem_cache *desc_cache;
 };
 
 extern struct iser_global ig;
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 0606744c3f84..3aedd59b8a84 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -35,6 +35,7 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
+#include <linux/highmem.h>
 #include <asm/io.h>
 #include <asm/scatterlist.h>
 #include <linux/scatterlist.h>
@@ -113,7 +114,7 @@ int iser_start_rdma_unaligned_sg(struct iscsi_iser_cmd_task  *iser_ctask,
 
         if (cmd_data_len > ISER_KMALLOC_THRESHOLD)
                 mem = (void *)__get_free_pages(GFP_NOIO,
-                      long_log2(roundup_pow_of_two(cmd_data_len)) - PAGE_SHIFT);
+                      ilog2(roundup_pow_of_two(cmd_data_len)) - PAGE_SHIFT);
         else
                 mem = kmalloc(cmd_data_len, GFP_NOIO);
 
@@ -210,7 +211,7 @@ void iser_finalize_rdma_unaligned_sg(struct iscsi_iser_cmd_task *iser_ctask,
 
         if (cmd_data_len > ISER_KMALLOC_THRESHOLD)
                 free_pages((unsigned long)mem_copy->copy_buf,
-                           long_log2(roundup_pow_of_two(cmd_data_len)) - PAGE_SHIFT);
+                           ilog2(roundup_pow_of_two(cmd_data_len)) - PAGE_SHIFT);
         else
                 kfree(mem_copy->copy_buf);
 
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 18a000034996..693b77002897 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -48,7 +48,7 @@
 
 static void iser_cq_tasklet_fn(unsigned long data);
 static void iser_cq_callback(struct ib_cq *cq, void *cq_context);
-static void iser_comp_error_worker(void *data);
+static void iser_comp_error_worker(struct work_struct *work);
 
 static void iser_cq_event_callback(struct ib_event *cause, void *context)
 {
@@ -480,8 +480,7 @@ int iser_conn_init(struct iser_conn **ibconn)
         init_waitqueue_head(&ib_conn->wait);
         atomic_set(&ib_conn->post_recv_buf_count, 0);
         atomic_set(&ib_conn->post_send_buf_count, 0);
-        INIT_WORK(&ib_conn->comperror_work, iser_comp_error_worker,
-                  ib_conn);
+        INIT_WORK(&ib_conn->comperror_work, iser_comp_error_worker);
         INIT_LIST_HEAD(&ib_conn->conn_list);
         spin_lock_init(&ib_conn->lock);
 
@@ -754,9 +753,10 @@ int iser_post_send(struct iser_desc *tx_desc)
         return ret_val;
 }
 
-static void iser_comp_error_worker(void *data)
+static void iser_comp_error_worker(struct work_struct *work)
 {
-        struct iser_conn *ib_conn = data;
+        struct iser_conn *ib_conn =
+                container_of(work, struct iser_conn, comperror_work);
 
         /* getting here when the state is UP means that the conn is being *
          * terminated asynchronously from the iSCSI layer's perspective.  */
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 4b09147f438f..a6289595557b 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -390,9 +390,10 @@ static void srp_disconnect_target(struct srp_target_port *target)
         wait_for_completion(&target->done);
 }
 
-static void srp_remove_work(void *target_ptr)
+static void srp_remove_work(struct work_struct *work)
 {
-        struct srp_target_port *target = target_ptr;
+        struct srp_target_port *target =
+                container_of(work, struct srp_target_port, work);
 
         spin_lock_irq(target->scsi_host->host_lock);
         if (target->state != SRP_TARGET_DEAD) {
@@ -575,7 +576,7 @@ err:
         spin_lock_irq(target->scsi_host->host_lock);
         if (target->state == SRP_TARGET_CONNECTING) {
                 target->state = SRP_TARGET_DEAD;
-                INIT_WORK(&target->work, srp_remove_work, target);
+                INIT_WORK(&target->work, srp_remove_work);
                 schedule_work(&target->work);
         }
         spin_unlock_irq(target->scsi_host->host_lock);
@@ -1176,9 +1177,11 @@ static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
                         break;
                 }
 
-                target->status = srp_alloc_iu_bufs(target);
-                if (target->status)
-                        break;
+                if (!target->rx_ring[0]) {
+                        target->status = srp_alloc_iu_bufs(target);
+                        if (target->status)
+                                break;
+                }
 
                 qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
                 if (!qp_attr) {
@@ -1716,7 +1719,8 @@ static ssize_t srp_create_target(struct class_device *class_dev,
         if (!target_host)
                 return -ENOMEM;
 
-        target_host->max_lun = SRP_MAX_LUN;
+        target_host->max_lun     = SRP_MAX_LUN;
+        target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
 
         target = host_to_target(target_host);