15 files changed, 980 insertions, 759 deletions
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index acf30c06a0c0..daad09a45910 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -1197,7 +1197,7 @@ void ipath_kreceive(struct ipath_portdata *pd)
        }
 reloop:
-        for (last = 0, i = 1; !last; i++) {
+        for (last = 0, i = 1; !last; i += !last) {
                hdr = dd->ipath_f_get_msgheader(dd, rhf_addr);
                eflags = ipath_hdrget_err_flags(rhf_addr);
                etype = ipath_hdrget_rcv_type(rhf_addr);
@@ -1428,6 +1428,40 @@ static void ipath_update_pio_bufs(struct ipath_devdata *dd)
        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
 }
+/*
+ * used to force update of pioavailshadow if we can't get a pio buffer.
+ * Needed primarily due to exitting freeze mode after recovering
+ * from errors.  Done lazily, because it's safer (known to not
+ * be writing pio buffers).
+ */
+static void ipath_reset_availshadow(struct ipath_devdata *dd)
+{
+        int i, im;
+        unsigned long flags;
+        spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        for (i = 0; i < dd->ipath_pioavregs; i++) {
+                u64 val, oldval;
+                /* deal with 6110 chip bug on high register #s */
+                im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
+                        i ^ 1 : i;
+                val = le64_to_cpu(dd->ipath_pioavailregs_dma[im]);
+                /*
+                 * busy out the buffers not in the kernel avail list,
+                 * without changing the generation bits.
+                 */
+                oldval = dd->ipath_pioavailshadow[i];
+                dd->ipath_pioavailshadow[i] = val |
+                        ((~dd->ipath_pioavailkernel[i] <<
+                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT) &
+                        0xaaaaaaaaaaaaaaaaULL); /* All BUSY bits in qword */
+                if (oldval != dd->ipath_pioavailshadow[i])
+                        ipath_dbg("shadow[%d] was %Lx, now %lx\n",
+                                i, oldval, dd->ipath_pioavailshadow[i]);
+        }
+        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+}
 /**
 * ipath_setrcvhdrsize - set the receive header size
 * @dd: the infinipath device
@@ -1482,9 +1516,12 @@ static noinline void no_pio_bufs(struct ipath_devdata *dd)
         */
        ipath_stats.sps_nopiobufs++;
        if (!(++dd->ipath_consec_nopiobuf % 100000)) {
-                ipath_dbg("%u pio sends with no bufavail; dmacopy: "
+                ipath_force_pio_avail_update(dd); /* at start */
-                        "%llx %llx %llx %llx; shadow:  %lx %lx %lx %lx\n",
+                ipath_dbg("%u tries no piobufavail ts%lx; dmacopy: "
+                        "%llx %llx %llx %llx\n"
+                        "ipath  shadow:  %lx %lx %lx %lx\n",
                        dd->ipath_consec_nopiobuf,
+                        (unsigned long)get_cycles(),
                        (unsigned long long) le64_to_cpu(dma[0]),
                        (unsigned long long) le64_to_cpu(dma[1]),
                        (unsigned long long) le64_to_cpu(dma[2]),
@@ -1496,14 +1533,17 @@ static noinline void no_pio_bufs(struct ipath_devdata *dd)
                 */
                if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) >
                    (sizeof(shadow[0]) * 4 * 4))
-                        ipath_dbg("2nd group: dmacopy: %llx %llx "
+                        ipath_dbg("2nd group: dmacopy: "
-                                  "%llx %llx; shadow: %lx %lx %lx %lx\n",
+                                  "%llx %llx %llx %llx\n"
+                                  "ipath  shadow:  %lx %lx %lx %lx\n",
                                  (unsigned long long)le64_to_cpu(dma[4]),
                                  (unsigned long long)le64_to_cpu(dma[5]),
                                  (unsigned long long)le64_to_cpu(dma[6]),
                                  (unsigned long long)le64_to_cpu(dma[7]),
-                                  shadow[4], shadow[5], shadow[6],
+                                  shadow[4], shadow[5], shadow[6], shadow[7]);
-                                  shadow[7]);
+                /* at end, so update likely happened */
+                ipath_reset_availshadow(dd);
        }
 }
@@ -1652,19 +1692,46 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
                              unsigned len, int avail)
 {
        unsigned long flags;
-        unsigned end;
+        unsigned end, cnt = 0, next;
        /* There are two bits per send buffer (busy and generation) */
        start *= 2;
-        len *= 2;
+        end = start + len * 2;
-        end = start + len;
-        /* Set or clear the generation bits. */
        spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        /* Set or clear the busy bit in the shadow. */
        while (start < end) {
                if (avail) {
-                        __clear_bit(start + INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT,
+                        unsigned long dma;
-                                dd->ipath_pioavailshadow);
+                        int i, im;
+                        /*
+                         * the BUSY bit will never be set, because we disarm
+                         * the user buffers before we hand them back to the
+                         * kernel.  We do have to make sure the generation
+                         * bit is set correctly in shadow, since it could
+                         * have changed many times while allocated to user.
+                         * We can't use the bitmap functions on the full
+                         * dma array because it is always little-endian, so
+                         * we have to flip to host-order first.
+                         * BITS_PER_LONG is slightly wrong, since it's
+                         * always 64 bits per register in chip...
+                         * We only work on 64 bit kernels, so that's OK.
+                         */
+                        /* deal with 6110 chip bug on high register #s */
+                        i = start / BITS_PER_LONG;
+                        im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
+                                i ^ 1 : i;
+                        __clear_bit(INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT
+                                + start, dd->ipath_pioavailshadow);
+                        dma = (unsigned long) le64_to_cpu(
+                                dd->ipath_pioavailregs_dma[im]);
+                        if (test_bit((INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                + start) % BITS_PER_LONG, &dma))
+                                __set_bit(INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                        + start, dd->ipath_pioavailshadow);
+                        else
+                                __clear_bit(INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                        + start, dd->ipath_pioavailshadow);
                        __set_bit(start, dd->ipath_pioavailkernel);
                } else {
                        __set_bit(start + INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT,
@@ -1673,7 +1740,44 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
                }
                start += 2;
        }
+        if (dd->ipath_pioupd_thresh) {
+                end = 2 * (dd->ipath_piobcnt2k + dd->ipath_piobcnt4k);
+                next = find_first_bit(dd->ipath_pioavailkernel, end);
+                while (next < end) {
+                        cnt++;
+                        next = find_next_bit(dd->ipath_pioavailkernel, end,
+                                        next + 1);
+                }
+        }
        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+        /*
+         * When moving buffers from kernel to user, if number assigned to
+         * the user is less than the pio update threshold, and threshold
+         * is supported (cnt was computed > 0), drop the update threshold
+         * so we update at least once per allocated number of buffers.
+         * In any case, if the kernel buffers are less than the threshold,
+         * drop the threshold.  We don't bother increasing it, having once
+         * decreased it, since it would typically just cycle back and forth.
+         * If we don't decrease below buffers in use, we can wait a long
+         * time for an update, until some other context uses PIO buffers.
+         */
+        if (!avail && len < cnt)
+                cnt = len;
+        if (cnt < dd->ipath_pioupd_thresh) {
+                dd->ipath_pioupd_thresh = cnt;
+                ipath_dbg("Decreased pio update threshold to %u\n",
+                        dd->ipath_pioupd_thresh);
+                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
+                dd->ipath_sendctrl &= ~(INFINIPATH_S_UPDTHRESH_MASK
+                        << INFINIPATH_S_UPDTHRESH_SHIFT);
+                dd->ipath_sendctrl |= dd->ipath_pioupd_thresh
+                        << INFINIPATH_S_UPDTHRESH_SHIFT;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                        dd->ipath_sendctrl);
+                spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
+        }
 }
 /**
@@ -1790,12 +1894,12 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
         */
        if (dd->ipath_flags & IPATH_HAS_SEND_DMA) {
                int skip_cancel;
-                u64 *statp = &dd->ipath_sdma_status;
+                unsigned long *statp = &dd->ipath_sdma_status;
                spin_lock_irqsave(&dd->ipath_sdma_lock, flags);
                skip_cancel =
-                        !test_bit(IPATH_SDMA_DISABLED, statp) &&
+                        test_and_set_bit(IPATH_SDMA_ABORTING, statp)
-                        test_and_set_bit(IPATH_SDMA_ABORTING, statp);
+                        && !test_bit(IPATH_SDMA_DISABLED, statp);
                spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
                if (skip_cancel)
                        goto bail;
@@ -1826,6 +1930,9 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
        ipath_disarm_piobufs(dd, 0,
                dd->ipath_piobcnt2k + dd->ipath_piobcnt4k);
+        if (dd->ipath_flags & IPATH_HAS_SEND_DMA)
+                set_bit(IPATH_SDMA_DISARMED, &dd->ipath_sdma_status);
        if (restore_sendctrl) {
                /* else done by caller later if needed */
                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
@@ -1845,7 +1952,6 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
                /* only wait so long for intr */
                dd->ipath_sdma_abort_intr_timeout = jiffies + HZ;
                dd->ipath_sdma_reset_wait = 200;
-                __set_bit(IPATH_SDMA_DISARMED, &dd->ipath_sdma_status);
                if (!test_bit(IPATH_SDMA_SHUTDOWN, &dd->ipath_sdma_status))
                        tasklet_hi_schedule(&dd->ipath_sdma_abort_task);
                spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
@@ -2510,7 +2616,7 @@ int ipath_reset_device(int unit)
                                ipath_dbg("unit %u port %d is in use "
                                          "(PID %u cmd %s), can't reset\n",
                                          unit, i,
-                                          dd->ipath_pd[i]->port_pid,
+                                          pid_nr(dd->ipath_pd[i]->port_pid),
                                          dd->ipath_pd[i]->port_comm);
                                ret = -EBUSY;
                                goto bail;
@@ -2548,19 +2654,21 @@ bail:
 static int ipath_signal_procs(struct ipath_devdata *dd, int sig)
 {
        int i, sub, any = 0;
-        pid_t pid;
+        struct pid *pid;
        if (!dd->ipath_pd)
                return 0;
        for (i = 1; i < dd->ipath_cfgports; i++) {
-                if (!dd->ipath_pd[i] || !dd->ipath_pd[i]->port_cnt ||
+                if (!dd->ipath_pd[i] || !dd->ipath_pd[i]->port_cnt)
-                    !dd->ipath_pd[i]->port_pid)
                        continue;
                pid = dd->ipath_pd[i]->port_pid;
+                if (!pid)
+                        continue;
                dev_info(&dd->pcidev->dev, "context %d in use "
                          "(PID %u), sending signal %d\n",
-                          i, pid, sig);
+                          i, pid_nr(pid), sig);
-                kill_proc(pid, sig, 1);
+                kill_pid(pid, sig, 1);
                any++;
                for (sub = 0; sub < INFINIPATH_MAX_SUBPORT; sub++) {
                        pid = dd->ipath_pd[i]->port_subpid[sub];
@@ -2568,8 +2676,8 @@ static int ipath_signal_procs(struct ipath_devdata *dd, int sig)
                                continue;
                        dev_info(&dd->pcidev->dev, "sub-context "
                                "%d:%d in use (PID %u), sending "
-                                "signal %d\n", i, sub, pid, sig);
+                                "signal %d\n", i, sub, pid_nr(pid), sig);
-                        kill_proc(pid, sig, 1);
+                        kill_pid(pid, sig, 1);
                        any++;
                }
        }
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 8b1752202e78..b472b15637f0 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -173,47 +173,25 @@ static int ipath_get_base_info(struct file *fp,
                (void *) dd->ipath_statusp -
                (void *) dd->ipath_pioavailregs_dma;
        if (!shared) {
-                kinfo->spi_piocnt = dd->ipath_pbufsport;
+                kinfo->spi_piocnt = pd->port_piocnt;
                kinfo->spi_piobufbase = (u64) pd->port_piobufs;
                kinfo->__spi_uregbase = (u64) dd->ipath_uregbase +
                        dd->ipath_ureg_align * pd->port_port;
        } else if (master) {
-                kinfo->spi_piocnt = (dd->ipath_pbufsport / subport_cnt) +
+                kinfo->spi_piocnt = (pd->port_piocnt / subport_cnt) +
-                                    (dd->ipath_pbufsport % subport_cnt);
+                                    (pd->port_piocnt % subport_cnt);
                /* Master's PIO buffers are after all the slave's */
                kinfo->spi_piobufbase = (u64) pd->port_piobufs +
                        dd->ipath_palign *
-                        (dd->ipath_pbufsport - kinfo->spi_piocnt);
+                        (pd->port_piocnt - kinfo->spi_piocnt);
        } else {
                unsigned slave = subport_fp(fp) - 1;
-                kinfo->spi_piocnt = dd->ipath_pbufsport / subport_cnt;
+                kinfo->spi_piocnt = pd->port_piocnt / subport_cnt;
                kinfo->spi_piobufbase = (u64) pd->port_piobufs +
                        dd->ipath_palign * kinfo->spi_piocnt * slave;
        }
-        /*
-         * Set the PIO avail update threshold to no larger
-         * than the number of buffers per process. Note that
-         * we decrease it here, but won't ever increase it.
-         */
-        if (dd->ipath_pioupd_thresh &&
-            kinfo->spi_piocnt < dd->ipath_pioupd_thresh) {
-                unsigned long flags;
-                dd->ipath_pioupd_thresh = kinfo->spi_piocnt;
-                ipath_dbg("Decreased pio update threshold to %u\n",
-                        dd->ipath_pioupd_thresh);
-                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
-                dd->ipath_sendctrl &= ~(INFINIPATH_S_UPDTHRESH_MASK
-                        << INFINIPATH_S_UPDTHRESH_SHIFT);
-                dd->ipath_sendctrl |= dd->ipath_pioupd_thresh
-                        << INFINIPATH_S_UPDTHRESH_SHIFT;
-                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                        dd->ipath_sendctrl);
-                spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
-        }
        if (shared) {
                kinfo->spi_port_uregbase = (u64) dd->ipath_uregbase +
                        dd->ipath_ureg_align * pd->port_port;
@@ -577,7 +555,7 @@ static int ipath_tid_free(struct ipath_portdata *pd, unsigned subport,
                        p = dd->ipath_pageshadow[porttid + tid];
                        dd->ipath_pageshadow[porttid + tid] = NULL;
                        ipath_cdbg(VERBOSE, "PID %u freeing TID %u\n",
-                                   pd->port_pid, tid);
+                                   pid_nr(pd->port_pid), tid);
                        dd->ipath_f_put_tid(dd, &tidbase[tid],
                                            RCVHQ_RCV_TYPE_EXPECTED,
                                            dd->ipath_tidinvalid);
@@ -1309,19 +1287,19 @@ static int ipath_mmap(struct file *fp, struct vm_area_struct *vma)
        ureg = dd->ipath_uregbase + dd->ipath_ureg_align * pd->port_port;
        if (!pd->port_subport_cnt) {
                /* port is not shared */
-                piocnt = dd->ipath_pbufsport;
+                piocnt = pd->port_piocnt;
                piobufs = pd->port_piobufs;
        } else if (!subport_fp(fp)) {
                /* caller is the master */
-                piocnt = (dd->ipath_pbufsport / pd->port_subport_cnt) +
+                piocnt = (pd->port_piocnt / pd->port_subport_cnt) +
-                         (dd->ipath_pbufsport % pd->port_subport_cnt);
+                         (pd->port_piocnt % pd->port_subport_cnt);
                piobufs = pd->port_piobufs +
-                        dd->ipath_palign * (dd->ipath_pbufsport - piocnt);
+                        dd->ipath_palign * (pd->port_piocnt - piocnt);
        } else {
                unsigned slave = subport_fp(fp) - 1;
                /* caller is a slave */
-                piocnt = dd->ipath_pbufsport / pd->port_subport_cnt;
+                piocnt = pd->port_piocnt / pd->port_subport_cnt;
                piobufs = pd->port_piobufs + dd->ipath_palign * piocnt * slave;
        }
@@ -1631,11 +1609,8 @@ static int try_alloc_port(struct ipath_devdata *dd, int port,
                           port);
                pd->port_cnt = 1;
                port_fp(fp) = pd;
-                pd->port_pid = current->pid;
+                pd->port_pid = get_pid(task_pid(current));
                strncpy(pd->port_comm, current->comm, sizeof(pd->port_comm));
-                ipath_chg_pioavailkernel(dd,
-                        dd->ipath_pbufsport * (pd->port_port - 1),
-                        dd->ipath_pbufsport, 0);
                ipath_stats.sps_ports++;
                ret = 0;
        } else
@@ -1818,14 +1793,15 @@ static int find_shared_port(struct file *fp,
                        }
                        port_fp(fp) = pd;
                        subport_fp(fp) = pd->port_cnt++;
-                        pd->port_subpid[subport_fp(fp)] = current->pid;
+                        pd->port_subpid[subport_fp(fp)] =
+                                get_pid(task_pid(current));
                        tidcursor_fp(fp) = 0;
                        pd->active_slaves |= 1 << subport_fp(fp);
                        ipath_cdbg(PROC,
                                   "%s[%u] %u sharing %s[%u] unit:port %u:%u\n",
                                   current->comm, current->pid,
                                   subport_fp(fp),
-                                   pd->port_comm, pd->port_pid,
+                                   pd->port_comm, pid_nr(pd->port_pid),
                                   dd->ipath_unit, pd->port_port);
                        ret = 1;
                        goto done;
@@ -1938,11 +1914,25 @@ static int ipath_do_user_init(struct file *fp,
        /* for now we do nothing with rcvhdrcnt: uinfo->spu_rcvhdrcnt */
+        /* some ports may get extra buffers, calculate that here */
+        if (pd->port_port <= dd->ipath_ports_extrabuf)
+                pd->port_piocnt = dd->ipath_pbufsport + 1;
+        else
+                pd->port_piocnt = dd->ipath_pbufsport;
        /* for right now, kernel piobufs are at end, so port 1 is at 0 */
+        if (pd->port_port <= dd->ipath_ports_extrabuf)
+                pd->port_pio_base = (dd->ipath_pbufsport + 1)
+                        * (pd->port_port - 1);
+        else
+                pd->port_pio_base = dd->ipath_ports_extrabuf +
+                        dd->ipath_pbufsport * (pd->port_port - 1);
        pd->port_piobufs = dd->ipath_piobufbase +
-                dd->ipath_pbufsport * (pd->port_port - 1) * dd->ipath_palign;
+                pd->port_pio_base * dd->ipath_palign;
-        ipath_cdbg(VERBOSE, "Set base of piobufs for port %u to 0x%x\n",
+        ipath_cdbg(VERBOSE, "piobuf base for port %u is 0x%x, piocnt %u,"
-                   pd->port_port, pd->port_piobufs);
+                " first pio %u\n", pd->port_port, pd->port_piobufs,
+                pd->port_piocnt, pd->port_pio_base);
+        ipath_chg_pioavailkernel(dd, pd->port_pio_base, pd->port_piocnt, 0);
        /*
         * Now allocate the rcvhdr Q and eager TIDs; skip the TID
@@ -2077,7 +2067,8 @@ static int ipath_close(struct inode *in, struct file *fp)
                 * the slave(s) don't wait for receive data forever.
                 */
                pd->active_slaves &= ~(1 << fd->subport);
-                pd->port_subpid[fd->subport] = 0;
+                put_pid(pd->port_subpid[fd->subport]);
+                pd->port_subpid[fd->subport] = NULL;
                mutex_unlock(&ipath_mutex);
                goto bail;
        }
@@ -2085,7 +2076,7 @@ static int ipath_close(struct inode *in, struct file *fp)
        if (pd->port_hdrqfull) {
                ipath_cdbg(PROC, "%s[%u] had %u rcvhdrqfull errors "
-                           "during run\n", pd->port_comm, pd->port_pid,
+                           "during run\n", pd->port_comm, pid_nr(pd->port_pid),
                           pd->port_hdrqfull);
                pd->port_hdrqfull = 0;
        }
@@ -2107,7 +2098,6 @@ static int ipath_close(struct inode *in, struct file *fp)
        }
        if (dd->ipath_kregbase) {
-                int i;
                /* atomically clear receive enable port and intr avail. */
                clear_bit(dd->ipath_r_portenable_shift + port,
                          &dd->ipath_rcvctrl);
@@ -2136,9 +2126,9 @@ static int ipath_close(struct inode *in, struct file *fp)
                ipath_write_kreg_port(dd, dd->ipath_kregs->kr_rcvhdraddr,
                        pd->port_port, dd->ipath_dummy_hdrq_phys);
-                i = dd->ipath_pbufsport * (port - 1);
+                ipath_disarm_piobufs(dd, pd->port_pio_base, pd->port_piocnt);
-                ipath_disarm_piobufs(dd, i, dd->ipath_pbufsport);
+                ipath_chg_pioavailkernel(dd, pd->port_pio_base,
-                ipath_chg_pioavailkernel(dd, i, dd->ipath_pbufsport, 1);
+                        pd->port_piocnt, 1);
                dd->ipath_f_clear_tids(dd, pd->port_port);
@@ -2146,11 +2136,12 @@ static int ipath_close(struct inode *in, struct file *fp)
                        unlock_expected_tids(pd);
                ipath_stats.sps_ports--;
                ipath_cdbg(PROC, "%s[%u] closed port %u:%u\n",
-                           pd->port_comm, pd->port_pid,
+                           pd->port_comm, pid_nr(pd->port_pid),
                           dd->ipath_unit, port);
        }
-        pd->port_pid = 0;
+        put_pid(pd->port_pid);
+        pd->port_pid = NULL;
        dd->ipath_pd[pd->port_port] = NULL; /* before releasing mutex */
        mutex_unlock(&ipath_mutex);
        ipath_free_pddata(dd, pd); /* after releasing the mutex */
diff --git a/drivers/infiniband/hw/ipath/ipath_iba7220.c b/drivers/infiniband/hw/ipath/ipath_iba7220.c
index e3ec0d1bdf50..8eee7830f042 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba7220.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba7220.c
@@ -595,7 +595,7 @@ static void ipath_7220_txe_recover(struct ipath_devdata *dd)
        dev_info(&dd->pcidev->dev,
                "Recovering from TXE PIO parity error\n");
-        ipath_disarm_senderrbufs(dd, 1);
+        ipath_disarm_senderrbufs(dd);
 }
@@ -675,10 +675,8 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
        ctrl = ipath_read_kreg32(dd, dd->ipath_kregs->kr_control);
        if ((ctrl & INFINIPATH_C_FREEZEMODE) && !ipath_diag_inuse) {
                /*
-                 * Parity errors in send memory are recoverable,
+                 * Parity errors in send memory are recoverable by h/w
-                 * just cancel the send (if indicated in * sendbuffererror),
+                 * just do housekeeping, exit freeze mode and continue.
-                 * count the occurrence, unfreeze (if no other handled
-                 * hardware error bits are set), and continue.
                 */
                if (hwerrs & ((INFINIPATH_HWE_TXEMEMPARITYERR_PIOBUF |
                               INFINIPATH_HWE_TXEMEMPARITYERR_PIOPBC)
@@ -687,13 +685,6 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                        hwerrs &= ~((INFINIPATH_HWE_TXEMEMPARITYERR_PIOBUF |
                                     INFINIPATH_HWE_TXEMEMPARITYERR_PIOPBC)
                                    << INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT);
-                        if (!hwerrs) {
-                                /* else leave in freeze mode */
-                                ipath_write_kreg(dd,
-                                                 dd->ipath_kregs->kr_control,
-                                                 dd->ipath_control);
-                                goto bail;
-                        }
                }
                if (hwerrs) {
                        /*
@@ -723,8 +714,8 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                        *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
                        dd->ipath_flags &= ~IPATH_INITTED;
                } else {
-                        ipath_dbg("Clearing freezemode on ignored hardware "
+                        ipath_dbg("Clearing freezemode on ignored or "
-                                  "error\n");
+                                "recovered hardware error\n");
                        ipath_clear_freeze(dd);
                }
        }
@@ -870,8 +861,9 @@ static int ipath_7220_boardname(struct ipath_devdata *dd, char *name,
                              "revision %u.%u!\n",
                              dd->ipath_majrev, dd->ipath_minrev);
                ret = 1;
-        } else if (dd->ipath_minrev == 1) {
+        } else if (dd->ipath_minrev == 1 &&
-                /* Rev1 chips are prototype. Complain, but allow use */
+                !(dd->ipath_flags & IPATH_INITTED)) {
+                /* Rev1 chips are prototype. Complain at init, but allow use */
                ipath_dev_err(dd, "Unsupported hardware "
                              "revision %u.%u, Contact support@qlogic.com\n",
                              dd->ipath_majrev, dd->ipath_minrev);
@@ -1966,7 +1958,7 @@ static void ipath_7220_config_ports(struct ipath_devdata *dd, ushort cfgports)
                         dd->ipath_rcvctrl);
        dd->ipath_p0_rcvegrcnt = 2048; /* always */
        if (dd->ipath_flags & IPATH_HAS_SEND_DMA)
-                dd->ipath_pioreserved = 1; /* reserve a buffer */
+                dd->ipath_pioreserved = 3; /* kpiobufs used for PIO */
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 27dd89476660..3e5baa43fc82 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -41,7 +41,7 @@
 /*
 * min buffers we want to have per port, after driver
 */
-#define IPATH_MIN_USER_PORT_BUFCNT 8
+#define IPATH_MIN_USER_PORT_BUFCNT 7
 /*
 * Number of ports we are configured to use (to allow for more pio
@@ -54,13 +54,9 @@ MODULE_PARM_DESC(cfgports, "Set max number of ports to use");
 /*
 * Number of buffers reserved for driver (verbs and layered drivers.)
- * Reserved at end of buffer list.   Initialized based on
+ * Initialized based on number of PIO buffers if not set via module interface.
- * number of PIO buffers if not set via module interface.
 * The problem with this is that it's global, but we'll use different
- * numbers for different chip types.  So the default value is not
+ * numbers for different chip types.
- * very useful.  I've redefined it for the 1.3 release so that it's
- * zero unless set by the user to something else, in which case we
- * try to respect it.
 */
 static ushort ipath_kpiobufs;
@@ -546,9 +542,12 @@ static void enable_chip(struct ipath_devdata *dd, int reinit)
                        pioavail = dd->ipath_pioavailregs_dma[i ^ 1];
                else
                        pioavail = dd->ipath_pioavailregs_dma[i];
-                dd->ipath_pioavailshadow[i] = le64_to_cpu(pioavail) |
+                /*
-                        (~dd->ipath_pioavailkernel[i] <<
+                 * don't need to worry about ipath_pioavailkernel here
-                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT);
+                 * because we will call ipath_chg_pioavailkernel() later
+                 * in initialization, to busy out buffers as needed
+                 */
+                dd->ipath_pioavailshadow[i] = le64_to_cpu(pioavail);
        }
        /* can get counters, stats, etc. */
        dd->ipath_flags |= IPATH_PRESENT;
@@ -708,12 +707,11 @@ static void verify_interrupt(unsigned long opaque)
 int ipath_init_chip(struct ipath_devdata *dd, int reinit)
 {
        int ret = 0;
-        u32 val32, kpiobufs;
+        u32 kpiobufs, defkbufs;
        u32 piobufs, uports;
        u64 val;
        struct ipath_portdata *pd;
        gfp_t gfp_flags = GFP_USER | __GFP_COMP;
-        unsigned long flags;
        ret = init_housekeeping(dd, reinit);
        if (ret)
@@ -753,56 +751,46 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
        dd->ipath_pioavregs = ALIGN(piobufs, sizeof(u64) * BITS_PER_BYTE / 2)
                / (sizeof(u64) * BITS_PER_BYTE / 2);
        uports = dd->ipath_cfgports ? dd->ipath_cfgports - 1 : 0;
-        if (ipath_kpiobufs == 0) {
+        if (piobufs > 144)
-                /* not set by user (this is default) */
+                defkbufs = 32 + dd->ipath_pioreserved;
-                if (piobufs > 144)
-                        kpiobufs = 32;
-                else
-                        kpiobufs = 16;
-        }
        else
-                kpiobufs = ipath_kpiobufs;
+                defkbufs = 16 + dd->ipath_pioreserved;
-        if (kpiobufs + (uports * IPATH_MIN_USER_PORT_BUFCNT) > piobufs) {
+        if (ipath_kpiobufs && (ipath_kpiobufs +
+                (uports * IPATH_MIN_USER_PORT_BUFCNT)) > piobufs) {
                int i = (int) piobufs -
                        (int) (uports * IPATH_MIN_USER_PORT_BUFCNT);
                if (i < 1)
                        i = 1;
                dev_info(&dd->pcidev->dev, "Allocating %d PIO bufs of "
                         "%d for kernel leaves too few for %d user ports "
-                         "(%d each); using %u\n", kpiobufs,
+                         "(%d each); using %u\n", ipath_kpiobufs,
                         piobufs, uports, IPATH_MIN_USER_PORT_BUFCNT, i);
                /*
                 * shouldn't change ipath_kpiobufs, because could be
                 * different for different devices...
                 */
                kpiobufs = i;
-        }
+        } else if (ipath_kpiobufs)
+                kpiobufs = ipath_kpiobufs;
+        else
+                kpiobufs = defkbufs;
        dd->ipath_lastport_piobuf = piobufs - kpiobufs;
        dd->ipath_pbufsport =
                uports ? dd->ipath_lastport_piobuf / uports : 0;
-        val32 = dd->ipath_lastport_piobuf - (dd->ipath_pbufsport * uports);
+        /* if not an even divisor, some user ports get extra buffers */
-        if (val32 > 0) {
+        dd->ipath_ports_extrabuf = dd->ipath_lastport_piobuf -
-                ipath_dbg("allocating %u pbufs/port leaves %u unused, "
+                (dd->ipath_pbufsport * uports);
-                          "add to kernel\n", dd->ipath_pbufsport, val32);
+        if (dd->ipath_ports_extrabuf)
-                dd->ipath_lastport_piobuf -= val32;
+                ipath_dbg("%u pbufs/port leaves some unused, add 1 buffer to "
-                kpiobufs += val32;
+                        "ports <= %u\n", dd->ipath_pbufsport,
-                ipath_dbg("%u pbufs/port leaves %u unused, add to kernel\n",
+                        dd->ipath_ports_extrabuf);
-                          dd->ipath_pbufsport, val32);
-        }
        dd->ipath_lastpioindex = 0;
        dd->ipath_lastpioindexl = dd->ipath_piobcnt2k;
-        ipath_chg_pioavailkernel(dd, 0, piobufs, 1);
+        /* ipath_pioavailshadow initialized earlier */
        ipath_cdbg(VERBOSE, "%d PIO bufs for kernel out of %d total %u "
                   "each for %u user ports\n", kpiobufs,
                   piobufs, dd->ipath_pbufsport, uports);
-        if (dd->ipath_pioupd_thresh) {
-                if (dd->ipath_pbufsport < dd->ipath_pioupd_thresh)
-                        dd->ipath_pioupd_thresh = dd->ipath_pbufsport;
-                if (kpiobufs < dd->ipath_pioupd_thresh)
-                        dd->ipath_pioupd_thresh = kpiobufs;
-        }
        ret = dd->ipath_f_early_init(dd);
        if (ret) {
                ipath_dev_err(dd, "Early initialization failure\n");
@@ -810,13 +798,6 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
        }
        /*
-         * Cancel any possible active sends from early driver load.
-         * Follows early_init because some chips have to initialize
-         * PIO buffers in early_init to avoid false parity errors.
-         */
-        ipath_cancel_sends(dd, 0);
-        /*
         * Early_init sets rcvhdrentsize and rcvhdrsize, so this must be
         * done after early_init.
         */
@@ -836,6 +817,7 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendpioavailaddr,
                         dd->ipath_pioavailregs_phys);
        /*
         * this is to detect s/w errors, which the h/w works around by
         * ignoring the low 6 bits of address, if it wasn't aligned.
@@ -862,12 +844,6 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
                         ~0ULL&~INFINIPATH_HWE_MEMBISTFAILED);
        ipath_write_kreg(dd, dd->ipath_kregs->kr_control, 0ULL);
-        spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
-        dd->ipath_sendctrl = INFINIPATH_S_PIOENABLE;
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl, dd->ipath_sendctrl);
-        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
-        spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
        /*
         * before error clears, since we expect serdes pll errors during
         * this, the first time after reset
@@ -940,6 +916,19 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
        else
                enable_chip(dd, reinit);
+        /* after enable_chip, so pioavailshadow setup */
+        ipath_chg_pioavailkernel(dd, 0, piobufs, 1);
+        /*
+         * Cancel any possible active sends from early driver load.
+         * Follows early_init because some chips have to initialize
+         * PIO buffers in early_init to avoid false parity errors.
+         * After enable and ipath_chg_pioavailkernel so we can safely
+         * enable pioavail updates and PIOENABLE; packets are now
+         * ready to go out.
+         */
+        ipath_cancel_sends(dd, 1);
        if (!reinit) {
                /*
                 * Used when we close a port, for DMA already in flight
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index 1b58f4737c71..26900b3b7a4e 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -38,42 +38,12 @@
 #include "ipath_verbs.h"
 #include "ipath_common.h"
-/*
- * clear (write) a pio buffer, to clear a parity error.   This routine
- * should only be called when in freeze mode, and the buffer should be
- * canceled afterwards.
- */
-static void ipath_clrpiobuf(struct ipath_devdata *dd, u32 pnum)
-{
-        u32 __iomem *pbuf;
-        u32 dwcnt; /* dword count to write */
-        if (pnum < dd->ipath_piobcnt2k) {
-                pbuf = (u32 __iomem *) (dd->ipath_pio2kbase + pnum *
-                        dd->ipath_palign);
-                dwcnt = dd->ipath_piosize2k >> 2;
-        }
-        else {
-                pbuf = (u32 __iomem *) (dd->ipath_pio4kbase +
-                        (pnum - dd->ipath_piobcnt2k) * dd->ipath_4kalign);
-                dwcnt = dd->ipath_piosize4k >> 2;
-        }
-        dev_info(&dd->pcidev->dev,
-                "Rewrite PIO buffer %u, to recover from parity error\n",
-                pnum);
-        /* no flush required, since already in freeze */
-        writel(dwcnt + 1, pbuf);
-        while (--dwcnt)
-                writel(0, pbuf++);
-}
 /*
 * Called when we might have an error that is specific to a particular
 * PIO buffer, and may need to cancel that buffer, so it can be re-used.
- * If rewrite is true, and bits are set in the sendbufferror registers,
- * we'll write to the buffer, for error recovery on parity errors.
 */
-void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
+void ipath_disarm_senderrbufs(struct ipath_devdata *dd)
 {
        u32 piobcnt;
        unsigned long sbuf[4];
@@ -109,11 +79,8 @@ void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
                }
                for (i = 0; i < piobcnt; i++)
-                        if (test_bit(i, sbuf)) {
+                        if (test_bit(i, sbuf))
-                                if (rewrite)
-                                        ipath_clrpiobuf(dd, i);
                                ipath_disarm_piobufs(dd, i, 1);
-                        }
                /* ignore armlaunch errs for a bit */
                dd->ipath_lastcancel = jiffies+3;
        }
@@ -164,7 +131,7 @@ static u64 handle_e_sum_errs(struct ipath_devdata *dd, ipath_err_t errs)
 {
        u64 ignore_this_time = 0;
-        ipath_disarm_senderrbufs(dd, 0);
+        ipath_disarm_senderrbufs(dd);
        if ((errs & E_SUM_LINK_PKTERRS) &&
            !(dd->ipath_flags & IPATH_LINKACTIVE)) {
                /*
@@ -909,8 +876,8 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
 * processes (causing armlaunch), send errors due to going into freeze mode,
 * etc., and try to avoid causing extra interrupts while doing so.
 * Forcibly update the in-memory pioavail register copies after cleanup
- * because the chip won't do it for anything changing while in freeze mode
+ * because the chip won't do it while in freeze mode (the register values
- * (we don't want to wait for the next pio buffer state change).
+ * themselves are kept correct).
 * Make sure that we don't lose any important interrupts by using the chip
 * feature that says that writing 0 to a bit in *clear that is set in
 * *status will cause an interrupt to be generated again (if allowed by
@@ -918,44 +885,23 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
 */
 void ipath_clear_freeze(struct ipath_devdata *dd)
 {
-        int i, im;
-        u64 val;
        /* disable error interrupts, to avoid confusion */
        ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask, 0ULL);
        /* also disable interrupts; errormask is sometimes overwriten */
        ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask, 0ULL);
-        /*
+        ipath_cancel_sends(dd, 1);
-         * clear all sends, because they have may been
-         * completed by usercode while in freeze mode, and
+        /* clear the freeze, and be sure chip saw it */
-         * therefore would not be sent, and eventually
-         * might cause the process to run out of bufs
-         */
-        ipath_cancel_sends(dd, 0);
        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
                         dd->ipath_control);
+        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
-        /* ensure pio avail updates continue */
+        /* force in-memory update now we are out of freeze */
        ipath_force_pio_avail_update(dd);
        /*
-         * We just enabled pioavailupdate, so dma copy is almost certainly
-         * not yet right, so read the registers directly.  Similar to init
-         */
-        for (i = 0; i < dd->ipath_pioavregs; i++) {
-                /* deal with 6110 chip bug */
-                im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
-                        i ^ 1 : i;
-                val = ipath_read_kreg64(dd, (0x1000 / sizeof(u64)) + im);
-                dd->ipath_pioavailregs_dma[i] = cpu_to_le64(val);
-                dd->ipath_pioavailshadow[i] = val |
-                        (~dd->ipath_pioavailkernel[i] <<
-                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT);
-        }
-        /*
         * force new interrupt if any hwerr, error or interrupt bits are
         * still set, and clear "safe" send packet errors related to freeze
         * and cancelling sends.  Re-enable error interrupts before possible
@@ -1312,10 +1258,8 @@ irqreturn_t ipath_intr(int irq, void *data)
                ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
                spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
-                if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA))
+                /* always process; sdma verbs uses PIO for acks and VL15  */
-                        handle_layer_pioavail(dd);
+                handle_layer_pioavail(dd);
-                else
-                        ipath_dbg("unexpected BUFAVAIL intr\n");
        }
        ret = IRQ_HANDLED;
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 202337ae90dc..59a8b254b97f 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -117,6 +117,10 @@ struct ipath_portdata {
        u16 port_subport_cnt;
        /* non-zero if port is being shared. */
        u16 port_subport_id;
+        /* number of pio bufs for this port (all procs, if shared) */
+        u32 port_piocnt;
+        /* first pio buffer for this port */
+        u32 port_pio_base;
        /* chip offset of PIO buffers for this port */
        u32 port_piobufs;
        /* how many alloc_pages() chunks in port_rcvegrbuf_pages */
@@ -155,8 +159,8 @@ struct ipath_portdata {
        /* saved total number of polled urgent packets for poll edge trigger */
        u32 port_urgent_poll;
        /* pid of process using this port */
-        pid_t port_pid;
+        struct pid *port_pid;
-        pid_t port_subpid[INFINIPATH_MAX_SUBPORT];
+        struct pid *port_subpid[INFINIPATH_MAX_SUBPORT];
        /* same size as task_struct .comm[] */
        char port_comm[16];
        /* pkeys set by this use of this port */
@@ -384,6 +388,8 @@ struct ipath_devdata {
        u32 ipath_lastrpkts;
        /* pio bufs allocated per port */
        u32 ipath_pbufsport;
+        /* if remainder on bufs/port, ports < extrabuf get 1 extra */
+        u32 ipath_ports_extrabuf;
        u32 ipath_pioupd_thresh; /* update threshold, some chips */
        /*
         * number of ports configured as max; zero is set to number chip
@@ -477,7 +483,7 @@ struct ipath_devdata {
        /* SendDMA related entries */
        spinlock_t            ipath_sdma_lock;
-        u64                   ipath_sdma_status;
+        unsigned long         ipath_sdma_status;
        unsigned long         ipath_sdma_abort_jiffies;
        unsigned long         ipath_sdma_abort_intr_timeout;
        unsigned long         ipath_sdma_buf_jiffies;
@@ -816,8 +822,8 @@ struct ipath_devdata {
 #define IPATH_SDMA_DISARMED  1
 #define IPATH_SDMA_DISABLED  2
 #define IPATH_SDMA_LAYERBUF  3
-#define IPATH_SDMA_RUNNING  62
+#define IPATH_SDMA_RUNNING  30
-#define IPATH_SDMA_SHUTDOWN 63
+#define IPATH_SDMA_SHUTDOWN 31
 /* bit combinations that correspond to abort states */
 #define IPATH_SDMA_ABORT_NONE 0
@@ -1011,7 +1017,7 @@ void ipath_get_eeprom_info(struct ipath_devdata *);
 int ipath_update_eeprom_log(struct ipath_devdata *dd);
 void ipath_inc_eeprom_err(struct ipath_devdata *dd, u32 eidx, u32 incr);
 u64 ipath_snap_cntr(struct ipath_devdata *, ipath_creg);
-void ipath_disarm_senderrbufs(struct ipath_devdata *, int);
+void ipath_disarm_senderrbufs(struct ipath_devdata *);
 void ipath_force_pio_avail_update(struct ipath_devdata *);
 void signal_ib_event(struct ipath_devdata *dd, enum ib_event_type ev);
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index dd5b6e9d57c2..4715911101e4 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -242,7 +242,6 @@ static void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
 {
        struct ipath_qp *q, **qpp;
        unsigned long flags;
-        int fnd = 0;
        spin_lock_irqsave(&qpt->lock, flags);
@@ -253,51 +252,40 @@ static void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
                        *qpp = qp->next;
                        qp->next = NULL;
                        atomic_dec(&qp->refcount);
-                        fnd = 1;
                        break;
                }
        }
        spin_unlock_irqrestore(&qpt->lock, flags);
-        if (!fnd)
-                return;
-        free_qpn(qpt, qp->ibqp.qp_num);
-        wait_event(qp->wait, !atomic_read(&qp->refcount));
 }
 /**
- * ipath_free_all_qps - remove all QPs from the table
+ * ipath_free_all_qps - check for QPs still in use
 * @qpt: the QP table to empty
+ *
+ * There should not be any QPs still in use.
+ * Free memory for table.
 */
-void ipath_free_all_qps(struct ipath_qp_table *qpt)
+unsigned ipath_free_all_qps(struct ipath_qp_table *qpt)
 {
        unsigned long flags;
-        struct ipath_qp *qp, *nqp;
+        struct ipath_qp *qp;
-        u32 n;
+        u32 n, qp_inuse = 0;
+        spin_lock_irqsave(&qpt->lock, flags);
        for (n = 0; n < qpt->max; n++) {
-                spin_lock_irqsave(&qpt->lock, flags);
                qp = qpt->table[n];
                qpt->table[n] = NULL;
-                spin_unlock_irqrestore(&qpt->lock, flags);
+                for (; qp; qp = qp->next)
-                while (qp) {
+                        qp_inuse++;
-                        nqp = qp->next;
-                        free_qpn(qpt, qp->ibqp.qp_num);
-                        if (!atomic_dec_and_test(&qp->refcount) ||
-                            !ipath_destroy_qp(&qp->ibqp))
-                                ipath_dbg("QP memory leak!\n");
-                        qp = nqp;
-                }
        }
+        spin_unlock_irqrestore(&qpt->lock, flags);
-        for (n = 0; n < ARRAY_SIZE(qpt->map); n++) {
+        for (n = 0; n < ARRAY_SIZE(qpt->map); n++)
                if (qpt->map[n].page)
-                        free_page((unsigned long)qpt->map[n].page);
+                        free_page((unsigned long) qpt->map[n].page);
-        }
+        return qp_inuse;
 }
 /**
@@ -336,11 +324,12 @@ static void ipath_reset_qp(struct ipath_qp *qp, enum ib_qp_type type)
        qp->remote_qpn = 0;
        qp->qkey = 0;
        qp->qp_access_flags = 0;
-        qp->s_busy = 0;
+        atomic_set(&qp->s_dma_busy, 0);
        qp->s_flags &= IPATH_S_SIGNAL_REQ_WR;
        qp->s_hdrwords = 0;
        qp->s_wqe = NULL;
        qp->s_pkt_delay = 0;
+        qp->s_draining = 0;
        qp->s_psn = 0;
        qp->r_psn = 0;
        qp->r_msn = 0;
@@ -353,7 +342,8 @@ static void ipath_reset_qp(struct ipath_qp *qp, enum ib_qp_type type)
        }
        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
        qp->r_nak_state = 0;
-        qp->r_wrid_valid = 0;
+        qp->r_aflags = 0;
+        qp->r_flags = 0;
        qp->s_rnr_timeout = 0;
        qp->s_head = 0;
        qp->s_tail = 0;
@@ -361,7 +351,6 @@ static void ipath_reset_qp(struct ipath_qp *qp, enum ib_qp_type type)
        qp->s_last = 0;
        qp->s_ssn = 1;
        qp->s_lsn = 0;
-        qp->s_wait_credit = 0;
        memset(qp->s_ack_queue, 0, sizeof(qp->s_ack_queue));
        qp->r_head_ack_queue = 0;
        qp->s_tail_ack_queue = 0;
@@ -370,17 +359,17 @@ static void ipath_reset_qp(struct ipath_qp *qp, enum ib_qp_type type)
                qp->r_rq.wq->head = 0;
                qp->r_rq.wq->tail = 0;
        }
-        qp->r_reuse_sge = 0;
 }
 /**
- * ipath_error_qp - put a QP into an error state
+ * ipath_error_qp - put a QP into the error state
- * @qp: the QP to put into an error state
+ * @qp: the QP to put into the error state
 * @err: the receive completion error to signal if a RWQE is active
 *
 * Flushes both send and receive work queues.
 * Returns true if last WQE event should be generated.
 * The QP s_lock should be held and interrupts disabled.
+ * If we are already in error state, just return.
 */
 int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
@@ -389,8 +378,10 @@ int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
        struct ib_wc wc;
        int ret = 0;
-        ipath_dbg("QP%d/%d in error state (%d)\n",
+        if (qp->state == IB_QPS_ERR)
-                  qp->ibqp.qp_num, qp->remote_qpn, err);
+                goto bail;
+        qp->state = IB_QPS_ERR;
        spin_lock(&dev->pending_lock);
        if (!list_empty(&qp->timerwait))
@@ -399,39 +390,21 @@ int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
                list_del_init(&qp->piowait);
        spin_unlock(&dev->pending_lock);
-        wc.vendor_err = 0;
+        /* Schedule the sending tasklet to drain the send work queue. */
-        wc.byte_len = 0;
+        if (qp->s_last != qp->s_head)
-        wc.imm_data = 0;
+                ipath_schedule_send(qp);
+        memset(&wc, 0, sizeof(wc));
        wc.qp = &qp->ibqp;
-        wc.src_qp = 0;
+        wc.opcode = IB_WC_RECV;
-        wc.wc_flags = 0;
-        wc.pkey_index = 0;
+        if (test_and_clear_bit(IPATH_R_WRID_VALID, &qp->r_aflags)) {
-        wc.slid = 0;
-        wc.sl = 0;
-        wc.dlid_path_bits = 0;
-        wc.port_num = 0;
-        if (qp->r_wrid_valid) {
-                qp->r_wrid_valid = 0;
                wc.wr_id = qp->r_wr_id;
-                wc.opcode = IB_WC_RECV;
                wc.status = err;
                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
        }
        wc.status = IB_WC_WR_FLUSH_ERR;
-        while (qp->s_last != qp->s_head) {
-                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
-                wc.wr_id = wqe->wr.wr_id;
-                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                if (++qp->s_last >= qp->s_size)
-                        qp->s_last = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
-        }
-        qp->s_cur = qp->s_tail = qp->s_head;
-        qp->s_hdrwords = 0;
-        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
        if (qp->r_rq.wq) {
                struct ipath_rwq *wq;
                u32 head;
@@ -447,7 +420,6 @@ int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
                tail = wq->tail;
                if (tail >= qp->r_rq.size)
                        tail = 0;
-                wc.opcode = IB_WC_RECV;
                while (tail != head) {
                        wc.wr_id = get_rwqe_ptr(&qp->r_rq, tail)->wr_id;
                        if (++tail >= qp->r_rq.size)
@@ -460,6 +432,7 @@ int ipath_error_qp(struct ipath_qp *qp, enum ib_wc_status err)
        } else if (qp->ibqp.event_handler)
                ret = 1;
+bail:
        return ret;
 }
@@ -478,11 +451,10 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        struct ipath_ibdev *dev = to_idev(ibqp->device);
        struct ipath_qp *qp = to_iqp(ibqp);
        enum ib_qp_state cur_state, new_state;
-        unsigned long flags;
        int lastwqe = 0;
        int ret;
-        spin_lock_irqsave(&qp->s_lock, flags);
+        spin_lock_irq(&qp->s_lock);
        cur_state = attr_mask & IB_QP_CUR_STATE ?
                attr->cur_qp_state : qp->state;
@@ -535,16 +507,42 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        switch (new_state) {
        case IB_QPS_RESET:
+                if (qp->state != IB_QPS_RESET) {
+                        qp->state = IB_QPS_RESET;
+                        spin_lock(&dev->pending_lock);
+                        if (!list_empty(&qp->timerwait))
+                                list_del_init(&qp->timerwait);
+                        if (!list_empty(&qp->piowait))
+                                list_del_init(&qp->piowait);
+                        spin_unlock(&dev->pending_lock);
+                        qp->s_flags &= ~IPATH_S_ANY_WAIT;
+                        spin_unlock_irq(&qp->s_lock);
+                        /* Stop the sending tasklet */
+                        tasklet_kill(&qp->s_task);
+                        wait_event(qp->wait_dma, !atomic_read(&qp->s_dma_busy));
+                        spin_lock_irq(&qp->s_lock);
+                }
                ipath_reset_qp(qp, ibqp->qp_type);
                break;
+        case IB_QPS_SQD:
+                qp->s_draining = qp->s_last != qp->s_cur;
+                qp->state = new_state;
+                break;
+        case IB_QPS_SQE:
+                if (qp->ibqp.qp_type == IB_QPT_RC)
+                        goto inval;
+                qp->state = new_state;
+                break;
        case IB_QPS_ERR:
                lastwqe = ipath_error_qp(qp, IB_WC_WR_FLUSH_ERR);
                break;
        default:
+                qp->state = new_state;
                break;
        }
        if (attr_mask & IB_QP_PKEY_INDEX)
@@ -597,8 +595,7 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC)
                qp->s_max_rd_atomic = attr->max_rd_atomic;
-        qp->state = new_state;
+        spin_unlock_irq(&qp->s_lock);
-        spin_unlock_irqrestore(&qp->s_lock, flags);
        if (lastwqe) {
                struct ib_event ev;
@@ -612,7 +609,7 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        goto bail;
 inval:
-        spin_unlock_irqrestore(&qp->s_lock, flags);
+        spin_unlock_irq(&qp->s_lock);
        ret = -EINVAL;
 bail:
@@ -643,7 +640,7 @@ int ipath_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        attr->pkey_index = qp->s_pkey_index;
        attr->alt_pkey_index = 0;
        attr->en_sqd_async_notify = 0;
-        attr->sq_draining = 0;
+        attr->sq_draining = qp->s_draining;
        attr->max_rd_atomic = qp->s_max_rd_atomic;
        attr->max_dest_rd_atomic = qp->r_max_rd_atomic;
        attr->min_rnr_timer = qp->r_min_rnr_timer;
@@ -833,6 +830,7 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                spin_lock_init(&qp->r_rq.lock);
                atomic_set(&qp->refcount, 0);
                init_waitqueue_head(&qp->wait);
+                init_waitqueue_head(&qp->wait_dma);
                tasklet_init(&qp->s_task, ipath_do_send, (unsigned long)qp);
                INIT_LIST_HEAD(&qp->piowait);
                INIT_LIST_HEAD(&qp->timerwait);
@@ -926,6 +924,7 @@ bail_ip:
        else
                vfree(qp->r_rq.wq);
        ipath_free_qp(&dev->qp_table, qp);
+        free_qpn(&dev->qp_table, qp->ibqp.qp_num);
 bail_qp:
        kfree(qp);
 bail_swq:
@@ -947,41 +946,44 @@ int ipath_destroy_qp(struct ib_qp *ibqp)
 {
        struct ipath_qp *qp = to_iqp(ibqp);
        struct ipath_ibdev *dev = to_idev(ibqp->device);
-        unsigned long flags;
-        spin_lock_irqsave(&qp->s_lock, flags);
+        /* Make sure HW and driver activity is stopped. */
-        qp->state = IB_QPS_ERR;
+        spin_lock_irq(&qp->s_lock);
-        spin_unlock_irqrestore(&qp->s_lock, flags);
+        if (qp->state != IB_QPS_RESET) {
-        spin_lock(&dev->n_qps_lock);
+                qp->state = IB_QPS_RESET;
-        dev->n_qps_allocated--;
+                spin_lock(&dev->pending_lock);
-        spin_unlock(&dev->n_qps_lock);
+                if (!list_empty(&qp->timerwait))
+                        list_del_init(&qp->timerwait);
+                if (!list_empty(&qp->piowait))
+                        list_del_init(&qp->piowait);
+                spin_unlock(&dev->pending_lock);
+                qp->s_flags &= ~IPATH_S_ANY_WAIT;
+                spin_unlock_irq(&qp->s_lock);
+                /* Stop the sending tasklet */
+                tasklet_kill(&qp->s_task);
+                wait_event(qp->wait_dma, !atomic_read(&qp->s_dma_busy));
+        } else
+                spin_unlock_irq(&qp->s_lock);
-        /* Stop the sending tasklet. */
+        ipath_free_qp(&dev->qp_table, qp);
-        tasklet_kill(&qp->s_task);
        if (qp->s_tx) {
                atomic_dec(&qp->refcount);
                if (qp->s_tx->txreq.flags & IPATH_SDMA_TXREQ_F_FREEBUF)
                        kfree(qp->s_tx->txreq.map_addr);
+                spin_lock_irq(&dev->pending_lock);
+                list_add(&qp->s_tx->txreq.list, &dev->txreq_free);
+                spin_unlock_irq(&dev->pending_lock);
+                qp->s_tx = NULL;
        }
-        /* Make sure the QP isn't on the timeout list. */
+        wait_event(qp->wait, !atomic_read(&qp->refcount));
-        spin_lock_irqsave(&dev->pending_lock, flags);
-        if (!list_empty(&qp->timerwait))
-                list_del_init(&qp->timerwait);
-        if (!list_empty(&qp->piowait))
-                list_del_init(&qp->piowait);
-        if (qp->s_tx)
-                list_add(&qp->s_tx->txreq.list, &dev->txreq_free);
-        spin_unlock_irqrestore(&dev->pending_lock, flags);
-        /*
+        /* all user's cleaned up, mark it available */
-         * Make sure that the QP is not in the QPN table so receive
+        free_qpn(&dev->qp_table, qp->ibqp.qp_num);
-         * interrupts will discard packets for this QP.  XXX Also remove QP
+        spin_lock(&dev->n_qps_lock);
-         * from multicast table.
+        dev->n_qps_allocated--;
-         */
+        spin_unlock(&dev->n_qps_lock);
-        if (atomic_read(&qp->refcount) != 0)
-                ipath_free_qp(&dev->qp_table, qp);
        if (qp->ip)
                kref_put(&qp->ip->ref, ipath_release_mmap_info);
@@ -1026,48 +1028,6 @@ bail:
 }
 /**
- * ipath_sqerror_qp - put a QP's send queue into an error state
- * @qp: QP who's send queue will be put into an error state
- * @wc: the WC responsible for putting the QP in this state
- *
- * Flushes the send work queue.
- * The QP s_lock should be held and interrupts disabled.
- */
-void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc)
-{
-        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
-        struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
-        ipath_dbg("Send queue error on QP%d/%d: err: %d\n",
-                  qp->ibqp.qp_num, qp->remote_qpn, wc->status);
-        spin_lock(&dev->pending_lock);
-        if (!list_empty(&qp->timerwait))
-                list_del_init(&qp->timerwait);
-        if (!list_empty(&qp->piowait))
-                list_del_init(&qp->piowait);
-        spin_unlock(&dev->pending_lock);
-        ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 1);
-        if (++qp->s_last >= qp->s_size)
-                qp->s_last = 0;
-        wc->status = IB_WC_WR_FLUSH_ERR;
-        while (qp->s_last != qp->s_head) {
-                wqe = get_swqe_ptr(qp, qp->s_last);
-                wc->wr_id = wqe->wr.wr_id;
-                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 1);
-                if (++qp->s_last >= qp->s_size)
-                        qp->s_last = 0;
-        }
-        qp->s_cur = qp->s_tail = qp->s_head;
-        qp->state = IB_QPS_SQE;
-}
-/**
 * ipath_get_credit - flush the send work queue of a QP
 * @qp: the qp who's send work queue to flush
 * @aeth: the Acknowledge Extended Transport Header
@@ -1093,9 +1053,10 @@ void ipath_get_credit(struct ipath_qp *qp, u32 aeth)
        }
        /* Restart sending if it was blocked due to lack of credits. */
-        if (qp->s_cur != qp->s_head &&
+        if ((qp->s_flags & IPATH_S_WAIT_SSN_CREDIT) &&
+            qp->s_cur != qp->s_head &&
            (qp->s_lsn == (u32) -1 ||
             ipath_cmp24(get_swqe_ptr(qp, qp->s_cur)->ssn,
                         qp->s_lsn + 1) <= 0))
-                tasklet_hi_schedule(&qp->s_task);
+                ipath_schedule_send(qp);
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
index c405dfba5531..108df667d2ee 100644
--- a/drivers/infiniband/hw/ipath/ipath_rc.c
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -92,6 +92,10 @@ static int ipath_make_rc_ack(struct ipath_ibdev *dev, struct ipath_qp *qp,
        u32 bth0;
        u32 bth2;
+        /* Don't send an ACK if we aren't supposed to. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK))
+                goto bail;
        /* header size in 32-bit words LRH+BTH = (8+12)/4. */
        hwords = 5;
@@ -238,14 +242,25 @@ int ipath_make_rc_req(struct ipath_qp *qp)
            ipath_make_rc_ack(dev, qp, ohdr, pmtu))
                goto done;
-        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK) ||
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)) {
-            qp->s_rnr_timeout || qp->s_wait_credit)
+                if (!(ib_ipath_state_ops[qp->state] & IPATH_FLUSH_SEND))
-                goto bail;
+                        goto bail;
+                /* We are in the error state, flush the work request. */
+                if (qp->s_last == qp->s_head)
+                        goto bail;
+                /* If DMAs are in progress, we can't flush immediately. */
+                if (atomic_read(&qp->s_dma_busy)) {
+                        qp->s_flags |= IPATH_S_WAIT_DMA;
+                        goto bail;
+                }
+                wqe = get_swqe_ptr(qp, qp->s_last);
+                ipath_send_complete(qp, wqe, IB_WC_WR_FLUSH_ERR);
+                goto done;
+        }
-        /* Limit the number of packets sent without an ACK. */
+        /* Leave BUSY set until RNR timeout. */
-        if (ipath_cmp24(qp->s_psn, qp->s_last_psn + IPATH_PSN_CREDIT) > 0) {
+        if (qp->s_rnr_timeout) {
-                qp->s_wait_credit = 1;
+                qp->s_flags |= IPATH_S_WAITING;
-                dev->n_rc_stalls++;
                goto bail;
        }
@@ -257,6 +272,9 @@ int ipath_make_rc_req(struct ipath_qp *qp)
        wqe = get_swqe_ptr(qp, qp->s_cur);
        switch (qp->s_state) {
        default:
+                if (!(ib_ipath_state_ops[qp->state] &
+                    IPATH_PROCESS_NEXT_SEND_OK))
+                        goto bail;
                /*
                 * Resend an old request or start a new one.
                 *
@@ -294,8 +312,10 @@ int ipath_make_rc_req(struct ipath_qp *qp)
                case IB_WR_SEND_WITH_IMM:
                        /* If no credit, return. */
                        if (qp->s_lsn != (u32) -1 &&
-                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0)
+                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0) {
+                                qp->s_flags |= IPATH_S_WAIT_SSN_CREDIT;
                                goto bail;
+                        }
                        wqe->lpsn = wqe->psn;
                        if (len > pmtu) {
                                wqe->lpsn += (len - 1) / pmtu;
@@ -325,8 +345,10 @@ int ipath_make_rc_req(struct ipath_qp *qp)
                case IB_WR_RDMA_WRITE_WITH_IMM:
                        /* If no credit, return. */
                        if (qp->s_lsn != (u32) -1 &&
-                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0)
+                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0) {
+                                qp->s_flags |= IPATH_S_WAIT_SSN_CREDIT;
                                goto bail;
+                        }
                        ohdr->u.rc.reth.vaddr =
                                cpu_to_be64(wqe->wr.wr.rdma.remote_addr);
                        ohdr->u.rc.reth.rkey =
@@ -570,7 +592,11 @@ int ipath_make_rc_req(struct ipath_qp *qp)
        ipath_make_ruc_header(dev, qp, ohdr, bth0 | (qp->s_state << 24), bth2);
 done:
        ret = 1;
+        goto unlock;
 bail:
+        qp->s_flags &= ~IPATH_S_BUSY;
+unlock:
        spin_unlock_irqrestore(&qp->s_lock, flags);
        return ret;
 }
@@ -606,7 +632,11 @@ static void send_rc_ack(struct ipath_qp *qp)
        spin_unlock_irqrestore(&qp->s_lock, flags);
+        /* Don't try to send ACKs if the link isn't ACTIVE */
        dd = dev->dd;
+        if (!(dd->ipath_flags & IPATH_LINKACTIVE))
+                goto done;
        piobuf = ipath_getpiobuf(dd, 0, NULL);
        if (!piobuf) {
                /*
@@ -668,15 +698,16 @@ static void send_rc_ack(struct ipath_qp *qp)
        goto done;
 queue_ack:
-        dev->n_rc_qacks++;
+        if (ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK) {
-        qp->s_flags |= IPATH_S_ACK_PENDING;
+                dev->n_rc_qacks++;
-        qp->s_nak_state = qp->r_nak_state;
+                qp->s_flags |= IPATH_S_ACK_PENDING;
-        qp->s_ack_psn = qp->r_ack_psn;
+                qp->s_nak_state = qp->r_nak_state;
+                qp->s_ack_psn = qp->r_ack_psn;
+                /* Schedule the send tasklet. */
+                ipath_schedule_send(qp);
+        }
        spin_unlock_irqrestore(&qp->s_lock, flags);
-        /* Call ipath_do_rc_send() in another thread. */
-        tasklet_hi_schedule(&qp->s_task);
 done:
        return;
 }
@@ -735,7 +766,7 @@ static void reset_psn(struct ipath_qp *qp, u32 psn)
        /*
         * Set the state to restart in the middle of a request.
         * Don't change the s_sge, s_cur_sge, or s_cur_size.
-         * See ipath_do_rc_send().
+         * See ipath_make_rc_req().
         */
        switch (opcode) {
        case IB_WR_SEND:
@@ -771,27 +802,14 @@ done:
 *
 * The QP s_lock should be held and interrupts disabled.
 */
-void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc)
+void ipath_restart_rc(struct ipath_qp *qp, u32 psn)
 {
        struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
        struct ipath_ibdev *dev;
        if (qp->s_retry == 0) {
-                wc->wr_id = wqe->wr.wr_id;
+                ipath_send_complete(qp, wqe, IB_WC_RETRY_EXC_ERR);
-                wc->status = IB_WC_RETRY_EXC_ERR;
+                ipath_error_qp(qp, IB_WC_WR_FLUSH_ERR);
-                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                wc->vendor_err = 0;
-                wc->byte_len = 0;
-                wc->qp = &qp->ibqp;
-                wc->imm_data = 0;
-                wc->src_qp = qp->remote_qpn;
-                wc->wc_flags = 0;
-                wc->pkey_index = 0;
-                wc->slid = qp->remote_ah_attr.dlid;
-                wc->sl = qp->remote_ah_attr.sl;
-                wc->dlid_path_bits = 0;
-                wc->port_num = 0;
-                ipath_sqerror_qp(qp, wc);
                goto bail;
        }
        qp->s_retry--;
@@ -804,6 +822,8 @@ void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc)
        spin_lock(&dev->pending_lock);
        if (!list_empty(&qp->timerwait))
                list_del_init(&qp->timerwait);
+        if (!list_empty(&qp->piowait))
+                list_del_init(&qp->piowait);
        spin_unlock(&dev->pending_lock);
        if (wqe->wr.opcode == IB_WR_RDMA_READ)
@@ -812,7 +832,7 @@ void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc)
                dev->n_rc_resends += (qp->s_psn - psn) & IPATH_PSN_MASK;
        reset_psn(qp, psn);
-        tasklet_hi_schedule(&qp->s_task);
+        ipath_schedule_send(qp);
 bail:
        return;
@@ -820,13 +840,7 @@ bail:
 static inline void update_last_psn(struct ipath_qp *qp, u32 psn)
 {
-        if (qp->s_last_psn != psn) {
+        qp->s_last_psn = psn;
-                qp->s_last_psn = psn;
-                if (qp->s_wait_credit) {
-                        qp->s_wait_credit = 0;
-                        tasklet_hi_schedule(&qp->s_task);
-                }
-        }
 }
 /**
@@ -845,6 +859,7 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
 {
        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
        struct ib_wc wc;
+        enum ib_wc_status status;
        struct ipath_swqe *wqe;
        int ret = 0;
        u32 ack_psn;
@@ -909,7 +924,7 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                         */
                        update_last_psn(qp, wqe->psn - 1);
                        /* Retry this request. */
-                        ipath_restart_rc(qp, wqe->psn, &wc);
+                        ipath_restart_rc(qp, wqe->psn);
                        /*
                         * No need to process the ACK/NAK since we are
                         * restarting an earlier request.
@@ -925,32 +940,23 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                     wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD)) {
                        qp->s_num_rd_atomic--;
                        /* Restart sending task if fence is complete */
-                        if ((qp->s_flags & IPATH_S_FENCE_PENDING) &&
+                        if (((qp->s_flags & IPATH_S_FENCE_PENDING) &&
-                            !qp->s_num_rd_atomic) {
+                             !qp->s_num_rd_atomic) ||
-                                qp->s_flags &= ~IPATH_S_FENCE_PENDING;
+                            qp->s_flags & IPATH_S_RDMAR_PENDING)
-                                tasklet_hi_schedule(&qp->s_task);
+                                ipath_schedule_send(qp);
-                        } else if (qp->s_flags & IPATH_S_RDMAR_PENDING) {
-                                qp->s_flags &= ~IPATH_S_RDMAR_PENDING;
-                                tasklet_hi_schedule(&qp->s_task);
-                        }
                }
                /* Post a send completion queue entry if requested. */
                if (!(qp->s_flags & IPATH_S_SIGNAL_REQ_WR) ||
                    (wqe->wr.send_flags & IB_SEND_SIGNALED)) {
+                        memset(&wc, 0, sizeof wc);
                        wc.wr_id = wqe->wr.wr_id;
                        wc.status = IB_WC_SUCCESS;
                        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                        wc.vendor_err = 0;
                        wc.byte_len = wqe->length;
-                        wc.imm_data = 0;
                        wc.qp = &qp->ibqp;
                        wc.src_qp = qp->remote_qpn;
-                        wc.wc_flags = 0;
-                        wc.pkey_index = 0;
                        wc.slid = qp->remote_ah_attr.dlid;
                        wc.sl = qp->remote_ah_attr.sl;
-                        wc.dlid_path_bits = 0;
-                        wc.port_num = 0;
                        ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 0);
                }
                qp->s_retry = qp->s_retry_cnt;
@@ -971,6 +977,8 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                } else {
                        if (++qp->s_last >= qp->s_size)
                                qp->s_last = 0;
+                        if (qp->state == IB_QPS_SQD && qp->s_last == qp->s_cur)
+                                qp->s_draining = 0;
                        if (qp->s_last == qp->s_tail)
                                break;
                        wqe = get_swqe_ptr(qp, qp->s_last);
@@ -994,7 +1002,7 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                         */
                        if (ipath_cmp24(qp->s_psn, psn) <= 0) {
                                reset_psn(qp, psn + 1);
-                                tasklet_hi_schedule(&qp->s_task);
+                                ipath_schedule_send(qp);
                        }
                } else if (ipath_cmp24(qp->s_psn, psn) <= 0) {
                        qp->s_state = OP(SEND_LAST);
@@ -1012,7 +1020,7 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                if (qp->s_last == qp->s_tail)
                        goto bail;
                if (qp->s_rnr_retry == 0) {
-                        wc.status = IB_WC_RNR_RETRY_EXC_ERR;
+                        status = IB_WC_RNR_RETRY_EXC_ERR;
                        goto class_b;
                }
                if (qp->s_rnr_retry_cnt < 7)
@@ -1033,6 +1041,7 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                        ib_ipath_rnr_table[(aeth >> IPATH_AETH_CREDIT_SHIFT) &
                                           IPATH_AETH_CREDIT_MASK];
                ipath_insert_rnr_queue(qp);
+                ipath_schedule_send(qp);
                goto bail;
        case 3:         /* NAK */
@@ -1050,37 +1059,25 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode,
                         * RDMA READ response which terminates the RDMA
                         * READ.
                         */
-                        ipath_restart_rc(qp, psn, &wc);
+                        ipath_restart_rc(qp, psn);
                        break;
                case 1: /* Invalid Request */
-                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        status = IB_WC_REM_INV_REQ_ERR;
                        dev->n_other_naks++;
                        goto class_b;
                case 2: /* Remote Access Error */
-                        wc.status = IB_WC_REM_ACCESS_ERR;
+                        status = IB_WC_REM_ACCESS_ERR;
                        dev->n_other_naks++;
                        goto class_b;
                case 3: /* Remote Operation Error */
-                        wc.status = IB_WC_REM_OP_ERR;
+                        status = IB_WC_REM_OP_ERR;
                        dev->n_other_naks++;
                class_b:
-                        wc.wr_id = wqe->wr.wr_id;
+                        ipath_send_complete(qp, wqe, status);
-                        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                        ipath_error_qp(qp, IB_WC_WR_FLUSH_ERR);
-                        wc.vendor_err = 0;
-                        wc.byte_len = 0;
-                        wc.qp = &qp->ibqp;
-                        wc.imm_data = 0;
-                        wc.src_qp = qp->remote_qpn;
-                        wc.wc_flags = 0;
-                        wc.pkey_index = 0;
-                        wc.slid = qp->remote_ah_attr.dlid;
-                        wc.sl = qp->remote_ah_attr.sl;
-                        wc.dlid_path_bits = 0;
-                        wc.port_num = 0;
-                        ipath_sqerror_qp(qp, &wc);
                        break;
                default:
@@ -1126,8 +1123,8 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                                     int header_in_data)
 {
        struct ipath_swqe *wqe;
+        enum ib_wc_status status;
        unsigned long flags;
-        struct ib_wc wc;
        int diff;
        u32 pad;
        u32 aeth;
@@ -1135,6 +1132,10 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
        spin_lock_irqsave(&qp->s_lock, flags);
+        /* Double check we can process this now that we hold the s_lock. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK))
+                goto ack_done;
        /* Ignore invalid responses. */
        if (ipath_cmp24(psn, qp->s_next_psn) >= 0)
                goto ack_done;
@@ -1159,6 +1160,7 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
        if (unlikely(qp->s_last == qp->s_tail))
                goto ack_done;
        wqe = get_swqe_ptr(qp, qp->s_last);
+        status = IB_WC_SUCCESS;
        switch (opcode) {
        case OP(ACKNOWLEDGE):
@@ -1187,6 +1189,7 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                wqe = get_swqe_ptr(qp, qp->s_last);
                if (unlikely(wqe->wr.opcode != IB_WR_RDMA_READ))
                        goto ack_op_err;
+                qp->r_flags &= ~IPATH_R_RDMAR_SEQ;
                /*
                 * If this is a response to a resent RDMA read, we
                 * have to be careful to copy the data to the right
@@ -1200,7 +1203,10 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                /* no AETH, no ACK */
                if (unlikely(ipath_cmp24(psn, qp->s_last_psn + 1))) {
                        dev->n_rdma_seq++;
-                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                        if (qp->r_flags & IPATH_R_RDMAR_SEQ)
+                                goto ack_done;
+                        qp->r_flags |= IPATH_R_RDMAR_SEQ;
+                        ipath_restart_rc(qp, qp->s_last_psn + 1);
                        goto ack_done;
                }
                if (unlikely(wqe->wr.opcode != IB_WR_RDMA_READ))
@@ -1261,7 +1267,10 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                /* ACKs READ req. */
                if (unlikely(ipath_cmp24(psn, qp->s_last_psn + 1))) {
                        dev->n_rdma_seq++;
-                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                        if (qp->r_flags & IPATH_R_RDMAR_SEQ)
+                                goto ack_done;
+                        qp->r_flags |= IPATH_R_RDMAR_SEQ;
+                        ipath_restart_rc(qp, qp->s_last_psn + 1);
                        goto ack_done;
                }
                if (unlikely(wqe->wr.opcode != IB_WR_RDMA_READ))
@@ -1291,31 +1300,16 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
                goto ack_done;
        }
-ack_done:
-        spin_unlock_irqrestore(&qp->s_lock, flags);
-        goto bail;
 ack_op_err:
-        wc.status = IB_WC_LOC_QP_OP_ERR;
+        status = IB_WC_LOC_QP_OP_ERR;
        goto ack_err;
 ack_len_err:
-        wc.status = IB_WC_LOC_LEN_ERR;
+        status = IB_WC_LOC_LEN_ERR;
 ack_err:
-        wc.wr_id = wqe->wr.wr_id;
+        ipath_send_complete(qp, wqe, status);
-        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+        ipath_error_qp(qp, IB_WC_WR_FLUSH_ERR);
-        wc.vendor_err = 0;
+ack_done:
-        wc.byte_len = 0;
-        wc.imm_data = 0;
-        wc.qp = &qp->ibqp;
-        wc.src_qp = qp->remote_qpn;
-        wc.wc_flags = 0;
-        wc.pkey_index = 0;
-        wc.slid = qp->remote_ah_attr.dlid;
-        wc.sl = qp->remote_ah_attr.sl;
-        wc.dlid_path_bits = 0;
-        wc.port_num = 0;
-        ipath_sqerror_qp(qp, &wc);
        spin_unlock_irqrestore(&qp->s_lock, flags);
 bail:
        return;
@@ -1384,7 +1378,12 @@ static inline int ipath_rc_rcv_error(struct ipath_ibdev *dev,
        psn &= IPATH_PSN_MASK;
        e = NULL;
        old_req = 1;
        spin_lock_irqsave(&qp->s_lock, flags);
+        /* Double check we can process this now that we hold the s_lock. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK))
+                goto unlock_done;
        for (i = qp->r_head_ack_queue; ; i = prev) {
                if (i == qp->s_tail_ack_queue)
                        old_req = 0;
@@ -1512,7 +1511,7 @@ static inline int ipath_rc_rcv_error(struct ipath_ibdev *dev,
                break;
        }
        qp->r_nak_state = 0;
-        tasklet_hi_schedule(&qp->s_task);
+        ipath_schedule_send(qp);
 unlock_done:
        spin_unlock_irqrestore(&qp->s_lock, flags);
@@ -1523,13 +1522,12 @@ send_ack:
        return 0;
 }
-static void ipath_rc_error(struct ipath_qp *qp, enum ib_wc_status err)
+void ipath_rc_error(struct ipath_qp *qp, enum ib_wc_status err)
 {
        unsigned long flags;
        int lastwqe;
        spin_lock_irqsave(&qp->s_lock, flags);
-        qp->state = IB_QPS_ERR;
        lastwqe = ipath_error_qp(qp, err);
        spin_unlock_irqrestore(&qp->s_lock, flags);
@@ -1545,18 +1543,15 @@ static void ipath_rc_error(struct ipath_qp *qp, enum ib_wc_status err)
 static inline void ipath_update_ack_queue(struct ipath_qp *qp, unsigned n)
 {
-        unsigned long flags;
        unsigned next;
        next = n + 1;
        if (next > IPATH_MAX_RDMA_ATOMIC)
                next = 0;
-        spin_lock_irqsave(&qp->s_lock, flags);
        if (n == qp->s_tail_ack_queue) {
                qp->s_tail_ack_queue = next;
                qp->s_ack_state = OP(ACKNOWLEDGE);
        }
-        spin_unlock_irqrestore(&qp->s_lock, flags);
 }
 /**
@@ -1585,6 +1580,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
        int diff;
        struct ib_reth *reth;
        int header_in_data;
+        unsigned long flags;
        /* Validate the SLID. See Ch. 9.6.1.5 */
        if (unlikely(be16_to_cpu(hdr->lrh[3]) != qp->remote_ah_attr.dlid))
@@ -1643,11 +1639,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                    opcode == OP(SEND_LAST) ||
                    opcode == OP(SEND_LAST_WITH_IMMEDIATE))
                        break;
-        nack_inv:
+                goto nack_inv;
-                ipath_rc_error(qp, IB_WC_REM_INV_REQ_ERR);
-                qp->r_nak_state = IB_NAK_INVALID_REQUEST;
-                qp->r_ack_psn = qp->r_psn;
-                goto send_ack;
        case OP(RDMA_WRITE_FIRST):
        case OP(RDMA_WRITE_MIDDLE):
@@ -1673,18 +1665,13 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                break;
        }
-        wc.imm_data = 0;
+        memset(&wc, 0, sizeof wc);
-        wc.wc_flags = 0;
        /* OK, process the packet. */
        switch (opcode) {
        case OP(SEND_FIRST):
-                if (!ipath_get_rwqe(qp, 0)) {
+                if (!ipath_get_rwqe(qp, 0))
-                rnr_nak:
+                        goto rnr_nak;
-                        qp->r_nak_state = IB_RNR_NAK | qp->r_min_rnr_timer;
-                        qp->r_ack_psn = qp->r_psn;
-                        goto send_ack;
-                }
                qp->r_rcv_len = 0;
                /* FALLTHROUGH */
        case OP(SEND_MIDDLE):
@@ -1741,20 +1728,19 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                        goto nack_inv;
                ipath_copy_sge(&qp->r_sge, data, tlen);
                qp->r_msn++;
-                if (!qp->r_wrid_valid)
+                if (!test_and_clear_bit(IPATH_R_WRID_VALID, &qp->r_aflags))
                        break;
-                qp->r_wrid_valid = 0;
                wc.wr_id = qp->r_wr_id;
                wc.status = IB_WC_SUCCESS;
-                wc.opcode = IB_WC_RECV;
+                if (opcode == OP(RDMA_WRITE_LAST_WITH_IMMEDIATE) ||
-                wc.vendor_err = 0;
+                    opcode == OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE))
+                        wc.opcode = IB_WC_RECV_RDMA_WITH_IMM;
+                else
+                        wc.opcode = IB_WC_RECV;
                wc.qp = &qp->ibqp;
                wc.src_qp = qp->remote_qpn;
-                wc.pkey_index = 0;
                wc.slid = qp->remote_ah_attr.dlid;
                wc.sl = qp->remote_ah_attr.sl;
-                wc.dlid_path_bits = 0;
-                wc.port_num = 0;
                /* Signal completion event if the solicited bit is set. */
                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
                               (ohdr->bth[0] &
@@ -1815,9 +1801,13 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                next = qp->r_head_ack_queue + 1;
                if (next > IPATH_MAX_RDMA_ATOMIC)
                        next = 0;
+                spin_lock_irqsave(&qp->s_lock, flags);
+                /* Double check we can process this while holding the s_lock. */
+                if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK))
+                        goto unlock;
                if (unlikely(next == qp->s_tail_ack_queue)) {
                        if (!qp->s_ack_queue[next].sent)
-                                goto nack_inv;
+                                goto nack_inv_unlck;
                        ipath_update_ack_queue(qp, next);
                }
                e = &qp->s_ack_queue[qp->r_head_ack_queue];
@@ -1838,7 +1828,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                        ok = ipath_rkey_ok(qp, &e->rdma_sge, len, vaddr,
                                           rkey, IB_ACCESS_REMOTE_READ);
                        if (unlikely(!ok))
-                                goto nack_acc;
+                                goto nack_acc_unlck;
                        /*
                         * Update the next expected PSN.  We add 1 later
                         * below, so only add the remainder here.
@@ -1865,13 +1855,12 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                qp->r_psn++;
                qp->r_state = opcode;
                qp->r_nak_state = 0;
-                barrier();
                qp->r_head_ack_queue = next;
-                /* Call ipath_do_rc_send() in another thread. */
+                /* Schedule the send tasklet. */
-                tasklet_hi_schedule(&qp->s_task);
+                ipath_schedule_send(qp);
-                goto done;
+                goto unlock;
        }
        case OP(COMPARE_SWAP):
@@ -1890,9 +1879,13 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                next = qp->r_head_ack_queue + 1;
                if (next > IPATH_MAX_RDMA_ATOMIC)
                        next = 0;
+                spin_lock_irqsave(&qp->s_lock, flags);
+                /* Double check we can process this while holding the s_lock. */
+                if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK))
+                        goto unlock;
                if (unlikely(next == qp->s_tail_ack_queue)) {
                        if (!qp->s_ack_queue[next].sent)
-                                goto nack_inv;
+                                goto nack_inv_unlck;
                        ipath_update_ack_queue(qp, next);
                }
                if (!header_in_data)
@@ -1902,13 +1895,13 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                vaddr = ((u64) be32_to_cpu(ateth->vaddr[0]) << 32) |
                        be32_to_cpu(ateth->vaddr[1]);
                if (unlikely(vaddr & (sizeof(u64) - 1)))
-                        goto nack_inv;
+                        goto nack_inv_unlck;
                rkey = be32_to_cpu(ateth->rkey);
                /* Check rkey & NAK */
                if (unlikely(!ipath_rkey_ok(qp, &qp->r_sge,
                                            sizeof(u64), vaddr, rkey,
                                            IB_ACCESS_REMOTE_ATOMIC)))
-                        goto nack_acc;
+                        goto nack_acc_unlck;
                /* Perform atomic OP and save result. */
                maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
                sdata = be64_to_cpu(ateth->swap_data);
@@ -1925,13 +1918,12 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                qp->r_psn++;
                qp->r_state = opcode;
                qp->r_nak_state = 0;
-                barrier();
                qp->r_head_ack_queue = next;
-                /* Call ipath_do_rc_send() in another thread. */
+                /* Schedule the send tasklet. */
-                tasklet_hi_schedule(&qp->s_task);
+                ipath_schedule_send(qp);
-                goto done;
+                goto unlock;
        }
        default:
@@ -1947,14 +1939,31 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                goto send_ack;
        goto done;
+rnr_nak:
+        qp->r_nak_state = IB_RNR_NAK | qp->r_min_rnr_timer;
+        qp->r_ack_psn = qp->r_psn;
+        goto send_ack;
+nack_inv_unlck:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+nack_inv:
+        ipath_rc_error(qp, IB_WC_LOC_QP_OP_ERR);
+        qp->r_nak_state = IB_NAK_INVALID_REQUEST;
+        qp->r_ack_psn = qp->r_psn;
+        goto send_ack;
+nack_acc_unlck:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
 nack_acc:
-        ipath_rc_error(qp, IB_WC_REM_ACCESS_ERR);
+        ipath_rc_error(qp, IB_WC_LOC_PROT_ERR);
        qp->r_nak_state = IB_NAK_REMOTE_ACCESS_ERROR;
        qp->r_ack_psn = qp->r_psn;
 send_ack:
        send_rc_ack(qp);
+        goto done;
+unlock:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
 done:
        return;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index 8ac5c1d82ccd..a4b5521567fe 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
+ * Copyright (c) 2006, 2007, 2008 QLogic Corporation. All rights reserved.
 * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
 *
 * This software is available to you under a choice of one of two
@@ -78,6 +78,7 @@ const u32 ib_ipath_rnr_table[32] = {
 * ipath_insert_rnr_queue - put QP on the RNR timeout list for the device
 * @qp: the QP
 *
+ * Called with the QP s_lock held and interrupts disabled.
 * XXX Use a simple list for now.  We might need a priority
 * queue if we have lots of QPs waiting for RNR timeouts
 * but that should be rare.
@@ -85,9 +86,9 @@ const u32 ib_ipath_rnr_table[32] = {
 void ipath_insert_rnr_queue(struct ipath_qp *qp)
 {
        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
-        unsigned long flags;
-        spin_lock_irqsave(&dev->pending_lock, flags);
+        /* We already did a spin_lock_irqsave(), so just use spin_lock */
+        spin_lock(&dev->pending_lock);
        if (list_empty(&dev->rnrwait))
                list_add(&qp->timerwait, &dev->rnrwait);
        else {
@@ -109,7 +110,7 @@ void ipath_insert_rnr_queue(struct ipath_qp *qp)
                        nqp->s_rnr_timeout -= qp->s_rnr_timeout;
                list_add(&qp->timerwait, l);
        }
-        spin_unlock_irqrestore(&dev->pending_lock, flags);
+        spin_unlock(&dev->pending_lock);
 }
 /**
@@ -140,20 +141,11 @@ int ipath_init_sge(struct ipath_qp *qp, struct ipath_rwqe *wqe,
        goto bail;
 bad_lkey:
+        memset(&wc, 0, sizeof(wc));
        wc.wr_id = wqe->wr_id;
        wc.status = IB_WC_LOC_PROT_ERR;
        wc.opcode = IB_WC_RECV;
-        wc.vendor_err = 0;
-        wc.byte_len = 0;
-        wc.imm_data = 0;
        wc.qp = &qp->ibqp;
-        wc.src_qp = 0;
-        wc.wc_flags = 0;
-        wc.pkey_index = 0;
-        wc.slid = 0;
-        wc.sl = 0;
-        wc.dlid_path_bits = 0;
-        wc.port_num = 0;
        /* Signal solicited completion event. */
        ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
        ret = 0;
@@ -194,6 +186,11 @@ int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
        }
        spin_lock_irqsave(&rq->lock, flags);
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK)) {
+                ret = 0;
+                goto unlock;
+        }
        wq = rq->wq;
        tail = wq->tail;
        /* Validate tail before using it since it is user writable. */
@@ -201,9 +198,8 @@ int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
                tail = 0;
        do {
                if (unlikely(tail == wq->head)) {
-                        spin_unlock_irqrestore(&rq->lock, flags);
                        ret = 0;
-                        goto bail;
+                        goto unlock;
                }
                /* Make sure entry is read after head index is read. */
                smp_rmb();
@@ -216,7 +212,7 @@ int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
        wq->tail = tail;
        ret = 1;
-        qp->r_wrid_valid = 1;
+        set_bit(IPATH_R_WRID_VALID, &qp->r_aflags);
        if (handler) {
                u32 n;
@@ -243,8 +239,8 @@ int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
                        goto bail;
                }
        }
+unlock:
        spin_unlock_irqrestore(&rq->lock, flags);
 bail:
        return ret;
 }
@@ -270,38 +266,63 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
        struct ib_wc wc;
        u64 sdata;
        atomic64_t *maddr;
+        enum ib_wc_status send_status;
+        /*
+         * Note that we check the responder QP state after
+         * checking the requester's state.
+         */
        qp = ipath_lookup_qpn(&dev->qp_table, sqp->remote_qpn);
-        if (!qp) {
-                dev->n_pkt_drops++;
-                return;
-        }
-again:
        spin_lock_irqsave(&sqp->s_lock, flags);
-        if (!(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_SEND_OK) ||
+        /* Return if we are already busy processing a work request. */
-            sqp->s_rnr_timeout) {
+        if ((sqp->s_flags & (IPATH_S_BUSY | IPATH_S_ANY_WAIT)) ||
-                spin_unlock_irqrestore(&sqp->s_lock, flags);
+            !(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_OR_FLUSH_SEND))
-                goto done;
+                goto unlock;
-        }
-        /* Get the next send request. */
+        sqp->s_flags |= IPATH_S_BUSY;
-        if (sqp->s_last == sqp->s_head) {
-                /* Send work queue is empty. */
+again:
-                spin_unlock_irqrestore(&sqp->s_lock, flags);
+        if (sqp->s_last == sqp->s_head)
-                goto done;
+                goto clr_busy;
+        wqe = get_swqe_ptr(sqp, sqp->s_last);
+        /* Return if it is not OK to start a new work reqeust. */
+        if (!(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_NEXT_SEND_OK)) {
+                if (!(ib_ipath_state_ops[sqp->state] & IPATH_FLUSH_SEND))
+                        goto clr_busy;
+                /* We are in the error state, flush the work request. */
+                send_status = IB_WC_WR_FLUSH_ERR;
+                goto flush_send;
        }
        /*
         * We can rely on the entry not changing without the s_lock
         * being held until we update s_last.
+         * We increment s_cur to indicate s_last is in progress.
         */
-        wqe = get_swqe_ptr(sqp, sqp->s_last);
+        if (sqp->s_last == sqp->s_cur) {
+                if (++sqp->s_cur >= sqp->s_size)
+                        sqp->s_cur = 0;
+        }
        spin_unlock_irqrestore(&sqp->s_lock, flags);
-        wc.wc_flags = 0;
+        if (!qp || !(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK)) {
-        wc.imm_data = 0;
+                dev->n_pkt_drops++;
+                /*
+                 * For RC, the requester would timeout and retry so
+                 * shortcut the timeouts and just signal too many retries.
+                 */
+                if (sqp->ibqp.qp_type == IB_QPT_RC)
+                        send_status = IB_WC_RETRY_EXC_ERR;
+                else
+                        send_status = IB_WC_SUCCESS;
+                goto serr;
+        }
+        memset(&wc, 0, sizeof wc);
+        send_status = IB_WC_SUCCESS;
        sqp->s_sge.sge = wqe->sg_list[0];
        sqp->s_sge.sg_list = wqe->sg_list + 1;
@@ -313,75 +334,33 @@ again:
                wc.imm_data = wqe->wr.ex.imm_data;
                /* FALLTHROUGH */
        case IB_WR_SEND:
-                if (!ipath_get_rwqe(qp, 0)) {
+                if (!ipath_get_rwqe(qp, 0))
-                rnr_nak:
+                        goto rnr_nak;
-                        /* Handle RNR NAK */
-                        if (qp->ibqp.qp_type == IB_QPT_UC)
-                                goto send_comp;
-                        if (sqp->s_rnr_retry == 0) {
-                                wc.status = IB_WC_RNR_RETRY_EXC_ERR;
-                                goto err;
-                        }
-                        if (sqp->s_rnr_retry_cnt < 7)
-                                sqp->s_rnr_retry--;
-                        dev->n_rnr_naks++;
-                        sqp->s_rnr_timeout =
-                                ib_ipath_rnr_table[qp->r_min_rnr_timer];
-                        ipath_insert_rnr_queue(sqp);
-                        goto done;
-                }
                break;
        case IB_WR_RDMA_WRITE_WITH_IMM:
-                if (unlikely(!(qp->qp_access_flags &
+                if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_WRITE)))
-                               IB_ACCESS_REMOTE_WRITE))) {
+                        goto inv_err;
-                        wc.status = IB_WC_REM_INV_REQ_ERR;
-                        goto err;
-                }
                wc.wc_flags = IB_WC_WITH_IMM;
                wc.imm_data = wqe->wr.ex.imm_data;
                if (!ipath_get_rwqe(qp, 1))
                        goto rnr_nak;
                /* FALLTHROUGH */
        case IB_WR_RDMA_WRITE:
-                if (unlikely(!(qp->qp_access_flags &
+                if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_WRITE)))
-                               IB_ACCESS_REMOTE_WRITE))) {
+                        goto inv_err;
-                        wc.status = IB_WC_REM_INV_REQ_ERR;
-                        goto err;
-                }
                if (wqe->length == 0)
                        break;
                if (unlikely(!ipath_rkey_ok(qp, &qp->r_sge, wqe->length,
                                            wqe->wr.wr.rdma.remote_addr,
                                            wqe->wr.wr.rdma.rkey,
-                                            IB_ACCESS_REMOTE_WRITE))) {
+                                            IB_ACCESS_REMOTE_WRITE)))
-                acc_err:
+                        goto acc_err;
-                        wc.status = IB_WC_REM_ACCESS_ERR;
-                err:
-                        wc.wr_id = wqe->wr.wr_id;
-                        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                        wc.vendor_err = 0;
-                        wc.byte_len = 0;
-                        wc.qp = &sqp->ibqp;
-                        wc.src_qp = sqp->remote_qpn;
-                        wc.pkey_index = 0;
-                        wc.slid = sqp->remote_ah_attr.dlid;
-                        wc.sl = sqp->remote_ah_attr.sl;
-                        wc.dlid_path_bits = 0;
-                        wc.port_num = 0;
-                        spin_lock_irqsave(&sqp->s_lock, flags);
-                        ipath_sqerror_qp(sqp, &wc);
-                        spin_unlock_irqrestore(&sqp->s_lock, flags);
-                        goto done;
-                }
                break;
        case IB_WR_RDMA_READ:
-                if (unlikely(!(qp->qp_access_flags &
+                if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_READ)))
-                               IB_ACCESS_REMOTE_READ))) {
+                        goto inv_err;
-                        wc.status = IB_WC_REM_INV_REQ_ERR;
-                        goto err;
-                }
                if (unlikely(!ipath_rkey_ok(qp, &sqp->s_sge, wqe->length,
                                            wqe->wr.wr.rdma.remote_addr,
                                            wqe->wr.wr.rdma.rkey,
@@ -394,11 +373,8 @@ again:
        case IB_WR_ATOMIC_CMP_AND_SWP:
        case IB_WR_ATOMIC_FETCH_AND_ADD:
-                if (unlikely(!(qp->qp_access_flags &
+                if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_ATOMIC)))
-                               IB_ACCESS_REMOTE_ATOMIC))) {
+                        goto inv_err;
-                        wc.status = IB_WC_REM_INV_REQ_ERR;
-                        goto err;
-                }
                if (unlikely(!ipath_rkey_ok(qp, &qp->r_sge, sizeof(u64),
                                            wqe->wr.wr.atomic.remote_addr,
                                            wqe->wr.wr.atomic.rkey,
@@ -415,7 +391,8 @@ again:
                goto send_comp;
        default:
-                goto done;
+                send_status = IB_WC_LOC_QP_OP_ERR;
+                goto serr;
        }
        sge = &sqp->s_sge.sge;
@@ -448,8 +425,7 @@ again:
                sqp->s_len -= len;
        }
-        if (wqe->wr.opcode == IB_WR_RDMA_WRITE ||
+        if (!test_and_clear_bit(IPATH_R_WRID_VALID, &qp->r_aflags))
-            wqe->wr.opcode == IB_WR_RDMA_READ)
                goto send_comp;
        if (wqe->wr.opcode == IB_WR_RDMA_WRITE_WITH_IMM)
@@ -458,32 +434,89 @@ again:
                wc.opcode = IB_WC_RECV;
        wc.wr_id = qp->r_wr_id;
        wc.status = IB_WC_SUCCESS;
-        wc.vendor_err = 0;
        wc.byte_len = wqe->length;
        wc.qp = &qp->ibqp;
        wc.src_qp = qp->remote_qpn;
-        wc.pkey_index = 0;
        wc.slid = qp->remote_ah_attr.dlid;
        wc.sl = qp->remote_ah_attr.sl;
-        wc.dlid_path_bits = 0;
        wc.port_num = 1;
        /* Signal completion event if the solicited bit is set. */
        ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
                       wqe->wr.send_flags & IB_SEND_SOLICITED);
 send_comp:
+        spin_lock_irqsave(&sqp->s_lock, flags);
+flush_send:
        sqp->s_rnr_retry = sqp->s_rnr_retry_cnt;
-        ipath_send_complete(sqp, wqe, IB_WC_SUCCESS);
+        ipath_send_complete(sqp, wqe, send_status);
        goto again;
+rnr_nak:
+        /* Handle RNR NAK */
+        if (qp->ibqp.qp_type == IB_QPT_UC)
+                goto send_comp;
+        /*
+         * Note: we don't need the s_lock held since the BUSY flag
+         * makes this single threaded.
+         */
+        if (sqp->s_rnr_retry == 0) {
+                send_status = IB_WC_RNR_RETRY_EXC_ERR;
+                goto serr;
+        }
+        if (sqp->s_rnr_retry_cnt < 7)
+                sqp->s_rnr_retry--;
+        spin_lock_irqsave(&sqp->s_lock, flags);
+        if (!(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_RECV_OK))
+                goto clr_busy;
+        sqp->s_flags |= IPATH_S_WAITING;
+        dev->n_rnr_naks++;
+        sqp->s_rnr_timeout = ib_ipath_rnr_table[qp->r_min_rnr_timer];
+        ipath_insert_rnr_queue(sqp);
+        goto clr_busy;
+inv_err:
+        send_status = IB_WC_REM_INV_REQ_ERR;
+        wc.status = IB_WC_LOC_QP_OP_ERR;
+        goto err;
+acc_err:
+        send_status = IB_WC_REM_ACCESS_ERR;
+        wc.status = IB_WC_LOC_PROT_ERR;
+err:
+        /* responder goes to error state */
+        ipath_rc_error(qp, wc.status);
+serr:
+        spin_lock_irqsave(&sqp->s_lock, flags);
+        ipath_send_complete(sqp, wqe, send_status);
+        if (sqp->ibqp.qp_type == IB_QPT_RC) {
+                int lastwqe = ipath_error_qp(sqp, IB_WC_WR_FLUSH_ERR);
+                sqp->s_flags &= ~IPATH_S_BUSY;
+                spin_unlock_irqrestore(&sqp->s_lock, flags);
+                if (lastwqe) {
+                        struct ib_event ev;
+                        ev.device = sqp->ibqp.device;
+                        ev.element.qp = &sqp->ibqp;
+                        ev.event = IB_EVENT_QP_LAST_WQE_REACHED;
+                        sqp->ibqp.event_handler(&ev, sqp->ibqp.qp_context);
+                }
+                goto done;
+        }
+clr_busy:
+        sqp->s_flags &= ~IPATH_S_BUSY;
+unlock:
+        spin_unlock_irqrestore(&sqp->s_lock, flags);
 done:
-        if (atomic_dec_and_test(&qp->refcount))
+        if (qp && atomic_dec_and_test(&qp->refcount))
                wake_up(&qp->wait);
 }
-static void want_buffer(struct ipath_devdata *dd)
+static void want_buffer(struct ipath_devdata *dd, struct ipath_qp *qp)
 {
-        if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA)) {
+        if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA) ||
+            qp->ibqp.qp_type == IB_QPT_SMI) {
                unsigned long flags;
                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
@@ -501,26 +534,36 @@ static void want_buffer(struct ipath_devdata *dd)
 * @dev: the device we ran out of buffers on
 *
 * Called when we run out of PIO buffers.
+ * If we are now in the error state, return zero to flush the
+ * send work request.
 */
-static void ipath_no_bufs_available(struct ipath_qp *qp,
+static int ipath_no_bufs_available(struct ipath_qp *qp,
                                    struct ipath_ibdev *dev)
 {
        unsigned long flags;
+        int ret = 1;
        /*
         * Note that as soon as want_buffer() is called and
         * possibly before it returns, ipath_ib_piobufavail()
-         * could be called.  If we are still in the tasklet function,
+         * could be called. Therefore, put QP on the piowait list before
-         * tasklet_hi_schedule() will not call us until the next time
+         * enabling the PIO avail interrupt.
-         * tasklet_hi_schedule() is called.
-         * We leave the busy flag set so that another post send doesn't
-         * try to put the same QP on the piowait list again.
         */
-        spin_lock_irqsave(&dev->pending_lock, flags);
+        spin_lock_irqsave(&qp->s_lock, flags);
-        list_add_tail(&qp->piowait, &dev->piowait);
+        if (ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK) {
-        spin_unlock_irqrestore(&dev->pending_lock, flags);
+                dev->n_piowait++;
-        want_buffer(dev->dd);
+                qp->s_flags |= IPATH_S_WAITING;
-        dev->n_piowait++;
+                qp->s_flags &= ~IPATH_S_BUSY;
+                spin_lock(&dev->pending_lock);
+                if (list_empty(&qp->piowait))
+                        list_add_tail(&qp->piowait, &dev->piowait);
+                spin_unlock(&dev->pending_lock);
+        } else
+                ret = 0;
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+        if (ret)
+                want_buffer(dev->dd, qp);
+        return ret;
 }
 /**
@@ -596,15 +639,13 @@ void ipath_do_send(unsigned long data)
        struct ipath_qp *qp = (struct ipath_qp *)data;
        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
        int (*make_req)(struct ipath_qp *qp);
+        unsigned long flags;
-        if (test_and_set_bit(IPATH_S_BUSY, &qp->s_busy))
-                goto bail;
        if ((qp->ibqp.qp_type == IB_QPT_RC ||
             qp->ibqp.qp_type == IB_QPT_UC) &&
            qp->remote_ah_attr.dlid == dev->dd->ipath_lid) {
                ipath_ruc_loopback(qp);
-                goto clear;
+                goto bail;
        }
        if (qp->ibqp.qp_type == IB_QPT_RC)
@@ -614,6 +655,19 @@ void ipath_do_send(unsigned long data)
        else
               make_req = ipath_make_ud_req;
+        spin_lock_irqsave(&qp->s_lock, flags);
+        /* Return if we are already busy processing a work request. */
+        if ((qp->s_flags & (IPATH_S_BUSY | IPATH_S_ANY_WAIT)) ||
+            !(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_OR_FLUSH_SEND)) {
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                goto bail;
+        }
+        qp->s_flags |= IPATH_S_BUSY;
+        spin_unlock_irqrestore(&qp->s_lock, flags);
 again:
        /* Check for a constructed packet to be sent. */
        if (qp->s_hdrwords != 0) {
@@ -623,8 +677,8 @@ again:
                 */
                if (ipath_verbs_send(qp, &qp->s_hdr, qp->s_hdrwords,
                                     qp->s_cur_sge, qp->s_cur_size)) {
-                        ipath_no_bufs_available(qp, dev);
+                        if (ipath_no_bufs_available(qp, dev))
-                        goto bail;
+                                goto bail;
                }
                dev->n_unicast_xmit++;
                /* Record that we sent the packet and s_hdr is empty. */
@@ -633,16 +687,20 @@ again:
        if (make_req(qp))
                goto again;
-clear:
-        clear_bit(IPATH_S_BUSY, &qp->s_busy);
 bail:;
 }
+/*
+ * This should be called with s_lock held.
+ */
 void ipath_send_complete(struct ipath_qp *qp, struct ipath_swqe *wqe,
                         enum ib_wc_status status)
 {
-        unsigned long flags;
+        u32 old_last, last;
-        u32 last;
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_OR_FLUSH_SEND))
+                return;
        /* See ch. 11.2.4.1 and 10.7.3.1 */
        if (!(qp->s_flags & IPATH_S_SIGNAL_REQ_WR) ||
@@ -650,27 +708,25 @@ void ipath_send_complete(struct ipath_qp *qp, struct ipath_swqe *wqe,
            status != IB_WC_SUCCESS) {
                struct ib_wc wc;
+                memset(&wc, 0, sizeof wc);
                wc.wr_id = wqe->wr.wr_id;
                wc.status = status;
                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                wc.vendor_err = 0;
-                wc.byte_len = wqe->length;
-                wc.imm_data = 0;
                wc.qp = &qp->ibqp;
-                wc.src_qp = 0;
+                if (status == IB_WC_SUCCESS)
-                wc.wc_flags = 0;
+                        wc.byte_len = wqe->length;
-                wc.pkey_index = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc,
-                wc.slid = 0;
+                               status != IB_WC_SUCCESS);
-                wc.sl = 0;
-                wc.dlid_path_bits = 0;
-                wc.port_num = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 0);
        }
-        spin_lock_irqsave(&qp->s_lock, flags);
+        old_last = last = qp->s_last;
-        last = qp->s_last;
        if (++last >= qp->s_size)
                last = 0;
        qp->s_last = last;
-        spin_unlock_irqrestore(&qp->s_lock, flags);
+        if (qp->s_cur == old_last)
+                qp->s_cur = last;
+        if (qp->s_tail == old_last)
+                qp->s_tail = last;
+        if (qp->state == IB_QPS_SQD && last == qp->s_cur)
+                qp->s_draining = 0;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_sdma.c b/drivers/infiniband/hw/ipath/ipath_sdma.c
index 1974df7a9f78..3697449c1ba4 100644
--- a/drivers/infiniband/hw/ipath/ipath_sdma.c
+++ b/drivers/infiniband/hw/ipath/ipath_sdma.c
@@ -308,13 +308,15 @@ static void sdma_abort_task(unsigned long opaque)
                spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
                /*
-                 * Don't restart sdma here. Wait until link is up to ACTIVE.
+                 * Don't restart sdma here (with the exception
-                 * VL15 MADs used to bring the link up use PIO, and multiple
+                 * below). Wait until link is up to ACTIVE.  VL15 MADs
-                 * link transitions otherwise cause the sdma engine to be
+                 * used to bring the link up use PIO, and multiple link
+                 * transitions otherwise cause the sdma engine to be
                 * stopped and started multiple times.
-                 * The disable is done here, including the shadow, so the
+                 * The disable is done here, including the shadow,
-                 * state is kept consistent.
+                 * so the state is kept consistent.
-                 * See ipath_restart_sdma() for the actual starting of sdma.
+                 * See ipath_restart_sdma() for the actual starting
+                 * of sdma.
                 */
                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
                dd->ipath_sendctrl &= ~INFINIPATH_S_SDMAENABLE;
@@ -326,6 +328,13 @@ static void sdma_abort_task(unsigned long opaque)
                /* make sure I see next message */
                dd->ipath_sdma_abort_jiffies = 0;
+                /*
+                 * Not everything that takes SDMA offline is a link
+                 * status change.  If the link was up, restart SDMA.
+                 */
+                if (dd->ipath_flags & IPATH_LINKACTIVE)
+                        ipath_restart_sdma(dd);
                goto done;
        }
@@ -427,7 +436,12 @@ int setup_sdma(struct ipath_devdata *dd)
                goto done;
        }
-        dd->ipath_sdma_status = 0;
+        /*
+         * Set initial status as if we had been up, then gone down.
+         * This lets initial start on transition to ACTIVE be the
+         * same as restart after link flap.
+         */
+        dd->ipath_sdma_status = IPATH_SDMA_ABORT_ABORTED;
        dd->ipath_sdma_abort_jiffies = 0;
        dd->ipath_sdma_generation = 0;
        dd->ipath_sdma_descq_tail = 0;
@@ -449,16 +463,19 @@ int setup_sdma(struct ipath_devdata *dd)
        ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmaheadaddr,
                         dd->ipath_sdma_head_phys);
-        /* Reserve all the former "kernel" piobufs */
+        /*
-        n = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k - dd->ipath_pioreserved;
+         * Reserve all the former "kernel" piobufs, using high number range
-        for (i = dd->ipath_lastport_piobuf; i < n; ++i) {
+         * so we get as many 4K buffers as possible
+         */
+        n = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k;
+        i = dd->ipath_lastport_piobuf + dd->ipath_pioreserved;
+        ipath_chg_pioavailkernel(dd, i, n - i , 0);
+        for (; i < n; ++i) {
                unsigned word = i / 64;
                unsigned bit = i & 63;
                BUG_ON(word >= 3);
                senddmabufmask[word] |= 1ULL << bit;
        }
-        ipath_chg_pioavailkernel(dd, dd->ipath_lastport_piobuf,
-                n - dd->ipath_lastport_piobuf, 0);
        ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmabufmask0,
                         senddmabufmask[0]);
        ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmabufmask1,
@@ -615,6 +632,9 @@ void ipath_restart_sdma(struct ipath_devdata *dd)
        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
        spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
+        /* notify upper layers */
+        ipath_ib_piobufavail(dd->verbs_dev);
 bail:
        return;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_uc.c b/drivers/infiniband/hw/ipath/ipath_uc.c
index bfe8926b5514..7fd18e833907 100644
--- a/drivers/infiniband/hw/ipath/ipath_uc.c
+++ b/drivers/infiniband/hw/ipath/ipath_uc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2007 QLogic Corporation. All rights reserved.
+ * Copyright (c) 2006, 2007, 2008 QLogic Corporation. All rights reserved.
 * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
 *
 * This software is available to you under a choice of one of two
@@ -47,14 +47,30 @@ int ipath_make_uc_req(struct ipath_qp *qp)
 {
        struct ipath_other_headers *ohdr;
        struct ipath_swqe *wqe;
+        unsigned long flags;
        u32 hwords;
        u32 bth0;
        u32 len;
        u32 pmtu = ib_mtu_enum_to_int(qp->path_mtu);
        int ret = 0;
-        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK))
+        spin_lock_irqsave(&qp->s_lock, flags);
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)) {
+                if (!(ib_ipath_state_ops[qp->state] & IPATH_FLUSH_SEND))
+                        goto bail;
+                /* We are in the error state, flush the work request. */
+                if (qp->s_last == qp->s_head)
+                        goto bail;
+                /* If DMAs are in progress, we can't flush immediately. */
+                if (atomic_read(&qp->s_dma_busy)) {
+                        qp->s_flags |= IPATH_S_WAIT_DMA;
+                        goto bail;
+                }
+                wqe = get_swqe_ptr(qp, qp->s_last);
+                ipath_send_complete(qp, wqe, IB_WC_WR_FLUSH_ERR);
                goto done;
+        }
        ohdr = &qp->s_hdr.u.oth;
        if (qp->remote_ah_attr.ah_flags & IB_AH_GRH)
@@ -69,9 +85,12 @@ int ipath_make_uc_req(struct ipath_qp *qp)
        qp->s_wqe = NULL;
        switch (qp->s_state) {
        default:
+                if (!(ib_ipath_state_ops[qp->state] &
+                    IPATH_PROCESS_NEXT_SEND_OK))
+                        goto bail;
                /* Check if send work queue is empty. */
                if (qp->s_cur == qp->s_head)
-                        goto done;
+                        goto bail;
                /*
                 * Start a new request.
                 */
@@ -134,7 +153,7 @@ int ipath_make_uc_req(struct ipath_qp *qp)
                        break;
                default:
-                        goto done;
+                        goto bail;
                }
                break;
@@ -194,9 +213,14 @@ int ipath_make_uc_req(struct ipath_qp *qp)
        ipath_make_ruc_header(to_idev(qp->ibqp.device),
                              qp, ohdr, bth0 | (qp->s_state << 24),
                              qp->s_next_psn++ & IPATH_PSN_MASK);
+done:
        ret = 1;
+        goto unlock;
-done:
+bail:
+        qp->s_flags &= ~IPATH_S_BUSY;
+unlock:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
        return ret;
 }
@@ -258,8 +282,7 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         */
        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
-        wc.imm_data = 0;
+        memset(&wc, 0, sizeof wc);
-        wc.wc_flags = 0;
        /* Compare the PSN verses the expected PSN. */
        if (unlikely(ipath_cmp24(psn, qp->r_psn) != 0)) {
@@ -322,8 +345,8 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
        case OP(SEND_ONLY):
        case OP(SEND_ONLY_WITH_IMMEDIATE):
        send_first:
-                if (qp->r_reuse_sge) {
+                if (qp->r_flags & IPATH_R_REUSE_SGE) {
-                        qp->r_reuse_sge = 0;
+                        qp->r_flags &= ~IPATH_R_REUSE_SGE;
                        qp->r_sge = qp->s_rdma_read_sge;
                } else if (!ipath_get_rwqe(qp, 0)) {
                        dev->n_pkt_drops++;
@@ -340,13 +363,13 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
        case OP(SEND_MIDDLE):
                /* Check for invalid length PMTU or posted rwqe len. */
                if (unlikely(tlen != (hdrsize + pmtu + 4))) {
-                        qp->r_reuse_sge = 1;
+                        qp->r_flags |= IPATH_R_REUSE_SGE;
                        dev->n_pkt_drops++;
                        goto done;
                }
                qp->r_rcv_len += pmtu;
                if (unlikely(qp->r_rcv_len > qp->r_len)) {
-                        qp->r_reuse_sge = 1;
+                        qp->r_flags |= IPATH_R_REUSE_SGE;
                        dev->n_pkt_drops++;
                        goto done;
                }
@@ -372,7 +395,7 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                /* Check for invalid length. */
                /* XXX LAST len should be >= 1 */
                if (unlikely(tlen < (hdrsize + pad + 4))) {
-                        qp->r_reuse_sge = 1;
+                        qp->r_flags |= IPATH_R_REUSE_SGE;
                        dev->n_pkt_drops++;
                        goto done;
                }
@@ -380,7 +403,7 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                tlen -= (hdrsize + pad + 4);
                wc.byte_len = tlen + qp->r_rcv_len;
                if (unlikely(wc.byte_len > qp->r_len)) {
-                        qp->r_reuse_sge = 1;
+                        qp->r_flags |= IPATH_R_REUSE_SGE;
                        dev->n_pkt_drops++;
                        goto done;
                }
@@ -390,14 +413,10 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                wc.wr_id = qp->r_wr_id;
                wc.status = IB_WC_SUCCESS;
                wc.opcode = IB_WC_RECV;
-                wc.vendor_err = 0;
                wc.qp = &qp->ibqp;
                wc.src_qp = qp->remote_qpn;
-                wc.pkey_index = 0;
                wc.slid = qp->remote_ah_attr.dlid;
                wc.sl = qp->remote_ah_attr.sl;
-                wc.dlid_path_bits = 0;
-                wc.port_num = 0;
                /* Signal completion event if the solicited bit is set. */
                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
                               (ohdr->bth[0] &
@@ -488,8 +507,8 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                        dev->n_pkt_drops++;
                        goto done;
                }
-                if (qp->r_reuse_sge)
+                if (qp->r_flags & IPATH_R_REUSE_SGE)
-                        qp->r_reuse_sge = 0;
+                        qp->r_flags &= ~IPATH_R_REUSE_SGE;
                else if (!ipath_get_rwqe(qp, 1)) {
                        dev->n_pkt_drops++;
                        goto done;
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 8b6a261c89e3..77ca8ca74e78 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -65,9 +65,9 @@ static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_swqe *swqe)
        u32 length;
        qp = ipath_lookup_qpn(&dev->qp_table, swqe->wr.wr.ud.remote_qpn);
-        if (!qp) {
+        if (!qp || !(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK)) {
                dev->n_pkt_drops++;
-                goto send_comp;
+                goto done;
        }
        rsge.sg_list = NULL;
@@ -91,14 +91,12 @@ static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_swqe *swqe)
         * present on the wire.
         */
        length = swqe->length;
+        memset(&wc, 0, sizeof wc);
        wc.byte_len = length + sizeof(struct ib_grh);
        if (swqe->wr.opcode == IB_WR_SEND_WITH_IMM) {
                wc.wc_flags = IB_WC_WITH_IMM;
                wc.imm_data = swqe->wr.ex.imm_data;
-        } else {
-                wc.wc_flags = 0;
-                wc.imm_data = 0;
        }
        /*
@@ -229,7 +227,6 @@ static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_swqe *swqe)
        }
        wc.status = IB_WC_SUCCESS;
        wc.opcode = IB_WC_RECV;
-        wc.vendor_err = 0;
        wc.qp = &qp->ibqp;
        wc.src_qp = sqp->ibqp.qp_num;
        /* XXX do we know which pkey matched? Only needed for GSI. */
@@ -248,8 +245,7 @@ drop:
        kfree(rsge.sg_list);
        if (atomic_dec_and_test(&qp->refcount))
                wake_up(&qp->wait);
-send_comp:
+done:;
-        ipath_send_complete(sqp, swqe, IB_WC_SUCCESS);
 }
 /**
@@ -264,6 +260,7 @@ int ipath_make_ud_req(struct ipath_qp *qp)
        struct ipath_other_headers *ohdr;
        struct ib_ah_attr *ah_attr;
        struct ipath_swqe *wqe;
+        unsigned long flags;
        u32 nwords;
        u32 extra_bytes;
        u32 bth0;
@@ -271,13 +268,30 @@ int ipath_make_ud_req(struct ipath_qp *qp)
        u16 lid;
        int ret = 0;
-        if (unlikely(!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)))
+        spin_lock_irqsave(&qp->s_lock, flags);
-                goto bail;
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_NEXT_SEND_OK)) {
+                if (!(ib_ipath_state_ops[qp->state] & IPATH_FLUSH_SEND))
+                        goto bail;
+                /* We are in the error state, flush the work request. */
+                if (qp->s_last == qp->s_head)
+                        goto bail;
+                /* If DMAs are in progress, we can't flush immediately. */
+                if (atomic_read(&qp->s_dma_busy)) {
+                        qp->s_flags |= IPATH_S_WAIT_DMA;
+                        goto bail;
+                }
+                wqe = get_swqe_ptr(qp, qp->s_last);
+                ipath_send_complete(qp, wqe, IB_WC_WR_FLUSH_ERR);
+                goto done;
+        }
        if (qp->s_cur == qp->s_head)
                goto bail;
        wqe = get_swqe_ptr(qp, qp->s_cur);
+        if (++qp->s_cur >= qp->s_size)
+                qp->s_cur = 0;
        /* Construct the header. */
        ah_attr = &to_iah(wqe->wr.wr.ud.ah)->attr;
@@ -288,10 +302,23 @@ int ipath_make_ud_req(struct ipath_qp *qp)
                        dev->n_unicast_xmit++;
        } else {
                dev->n_unicast_xmit++;
-                lid = ah_attr->dlid &
+                lid = ah_attr->dlid & ~((1 << dev->dd->ipath_lmc) - 1);
-                        ~((1 << dev->dd->ipath_lmc) - 1);
                if (unlikely(lid == dev->dd->ipath_lid)) {
+                        /*
+                         * If DMAs are in progress, we can't generate
+                         * a completion for the loopback packet since
+                         * it would be out of order.
+                         * XXX Instead of waiting, we could queue a
+                         * zero length descriptor so we get a callback.
+                         */
+                        if (atomic_read(&qp->s_dma_busy)) {
+                                qp->s_flags |= IPATH_S_WAIT_DMA;
+                                goto bail;
+                        }
+                        spin_unlock_irqrestore(&qp->s_lock, flags);
                        ipath_ud_loopback(qp, wqe);
+                        spin_lock_irqsave(&qp->s_lock, flags);
+                        ipath_send_complete(qp, wqe, IB_WC_SUCCESS);
                        goto done;
                }
        }
@@ -368,11 +395,13 @@ int ipath_make_ud_req(struct ipath_qp *qp)
        ohdr->u.ud.deth[1] = cpu_to_be32(qp->ibqp.qp_num);
 done:
-        if (++qp->s_cur >= qp->s_size)
-                qp->s_cur = 0;
        ret = 1;
+        goto unlock;
 bail:
+        qp->s_flags &= ~IPATH_S_BUSY;
+unlock:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
        return ret;
 }
@@ -506,8 +535,8 @@ void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
        /*
         * Get the next work request entry to find where to put the data.
         */
-        if (qp->r_reuse_sge)
+        if (qp->r_flags & IPATH_R_REUSE_SGE)
-                qp->r_reuse_sge = 0;
+                qp->r_flags &= ~IPATH_R_REUSE_SGE;
        else if (!ipath_get_rwqe(qp, 0)) {
                /*
                 * Count VL15 packets dropped due to no receive buffer.
@@ -523,7 +552,7 @@ void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
        }
        /* Silently drop packets which are too big. */
        if (wc.byte_len > qp->r_len) {
-                qp->r_reuse_sge = 1;
+                qp->r_flags |= IPATH_R_REUSE_SGE;
                dev->n_pkt_drops++;
                goto bail;
        }
@@ -535,7 +564,8 @@ void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                ipath_skip_sge(&qp->r_sge, sizeof(struct ib_grh));
        ipath_copy_sge(&qp->r_sge, data,
                       wc.byte_len - sizeof(struct ib_grh));
-        qp->r_wrid_valid = 0;
+        if (!test_and_clear_bit(IPATH_R_WRID_VALID, &qp->r_aflags))
+                goto bail;
        wc.wr_id = qp->r_wr_id;
        wc.status = IB_WC_SUCCESS;
        wc.opcode = IB_WC_RECV;
diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.h b/drivers/infiniband/hw/ipath/ipath_user_sdma.h
index e70946c1428c..fc76316c4a58 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_sdma.h
+++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.h
@@ -45,8 +45,6 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd,
 int ipath_user_sdma_make_progress(struct ipath_devdata *dd,
                                  struct ipath_user_sdma_queue *pq);
-int ipath_user_sdma_pkt_sent(const struct ipath_user_sdma_queue *pq,
-                             u32 counter);
 void ipath_user_sdma_queue_drain(struct ipath_devdata *dd,
                                 struct ipath_user_sdma_queue *pq);
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index e63927cce5b5..e0ec540042bf 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -111,16 +111,24 @@ static unsigned int ib_ipath_disable_sma;
 module_param_named(disable_sma, ib_ipath_disable_sma, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(disable_sma, "Disable the SMA");
+/*
+ * Note that it is OK to post send work requests in the SQE and ERR
+ * states; ipath_do_send() will process them and generate error
+ * completions as per IB 1.2 C10-96.
+ */
 const int ib_ipath_state_ops[IB_QPS_ERR + 1] = {
        [IB_QPS_RESET] = 0,
        [IB_QPS_INIT] = IPATH_POST_RECV_OK,
        [IB_QPS_RTR] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK,
        [IB_QPS_RTS] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK |
-            IPATH_POST_SEND_OK | IPATH_PROCESS_SEND_OK,
+            IPATH_POST_SEND_OK | IPATH_PROCESS_SEND_OK |
+            IPATH_PROCESS_NEXT_SEND_OK,
        [IB_QPS_SQD] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK |
-            IPATH_POST_SEND_OK,
+            IPATH_POST_SEND_OK | IPATH_PROCESS_SEND_OK,
-        [IB_QPS_SQE] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK,
+        [IB_QPS_SQE] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK |
-        [IB_QPS_ERR] = 0,
+            IPATH_POST_SEND_OK | IPATH_FLUSH_SEND,
+        [IB_QPS_ERR] = IPATH_POST_RECV_OK | IPATH_FLUSH_RECV |
+            IPATH_POST_SEND_OK | IPATH_FLUSH_SEND,
 };
 struct ipath_ucontext {
@@ -230,18 +238,6 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
        }
 }
-static void ipath_flush_wqe(struct ipath_qp *qp, struct ib_send_wr *wr)
-{
-        struct ib_wc wc;
-        memset(&wc, 0, sizeof(wc));
-        wc.wr_id = wr->wr_id;
-        wc.status = IB_WC_WR_FLUSH_ERR;
-        wc.opcode = ib_ipath_wc_opcode[wr->opcode];
-        wc.qp = &qp->ibqp;
-        ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
-}
 /*
 * Count the number of DMA descriptors needed to send length bytes of data.
 * Don't modify the ipath_sge_state to get the count.
@@ -347,14 +343,8 @@ static int ipath_post_one_send(struct ipath_qp *qp, struct ib_send_wr *wr)
        spin_lock_irqsave(&qp->s_lock, flags);
        /* Check that state is OK to post send. */
-        if (unlikely(!(ib_ipath_state_ops[qp->state] & IPATH_POST_SEND_OK))) {
+        if (unlikely(!(ib_ipath_state_ops[qp->state] & IPATH_POST_SEND_OK)))
-                if (qp->state != IB_QPS_SQE && qp->state != IB_QPS_ERR)
+                goto bail_inval;
-                        goto bail_inval;
-                /* C10-96 says generate a flushed completion entry. */
-                ipath_flush_wqe(qp, wr);
-                ret = 0;
-                goto bail;
-        }
        /* IB spec says that num_sge == 0 is OK. */
        if (wr->num_sge > qp->s_max_sge)
@@ -396,7 +386,6 @@ static int ipath_post_one_send(struct ipath_qp *qp, struct ib_send_wr *wr)
        wqe = get_swqe_ptr(qp, qp->s_head);
        wqe->wr = *wr;
-        wqe->ssn = qp->s_ssn++;
        wqe->length = 0;
        if (wr->num_sge) {
                acc = wr->opcode >= IB_WR_RDMA_READ ?
@@ -422,6 +411,7 @@ static int ipath_post_one_send(struct ipath_qp *qp, struct ib_send_wr *wr)
                        goto bail_inval;
        } else if (wqe->length > to_idev(qp->ibqp.device)->dd->ipath_ibmtu)
                goto bail_inval;
+        wqe->ssn = qp->s_ssn++;
        qp->s_head = next;
        ret = 0;
@@ -677,6 +667,7 @@ bail:;
 static void ipath_ib_timer(struct ipath_ibdev *dev)
 {
        struct ipath_qp *resend = NULL;
+        struct ipath_qp *rnr = NULL;
        struct list_head *last;
        struct ipath_qp *qp;
        unsigned long flags;
@@ -703,7 +694,9 @@ static void ipath_ib_timer(struct ipath_ibdev *dev)
                if (--qp->s_rnr_timeout == 0) {
                        do {
                                list_del_init(&qp->timerwait);
-                                tasklet_hi_schedule(&qp->s_task);
+                                qp->timer_next = rnr;
+                                rnr = qp;
+                                atomic_inc(&qp->refcount);
                                if (list_empty(last))
                                        break;
                                qp = list_entry(last->next, struct ipath_qp,
@@ -743,13 +736,15 @@ static void ipath_ib_timer(struct ipath_ibdev *dev)
        spin_unlock_irqrestore(&dev->pending_lock, flags);
        /* XXX What if timer fires again while this is running? */
-        for (qp = resend; qp != NULL; qp = qp->timer_next) {
+        while (resend != NULL) {
-                struct ib_wc wc;
+                qp = resend;
+                resend = qp->timer_next;
                spin_lock_irqsave(&qp->s_lock, flags);
-                if (qp->s_last != qp->s_tail && qp->state == IB_QPS_RTS) {
+                if (qp->s_last != qp->s_tail &&
+                    ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK) {
                        dev->n_timeouts++;
-                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                        ipath_restart_rc(qp, qp->s_last_psn + 1);
                }
                spin_unlock_irqrestore(&qp->s_lock, flags);
@@ -757,6 +752,19 @@ static void ipath_ib_timer(struct ipath_ibdev *dev)
                if (atomic_dec_and_test(&qp->refcount))
                        wake_up(&qp->wait);
        }
+        while (rnr != NULL) {
+                qp = rnr;
+                rnr = qp->timer_next;
+                spin_lock_irqsave(&qp->s_lock, flags);
+                if (ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)
+                        ipath_schedule_send(qp);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                /* Notify ipath_destroy_qp() if it is waiting. */
+                if (atomic_dec_and_test(&qp->refcount))
+                        wake_up(&qp->wait);
+        }
 }
 static void update_sge(struct ipath_sge_state *ss, u32 length)
@@ -1012,13 +1020,24 @@ static void sdma_complete(void *cookie, int status)
        struct ipath_verbs_txreq *tx = cookie;
        struct ipath_qp *qp = tx->qp;
        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        unsigned int flags;
+        enum ib_wc_status ibs = status == IPATH_SDMA_TXREQ_S_OK ?
+                IB_WC_SUCCESS : IB_WC_WR_FLUSH_ERR;
-        /* Generate a completion queue entry if needed */
+        if (atomic_dec_and_test(&qp->s_dma_busy)) {
-        if (qp->ibqp.qp_type != IB_QPT_RC && tx->wqe) {
+                spin_lock_irqsave(&qp->s_lock, flags);
-                enum ib_wc_status ibs = status == IPATH_SDMA_TXREQ_S_OK ?
+                if (tx->wqe)
-                        IB_WC_SUCCESS : IB_WC_WR_FLUSH_ERR;
+                        ipath_send_complete(qp, tx->wqe, ibs);
+                if ((ib_ipath_state_ops[qp->state] & IPATH_FLUSH_SEND &&
+                     qp->s_last != qp->s_head) ||
+                    (qp->s_flags & IPATH_S_WAIT_DMA))
+                        ipath_schedule_send(qp);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                wake_up(&qp->wait_dma);
+        } else if (tx->wqe) {
+                spin_lock_irqsave(&qp->s_lock, flags);
                ipath_send_complete(qp, tx->wqe, ibs);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
        }
        if (tx->txreq.flags & IPATH_SDMA_TXREQ_F_FREEBUF)
@@ -1029,6 +1048,21 @@ static void sdma_complete(void *cookie, int status)
                wake_up(&qp->wait);
 }
+static void decrement_dma_busy(struct ipath_qp *qp)
+{
+        unsigned int flags;
+        if (atomic_dec_and_test(&qp->s_dma_busy)) {
+                spin_lock_irqsave(&qp->s_lock, flags);
+                if ((ib_ipath_state_ops[qp->state] & IPATH_FLUSH_SEND &&
+                     qp->s_last != qp->s_head) ||
+                    (qp->s_flags & IPATH_S_WAIT_DMA))
+                        ipath_schedule_send(qp);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                wake_up(&qp->wait_dma);
+        }
+}
 /*
 * Compute the number of clock cycles of delay before sending the next packet.
 * The multipliers reflect the number of clocks for the fastest rate so
@@ -1067,9 +1101,12 @@ static int ipath_verbs_send_dma(struct ipath_qp *qp,
        if (tx) {
                qp->s_tx = NULL;
                /* resend previously constructed packet */
+                atomic_inc(&qp->s_dma_busy);
                ret = ipath_sdma_verbs_send(dd, tx->ss, tx->len, tx);
-                if (ret)
+                if (ret) {
                        qp->s_tx = tx;
+                        decrement_dma_busy(qp);
+                }
                goto bail;
        }
@@ -1120,12 +1157,14 @@ static int ipath_verbs_send_dma(struct ipath_qp *qp,
                tx->txreq.sg_count = ndesc;
                tx->map_len = (hdrwords + 2) << 2;
                tx->txreq.map_addr = &tx->hdr;
+                atomic_inc(&qp->s_dma_busy);
                ret = ipath_sdma_verbs_send(dd, ss, dwords, tx);
                if (ret) {
                        /* save ss and length in dwords */
                        tx->ss = ss;
                        tx->len = dwords;
                        qp->s_tx = tx;
+                        decrement_dma_busy(qp);
                }
                goto bail;
        }
@@ -1146,6 +1185,7 @@ static int ipath_verbs_send_dma(struct ipath_qp *qp,
        memcpy(piobuf, hdr, hdrwords << 2);
        ipath_copy_from_sge(piobuf + hdrwords, ss, len);
+        atomic_inc(&qp->s_dma_busy);
        ret = ipath_sdma_verbs_send(dd, NULL, 0, tx);
        /*
         * If we couldn't queue the DMA request, save the info
@@ -1156,6 +1196,7 @@ static int ipath_verbs_send_dma(struct ipath_qp *qp,
                tx->ss = NULL;
                tx->len = 0;
                qp->s_tx = tx;
+                decrement_dma_busy(qp);
        }
        dev->n_unaligned++;
        goto bail;
@@ -1179,6 +1220,7 @@ static int ipath_verbs_send_pio(struct ipath_qp *qp,
        unsigned flush_wc;
        u32 control;
        int ret;
+        unsigned int flags;
        piobuf = ipath_getpiobuf(dd, plen, NULL);
        if (unlikely(piobuf == NULL)) {
@@ -1249,8 +1291,11 @@ static int ipath_verbs_send_pio(struct ipath_qp *qp,
        }
        copy_io(piobuf, ss, len, flush_wc);
 done:
-        if (qp->s_wqe)
+        if (qp->s_wqe) {
+                spin_lock_irqsave(&qp->s_lock, flags);
                ipath_send_complete(qp, qp->s_wqe, IB_WC_SUCCESS);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+        }
        ret = 0;
 bail:
        return ret;
@@ -1283,19 +1328,12 @@ int ipath_verbs_send(struct ipath_qp *qp, struct ipath_ib_header *hdr,
         * can defer SDMA restart until link goes ACTIVE without
         * worrying about just how we got there.
         */
-        if (qp->ibqp.qp_type == IB_QPT_SMI)
+        if (qp->ibqp.qp_type == IB_QPT_SMI ||
+            !(dd->ipath_flags & IPATH_HAS_SEND_DMA))
                ret = ipath_verbs_send_pio(qp, hdr, hdrwords, ss, len,
                                           plen, dwords);
-        /* All non-VL15 packets are dropped if link is not ACTIVE */
-        else if (!(dd->ipath_flags & IPATH_LINKACTIVE)) {
-                if (qp->s_wqe)
-                        ipath_send_complete(qp, qp->s_wqe, IB_WC_SUCCESS);
-                ret = 0;
-        } else if (dd->ipath_flags & IPATH_HAS_SEND_DMA)
-                ret = ipath_verbs_send_dma(qp, hdr, hdrwords, ss, len,
-                                           plen, dwords);
        else
-                ret = ipath_verbs_send_pio(qp, hdr, hdrwords, ss, len,
+                ret = ipath_verbs_send_dma(qp, hdr, hdrwords, ss, len,
                                           plen, dwords);
        return ret;
@@ -1403,27 +1441,46 @@ bail:
 * This is called from ipath_intr() at interrupt level when a PIO buffer is
 * available after ipath_verbs_send() returned an error that no buffers were
 * available.  Return 1 if we consumed all the PIO buffers and we still have
- * QPs waiting for buffers (for now, just do a tasklet_hi_schedule and
+ * QPs waiting for buffers (for now, just restart the send tasklet and
 * return zero).
 */
 int ipath_ib_piobufavail(struct ipath_ibdev *dev)
 {
+        struct list_head *list;
+        struct ipath_qp *qplist;
        struct ipath_qp *qp;
        unsigned long flags;
        if (dev == NULL)
                goto bail;
+        list = &dev->piowait;
+        qplist = NULL;
        spin_lock_irqsave(&dev->pending_lock, flags);
-        while (!list_empty(&dev->piowait)) {
+        while (!list_empty(list)) {
-                qp = list_entry(dev->piowait.next, struct ipath_qp,
+                qp = list_entry(list->next, struct ipath_qp, piowait);
-                                piowait);
                list_del_init(&qp->piowait);
-                clear_bit(IPATH_S_BUSY, &qp->s_busy);
+                qp->pio_next = qplist;
-                tasklet_hi_schedule(&qp->s_task);
+                qplist = qp;
+                atomic_inc(&qp->refcount);
        }
        spin_unlock_irqrestore(&dev->pending_lock, flags);
+        while (qplist != NULL) {
+                qp = qplist;
+                qplist = qp->pio_next;
+                spin_lock_irqsave(&qp->s_lock, flags);
+                if (ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)
+                        ipath_schedule_send(qp);
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                /* Notify ipath_destroy_qp() if it is waiting. */
+                if (atomic_dec_and_test(&qp->refcount))
+                        wake_up(&qp->wait);
+        }
 bail:
        return 0;
 }
@@ -2145,11 +2202,12 @@ bail:
 void ipath_unregister_ib_device(struct ipath_ibdev *dev)
 {
        struct ib_device *ibdev = &dev->ibdev;
+        u32 qps_inuse;
-        disable_timer(dev->dd);
        ib_unregister_device(ibdev);
+        disable_timer(dev->dd);
        if (!list_empty(&dev->pending[0]) ||
            !list_empty(&dev->pending[1]) ||
            !list_empty(&dev->pending[2]))
@@ -2164,7 +2222,10 @@ void ipath_unregister_ib_device(struct ipath_ibdev *dev)
         * Note that ipath_unregister_ib_device() can be called before all
         * the QPs are destroyed!
         */
-        ipath_free_all_qps(&dev->qp_table);
+        qps_inuse = ipath_free_all_qps(&dev->qp_table);
+        if (qps_inuse)
+                ipath_dev_err(dev->dd, "QP memory leak! %u still in use\n",
+                        qps_inuse);
        kfree(dev->qp_table.table);
        kfree(dev->lk_table.table);
        kfree(dev->txreq_bufs);
@@ -2215,17 +2276,14 @@ static ssize_t show_stats(struct device *device, struct device_attribute *attr,
                      "RC OTH NAKs %d\n"
                      "RC timeouts %d\n"
                      "RC RDMA dup %d\n"
-                      "RC stalls   %d\n"
                      "piobuf wait %d\n"
-                      "no piobuf   %d\n"
                      "unaligned   %d\n"
                      "PKT drops   %d\n"
                      "WQE errs    %d\n",
                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
                      dev->n_other_naks, dev->n_timeouts,
-                      dev->n_rdma_dup_busy, dev->n_rc_stalls, dev->n_piowait,
+                      dev->n_rdma_dup_busy, dev->n_piowait, dev->n_unaligned,
-                      dev->n_no_piobuf, dev->n_unaligned,
                      dev->n_pkt_drops, dev->n_wqe_errs);
        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
                const struct ipath_opcode_stats *si = &dev->opstats[i];
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
index 6514aa8306cd..9d12ae8a778e 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.h
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -74,6 +74,11 @@
 #define IPATH_POST_RECV_OK              0x02
 #define IPATH_PROCESS_RECV_OK           0x04
 #define IPATH_PROCESS_SEND_OK           0x08
+#define IPATH_PROCESS_NEXT_SEND_OK      0x10
+#define IPATH_FLUSH_SEND                0x20
+#define IPATH_FLUSH_RECV                0x40
+#define IPATH_PROCESS_OR_FLUSH_SEND \
+        (IPATH_PROCESS_SEND_OK | IPATH_FLUSH_SEND)
 /* IB Performance Manager status values */
 #define IB_PMA_SAMPLE_STATUS_DONE       0x00
@@ -353,12 +358,14 @@ struct ipath_qp {
        struct ib_qp ibqp;
        struct ipath_qp *next;          /* link list for QPN hash table */
        struct ipath_qp *timer_next;    /* link list for ipath_ib_timer() */
+        struct ipath_qp *pio_next;      /* link for ipath_ib_piobufavail() */
        struct list_head piowait;       /* link for wait PIO buf */
        struct list_head timerwait;     /* link for waiting for timeouts */
        struct ib_ah_attr remote_ah_attr;
        struct ipath_ib_header s_hdr;   /* next packet header to send */
        atomic_t refcount;
        wait_queue_head_t wait;
+        wait_queue_head_t wait_dma;
        struct tasklet_struct s_task;
        struct ipath_mmap_info *ip;
        struct ipath_sge_state *s_cur_sge;
@@ -369,7 +376,7 @@ struct ipath_qp {
        struct ipath_sge_state s_rdma_read_sge;
        struct ipath_sge_state r_sge;   /* current receive data */
        spinlock_t s_lock;
-        unsigned long s_busy;
+        atomic_t s_dma_busy;
        u16 s_pkt_delay;
        u16 s_hdrwords;         /* size of s_hdr in 32 bit words */
        u32 s_cur_size;         /* size of send packet in bytes */
@@ -383,6 +390,7 @@ struct ipath_qp {
        u32 s_rnr_timeout;      /* number of milliseconds for RNR timeout */
        u32 r_ack_psn;          /* PSN for next ACK or atomic ACK */
        u64 r_wr_id;            /* ID for current receive WQE */
+        unsigned long r_aflags;
        u32 r_len;              /* total length of r_sge */
        u32 r_rcv_len;          /* receive data len processed */
        u32 r_psn;              /* expected rcv packet sequence number */
@@ -394,8 +402,7 @@ struct ipath_qp {
        u8 r_state;             /* opcode of last packet received */
        u8 r_nak_state;         /* non-zero if NAK is pending */
        u8 r_min_rnr_timer;     /* retry timeout value for RNR NAKs */
-        u8 r_reuse_sge;         /* for UC receive errors */
+        u8 r_flags;
-        u8 r_wrid_valid;        /* r_wrid set but CQ entry not yet made */
        u8 r_max_rd_atomic;     /* max number of RDMA read/atomic to receive */
        u8 r_head_ack_queue;    /* index into s_ack_queue[] */
        u8 qp_access_flags;
@@ -404,13 +411,13 @@ struct ipath_qp {
        u8 s_rnr_retry_cnt;
        u8 s_retry;             /* requester retry counter */
        u8 s_rnr_retry;         /* requester RNR retry counter */
-        u8 s_wait_credit;       /* limit number of unacked packets sent */
        u8 s_pkey_index;        /* PKEY index to use */
        u8 s_max_rd_atomic;     /* max number of RDMA read/atomic to send */
        u8 s_num_rd_atomic;     /* number of RDMA read/atomic pending */
        u8 s_tail_ack_queue;    /* index into s_ack_queue[] */
        u8 s_flags;
        u8 s_dmult;
+        u8 s_draining;
        u8 timeout;             /* Timeout for this QP */
        enum ib_mtu path_mtu;
        u32 remote_qpn;
@@ -428,16 +435,40 @@ struct ipath_qp {
        struct ipath_sge r_sg_list[0];  /* verified SGEs */
 };
-/* Bit definition for s_busy. */
+/*
-#define IPATH_S_BUSY            0
+ * Atomic bit definitions for r_aflags.
+ */
+#define IPATH_R_WRID_VALID      0
+/*
+ * Bit definitions for r_flags.
+ */
+#define IPATH_R_REUSE_SGE       0x01
+#define IPATH_R_RDMAR_SEQ       0x02
 /*
 * Bit definitions for s_flags.
+ *
+ * IPATH_S_FENCE_PENDING - waiting for all prior RDMA read or atomic SWQEs
+ *                         before processing the next SWQE
+ * IPATH_S_RDMAR_PENDING - waiting for any RDMA read or atomic SWQEs
+ *                         before processing the next SWQE
+ * IPATH_S_WAITING - waiting for RNR timeout or send buffer available.
+ * IPATH_S_WAIT_SSN_CREDIT - waiting for RC credits to process next SWQE
+ * IPATH_S_WAIT_DMA - waiting for send DMA queue to drain before generating
+ *                    next send completion entry not via send DMA.
 */
 #define IPATH_S_SIGNAL_REQ_WR   0x01
 #define IPATH_S_FENCE_PENDING   0x02
 #define IPATH_S_RDMAR_PENDING   0x04
 #define IPATH_S_ACK_PENDING     0x08
+#define IPATH_S_BUSY            0x10
+#define IPATH_S_WAITING         0x20
+#define IPATH_S_WAIT_SSN_CREDIT 0x40
+#define IPATH_S_WAIT_DMA        0x80
+#define IPATH_S_ANY_WAIT (IPATH_S_FENCE_PENDING | IPATH_S_RDMAR_PENDING | \
+        IPATH_S_WAITING | IPATH_S_WAIT_SSN_CREDIT | IPATH_S_WAIT_DMA)
 #define IPATH_PSN_CREDIT        512
@@ -573,13 +604,11 @@ struct ipath_ibdev {
        u32 n_rnr_naks;
        u32 n_other_naks;
        u32 n_timeouts;
-        u32 n_rc_stalls;
        u32 n_pkt_drops;
        u32 n_vl15_dropped;
        u32 n_wqe_errs;
        u32 n_rdma_dup_busy;
        u32 n_piowait;
-        u32 n_no_piobuf;
        u32 n_unaligned;
        u32 port_cap_flags;
        u32 pma_sample_start;
@@ -657,6 +686,17 @@ static inline struct ipath_ibdev *to_idev(struct ib_device *ibdev)
        return container_of(ibdev, struct ipath_ibdev, ibdev);
 }
+/*
+ * This must be called with s_lock held.
+ */
+static inline void ipath_schedule_send(struct ipath_qp *qp)
+{
+        if (qp->s_flags & IPATH_S_ANY_WAIT)
+                qp->s_flags &= ~IPATH_S_ANY_WAIT;
+        if (!(qp->s_flags & IPATH_S_BUSY))
+                tasklet_hi_schedule(&qp->s_task);
+}
 int ipath_process_mad(struct ib_device *ibdev,
                      int mad_flags,
                      u8 port_num,
@@ -706,12 +746,10 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 int ipath_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                   int attr_mask, struct ib_qp_init_attr *init_attr);
-void ipath_free_all_qps(struct ipath_qp_table *qpt);
+unsigned ipath_free_all_qps(struct ipath_qp_table *qpt);
 int ipath_init_qp_table(struct ipath_ibdev *idev, int size);
-void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc);
 void ipath_get_credit(struct ipath_qp *qp, u32 aeth);
 unsigned ipath_ib_rate_to_mult(enum ib_rate rate);
@@ -729,7 +767,9 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
 void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp);
-void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc);
+void ipath_restart_rc(struct ipath_qp *qp, u32 psn);
+void ipath_rc_error(struct ipath_qp *qp, enum ib_wc_status err);
 int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr);