93 files changed, 2800 insertions, 1189 deletions

diff --git a/drivers/infiniband/hw/amso1100/Kbuild b/drivers/infiniband/hw/amso1100/Kbuild
index 06964c4af849..950dfabcd89d 100644
--- a/drivers/infiniband/hw/amso1100/Kbuild
+++ b/drivers/infiniband/hw/amso1100/Kbuild
@@ -1,6 +1,4 @@
-ifdef CONFIG_INFINIBAND_AMSO1100_DEBUG
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_INFINIBAND_AMSO1100_DEBUG) := -DDEBUG
 
 obj-$(CONFIG_INFINIBAND_AMSO1100) += iw_c2.o
 
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index dc85d777578e..0cfc455630d0 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -47,6 +47,7 @@
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
diff --git a/drivers/infiniband/hw/amso1100/c2_ae.c b/drivers/infiniband/hw/amso1100/c2_ae.c
index 62af74295dbe..24f9e3a90e8e 100644
--- a/drivers/infiniband/hw/amso1100/c2_ae.c
+++ b/drivers/infiniband/hw/amso1100/c2_ae.c
@@ -157,7 +157,7 @@ void c2_ae_event(struct c2_dev *c2dev, u32 mq_index)
         int status;
 
         /*
-         * retreive the message
+         * retrieve the message
          */
         wr = c2_mq_consume(mq);
         if (!wr)
diff --git a/drivers/infiniband/hw/amso1100/c2_intr.c b/drivers/infiniband/hw/amso1100/c2_intr.c
index 3b5095470cb3..0ebe4e806b86 100644
--- a/drivers/infiniband/hw/amso1100/c2_intr.c
+++ b/drivers/infiniband/hw/amso1100/c2_intr.c
@@ -62,8 +62,8 @@ void c2_rnic_interrupt(struct c2_dev *c2dev)
 static void handle_mq(struct c2_dev *c2dev, u32 mq_index)
 {
         if (c2dev->qptr_array[mq_index] == NULL) {
-                pr_debug(KERN_INFO "handle_mq: stray activity for mq_index=%d\n",
-                        mq_index);
+                pr_debug("handle_mq: stray activity for mq_index=%d\n",
+                         mq_index);
                 return;
         }
 
diff --git a/drivers/infiniband/hw/amso1100/c2_qp.c b/drivers/infiniband/hw/amso1100/c2_qp.c
index d8f4bb8bf42e..0d7b6f23caff 100644
--- a/drivers/infiniband/hw/amso1100/c2_qp.c
+++ b/drivers/infiniband/hw/amso1100/c2_qp.c
@@ -612,7 +612,7 @@ void c2_free_qp(struct c2_dev *c2dev, struct c2_qp *qp)
         c2_unlock_cqs(send_cq, recv_cq);
 
         /*
-         * Destory qp in the rnic...
+         * Destroy qp in the rnic...
          */
         destroy_qp(c2dev, qp);
 
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 85cfae4cad71..8c81992fa6db 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -459,13 +459,12 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
              IB_DEVICE_MEM_WINDOW);
 
         /* Allocate the qptr_array */
-        c2dev->qptr_array = vmalloc(C2_MAX_CQS * sizeof(void *));
+        c2dev->qptr_array = vzalloc(C2_MAX_CQS * sizeof(void *));
         if (!c2dev->qptr_array) {
                 return -ENOMEM;
         }
 
-        /* Inialize the qptr_array */
-        memset(c2dev->qptr_array, 0, C2_MAX_CQS * sizeof(void *));
+        /* Initialize the qptr_array */
         c2dev->qptr_array[0] = (void *) &c2dev->req_vq;
         c2dev->qptr_array[1] = (void *) &c2dev->rep_vq;
         c2dev->qptr_array[2] = (void *) &c2dev->aeq;
diff --git a/drivers/infiniband/hw/amso1100/c2_vq.c b/drivers/infiniband/hw/amso1100/c2_vq.c
index 9ce7819b7b2e..2ec716fb2edb 100644
--- a/drivers/infiniband/hw/amso1100/c2_vq.c
+++ b/drivers/infiniband/hw/amso1100/c2_vq.c
@@ -107,7 +107,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
         r = kmalloc(sizeof(struct c2_vq_req), GFP_KERNEL);
         if (r) {
                 init_waitqueue_head(&r->wait_object);
-                r->reply_msg = (u64) NULL;
+                r->reply_msg = 0;
                 r->event = 0;
                 r->cm_id = NULL;
                 r->qp = NULL;
@@ -123,7 +123,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
  */
 void vq_req_free(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
-        r->reply_msg = (u64) NULL;
+        r->reply_msg = 0;
         if (atomic_dec_and_test(&r->refcnt)) {
                 kfree(r);
         }
@@ -151,7 +151,7 @@ void vq_req_get(struct c2_dev *c2dev, struct c2_vq_req *r)
 void vq_req_put(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
         if (atomic_dec_and_test(&r->refcnt)) {
-                if (r->reply_msg != (u64) NULL)
+                if (r->reply_msg != 0)
                         vq_repbuf_free(c2dev,
                                        (void *) (unsigned long) r->reply_msg);
                 kfree(r);
diff --git a/drivers/infiniband/hw/amso1100/c2_wr.h b/drivers/infiniband/hw/amso1100/c2_wr.h
index c65fbdd6e469..8d4b4ca463ca 100644
--- a/drivers/infiniband/hw/amso1100/c2_wr.h
+++ b/drivers/infiniband/hw/amso1100/c2_wr.h
@@ -131,7 +131,7 @@ enum c2wr_ids {
          *          All the preceding IDs are fixed, and must not change.
          *          You can add new IDs, but must not remove or reorder
          *          any IDs. If you do, YOU will ruin any hope of
-         *          compatability between versions.
+         *          compatibility between versions.
          */
         CCWR_LAST,
 
@@ -242,7 +242,7 @@ enum c2_acf {
 /*
  *  to fix bug 1815 we define the max size allowable of the
  *  terminate message (per the IETF spec).Refer to the IETF
- *  protocal specification, section 12.1.6, page 64)
+ *  protocol specification, section 12.1.6, page 64)
  *  The message is prefixed by 20 types of DDP info.
  *
  *  Then the message has 6 bytes for the terminate control
diff --git a/drivers/infiniband/hw/cxgb3/Kconfig b/drivers/infiniband/hw/cxgb3/Kconfig
index 2acec3fadf69..2b6352b85485 100644
--- a/drivers/infiniband/hw/cxgb3/Kconfig
+++ b/drivers/infiniband/hw/cxgb3/Kconfig
@@ -10,7 +10,7 @@ config INFINIBAND_CXGB3
           our website at <http://www.chelsio.com>.
 
           For customer support, please visit our customer support page at
-          <http://www.chelsio.com/support.htm>.
+          <http://www.chelsio.com/support.html>.
 
           Please send feedback to <linux-bugs@chelsio.com>.
 
diff --git a/drivers/infiniband/hw/cxgb3/Makefile b/drivers/infiniband/hw/cxgb3/Makefile
index 7e7b5a66f042..621619c794e5 100644
--- a/drivers/infiniband/hw/cxgb3/Makefile
+++ b/drivers/infiniband/hw/cxgb3/Makefile
@@ -1,10 +1,8 @@
-EXTRA_CFLAGS += -Idrivers/net/cxgb3
+ccflags-y := -Idrivers/net/cxgb3
 
 obj-$(CONFIG_INFINIBAND_CXGB3) += iw_cxgb3.o
 
 iw_cxgb3-y :=  iwch_cm.o iwch_ev.o iwch_cq.o iwch_qp.o iwch_mem.o \
                iwch_provider.o iwch.o cxio_hal.o cxio_resource.o
 
-ifdef CONFIG_INFINIBAND_CXGB3_DEBUG
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_INFINIBAND_CXGB3_DEBUG) += -DDEBUG
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 005b7b52bc1e..c3f5aca4ef00 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -160,6 +160,7 @@ int cxio_create_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq, int kernel)
         struct rdma_cq_setup setup;
         int size = (1UL << (cq->size_log2)) * sizeof(struct t3_cqe);
 
+        size += 1; /* one extra page for storing cq-in-err state */
         cq->cqid = cxio_hal_get_cqid(rdev_p->rscp);
         if (!cq->cqid)
                 return -ENOMEM;
@@ -188,6 +189,7 @@ int cxio_create_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq, int kernel)
         return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
 }
 
+#ifdef notyet
 int cxio_resize_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
 {
         struct rdma_cq_setup setup;
@@ -199,6 +201,7 @@ int cxio_resize_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
         setup.ovfl_mode = 1;
         return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
 }
+#endif
 
 static u32 get_qpid(struct cxio_rdev *rdev_p, struct cxio_ucontext *uctx)
 {
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
index e5ddb63e7d23..83d2e19d31ae 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_wr.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -689,7 +689,7 @@ struct t3_swrq {
  * A T3 WQ implements both the SQ and RQ.
  */
 struct t3_wq {
-        union t3_wr *queue;             /* DMA accessable memory */
+        union t3_wr *queue;             /* DMA accessible memory */
         dma_addr_t dma_addr;            /* DMA address for HW */
         DEFINE_DMA_UNMAP_ADDR(mapping); /* unmap kruft */
         u32 error;                      /* 1 once we go to ERROR */
@@ -728,6 +728,22 @@ struct t3_cq {
 #define CQ_VLD_ENTRY(ptr,size_log2,cqe) (Q_GENBIT(ptr,size_log2) == \
                                          CQE_GENBIT(*cqe))
 
+struct t3_cq_status_page {
+        u32 cq_err;
+};
+
+static inline int cxio_cq_in_error(struct t3_cq *cq)
+{
+        return ((struct t3_cq_status_page *)
+                &cq->queue[1 << cq->size_log2])->cq_err;
+}
+
+static inline void cxio_set_cq_in_error(struct t3_cq *cq)
+{
+        ((struct t3_cq_status_page *)
+         &cq->queue[1 << cq->size_log2])->cq_err = 1;
+}
+
 static inline void cxio_set_wq_in_error(struct t3_wq *wq)
 {
         wq->queue->wq_in_err.err |= 1;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 13c88871dc3b..0a5008fbebac 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -338,23 +338,12 @@ static struct rtable *find_route(struct t3cdev *dev, __be32 local_ip,
                                  __be16 peer_port, u8 tos)
 {
         struct rtable *rt;
-        struct flowi fl = {
-                .oif = 0,
-                .nl_u = {
-                         .ip4_u = {
-                                   .daddr = peer_ip,
-                                   .saddr = local_ip,
-                                   .tos = tos}
-                         },
-                .proto = IPPROTO_TCP,
-                .uli_u = {
-                          .ports = {
-                                    .sport = local_port,
-                                    .dport = peer_port}
-                          }
-        };
-
-        if (ip_route_output_flow(&init_net, &rt, &fl, NULL, 0))
+        struct flowi4 fl4;
+
+        rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip,
+                                   peer_port, local_port, IPPROTO_TCP,
+                                   tos, 0);
+        if (IS_ERR(rt))
                 return NULL;
         return rt;
 }
@@ -925,7 +914,7 @@ static void process_mpa_reply(struct iwch_ep *ep, struct sk_buff *skb)
                 goto err;
 
         if (peer2peer && iwch_rqes_posted(ep->com.qp) == 0) {
-                iwch_post_zb_read(ep->com.qp);
+                iwch_post_zb_read(ep);
         }
 
         goto out;
@@ -1089,37 +1078,45 @@ static int tx_ack(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         struct iwch_ep *ep = ctx;
         struct cpl_wr_ack *hdr = cplhdr(skb);
         unsigned int credits = ntohs(hdr->credits);
+        unsigned long flags;
+        int post_zb = 0;
 
         PDBG("%s ep %p credits %u\n", __func__, ep, credits);
 
         if (credits == 0) {
-                PDBG(KERN_ERR "%s 0 credit ack  ep %p state %u\n",
-                        __func__, ep, state_read(&ep->com));
+                PDBG("%s 0 credit ack  ep %p state %u\n",
+                     __func__, ep, state_read(&ep->com));
                 return CPL_RET_BUF_DONE;
         }
 
+        spin_lock_irqsave(&ep->com.lock, flags);
         BUG_ON(credits != 1);
         dst_confirm(ep->dst);
         if (!ep->mpa_skb) {
                 PDBG("%s rdma_init wr_ack ep %p state %u\n",
-                        __func__, ep, state_read(&ep->com));
+                        __func__, ep, ep->com.state);
                 if (ep->mpa_attr.initiator) {
                         PDBG("%s initiator ep %p state %u\n",
-                                __func__, ep, state_read(&ep->com));
-                        if (peer2peer)
-                                iwch_post_zb_read(ep->com.qp);
+                                __func__, ep, ep->com.state);
+                        if (peer2peer && ep->com.state == FPDU_MODE)
+                                post_zb = 1;
                 } else {
                         PDBG("%s responder ep %p state %u\n",
-                                __func__, ep, state_read(&ep->com));
-                        ep->com.rpl_done = 1;
-                        wake_up(&ep->com.waitq);
+                                __func__, ep, ep->com.state);
+                        if (ep->com.state == MPA_REQ_RCVD) {
+                                ep->com.rpl_done = 1;
+                                wake_up(&ep->com.waitq);
+                        }
                 }
         } else {
                 PDBG("%s lsm ack ep %p state %u freeing skb\n",
-                        __func__, ep, state_read(&ep->com));
+                        __func__, ep, ep->com.state);
                 kfree_skb(ep->mpa_skb);
                 ep->mpa_skb = NULL;
         }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (post_zb)
+                iwch_post_zb_read(ep);
         return CPL_RET_BUF_DONE;
 }
 
diff --git a/drivers/infiniband/hw/cxgb3/iwch_ev.c b/drivers/infiniband/hw/cxgb3/iwch_ev.c
index 6afc89e7572c..71e0d845da3d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_ev.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_ev.c
@@ -76,6 +76,14 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
         atomic_inc(&qhp->refcnt);
         spin_unlock(&rnicp->lock);
 
+        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
+                attrs.next_state = IWCH_QP_STATE_TERMINATE;
+                iwch_modify_qp(qhp->rhp, qhp, IWCH_QP_ATTR_NEXT_STATE,
+                               &attrs, 1);
+                if (send_term)
+                        iwch_post_terminate(qhp, rsp_msg);
+        }
+
         event.event = ib_event;
         event.device = chp->ibcq.device;
         if (ib_event == IB_EVENT_CQ_ERR)
@@ -86,13 +94,7 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
         if (qhp->ibqp.event_handler)
                 (*qhp->ibqp.event_handler)(&event, qhp->ibqp.qp_context);
 
-        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
-                attrs.next_state = IWCH_QP_STATE_TERMINATE;
-                iwch_modify_qp(qhp->rhp, qhp, IWCH_QP_ATTR_NEXT_STATE,
-                               &attrs, 1);
-                if (send_term)
-                        iwch_post_terminate(qhp, rsp_msg);
-        }
+        (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
 
         if (atomic_dec_and_test(&qhp->refcnt))
                 wake_up(&qhp->wait);
@@ -179,7 +181,6 @@ void iwch_ev_dispatch(struct cxio_rdev *rdev_p, struct sk_buff *skb)
         case TPT_ERR_BOUND:
         case TPT_ERR_INVALIDATE_SHARED_MR:
         case TPT_ERR_INVALIDATE_MR_WITH_MW_BOUND:
-                (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
                 post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_ACCESS_ERR, 1);
                 break;
 
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index fca0b4b747e4..2e2741307af4 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -154,6 +154,8 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
         struct iwch_create_cq_resp uresp;
         struct iwch_create_cq_req ureq;
         struct iwch_ucontext *ucontext = NULL;
+        static int warned;
+        size_t resplen;
 
         PDBG("%s ib_dev %p entries %d\n", __func__, ibdev, entries);
         rhp = to_iwch_dev(ibdev);
@@ -217,15 +219,26 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                 uresp.key = ucontext->key;
                 ucontext->key += PAGE_SIZE;
                 spin_unlock(&ucontext->mmap_lock);
-                if (ib_copy_to_udata(udata, &uresp, sizeof (uresp))) {
+                mm->key = uresp.key;
+                mm->addr = virt_to_phys(chp->cq.queue);
+                if (udata->outlen < sizeof uresp) {
+                        if (!warned++)
+                                printk(KERN_WARNING MOD "Warning - "
+                                       "downlevel libcxgb3 (non-fatal).\n");
+                        mm->len = PAGE_ALIGN((1UL << uresp.size_log2) *
+                                             sizeof(struct t3_cqe));
+                        resplen = sizeof(struct iwch_create_cq_resp_v0);
+                } else {
+                        mm->len = PAGE_ALIGN(((1UL << uresp.size_log2) + 1) *
+                                             sizeof(struct t3_cqe));
+                        uresp.memsize = mm->len;
+                        resplen = sizeof uresp;
+                }
+                if (ib_copy_to_udata(udata, &uresp, resplen)) {
                         kfree(mm);
                         iwch_destroy_cq(&chp->ibcq);
                         return ERR_PTR(-EFAULT);
                 }
-                mm->key = uresp.key;
-                mm->addr = virt_to_phys(chp->cq.queue);
-                mm->len = PAGE_ALIGN((1UL << uresp.size_log2) *
-                                             sizeof (struct t3_cqe));
                 insert_mmap(ucontext, mm);
         }
         PDBG("created cqid 0x%0x chp %p size 0x%0x, dma_addr 0x%0llx\n",
@@ -1414,6 +1427,7 @@ int iwch_register_device(struct iwch_dev *dev)
         dev->ibdev.post_send = iwch_post_send;
         dev->ibdev.post_recv = iwch_post_receive;
         dev->ibdev.get_protocol_stats = iwch_get_mib;
+        dev->ibdev.uverbs_abi_ver = IWCH_UVERBS_ABI_VERSION;
 
         dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
         if (!dev->ibdev.iwcm)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
index a237d49bdcc9..9a342c9b220d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -332,11 +332,9 @@ int iwch_bind_mw(struct ib_qp *qp,
                              struct ib_mw_bind *mw_bind);
 int iwch_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
 int iwch_post_terminate(struct iwch_qp *qhp, struct respQ_msg_t *rsp_msg);
-int iwch_post_zb_read(struct iwch_qp *qhp);
+int iwch_post_zb_read(struct iwch_ep *ep);
 int iwch_register_device(struct iwch_dev *dev);
 void iwch_unregister_device(struct iwch_dev *dev);
-int iwch_quiesce_qps(struct iwch_cq *chp);
-int iwch_resume_qps(struct iwch_cq *chp);
 void stop_read_rep_timer(struct iwch_qp *qhp);
 int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                       struct iwch_mr *mhp, int shift);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index c64d27bf2c15..ecd313f359a4 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -738,7 +738,7 @@ static inline void build_term_codes(struct respQ_msg_t *rsp_msg,
         }
 }
 
-int iwch_post_zb_read(struct iwch_qp *qhp)
+int iwch_post_zb_read(struct iwch_ep *ep)
 {
         union t3_wr *wqe;
         struct sk_buff *skb;
@@ -761,10 +761,10 @@ int iwch_post_zb_read(struct iwch_qp *qhp)
         wqe->read.local_len = cpu_to_be32(0);
         wqe->read.local_to = cpu_to_be64(1);
         wqe->send.wrh.op_seop_flags = cpu_to_be32(V_FW_RIWR_OP(T3_WR_READ));
-        wqe->send.wrh.gen_tid_len = cpu_to_be32(V_FW_RIWR_TID(qhp->ep->hwtid)|
+        wqe->send.wrh.gen_tid_len = cpu_to_be32(V_FW_RIWR_TID(ep->hwtid)|
                                                 V_FW_RIWR_LEN(flit_cnt));
         skb->priority = CPL_PRIORITY_DATA;
-        return iwch_cxgb3_ofld_send(qhp->rhp->rdev.t3cdev_p, skb);
+        return iwch_cxgb3_ofld_send(ep->com.qp->rhp->rdev.t3cdev_p, skb);
 }
 
 /*
@@ -802,14 +802,12 @@ int iwch_post_terminate(struct iwch_qp *qhp, struct respQ_msg_t *rsp_msg)
 /*
  * Assumes qhp lock is held.
  */
-static void __flush_qp(struct iwch_qp *qhp, unsigned long *flag)
+static void __flush_qp(struct iwch_qp *qhp, struct iwch_cq *rchp,
+                                struct iwch_cq *schp, unsigned long *flag)
 {
-        struct iwch_cq *rchp, *schp;
         int count;
         int flushed;
 
-        rchp = get_chp(qhp->rhp, qhp->attr.rcq);
-        schp = get_chp(qhp->rhp, qhp->attr.scq);
 
         PDBG("%s qhp %p rchp %p schp %p\n", __func__, qhp, rchp, schp);
         /* take a ref on the qhp since we must release the lock */
@@ -847,10 +845,23 @@ static void __flush_qp(struct iwch_qp *qhp, unsigned long *flag)
 
 static void flush_qp(struct iwch_qp *qhp, unsigned long *flag)
 {
-        if (qhp->ibqp.uobject)
+        struct iwch_cq *rchp, *schp;
+
+        rchp = get_chp(qhp->rhp, qhp->attr.rcq);
+        schp = get_chp(qhp->rhp, qhp->attr.scq);
+
+        if (qhp->ibqp.uobject) {
                 cxio_set_wq_in_error(&qhp->wq);
-        else
-                __flush_qp(qhp, flag);
+                cxio_set_cq_in_error(&rchp->cq);
+                (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+                if (schp != rchp) {
+                        cxio_set_cq_in_error(&schp->cq);
+                        (*schp->ibcq.comp_handler)(&schp->ibcq,
+                                                   schp->ibcq.cq_context);
+                }
+                return;
+        }
+        __flush_qp(qhp, rchp, schp, flag);
 }
 
 
@@ -1138,59 +1149,3 @@ out:
         PDBG("%s exit state %d\n", __func__, qhp->attr.state);
         return ret;
 }
-
-static int quiesce_qp(struct iwch_qp *qhp)
-{
-        spin_lock_irq(&qhp->lock);
-        iwch_quiesce_tid(qhp->ep);
-        qhp->flags |= QP_QUIESCED;
-        spin_unlock_irq(&qhp->lock);
-        return 0;
-}
-
-static int resume_qp(struct iwch_qp *qhp)
-{
-        spin_lock_irq(&qhp->lock);
-        iwch_resume_tid(qhp->ep);
-        qhp->flags &= ~QP_QUIESCED;
-        spin_unlock_irq(&qhp->lock);
-        return 0;
-}
-
-int iwch_quiesce_qps(struct iwch_cq *chp)
-{
-        int i;
-        struct iwch_qp *qhp;
-
-        for (i=0; i < T3_MAX_NUM_QP; i++) {
-                qhp = get_qhp(chp->rhp, i);
-                if (!qhp)
-                        continue;
-                if ((qhp->attr.rcq == chp->cq.cqid) && !qp_quiesced(qhp)) {
-                        quiesce_qp(qhp);
-                        continue;
-                }
-                if ((qhp->attr.scq == chp->cq.cqid) && !qp_quiesced(qhp))
-                        quiesce_qp(qhp);
-        }
-        return 0;
-}
-
-int iwch_resume_qps(struct iwch_cq *chp)
-{
-        int i;
-        struct iwch_qp *qhp;
-
-        for (i=0; i < T3_MAX_NUM_QP; i++) {
-                qhp = get_qhp(chp->rhp, i);
-                if (!qhp)
-                        continue;
-                if ((qhp->attr.rcq == chp->cq.cqid) && qp_quiesced(qhp)) {
-                        resume_qp(qhp);
-                        continue;
-                }
-                if ((qhp->attr.scq == chp->cq.cqid) && qp_quiesced(qhp))
-                        resume_qp(qhp);
-        }
-        return 0;
-}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_user.h b/drivers/infiniband/hw/cxgb3/iwch_user.h
index cb7086f558c1..a277c31fcaf7 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_user.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_user.h
@@ -45,10 +45,18 @@ struct iwch_create_cq_req {
         __u64 user_rptr_addr;
 };
 
+struct iwch_create_cq_resp_v0 {
+        __u64 key;
+        __u32 cqid;
+        __u32 size_log2;
+};
+
 struct iwch_create_cq_resp {
         __u64 key;
         __u32 cqid;
         __u32 size_log2;
+        __u32 memsize;
+        __u32 reserved;
 };
 
 struct iwch_create_qp_resp {
diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
index ccb85eaaad75..6b7e6c543534 100644
--- a/drivers/infiniband/hw/cxgb4/Kconfig
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -10,7 +10,7 @@ config INFINIBAND_CXGB4
           our website at <http://www.chelsio.com>.
 
           For customer support, please visit our customer support page at
-          <http://www.chelsio.com/support.htm>.
+          <http://www.chelsio.com/support.html>.
 
           Please send feedback to <linux-bugs@chelsio.com>.
 
diff --git a/drivers/infiniband/hw/cxgb4/Makefile b/drivers/infiniband/hw/cxgb4/Makefile
index e31a499f0172..cd20b1342aec 100644
--- a/drivers/infiniband/hw/cxgb4/Makefile
+++ b/drivers/infiniband/hw/cxgb4/Makefile
@@ -1,4 +1,4 @@
-EXTRA_CFLAGS += -Idrivers/net/cxgb4
+ccflags-y := -Idrivers/net/cxgb4
 
 obj-$(CONFIG_INFINIBAND_CXGB4) += iw_cxgb4.o
 
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 32d352a88d50..31fb44085c9b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -61,9 +61,9 @@ static char *states[] = {
         NULL,
 };
 
-static int dack_mode;
+static int dack_mode = 1;
 module_param(dack_mode, int, 0644);
-MODULE_PARM_DESC(dack_mode, "Delayed ack mode (default=0)");
+MODULE_PARM_DESC(dack_mode, "Delayed ack mode (default=1)");
 
 int c4iw_max_read_depth = 8;
 module_param(c4iw_max_read_depth, int, 0644);
@@ -117,9 +117,9 @@ static int rcv_win = 256 * 1024;
 module_param(rcv_win, int, 0644);
 MODULE_PARM_DESC(rcv_win, "TCP receive window in bytes (default=256KB)");
 
-static int snd_win = 32 * 1024;
+static int snd_win = 128 * 1024;
 module_param(snd_win, int, 0644);
-MODULE_PARM_DESC(snd_win, "TCP send window in bytes (default=32KB)");
+MODULE_PARM_DESC(snd_win, "TCP send window in bytes (default=128KB)");
 
 static struct workqueue_struct *workq;
 
@@ -172,7 +172,7 @@ static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
         error = cxgb4_l2t_send(rdev->lldi.ports[0], skb, l2e);
         if (error < 0)
                 kfree_skb(skb);
-        return error;
+        return error < 0 ? error : 0;
 }
 
 int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb)
@@ -187,7 +187,7 @@ int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb)
         error = cxgb4_ofld_send(rdev->lldi.ports[0], skb);
         if (error < 0)
                 kfree_skb(skb);
-        return error;
+        return error < 0 ? error : 0;
 }
 
 static void release_tid(struct c4iw_rdev *rdev, u32 hwtid, struct sk_buff *skb)
@@ -219,12 +219,11 @@ static void set_emss(struct c4iw_ep *ep, u16 opt)
 
 static enum c4iw_ep_state state_read(struct c4iw_ep_common *epc)
 {
-        unsigned long flags;
         enum c4iw_ep_state state;
 
-        spin_lock_irqsave(&epc->lock, flags);
+        mutex_lock(&epc->mutex);
         state = epc->state;
-        spin_unlock_irqrestore(&epc->lock, flags);
+        mutex_unlock(&epc->mutex);
         return state;
 }
 
@@ -235,12 +234,10 @@ static void __state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
 
 static void state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&epc->lock, flags);
+        mutex_lock(&epc->mutex);
         PDBG("%s - %s -> %s\n", __func__, states[epc->state], states[new]);
         __state_set(epc, new);
-        spin_unlock_irqrestore(&epc->lock, flags);
+        mutex_unlock(&epc->mutex);
         return;
 }
 
@@ -251,8 +248,8 @@ static void *alloc_ep(int size, gfp_t gfp)
         epc = kzalloc(size, gfp);
         if (epc) {
                 kref_init(&epc->kref);
-                spin_lock_init(&epc->lock);
-                init_waitqueue_head(&epc->waitq);
+                mutex_init(&epc->mutex);
+                c4iw_init_wr_wait(&epc->wr_wait);
         }
         PDBG("%s alloc ep %p\n", __func__, epc);
         return epc;
@@ -318,23 +315,12 @@ static struct rtable *find_route(struct c4iw_dev *dev, __be32 local_ip,
                                  __be16 peer_port, u8 tos)
 {
         struct rtable *rt;
-        struct flowi fl = {
-                .oif = 0,
-                .nl_u = {
-                         .ip4_u = {
-                                   .daddr = peer_ip,
-                                   .saddr = local_ip,
-                                   .tos = tos}
-                         },
-                .proto = IPPROTO_TCP,
-                .uli_u = {
-                          .ports = {
-                                    .sport = local_port,
-                                    .dport = peer_port}
-                          }
-        };
-
-        if (ip_route_output_flow(&init_net, &rt, &fl, NULL, 0))
+        struct flowi4 fl4;
+
+        rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip,
+                                   peer_port, local_port, IPPROTO_TCP,
+                                   tos, 0);
+        if (IS_ERR(rt))
                 return NULL;
         return rt;
 }
@@ -383,7 +369,7 @@ static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
                                           16)) | FW_WR_FLOWID(ep->hwtid));
 
         flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
-        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
         flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
         flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
         flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
@@ -485,6 +471,7 @@ static int send_connect(struct c4iw_ep *ep)
                TX_CHAN(ep->tx_chan) |
                SMAC_SEL(ep->smac_idx) |
                DSCP(ep->tos) |
+               ULP_MODE(ULP_MODE_TCPDDP) |
                RCV_BUFSIZ(rcv_win>>10);
         opt2 = RX_CHANNEL(0) |
                RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
@@ -1131,7 +1118,6 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
 {
         struct c4iw_ep *ep;
         struct cpl_abort_rpl_rss *rpl = cplhdr(skb);
-        unsigned long flags;
         int release = 0;
         unsigned int tid = GET_TID(rpl);
         struct tid_info *t = dev->rdev.lldi.tids;
@@ -1139,7 +1125,7 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = lookup_tid(t, tid);
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         BUG_ON(!ep);
-        spin_lock_irqsave(&ep->com.lock, flags);
+        mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case ABORTING:
                 __state_set(&ep->com, DEAD);
@@ -1150,7 +1136,7 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
                      __func__, ep, ep->com.state);
                 break;
         }
-        spin_unlock_irqrestore(&ep->com.lock, flags);
+        mutex_unlock(&ep->com.mutex);
 
         if (release)
                 release_ep_resources(ep);
@@ -1213,9 +1199,7 @@ static int pass_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         }
         PDBG("%s ep %p status %d error %d\n", __func__, ep,
              rpl->status, status2errno(rpl->status));
-        ep->com.rpl_err = status2errno(rpl->status);
-        ep->com.rpl_done = 1;
-        wake_up(&ep->com.waitq);
+        c4iw_wake_up(&ep->com.wr_wait, status2errno(rpl->status));
 
         return 0;
 }
@@ -1249,9 +1233,7 @@ static int close_listsrv_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         struct c4iw_listen_ep *ep = lookup_stid(t, stid);
 
         PDBG("%s ep %p\n", __func__, ep);
-        ep->com.rpl_err = status2errno(rpl->status);
-        ep->com.rpl_done = 1;
-        wake_up(&ep->com.waitq);
+        c4iw_wake_up(&ep->com.wr_wait, status2errno(rpl->status));
         return 0;
 }
 
@@ -1278,6 +1260,7 @@ static void accept_cr(struct c4iw_ep *ep, __be32 peer_ip, struct sk_buff *skb,
                TX_CHAN(ep->tx_chan) |
                SMAC_SEL(ep->smac_idx) |
                DSCP(ep->tos) |
+               ULP_MODE(ULP_MODE_TCPDDP) |
                RCV_BUFSIZ(rcv_win>>10);
         opt2 = RX_CHANNEL(0) |
                RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
@@ -1478,18 +1461,17 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
         struct cpl_peer_close *hdr = cplhdr(skb);
         struct c4iw_ep *ep;
         struct c4iw_qp_attributes attrs;
-        unsigned long flags;
         int disconnect = 1;
         int release = 0;
-        int closing = 0;
         struct tid_info *t = dev->rdev.lldi.tids;
         unsigned int tid = GET_TID(hdr);
+        int ret;
 
         ep = lookup_tid(t, tid);
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         dst_confirm(ep->dst);
 
-        spin_lock_irqsave(&ep->com.lock, flags);
+        mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case MPA_REQ_WAIT:
                 __state_set(&ep->com, CLOSING);
@@ -1507,23 +1489,24 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
                  * in rdma connection migration (see c4iw_accept_cr()).
                  */
                 __state_set(&ep->com, CLOSING);
-                ep->com.rpl_done = 1;
-                ep->com.rpl_err = -ECONNRESET;
                 PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
-                wake_up(&ep->com.waitq);
+                c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
                 break;
         case MPA_REP_SENT:
                 __state_set(&ep->com, CLOSING);
-                ep->com.rpl_done = 1;
-                ep->com.rpl_err = -ECONNRESET;
                 PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
-                wake_up(&ep->com.waitq);
+                c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
                 break;
         case FPDU_MODE:
                 start_ep_timer(ep);
                 __state_set(&ep->com, CLOSING);
-                closing = 1;
-                peer_close_upcall(ep);
+                attrs.next_state = C4IW_QP_STATE_CLOSING;
+                ret = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                                       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                if (ret != -ECONNRESET) {
+                        peer_close_upcall(ep);
+                        disconnect = 1;
+                }
                 break;
         case ABORTING:
                 disconnect = 0;
@@ -1550,12 +1533,7 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
         default:
                 BUG_ON(1);
         }
-        spin_unlock_irqrestore(&ep->com.lock, flags);
-        if (closing) {
-                attrs.next_state = C4IW_QP_STATE_CLOSING;
-                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
-        }
+        mutex_unlock(&ep->com.mutex);
         if (disconnect)
                 c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
         if (release)
@@ -1581,7 +1559,6 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
         struct c4iw_qp_attributes attrs;
         int ret;
         int release = 0;
-        unsigned long flags;
         struct tid_info *t = dev->rdev.lldi.tids;
         unsigned int tid = GET_TID(req);
 
@@ -1591,9 +1568,15 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
                      ep->hwtid);
                 return 0;
         }
-        spin_lock_irqsave(&ep->com.lock, flags);
         PDBG("%s ep %p tid %u state %u\n", __func__, ep, ep->hwtid,
              ep->com.state);
+
+        /*
+         * Wake up any threads in rdma_init() or rdma_fini().
+         */
+        c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+
+        mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case CONNECTING:
                 break;
@@ -1605,23 +1588,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
                 connect_reply_upcall(ep, -ECONNRESET);
                 break;
         case MPA_REP_SENT:
-                ep->com.rpl_done = 1;
-                ep->com.rpl_err = -ECONNRESET;
-                PDBG("waking up ep %p\n", ep);
-                wake_up(&ep->com.waitq);
                 break;
         case MPA_REQ_RCVD:
-
-                /*
-                 * We're gonna mark this puppy DEAD, but keep
-                 * the reference on it until the ULP accepts or
-                 * rejects the CR. Also wake up anyone waiting
-                 * in rdma connection migration (see c4iw_accept_cr()).
-                 */
-                ep->com.rpl_done = 1;
-                ep->com.rpl_err = -ECONNRESET;
-                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
-                wake_up(&ep->com.waitq);
                 break;
         case MORIBUND:
         case CLOSING:
@@ -1644,7 +1612,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
                 break;
         case DEAD:
                 PDBG("%s PEER_ABORT IN DEAD STATE!!!!\n", __func__);
-                spin_unlock_irqrestore(&ep->com.lock, flags);
+                mutex_unlock(&ep->com.mutex);
                 return 0;
         default:
                 BUG_ON(1);
@@ -1655,7 +1623,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
                 __state_set(&ep->com, DEAD);
                 release = 1;
         }
-        spin_unlock_irqrestore(&ep->com.lock, flags);
+        mutex_unlock(&ep->com.mutex);
 
         rpl_skb = get_skb(skb, sizeof(*rpl), GFP_KERNEL);
         if (!rpl_skb) {
@@ -1681,7 +1649,6 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         struct c4iw_ep *ep;
         struct c4iw_qp_attributes attrs;
         struct cpl_close_con_rpl *rpl = cplhdr(skb);
-        unsigned long flags;
         int release = 0;
         struct tid_info *t = dev->rdev.lldi.tids;
         unsigned int tid = GET_TID(rpl);
@@ -1692,7 +1659,7 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         BUG_ON(!ep);
 
         /* The cm_id may be null if we failed to connect */
-        spin_lock_irqsave(&ep->com.lock, flags);
+        mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case CLOSING:
                 __state_set(&ep->com, MORIBUND);
@@ -1717,7 +1684,7 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
                 BUG_ON(1);
                 break;
         }
-        spin_unlock_irqrestore(&ep->com.lock, flags);
+        mutex_unlock(&ep->com.mutex);
         if (release)
                 release_ep_resources(ep);
         return 0;
@@ -1725,23 +1692,24 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
 
 static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
 {
-        struct c4iw_ep *ep;
-        struct cpl_rdma_terminate *term = cplhdr(skb);
+        struct cpl_rdma_terminate *rpl = cplhdr(skb);
         struct tid_info *t = dev->rdev.lldi.tids;
-        unsigned int tid = GET_TID(term);
+        unsigned int tid = GET_TID(rpl);
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attrs;
 
         ep = lookup_tid(t, tid);
+        BUG_ON(!ep);
 
-        if (state_read(&ep->com) != FPDU_MODE)
-                return 0;
+        if (ep && ep->com.qp) {
+                printk(KERN_WARNING MOD "TERM received tid %u qpid %u\n", tid,
+                       ep->com.qp->wq.sq.qid);
+                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+        } else
+                printk(KERN_WARNING MOD "TERM received tid %u no ep/qp\n", tid);
 
-        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        skb_pull(skb, sizeof *term);
-        PDBG("%s saving %d bytes of term msg\n", __func__, skb->len);
-        skb_copy_from_linear_data(skb, ep->com.qp->attr.terminate_buffer,
-                                  skb->len);
-        ep->com.qp->attr.terminate_msg_len = skb->len;
-        ep->com.qp->attr.is_terminate_local = 0;
         return 0;
 }
 
@@ -1762,8 +1730,8 @@ static int fw4_ack(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = lookup_tid(t, tid);
         PDBG("%s ep %p tid %u credits %u\n", __func__, ep, ep->hwtid, credits);
         if (credits == 0) {
-                PDBG(KERN_ERR "%s 0 credit ack ep %p tid %u state %u\n",
-                        __func__, ep, ep->hwtid, state_read(&ep->com));
+                PDBG("%s 0 credit ack ep %p tid %u state %u\n",
+                     __func__, ep, ep->hwtid, state_read(&ep->com));
                 return 0;
         }
 
@@ -2042,6 +2010,7 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
         }
 
         state_set(&ep->com, LISTEN);
+        c4iw_init_wr_wait(&ep->com.wr_wait);
         err = cxgb4_create_server(ep->com.dev->rdev.lldi.ports[0], ep->stid,
                                   ep->com.local_addr.sin_addr.s_addr,
                                   ep->com.local_addr.sin_port,
@@ -2050,15 +2019,8 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
                 goto fail3;
 
         /* wait for pass_open_rpl */
-        wait_event_timeout(ep->com.waitq, ep->com.rpl_done, C4IW_WR_TO);
-        if (ep->com.rpl_done)
-                err = ep->com.rpl_err;
-        else {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(ep->com.dev->rdev.lldi.pdev));
-                ep->com.dev->rdev.flags = T4_FATAL_ERROR;
-                err = -EIO;
-        }
+        err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait, 0, 0,
+                                  __func__);
         if (!err) {
                 cm_id->provider_data = ep;
                 goto out;
@@ -2082,20 +2044,12 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
 
         might_sleep();
         state_set(&ep->com, DEAD);
-        ep->com.rpl_done = 0;
-        ep->com.rpl_err = 0;
+        c4iw_init_wr_wait(&ep->com.wr_wait);
         err = listen_stop(ep);
         if (err)
                 goto done;
-        wait_event_timeout(ep->com.waitq, ep->com.rpl_done, C4IW_WR_TO);
-        if (ep->com.rpl_done)
-                err = ep->com.rpl_err;
-        else {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(ep->com.dev->rdev.lldi.pdev));
-                ep->com.dev->rdev.flags = T4_FATAL_ERROR;
-                err = -EIO;
-        }
+        err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait, 0, 0,
+                                  __func__);
         cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid, PF_INET);
 done:
         cm_id->rem_ref(cm_id);
@@ -2106,12 +2060,11 @@ done:
 int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
 {
         int ret = 0;
-        unsigned long flags;
         int close = 0;
         int fatal = 0;
         struct c4iw_rdev *rdev;
 
-        spin_lock_irqsave(&ep->com.lock, flags);
+        mutex_lock(&ep->com.mutex);
 
         PDBG("%s ep %p state %s, abrupt %d\n", __func__, ep,
              states[ep->com.state], abrupt);
@@ -2158,20 +2111,28 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
                 break;
         }
 
-        spin_unlock_irqrestore(&ep->com.lock, flags);
         if (close) {
-                if (abrupt)
-                        ret = abort_connection(ep, NULL, gfp);
-                else
+                if (abrupt) {
+                        close_complete_upcall(ep);
+                        ret = send_abort(ep, NULL, gfp);
+                } else
                         ret = send_halfclose(ep, gfp);
                 if (ret)
                         fatal = 1;
         }
+        mutex_unlock(&ep->com.mutex);
         if (fatal)
                 release_ep_resources(ep);
         return ret;
 }
 
+static int async_event(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_fw6_msg *rpl = cplhdr(skb);
+        c4iw_ev_dispatch(dev, (struct t4_cqe *)&rpl->data[0]);
+        return 0;
+}
+
 /*
  * These are the real handlers that are called from a
  * work queue.
@@ -2190,7 +2151,8 @@ static c4iw_handler_func work_handlers[NUM_CPL_CMDS] = {
         [CPL_ABORT_REQ_RSS] = peer_abort,
         [CPL_CLOSE_CON_RPL] = close_con_rpl,
         [CPL_RDMA_TERMINATE] = terminate,
-        [CPL_FW4_ACK] = fw4_ack
+        [CPL_FW4_ACK] = fw4_ack,
+        [CPL_FW6_MSG] = async_event
 };
 
 static void process_timeout(struct c4iw_ep *ep)
@@ -2198,7 +2160,7 @@ static void process_timeout(struct c4iw_ep *ep)
         struct c4iw_qp_attributes attrs;
         int abort = 1;
 
-        spin_lock_irq(&ep->com.lock);
+        mutex_lock(&ep->com.mutex);
         PDBG("%s ep %p tid %u state %d\n", __func__, ep, ep->hwtid,
              ep->com.state);
         switch (ep->com.state) {
@@ -2225,7 +2187,7 @@ static void process_timeout(struct c4iw_ep *ep)
                 WARN_ON(1);
                 abort = 0;
         }
-        spin_unlock_irq(&ep->com.lock);
+        mutex_unlock(&ep->com.mutex);
         if (abort)
                 abort_connection(ep, NULL, GFP_KERNEL);
         c4iw_put_ep(&ep->com);
@@ -2309,6 +2271,7 @@ static int set_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
                 printk(KERN_ERR MOD "Unexpected SET_TCB_RPL status %u "
                        "for tid %u\n", rpl->status, GET_TID(rpl));
         }
+        kfree_skb(skb);
         return 0;
 }
 
@@ -2323,25 +2286,49 @@ static int fw6_msg(struct c4iw_dev *dev, struct sk_buff *skb)
         switch (rpl->type) {
         case 1:
                 ret = (int)((be64_to_cpu(rpl->data[0]) >> 8) & 0xff);
-                wr_waitp = (__force struct c4iw_wr_wait *)rpl->data[1];
+                wr_waitp = (struct c4iw_wr_wait *)(__force unsigned long) rpl->data[1];
                 PDBG("%s wr_waitp %p ret %u\n", __func__, wr_waitp, ret);
-                if (wr_waitp) {
-                        wr_waitp->ret = ret;
-                        wr_waitp->done = 1;
-                        wake_up(&wr_waitp->wait);
-                }
+                if (wr_waitp)
+                        c4iw_wake_up(wr_waitp, ret ? -ret : 0);
+                kfree_skb(skb);
                 break;
         case 2:
-                c4iw_ev_dispatch(dev, (struct t4_cqe *)&rpl->data[0]);
+                sched(dev, skb);
                 break;
         default:
                 printk(KERN_ERR MOD "%s unexpected fw6 msg type %u\n", __func__,
                        rpl->type);
+                kfree_skb(skb);
                 break;
         }
         return 0;
 }
 
+static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_abort_req_rss *req = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+
+        ep = lookup_tid(t, tid);
+        if (is_neg_adv_abort(req->status)) {
+                PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+                     ep->hwtid);
+                kfree_skb(skb);
+                return 0;
+        }
+        PDBG("%s ep %p tid %u state %u\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+
+        /*
+         * Wake up any threads in rdma_init() or rdma_fini().
+         */
+        c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+        sched(dev, skb);
+        return 0;
+}
+
 /*
  * Most upcalls from the T4 Core go to sched() to
  * schedule the processing on a work queue.
@@ -2358,7 +2345,7 @@ c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS] = {
         [CPL_PASS_ESTABLISH] = sched,
         [CPL_PEER_CLOSE] = sched,
         [CPL_CLOSE_CON_RPL] = sched,
-        [CPL_ABORT_REQ_RSS] = sched,
+        [CPL_ABORT_REQ_RSS] = peer_abort_intr,
         [CPL_RDMA_TERMINATE] = sched,
         [CPL_FW4_ACK] = sched,
         [CPL_SET_TCB_RPL] = set_tcb_rpl,
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index b3daf39eed4a..1720dc790d13 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -55,7 +55,7 @@ static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
                         V_FW_RI_RES_WR_NRES(1) |
                         FW_WR_COMPL(1));
         res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
-        res_wr->cookie = (u64)&wr_wait;
+        res_wr->cookie = (unsigned long) &wr_wait;
         res = res_wr->res;
         res->u.cq.restype = FW_RI_RES_TYPE_CQ;
         res->u.cq.op = FW_RI_RES_OP_RESET;
@@ -64,14 +64,7 @@ static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
         c4iw_init_wr_wait(&wr_wait);
         ret = c4iw_ofld_send(rdev, skb);
         if (!ret) {
-                wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-                if (!wr_wait.done) {
-                        printk(KERN_ERR MOD "Device %s not responding!\n",
-                               pci_name(rdev->lldi.pdev));
-                        rdev->flags = T4_FATAL_ERROR;
-                        ret = -EIO;
-                } else
-                        ret = wr_wait.ret;
+                ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, __func__);
         }
 
         kfree(cq->sw_queue);
@@ -132,7 +125,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
                         V_FW_RI_RES_WR_NRES(1) |
                         FW_WR_COMPL(1));
         res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
-        res_wr->cookie = (u64)&wr_wait;
+        res_wr->cookie = (unsigned long) &wr_wait;
         res = res_wr->res;
         res->u.cq.restype = FW_RI_RES_TYPE_CQ;
         res->u.cq.op = FW_RI_RES_OP_WRITE;
@@ -157,14 +150,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
         if (ret)
                 goto err4;
         PDBG("%s wait_event wr_wait %p\n", __func__, &wr_wait);
-        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-        if (!wr_wait.done) {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(rdev->lldi.pdev));
-                rdev->flags = T4_FATAL_ERROR;
-                ret = -EIO;
-        } else
-                ret = wr_wait.ret;
+        ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, __func__);
         if (ret)
                 goto err4;
 
@@ -476,6 +462,11 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
                 goto proc_cqe;
         }
 
+        if (CQE_OPCODE(hw_cqe) == FW_RI_TERMINATE) {
+                ret = -EAGAIN;
+                goto skip_cqe;
+        }
+
         /*
          * RECV completion.
          */
@@ -696,6 +687,7 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                 case T4_ERR_MSN_RANGE:
                 case T4_ERR_IRD_OVERFLOW:
                 case T4_ERR_OPCODE:
+                case T4_ERR_INTERNAL_ERR:
                         wc->status = IB_WC_FATAL_ERR;
                         break;
                 case T4_ERR_SWFLUSH:
@@ -809,6 +801,10 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
         if (ucontext) {
                 memsize = roundup(memsize, PAGE_SIZE);
                 hwentries = memsize / sizeof *chp->cq.queue;
+                while (hwentries > T4_MAX_IQ_SIZE) {
+                        memsize -= PAGE_SIZE;
+                        hwentries = memsize / sizeof *chp->cq.queue;
+                }
         }
         chp->cq.size = hwentries;
         chp->cq.memsize = memsize;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 9bbf491d5d9e..40a13cc633a3 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -44,34 +44,38 @@ MODULE_DESCRIPTION("Chelsio T4 RDMA Driver");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 
-static LIST_HEAD(dev_list);
+static LIST_HEAD(uld_ctx_list);
 static DEFINE_MUTEX(dev_mutex);
 
 static struct dentry *c4iw_debugfs_root;
 
-struct debugfs_qp_data {
+struct c4iw_debugfs_data {
         struct c4iw_dev *devp;
         char *buf;
         int bufsize;
         int pos;
 };
 
-static int count_qps(int id, void *p, void *data)
+static int count_idrs(int id, void *p, void *data)
 {
-        struct c4iw_qp *qp = p;
         int *countp = data;
 
-        if (id != qp->wq.sq.qid)
-                return 0;
-
         *countp = *countp + 1;
         return 0;
 }
 
-static int dump_qps(int id, void *p, void *data)
+static ssize_t debugfs_read(struct file *file, char __user *buf, size_t count,
+                            loff_t *ppos)
+{
+        struct c4iw_debugfs_data *d = file->private_data;
+
+        return simple_read_from_buffer(buf, count, ppos, d->buf, d->pos);
+}
+
+static int dump_qp(int id, void *p, void *data)
 {
         struct c4iw_qp *qp = p;
-        struct debugfs_qp_data *qpd = data;
+        struct c4iw_debugfs_data *qpd = data;
         int space;
         int cc;
 
@@ -83,17 +87,22 @@ static int dump_qps(int id, void *p, void *data)
                 return 1;
 
         if (qp->ep)
-                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u "
+                cc = snprintf(qpd->buf + qpd->pos, space,
+                             "qp sq id %u rq id %u state %u onchip %u "
                              "ep tid %u state %u %pI4:%u->%pI4:%u\n",
-                             qp->wq.sq.qid, (int)qp->attr.state,
+                             qp->wq.sq.qid, qp->wq.rq.qid, (int)qp->attr.state,
+                             qp->wq.sq.flags & T4_SQ_ONCHIP,
                              qp->ep->hwtid, (int)qp->ep->com.state,
                              &qp->ep->com.local_addr.sin_addr.s_addr,
                              ntohs(qp->ep->com.local_addr.sin_port),
                              &qp->ep->com.remote_addr.sin_addr.s_addr,
                              ntohs(qp->ep->com.remote_addr.sin_port));
         else
-                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u\n",
-                              qp->wq.sq.qid, (int)qp->attr.state);
+                cc = snprintf(qpd->buf + qpd->pos, space,
+                             "qp sq id %u rq id %u state %u onchip %u\n",
+                              qp->wq.sq.qid, qp->wq.rq.qid,
+                              (int)qp->attr.state,
+                              qp->wq.sq.flags & T4_SQ_ONCHIP);
         if (cc < space)
                 qpd->pos += cc;
         return 0;
@@ -101,7 +110,7 @@ static int dump_qps(int id, void *p, void *data)
 
 static int qp_release(struct inode *inode, struct file *file)
 {
-        struct debugfs_qp_data *qpd = file->private_data;
+        struct c4iw_debugfs_data *qpd = file->private_data;
         if (!qpd) {
                 printk(KERN_INFO "%s null qpd?\n", __func__);
                 return 0;
@@ -113,7 +122,7 @@ static int qp_release(struct inode *inode, struct file *file)
 
 static int qp_open(struct inode *inode, struct file *file)
 {
-        struct debugfs_qp_data *qpd;
+        struct c4iw_debugfs_data *qpd;
         int ret = 0;
         int count = 1;
 
@@ -126,7 +135,7 @@ static int qp_open(struct inode *inode, struct file *file)
         qpd->pos = 0;
 
         spin_lock_irq(&qpd->devp->lock);
-        idr_for_each(&qpd->devp->qpidr, count_qps, &count);
+        idr_for_each(&qpd->devp->qpidr, count_idrs, &count);
         spin_unlock_irq(&qpd->devp->lock);
 
         qpd->bufsize = count * 128;
@@ -137,7 +146,7 @@ static int qp_open(struct inode *inode, struct file *file)
         }
 
         spin_lock_irq(&qpd->devp->lock);
-        idr_for_each(&qpd->devp->qpidr, dump_qps, qpd);
+        idr_for_each(&qpd->devp->qpidr, dump_qp, qpd);
         spin_unlock_irq(&qpd->devp->lock);
 
         qpd->buf[qpd->pos++] = 0;
@@ -149,43 +158,86 @@ out:
         return ret;
 }
 
-static ssize_t qp_read(struct file *file, char __user *buf, size_t count,
-                        loff_t *ppos)
+static const struct file_operations qp_debugfs_fops = {
+        .owner   = THIS_MODULE,
+        .open    = qp_open,
+        .release = qp_release,
+        .read    = debugfs_read,
+        .llseek  = default_llseek,
+};
+
+static int dump_stag(int id, void *p, void *data)
 {
-        struct debugfs_qp_data *qpd = file->private_data;
-        loff_t pos = *ppos;
-        loff_t avail = qpd->pos;
+        struct c4iw_debugfs_data *stagd = data;
+        int space;
+        int cc;
+
+        space = stagd->bufsize - stagd->pos - 1;
+        if (space == 0)
+                return 1;
+
+        cc = snprintf(stagd->buf + stagd->pos, space, "0x%x\n", id<<8);
+        if (cc < space)
+                stagd->pos += cc;
+        return 0;
+}
 
-        if (pos < 0)
-                return -EINVAL;
-        if (pos >= avail)
+static int stag_release(struct inode *inode, struct file *file)
+{
+        struct c4iw_debugfs_data *stagd = file->private_data;
+        if (!stagd) {
+                printk(KERN_INFO "%s null stagd?\n", __func__);
                 return 0;
-        if (count > avail - pos)
-                count = avail - pos;
+        }
+        kfree(stagd->buf);
+        kfree(stagd);
+        return 0;
+}
 
-        while (count) {
-                size_t len = 0;
+static int stag_open(struct inode *inode, struct file *file)
+{
+        struct c4iw_debugfs_data *stagd;
+        int ret = 0;
+        int count = 1;
 
-                len = min((int)count, (int)qpd->pos - (int)pos);
-                if (copy_to_user(buf, qpd->buf + pos, len))
-                        return -EFAULT;
-                if (len == 0)
-                        return -EINVAL;
+        stagd = kmalloc(sizeof *stagd, GFP_KERNEL);
+        if (!stagd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        stagd->devp = inode->i_private;
+        stagd->pos = 0;
+
+        spin_lock_irq(&stagd->devp->lock);
+        idr_for_each(&stagd->devp->mmidr, count_idrs, &count);
+        spin_unlock_irq(&stagd->devp->lock);
 
-                buf += len;
-                pos += len;
-                count -= len;
+        stagd->bufsize = count * sizeof("0x12345678\n");
+        stagd->buf = kmalloc(stagd->bufsize, GFP_KERNEL);
+        if (!stagd->buf) {
+                ret = -ENOMEM;
+                goto err1;
         }
-        count = pos - *ppos;
-        *ppos = pos;
-        return count;
+
+        spin_lock_irq(&stagd->devp->lock);
+        idr_for_each(&stagd->devp->mmidr, dump_stag, stagd);
+        spin_unlock_irq(&stagd->devp->lock);
+
+        stagd->buf[stagd->pos++] = 0;
+        file->private_data = stagd;
+        goto out;
+err1:
+        kfree(stagd);
+out:
+        return ret;
 }
 
-static const struct file_operations qp_debugfs_fops = {
+static const struct file_operations stag_debugfs_fops = {
         .owner   = THIS_MODULE,
-        .open    = qp_open,
-        .release = qp_release,
-        .read    = qp_read,
+        .open    = stag_open,
+        .release = stag_release,
+        .read    = debugfs_read,
+        .llseek  = default_llseek,
 };
 
 static int setup_debugfs(struct c4iw_dev *devp)
@@ -199,6 +251,11 @@ static int setup_debugfs(struct c4iw_dev *devp)
                                  (void *)devp, &qp_debugfs_fops);
         if (de && de->d_inode)
                 de->d_inode->i_size = 4096;
+
+        de = debugfs_create_file("stags", S_IWUSR, devp->debugfs_root,
+                                 (void *)devp, &stag_debugfs_fops);
+        if (de && de->d_inode)
+                de->d_inode->i_size = 4096;
         return 0;
 }
 
@@ -290,7 +347,14 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 printk(KERN_ERR MOD "error %d initializing rqt pool\n", err);
                 goto err3;
         }
+        err = c4iw_ocqp_pool_create(rdev);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing ocqp pool\n", err);
+                goto err4;
+        }
         return 0;
+err4:
+        c4iw_rqtpool_destroy(rdev);
 err3:
         c4iw_pblpool_destroy(rdev);
 err2:
@@ -306,18 +370,23 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
         c4iw_destroy_resource(&rdev->resource);
 }
 
-static void c4iw_remove(struct c4iw_dev *dev)
+struct uld_ctx {
+        struct list_head entry;
+        struct cxgb4_lld_info lldi;
+        struct c4iw_dev *dev;
+};
+
+static void c4iw_remove(struct uld_ctx *ctx)
 {
-        PDBG("%s c4iw_dev %p\n", __func__,  dev);
-        cancel_delayed_work_sync(&dev->db_drop_task);
-        list_del(&dev->entry);
-        if (dev->registered)
-                c4iw_unregister_device(dev);
-        c4iw_rdev_close(&dev->rdev);
-        idr_destroy(&dev->cqidr);
-        idr_destroy(&dev->qpidr);
-        idr_destroy(&dev->mmidr);
-        ib_dealloc_device(&dev->ibdev);
+        PDBG("%s c4iw_dev %p\n", __func__,  ctx->dev);
+        c4iw_unregister_device(ctx->dev);
+        c4iw_rdev_close(&ctx->dev->rdev);
+        idr_destroy(&ctx->dev->cqidr);
+        idr_destroy(&ctx->dev->qpidr);
+        idr_destroy(&ctx->dev->mmidr);
+        iounmap(ctx->dev->rdev.oc_mw_kva);
+        ib_dealloc_device(&ctx->dev->ibdev);
+        ctx->dev = NULL;
 }
 
 static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
@@ -328,26 +397,33 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
         devp = (struct c4iw_dev *)ib_alloc_device(sizeof(*devp));
         if (!devp) {
                 printk(KERN_ERR MOD "Cannot allocate ib device\n");
-                return NULL;
+                return ERR_PTR(-ENOMEM);
         }
         devp->rdev.lldi = *infop;
 
-        mutex_lock(&dev_mutex);
+        devp->rdev.oc_mw_pa = pci_resource_start(devp->rdev.lldi.pdev, 2) +
+                (pci_resource_len(devp->rdev.lldi.pdev, 2) -
+                 roundup_pow_of_two(devp->rdev.lldi.vr->ocq.size));
+        devp->rdev.oc_mw_kva = ioremap_wc(devp->rdev.oc_mw_pa,
+                                               devp->rdev.lldi.vr->ocq.size);
+
+        PDBG(KERN_INFO MOD "ocq memory: "
+               "hw_start 0x%x size %u mw_pa 0x%lx mw_kva %p\n",
+               devp->rdev.lldi.vr->ocq.start, devp->rdev.lldi.vr->ocq.size,
+               devp->rdev.oc_mw_pa, devp->rdev.oc_mw_kva);
 
         ret = c4iw_rdev_open(&devp->rdev);
         if (ret) {
                 mutex_unlock(&dev_mutex);
                 printk(KERN_ERR MOD "Unable to open CXIO rdev err %d\n", ret);
                 ib_dealloc_device(&devp->ibdev);
-                return NULL;
+                return ERR_PTR(ret);
         }
 
         idr_init(&devp->cqidr);
         idr_init(&devp->qpidr);
         idr_init(&devp->mmidr);
         spin_lock_init(&devp->lock);
-        list_add_tail(&devp->entry, &dev_list);
-        mutex_unlock(&dev_mutex);
 
         if (c4iw_debugfs_root) {
                 devp->debugfs_root = debugfs_create_dir(
@@ -360,7 +436,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
 
 static void *c4iw_uld_add(const struct cxgb4_lld_info *infop)
 {
-        struct c4iw_dev *dev;
+        struct uld_ctx *ctx;
         static int vers_printed;
         int i;
 
@@ -368,65 +444,33 @@ static void *c4iw_uld_add(const struct cxgb4_lld_info *infop)
                 printk(KERN_INFO MOD "Chelsio T4 RDMA Driver - version %s\n",
                        DRV_VERSION);
 
-        dev = c4iw_alloc(infop);
-        if (!dev)
+        ctx = kzalloc(sizeof *ctx, GFP_KERNEL);
+        if (!ctx) {
+                ctx = ERR_PTR(-ENOMEM);
                 goto out;
+        }
+        ctx->lldi = *infop;
 
         PDBG("%s found device %s nchan %u nrxq %u ntxq %u nports %u\n",
-             __func__, pci_name(dev->rdev.lldi.pdev),
-             dev->rdev.lldi.nchan, dev->rdev.lldi.nrxq,
-             dev->rdev.lldi.ntxq, dev->rdev.lldi.nports);
+             __func__, pci_name(ctx->lldi.pdev),
+             ctx->lldi.nchan, ctx->lldi.nrxq,
+             ctx->lldi.ntxq, ctx->lldi.nports);
 
-        for (i = 0; i < dev->rdev.lldi.nrxq; i++)
-                PDBG("rxqid[%u] %u\n", i, dev->rdev.lldi.rxq_ids[i]);
-out:
-        return dev;
-}
-
-static struct sk_buff *t4_pktgl_to_skb(const struct pkt_gl *gl,
-                                       unsigned int skb_len,
-                                       unsigned int pull_len)
-{
-        struct sk_buff *skb;
-        struct skb_shared_info *ssi;
+        mutex_lock(&dev_mutex);
+        list_add_tail(&ctx->entry, &uld_ctx_list);
+        mutex_unlock(&dev_mutex);
 
-        if (gl->tot_len <= 512) {
-                skb = alloc_skb(gl->tot_len, GFP_ATOMIC);
-                if (unlikely(!skb))
-                        goto out;
-                __skb_put(skb, gl->tot_len);
-                skb_copy_to_linear_data(skb, gl->va, gl->tot_len);
-        } else {
-                skb = alloc_skb(skb_len, GFP_ATOMIC);
-                if (unlikely(!skb))
-                        goto out;
-                __skb_put(skb, pull_len);
-                skb_copy_to_linear_data(skb, gl->va, pull_len);
-
-                ssi = skb_shinfo(skb);
-                ssi->frags[0].page = gl->frags[0].page;
-                ssi->frags[0].page_offset = gl->frags[0].page_offset + pull_len;
-                ssi->frags[0].size = gl->frags[0].size - pull_len;
-                if (gl->nfrags > 1)
-                        memcpy(&ssi->frags[1], &gl->frags[1],
-                               (gl->nfrags - 1) * sizeof(skb_frag_t));
-                ssi->nr_frags = gl->nfrags;
-
-                skb->len = gl->tot_len;
-                skb->data_len = skb->len - pull_len;
-                skb->truesize += skb->data_len;
-
-                /* Get a reference for the last page, we don't own it */
-                get_page(gl->frags[gl->nfrags - 1].page);
-        }
+        for (i = 0; i < ctx->lldi.nrxq; i++)
+                PDBG("rxqid[%u] %u\n", i, ctx->lldi.rxq_ids[i]);
 out:
-        return skb;
+        return ctx;
 }
 
 static int c4iw_uld_rx_handler(void *handle, const __be64 *rsp,
                         const struct pkt_gl *gl)
 {
-        struct c4iw_dev *dev = handle;
+        struct uld_ctx *ctx = handle;
+        struct c4iw_dev *dev = ctx->dev;
         struct sk_buff *skb;
         const struct cpl_act_establish *rpl;
         unsigned int opcode;
@@ -447,7 +491,7 @@ static int c4iw_uld_rx_handler(void *handle, const __be64 *rsp,
                 c4iw_ev_handler(dev, qid);
                 return 0;
         } else {
-                skb = t4_pktgl_to_skb(gl, 128, 128);
+                skb = cxgb4_pktgl_to_skb(gl, 128, 128);
                 if (unlikely(!skb))
                         goto nomem;
         }
@@ -468,39 +512,49 @@ nomem:
 
 static int c4iw_uld_state_change(void *handle, enum cxgb4_state new_state)
 {
-        struct c4iw_dev *dev = handle;
+        struct uld_ctx *ctx = handle;
 
         PDBG("%s new_state %u\n", __func__, new_state);
         switch (new_state) {
         case CXGB4_STATE_UP:
-                printk(KERN_INFO MOD "%s: Up\n", pci_name(dev->rdev.lldi.pdev));
-                if (!dev->registered) {
-                        int ret;
-                        ret = c4iw_register_device(dev);
-                        if (ret)
+                printk(KERN_INFO MOD "%s: Up\n", pci_name(ctx->lldi.pdev));
+                if (!ctx->dev) {
+                        int ret = 0;
+
+                        ctx->dev = c4iw_alloc(&ctx->lldi);
+                        if (!IS_ERR(ctx->dev))
+                                ret = c4iw_register_device(ctx->dev);
+                        if (IS_ERR(ctx->dev) || ret)
                                 printk(KERN_ERR MOD
                                        "%s: RDMA registration failed: %d\n",
-                                       pci_name(dev->rdev.lldi.pdev), ret);
+                                       pci_name(ctx->lldi.pdev), ret);
                 }
                 break;
         case CXGB4_STATE_DOWN:
                 printk(KERN_INFO MOD "%s: Down\n",
-                       pci_name(dev->rdev.lldi.pdev));
-                if (dev->registered)
-                        c4iw_unregister_device(dev);
+                       pci_name(ctx->lldi.pdev));
+                if (ctx->dev)
+                        c4iw_remove(ctx);
                 break;
         case CXGB4_STATE_START_RECOVERY:
                 printk(KERN_INFO MOD "%s: Fatal Error\n",
-                       pci_name(dev->rdev.lldi.pdev));
-                if (dev->registered)
-                        c4iw_unregister_device(dev);
+                       pci_name(ctx->lldi.pdev));
+                if (ctx->dev) {
+                        struct ib_event event;
+
+                        ctx->dev->rdev.flags |= T4_FATAL_ERROR;
+                        memset(&event, 0, sizeof event);
+                        event.event  = IB_EVENT_DEVICE_FATAL;
+                        event.device = &ctx->dev->ibdev;
+                        ib_dispatch_event(&event);
+                        c4iw_remove(ctx);
+                }
                 break;
         case CXGB4_STATE_DETACH:
                 printk(KERN_INFO MOD "%s: Detach\n",
-                       pci_name(dev->rdev.lldi.pdev));
-                mutex_lock(&dev_mutex);
-                c4iw_remove(dev);
-                mutex_unlock(&dev_mutex);
+                       pci_name(ctx->lldi.pdev));
+                if (ctx->dev)
+                        c4iw_remove(ctx);
                 break;
         }
         return 0;
@@ -533,11 +587,13 @@ static int __init c4iw_init_module(void)
 
 static void __exit c4iw_exit_module(void)
 {
-        struct c4iw_dev *dev, *tmp;
+        struct uld_ctx *ctx, *tmp;
 
         mutex_lock(&dev_mutex);
-        list_for_each_entry_safe(dev, tmp, &dev_list, entry) {
-                c4iw_remove(dev);
+        list_for_each_entry_safe(ctx, tmp, &uld_ctx_list, entry) {
+                if (ctx->dev)
+                        c4iw_remove(ctx);
+                kfree(ctx);
         }
         mutex_unlock(&dev_mutex);
         cxgb4_unregister_uld(CXGB4_ULD_RDMA);
diff --git a/drivers/infiniband/hw/cxgb4/ev.c b/drivers/infiniband/hw/cxgb4/ev.c
index 491e76a0327f..c13041a0aeba 100644
--- a/drivers/infiniband/hw/cxgb4/ev.c
+++ b/drivers/infiniband/hw/cxgb4/ev.c
@@ -60,7 +60,7 @@ static void post_qp_event(struct c4iw_dev *dev, struct c4iw_cq *chp,
         if (qhp->attr.state == C4IW_QP_STATE_RTS) {
                 attrs.next_state = C4IW_QP_STATE_TERMINATE;
                 c4iw_modify_qp(qhp->rhp, qhp, C4IW_QP_ATTR_NEXT_STATE,
-                               &attrs, 1);
+                               &attrs, 0);
         }
 
         event.event = ib_event;
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index ed459b8f800f..4f045375c8e2 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -35,7 +35,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
-#include <linux/workqueue.h>
+#include <linux/completion.h>
 #include <linux/netdevice.h>
 #include <linux/sched.h>
 #include <linux/pci.h>
@@ -79,21 +79,6 @@ static inline void *cplhdr(struct sk_buff *skb)
         return skb->data;
 }
 
-#define C4IW_WR_TO (10*HZ)
-
-struct c4iw_wr_wait {
-        wait_queue_head_t wait;
-        int done;
-        int ret;
-};
-
-static inline void c4iw_init_wr_wait(struct c4iw_wr_wait *wr_waitp)
-{
-        wr_waitp->ret = 0;
-        wr_waitp->done = 0;
-        init_waitqueue_head(&wr_waitp->wait);
-}
-
 struct c4iw_resource {
         struct kfifo tpt_fifo;
         spinlock_t tpt_fifo_lock;
@@ -127,8 +112,11 @@ struct c4iw_rdev {
         struct c4iw_dev_ucontext uctx;
         struct gen_pool *pbl_pool;
         struct gen_pool *rqt_pool;
+        struct gen_pool *ocqp_pool;
         u32 flags;
         struct cxgb4_lld_info lldi;
+        unsigned long oc_mw_pa;
+        void __iomem *oc_mw_kva;
 };
 
 static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
@@ -141,6 +129,52 @@ static inline int c4iw_num_stags(struct c4iw_rdev *rdev)
         return min((int)T4_MAX_NUM_STAG, (int)(rdev->lldi.vr->stag.size >> 5));
 }
 
+#define C4IW_WR_TO (10*HZ)
+
+struct c4iw_wr_wait {
+        struct completion completion;
+        int ret;
+};
+
+static inline void c4iw_init_wr_wait(struct c4iw_wr_wait *wr_waitp)
+{
+        wr_waitp->ret = 0;
+        init_completion(&wr_waitp->completion);
+}
+
+static inline void c4iw_wake_up(struct c4iw_wr_wait *wr_waitp, int ret)
+{
+        wr_waitp->ret = ret;
+        complete(&wr_waitp->completion);
+}
+
+static inline int c4iw_wait_for_reply(struct c4iw_rdev *rdev,
+                                 struct c4iw_wr_wait *wr_waitp,
+                                 u32 hwtid, u32 qpid,
+                                 const char *func)
+{
+        unsigned to = C4IW_WR_TO;
+        int ret;
+
+        do {
+                ret = wait_for_completion_timeout(&wr_waitp->completion, to);
+                if (!ret) {
+                        printk(KERN_ERR MOD "%s - Device %s not responding - "
+                               "tid %u qpid %u\n", func,
+                               pci_name(rdev->lldi.pdev), hwtid, qpid);
+                        if (c4iw_fatal_error(rdev)) {
+                                wr_waitp->ret = -EIO;
+                                break;
+                        }
+                        to = to << 2;
+                }
+        } while (!ret);
+        if (wr_waitp->ret)
+                PDBG("%s: FW reply %d tid %u qpid %u\n",
+                     pci_name(rdev->lldi.pdev), wr_waitp->ret, hwtid, qpid);
+        return wr_waitp->ret;
+}
+
 struct c4iw_dev {
         struct ib_device ibdev;
         struct c4iw_rdev rdev;
@@ -149,10 +183,7 @@ struct c4iw_dev {
         struct idr qpidr;
         struct idr mmidr;
         spinlock_t lock;
-        struct list_head entry;
-        struct delayed_work db_drop_task;
         struct dentry *debugfs_root;
-        u8 registered;
 };
 
 static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
@@ -327,6 +358,7 @@ struct c4iw_qp {
         struct c4iw_qp_attributes attr;
         struct t4_wq wq;
         spinlock_t lock;
+        struct mutex mutex;
         atomic_t refcnt;
         wait_queue_head_t wait;
         struct timer_list timer;
@@ -579,12 +611,10 @@ struct c4iw_ep_common {
         struct c4iw_dev *dev;
         enum c4iw_ep_state state;
         struct kref kref;
-        spinlock_t lock;
+        struct mutex mutex;
         struct sockaddr_in local_addr;
         struct sockaddr_in remote_addr;
-        wait_queue_head_t waitq;
-        int rpl_done;
-        int rpl_err;
+        struct c4iw_wr_wait wr_wait;
         unsigned long flags;
 };
 
@@ -654,8 +684,10 @@ int c4iw_init_resource(struct c4iw_rdev *rdev, u32 nr_tpt, u32 nr_pdid);
 int c4iw_init_ctrl_qp(struct c4iw_rdev *rdev);
 int c4iw_pblpool_create(struct c4iw_rdev *rdev);
 int c4iw_rqtpool_create(struct c4iw_rdev *rdev);
+int c4iw_ocqp_pool_create(struct c4iw_rdev *rdev);
 void c4iw_pblpool_destroy(struct c4iw_rdev *rdev);
 void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev);
+void c4iw_ocqp_pool_destroy(struct c4iw_rdev *rdev);
 void c4iw_destroy_resource(struct c4iw_resource *rscp);
 int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
 int c4iw_register_device(struct c4iw_dev *dev);
@@ -721,6 +753,8 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
 u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
 void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
+u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size);
+void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size);
 int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb);
 void c4iw_flush_hw_cq(struct t4_cq *cq);
 void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
@@ -730,7 +764,6 @@ int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
 int c4iw_flush_sq(struct t4_wq *wq, struct t4_cq *cq, int count);
 int c4iw_ev_handler(struct c4iw_dev *rnicp, u32 qid);
 u16 c4iw_rqes_posted(struct c4iw_qp *qhp);
-int c4iw_post_zb_read(struct c4iw_qp *qhp);
 int c4iw_post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe);
 u32 c4iw_get_cqid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
 void c4iw_put_cqid(struct c4iw_rdev *rdev, u32 qid,
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 269373a62f22..0347eed4a167 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -71,7 +71,7 @@ static int write_adapter_mem(struct c4iw_rdev *rdev, u32 addr, u32 len,
                 if (i == (num_wqe-1)) {
                         req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR) |
                                                     FW_WR_COMPL(1));
-                        req->wr.wr_lo = (__force __be64)&wr_wait;
+                        req->wr.wr_lo = (__force __be64)(unsigned long) &wr_wait;
                 } else
                         req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR));
                 req->wr.wr_mid = cpu_to_be32(
@@ -103,14 +103,7 @@ static int write_adapter_mem(struct c4iw_rdev *rdev, u32 addr, u32 len,
                 len -= C4IW_MAX_INLINE_SIZE;
         }
 
-        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-        if (!wr_wait.done) {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(rdev->lldi.pdev));
-                rdev->flags = T4_FATAL_ERROR;
-                ret = -EIO;
-        } else
-                ret = wr_wait.ret;
+        ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, __func__);
         return ret;
 }
 
@@ -632,7 +625,7 @@ pbl_done:
         mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
         mhp->attr.va_fbo = virt;
         mhp->attr.page_size = shift - 12;
-        mhp->attr.len = (u32) length;
+        mhp->attr.len = length;
 
         err = register_mem(rhp, php, mhp, shift);
         if (err)
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
index 8f645c83a125..5b9e4220ca08 100644
--- a/drivers/infiniband/hw/cxgb4/provider.c
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -54,9 +54,9 @@
 
 #include "iw_cxgb4.h"
 
-static int fastreg_support;
+static int fastreg_support = 1;
 module_param(fastreg_support, int, 0644);
-MODULE_PARM_DESC(fastreg_support, "Advertise fastreg support (default=0)");
+MODULE_PARM_DESC(fastreg_support, "Advertise fastreg support (default=1)");
 
 static int c4iw_modify_port(struct ib_device *ibdev,
                             u8 port, int port_modify_mask,
@@ -149,19 +149,28 @@ static int c4iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
         addr = mm->addr;
         kfree(mm);
 
-        if ((addr >= pci_resource_start(rdev->lldi.pdev, 2)) &&
-            (addr < (pci_resource_start(rdev->lldi.pdev, 2) +
-                       pci_resource_len(rdev->lldi.pdev, 2)))) {
+        if ((addr >= pci_resource_start(rdev->lldi.pdev, 0)) &&
+            (addr < (pci_resource_start(rdev->lldi.pdev, 0) +
+                    pci_resource_len(rdev->lldi.pdev, 0)))) {
 
                 /*
-                 * Map T4 DB register.
+                 * MA_SYNC register...
                  */
-                if (vma->vm_flags & VM_READ)
-                        return -EPERM;
-
                 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
-                vma->vm_flags &= ~VM_MAYREAD;
+                ret = io_remap_pfn_range(vma, vma->vm_start,
+                                         addr >> PAGE_SHIFT,
+                                         len, vma->vm_page_prot);
+        } else if ((addr >= pci_resource_start(rdev->lldi.pdev, 2)) &&
+                   (addr < (pci_resource_start(rdev->lldi.pdev, 2) +
+                    pci_resource_len(rdev->lldi.pdev, 2)))) {
+
+                /*
+                 * Map user DB or OCQP memory...
+                 */
+                if (addr >= rdev->oc_mw_pa)
+                        vma->vm_page_prot = t4_pgprot_wc(vma->vm_page_prot);
+                else
+                        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
                 ret = io_remap_pfn_range(vma, vma->vm_start,
                                          addr >> PAGE_SHIFT,
                                          len, vma->vm_page_prot);
@@ -382,7 +391,17 @@ static ssize_t show_board(struct device *dev, struct device_attribute *attr,
 static int c4iw_get_mib(struct ib_device *ibdev,
                         union rdma_protocol_stats *stats)
 {
-        return -ENOSYS;
+        struct tp_tcp_stats v4, v6;
+        struct c4iw_dev *c4iw_dev = to_c4iw_dev(ibdev);
+
+        cxgb4_get_tcp_stats(c4iw_dev->rdev.lldi.pdev, &v4, &v6);
+        memset(stats, 0, sizeof *stats);
+        stats->iw.tcpInSegs = v4.tcpInSegs + v6.tcpInSegs;
+        stats->iw.tcpOutSegs = v4.tcpOutSegs + v6.tcpOutSegs;
+        stats->iw.tcpRetransSegs = v4.tcpRetransSegs + v6.tcpRetransSegs;
+        stats->iw.tcpOutRsts = v4.tcpOutRsts + v6.tcpOutSegs;
+
+        return 0;
 }
 
 static DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
@@ -472,6 +491,7 @@ int c4iw_register_device(struct c4iw_dev *dev)
         dev->ibdev.post_send = c4iw_post_send;
         dev->ibdev.post_recv = c4iw_post_receive;
         dev->ibdev.get_protocol_stats = c4iw_get_mib;
+        dev->ibdev.uverbs_abi_ver = C4IW_UVERBS_ABI_VERSION;
 
         dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
         if (!dev->ibdev.iwcm)
@@ -496,7 +516,6 @@ int c4iw_register_device(struct c4iw_dev *dev)
                 if (ret)
                         goto bail2;
         }
-        dev->registered = 1;
         return 0;
 bail2:
         ib_unregister_device(&dev->ibdev);
@@ -515,6 +534,5 @@ void c4iw_unregister_device(struct c4iw_dev *dev)
                                    c4iw_class_attributes[i]);
         ib_unregister_device(&dev->ibdev);
         kfree(dev->ibdev.iwcm);
-        dev->registered = 0;
         return;
 }
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 93f6e5bf0ec5..a41578e48c7b 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -31,6 +31,63 @@
  */
 #include "iw_cxgb4.h"
 
+static int ocqp_support = 1;
+module_param(ocqp_support, int, 0644);
+MODULE_PARM_DESC(ocqp_support, "Support on-chip SQs (default=1)");
+
+static void set_state(struct c4iw_qp *qhp, enum c4iw_qp_state state)
+{
+        unsigned long flag;
+        spin_lock_irqsave(&qhp->lock, flag);
+        qhp->attr.state = state;
+        spin_unlock_irqrestore(&qhp->lock, flag);
+}
+
+static void dealloc_oc_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
+{
+        c4iw_ocqp_pool_free(rdev, sq->dma_addr, sq->memsize);
+}
+
+static void dealloc_host_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
+{
+        dma_free_coherent(&(rdev->lldi.pdev->dev), sq->memsize, sq->queue,
+                          pci_unmap_addr(sq, mapping));
+}
+
+static void dealloc_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
+{
+        if (t4_sq_onchip(sq))
+                dealloc_oc_sq(rdev, sq);
+        else
+                dealloc_host_sq(rdev, sq);
+}
+
+static int alloc_oc_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
+{
+        if (!ocqp_support || !t4_ocqp_supported())
+                return -ENOSYS;
+        sq->dma_addr = c4iw_ocqp_pool_alloc(rdev, sq->memsize);
+        if (!sq->dma_addr)
+                return -ENOMEM;
+        sq->phys_addr = rdev->oc_mw_pa + sq->dma_addr -
+                        rdev->lldi.vr->ocq.start;
+        sq->queue = (__force union t4_wr *)(rdev->oc_mw_kva + sq->dma_addr -
+                                            rdev->lldi.vr->ocq.start);
+        sq->flags |= T4_SQ_ONCHIP;
+        return 0;
+}
+
+static int alloc_host_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
+{
+        sq->queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev), sq->memsize,
+                                       &(sq->dma_addr), GFP_KERNEL);
+        if (!sq->queue)
+                return -ENOMEM;
+        sq->phys_addr = virt_to_phys(sq->queue);
+        pci_unmap_addr_set(sq, mapping, sq->dma_addr);
+        return 0;
+}
+
 static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                       struct c4iw_dev_ucontext *uctx)
 {
@@ -41,9 +98,7 @@ static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           wq->rq.memsize, wq->rq.queue,
                           dma_unmap_addr(&wq->rq, mapping));
-        dma_free_coherent(&(rdev->lldi.pdev->dev),
-                          wq->sq.memsize, wq->sq.queue,
-                          dma_unmap_addr(&wq->sq, mapping));
+        dealloc_sq(rdev, &wq->sq);
         c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
         kfree(wq->rq.sw_rq);
         kfree(wq->sq.sw_sq);
@@ -93,11 +148,12 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         if (!wq->rq.rqt_hwaddr)
                 goto err4;
 
-        wq->sq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
-                                          wq->sq.memsize, &(wq->sq.dma_addr),
-                                          GFP_KERNEL);
-        if (!wq->sq.queue)
-                goto err5;
+        if (user) {
+                if (alloc_oc_sq(rdev, &wq->sq) && alloc_host_sq(rdev, &wq->sq))
+                        goto err5;
+        } else
+                if (alloc_host_sq(rdev, &wq->sq))
+                        goto err5;
         memset(wq->sq.queue, 0, wq->sq.memsize);
         dma_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
 
@@ -144,7 +200,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                         V_FW_RI_RES_WR_NRES(2) |
                         FW_WR_COMPL(1));
         res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
-        res_wr->cookie = (u64)&wr_wait;
+        res_wr->cookie = (unsigned long) &wr_wait;
         res = res_wr->res;
         res->u.sqrq.restype = FW_RI_RES_TYPE_SQ;
         res->u.sqrq.op = FW_RI_RES_OP_WRITE;
@@ -158,12 +214,13 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_HOSTFCMODE(0) |  /* no host cidx updates */
                 V_FW_RI_RES_WR_CPRIO(0) |       /* don't keep in chip cache */
                 V_FW_RI_RES_WR_PCIECHN(0) |     /* set by uP at ri_init time */
+                (t4_sq_onchip(&wq->sq) ? F_FW_RI_RES_WR_ONCHIP : 0) |
                 V_FW_RI_RES_WR_IQID(scq->cqid));
         res->u.sqrq.dcaen_to_eqsize = cpu_to_be32(
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
@@ -186,7 +243,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
@@ -198,14 +255,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         ret = c4iw_ofld_send(rdev, skb);
         if (ret)
                 goto err7;
-        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-        if (!wr_wait.done) {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(rdev->lldi.pdev));
-                rdev->flags = T4_FATAL_ERROR;
-                ret = -EIO;
-        } else
-                ret = wr_wait.ret;
+        ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, wq->sq.qid, __func__);
         if (ret)
                 goto err7;
 
@@ -219,9 +269,7 @@ err7:
                           wq->rq.memsize, wq->rq.queue,
                           dma_unmap_addr(&wq->rq, mapping));
 err6:
-        dma_free_coherent(&(rdev->lldi.pdev->dev),
-                          wq->sq.memsize, wq->sq.queue,
-                          dma_unmap_addr(&wq->sq, mapping));
+        dealloc_sq(rdev, &wq->sq);
 err5:
         c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
 err4:
@@ -263,6 +311,9 @@ static int build_immd(struct t4_sq *sq, struct fw_ri_immd *immdp,
                         rem -= len;
                 }
         }
+        len = roundup(plen + sizeof *immdp, 16) - (plen + sizeof *immdp);
+        if (len)
+                memset(dstp, 0, len);
         immdp->op = FW_RI_DATA_IMMD;
         immdp->r1 = 0;
         immdp->r2 = 0;
@@ -292,6 +343,7 @@ static int build_isgl(__be64 *queue_start, __be64 *queue_end,
                 if (++flitp == queue_end)
                         flitp = queue_start;
         }
+        *flitp = (__force __be64)0;
         isglp->op = FW_RI_DATA_ISGL;
         isglp->r1 = 0;
         isglp->nsge = cpu_to_be16(num_sge);
@@ -453,13 +505,15 @@ static int build_rdma_recv(struct c4iw_qp *qhp, union t4_recv_wr *wqe,
         return 0;
 }
 
-static int build_fastreg(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+static int build_fastreg(struct t4_sq *sq, union t4_wr *wqe,
+                         struct ib_send_wr *wr, u8 *len16)
 {
 
         struct fw_ri_immd *imdp;
         __be64 *p;
         int i;
         int pbllen = roundup(wr->wr.fast_reg.page_list_len * sizeof(u64), 32);
+        int rem;
 
         if (wr->wr.fast_reg.page_list_len > T4_MAX_FR_DEPTH)
                 return -EINVAL;
@@ -474,32 +528,28 @@ static int build_fastreg(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
         wqe->fr.va_hi = cpu_to_be32(wr->wr.fast_reg.iova_start >> 32);
         wqe->fr.va_lo_fbo = cpu_to_be32(wr->wr.fast_reg.iova_start &
                                         0xffffffff);
-        if (pbllen > T4_MAX_FR_IMMD) {
-                struct c4iw_fr_page_list *c4pl =
-                                to_c4iw_fr_page_list(wr->wr.fast_reg.page_list);
-                struct fw_ri_dsgl *sglp;
-
-                sglp = (struct fw_ri_dsgl *)(&wqe->fr + 1);
-                sglp->op = FW_RI_DATA_DSGL;
-                sglp->r1 = 0;
-                sglp->nsge = cpu_to_be16(1);
-                sglp->addr0 = cpu_to_be64(c4pl->dma_addr);
-                sglp->len0 = cpu_to_be32(pbllen);
-
-                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *sglp, 16);
-        } else {
-                imdp = (struct fw_ri_immd *)(&wqe->fr + 1);
-                imdp->op = FW_RI_DATA_IMMD;
-                imdp->r1 = 0;
-                imdp->r2 = 0;
-                imdp->immdlen = cpu_to_be32(pbllen);
-                p = (__be64 *)(imdp + 1);
-                for (i = 0; i < wr->wr.fast_reg.page_list_len; i++, p++)
-                        *p = cpu_to_be64(
-                                (u64)wr->wr.fast_reg.page_list->page_list[i]);
-                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *imdp + pbllen,
-                                      16);
+        WARN_ON(pbllen > T4_MAX_FR_IMMD);
+        imdp = (struct fw_ri_immd *)(&wqe->fr + 1);
+        imdp->op = FW_RI_DATA_IMMD;
+        imdp->r1 = 0;
+        imdp->r2 = 0;
+        imdp->immdlen = cpu_to_be32(pbllen);
+        p = (__be64 *)(imdp + 1);
+        rem = pbllen;
+        for (i = 0; i < wr->wr.fast_reg.page_list_len; i++) {
+                *p = cpu_to_be64((u64)wr->wr.fast_reg.page_list->page_list[i]);
+                rem -= sizeof *p;
+                if (++p == (__be64 *)&sq->queue[sq->size])
+                        p = (__be64 *)sq->queue;
         }
+        BUG_ON(rem < 0);
+        while (rem) {
+                *p = 0;
+                rem -= sizeof *p;
+                if (++p == (__be64 *)&sq->queue[sq->size])
+                        p = (__be64 *)sq->queue;
+        }
+        *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *imdp + pbllen, 16);
         return 0;
 }
 
@@ -587,7 +637,7 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         fw_opcode = FW_RI_RDMA_READ_WR;
                         swsqe->opcode = FW_RI_READ_REQ;
                         if (wr->opcode == IB_WR_RDMA_READ_WITH_INV)
-                                fw_flags |= FW_RI_RDMA_READ_INVALIDATE;
+                                fw_flags = FW_RI_RDMA_READ_INVALIDATE;
                         else
                                 fw_flags = 0;
                         err = build_rdma_read(wqe, wr, &len16);
@@ -600,7 +650,7 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 case IB_WR_FAST_REG_MR:
                         fw_opcode = FW_RI_FR_NSMR_WR;
                         swsqe->opcode = FW_RI_FAST_REGISTER;
-                        err = build_fastreg(wqe, wr, &len16);
+                        err = build_fastreg(&qhp->wq.sq, wqe, wr, &len16);
                         break;
                 case IB_WR_LOCAL_INV:
                         if (wr->send_flags & IB_SEND_FENCE)
@@ -842,36 +892,6 @@ static inline void build_term_codes(struct t4_cqe *err_cqe, u8 *layer_type,
         }
 }
 
-int c4iw_post_zb_read(struct c4iw_qp *qhp)
-{
-        union t4_wr *wqe;
-        struct sk_buff *skb;
-        u8 len16;
-
-        PDBG("%s enter\n", __func__);
-        skb = alloc_skb(40, GFP_KERNEL);
-        if (!skb) {
-                printk(KERN_ERR "%s cannot send zb_read!!\n", __func__);
-                return -ENOMEM;
-        }
-        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
-
-        wqe = (union t4_wr *)skb_put(skb, sizeof wqe->read);
-        memset(wqe, 0, sizeof wqe->read);
-        wqe->read.r2 = cpu_to_be64(0);
-        wqe->read.stag_sink = cpu_to_be32(1);
-        wqe->read.to_sink_hi = cpu_to_be32(0);
-        wqe->read.to_sink_lo = cpu_to_be32(1);
-        wqe->read.stag_src = cpu_to_be32(1);
-        wqe->read.plen = cpu_to_be32(0);
-        wqe->read.to_src_hi = cpu_to_be32(0);
-        wqe->read.to_src_lo = cpu_to_be32(1);
-        len16 = DIV_ROUND_UP(sizeof wqe->read, 16);
-        init_wr_hdr(wqe, 0, FW_RI_RDMA_READ_WR, FW_RI_COMPLETION_FLAG, len16);
-
-        return c4iw_ofld_send(&qhp->rhp->rdev, skb);
-}
-
 static void post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe,
                            gfp_t gfp)
 {
@@ -905,46 +925,38 @@ static void post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe,
  * Assumes qhp lock is held.
  */
 static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
-                       struct c4iw_cq *schp, unsigned long *flag)
+                       struct c4iw_cq *schp)
 {
         int count;
         int flushed;
+        unsigned long flag;
 
         PDBG("%s qhp %p rchp %p schp %p\n", __func__, qhp, rchp, schp);
-        /* take a ref on the qhp since we must release the lock */
-        atomic_inc(&qhp->refcnt);
-        spin_unlock_irqrestore(&qhp->lock, *flag);
 
         /* locking hierarchy: cq lock first, then qp lock. */
-        spin_lock_irqsave(&rchp->lock, *flag);
+        spin_lock_irqsave(&rchp->lock, flag);
         spin_lock(&qhp->lock);
         c4iw_flush_hw_cq(&rchp->cq);
         c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
         flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
         spin_unlock(&qhp->lock);
-        spin_unlock_irqrestore(&rchp->lock, *flag);
+        spin_unlock_irqrestore(&rchp->lock, flag);
         if (flushed)
                 (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
 
         /* locking hierarchy: cq lock first, then qp lock. */
-        spin_lock_irqsave(&schp->lock, *flag);
+        spin_lock_irqsave(&schp->lock, flag);
         spin_lock(&qhp->lock);
         c4iw_flush_hw_cq(&schp->cq);
         c4iw_count_scqes(&schp->cq, &qhp->wq, &count);
         flushed = c4iw_flush_sq(&qhp->wq, &schp->cq, count);
         spin_unlock(&qhp->lock);
-        spin_unlock_irqrestore(&schp->lock, *flag);
+        spin_unlock_irqrestore(&schp->lock, flag);
         if (flushed)
                 (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
-
-        /* deref */
-        if (atomic_dec_and_test(&qhp->refcnt))
-                wake_up(&qhp->wait);
-
-        spin_lock_irqsave(&qhp->lock, *flag);
 }
 
-static void flush_qp(struct c4iw_qp *qhp, unsigned long *flag)
+static void flush_qp(struct c4iw_qp *qhp)
 {
         struct c4iw_cq *rchp, *schp;
 
@@ -958,7 +970,7 @@ static void flush_qp(struct c4iw_qp *qhp, unsigned long *flag)
                         t4_set_cq_in_error(&schp->cq);
                 return;
         }
-        __flush_qp(qhp, rchp, schp, flag);
+        __flush_qp(qhp, rchp, schp);
 }
 
 static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
@@ -966,7 +978,6 @@ static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
 {
         struct fw_ri_wr *wqe;
         int ret;
-        struct c4iw_wr_wait wr_wait;
         struct sk_buff *skb;
 
         PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
@@ -985,28 +996,15 @@ static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
         wqe->flowid_len16 = cpu_to_be32(
                 FW_WR_FLOWID(ep->hwtid) |
                 FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
-        wqe->cookie = (u64)&wr_wait;
+        wqe->cookie = (unsigned long) &ep->com.wr_wait;
 
         wqe->u.fini.type = FW_RI_TYPE_FINI;
-        c4iw_init_wr_wait(&wr_wait);
         ret = c4iw_ofld_send(&rhp->rdev, skb);
         if (ret)
                 goto out;
 
-        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-        if (!wr_wait.done) {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(rhp->rdev.lldi.pdev));
-                rhp->rdev.flags = T4_FATAL_ERROR;
-                ret = -EIO;
-        } else {
-                ret = wr_wait.ret;
-                if (ret)
-                        printk(KERN_WARNING MOD
-                               "%s: Abnormal close qpid %d ret %u\n",
-                               pci_name(rhp->rdev.lldi.pdev), qhp->wq.sq.qid,
-                               ret);
-        }
+        ret = c4iw_wait_for_reply(&rhp->rdev, &ep->com.wr_wait, qhp->ep->hwtid,
+                             qhp->wq.sq.qid, __func__);
 out:
         PDBG("%s ret %d\n", __func__, ret);
         return ret;
@@ -1040,7 +1038,6 @@ static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
 {
         struct fw_ri_wr *wqe;
         int ret;
-        struct c4iw_wr_wait wr_wait;
         struct sk_buff *skb;
 
         PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
@@ -1060,7 +1057,7 @@ static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
                 FW_WR_FLOWID(qhp->ep->hwtid) |
                 FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
 
-        wqe->cookie = (u64)&wr_wait;
+        wqe->cookie = (unsigned long) &qhp->ep->com.wr_wait;
 
         wqe->u.init.type = FW_RI_TYPE_INIT;
         wqe->u.init.mpareqbit_p2ptype =
@@ -1097,19 +1094,12 @@ static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
         if (qhp->attr.mpa_attr.initiator)
                 build_rtr_msg(qhp->attr.mpa_attr.p2p_type, &wqe->u.init);
 
-        c4iw_init_wr_wait(&wr_wait);
         ret = c4iw_ofld_send(&rhp->rdev, skb);
         if (ret)
                 goto out;
 
-        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
-        if (!wr_wait.done) {
-                printk(KERN_ERR MOD "Device %s not responding!\n",
-                       pci_name(rhp->rdev.lldi.pdev));
-                rhp->rdev.flags = T4_FATAL_ERROR;
-                ret = -EIO;
-        } else
-                ret = wr_wait.ret;
+        ret = c4iw_wait_for_reply(&rhp->rdev, &qhp->ep->com.wr_wait,
+                                  qhp->ep->hwtid, qhp->wq.sq.qid, __func__);
 out:
         PDBG("%s ret %d\n", __func__, ret);
         return ret;
@@ -1122,7 +1112,6 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
 {
         int ret = 0;
         struct c4iw_qp_attributes newattr = qhp->attr;
-        unsigned long flag;
         int disconnect = 0;
         int terminate = 0;
         int abort = 0;
@@ -1133,7 +1122,7 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
              qhp, qhp->wq.sq.qid, qhp->wq.rq.qid, qhp->ep, qhp->attr.state,
              (mask & C4IW_QP_ATTR_NEXT_STATE) ? attrs->next_state : -1);
 
-        spin_lock_irqsave(&qhp->lock, flag);
+        mutex_lock(&qhp->mutex);
 
         /* Process attr changes if in IDLE */
         if (mask & C4IW_QP_ATTR_VALID_MODIFY) {
@@ -1184,7 +1173,7 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                         qhp->attr.mpa_attr = attrs->mpa_attr;
                         qhp->attr.llp_stream_handle = attrs->llp_stream_handle;
                         qhp->ep = qhp->attr.llp_stream_handle;
-                        qhp->attr.state = C4IW_QP_STATE_RTS;
+                        set_state(qhp, C4IW_QP_STATE_RTS);
 
                         /*
                          * Ref the endpoint here and deref when we
@@ -1193,15 +1182,13 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                          * transition.
                          */
                         c4iw_get_ep(&qhp->ep->com);
-                        spin_unlock_irqrestore(&qhp->lock, flag);
                         ret = rdma_init(rhp, qhp);
-                        spin_lock_irqsave(&qhp->lock, flag);
                         if (ret)
                                 goto err;
                         break;
                 case C4IW_QP_STATE_ERROR:
-                        qhp->attr.state = C4IW_QP_STATE_ERROR;
-                        flush_qp(qhp, &flag);
+                        set_state(qhp, C4IW_QP_STATE_ERROR);
+                        flush_qp(qhp);
                         break;
                 default:
                         ret = -EINVAL;
@@ -1212,38 +1199,34 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                 switch (attrs->next_state) {
                 case C4IW_QP_STATE_CLOSING:
                         BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
-                        qhp->attr.state = C4IW_QP_STATE_CLOSING;
+                        set_state(qhp, C4IW_QP_STATE_CLOSING);
                         ep = qhp->ep;
                         if (!internal) {
                                 abort = 0;
                                 disconnect = 1;
-                                c4iw_get_ep(&ep->com);
+                                c4iw_get_ep(&qhp->ep->com);
                         }
-                        spin_unlock_irqrestore(&qhp->lock, flag);
                         ret = rdma_fini(rhp, qhp, ep);
-                        spin_lock_irqsave(&qhp->lock, flag);
-                        if (ret) {
-                                c4iw_get_ep(&ep->com);
-                                disconnect = abort = 1;
+                        if (ret)
                                 goto err;
-                        }
                         break;
                 case C4IW_QP_STATE_TERMINATE:
-                        qhp->attr.state = C4IW_QP_STATE_TERMINATE;
+                        set_state(qhp, C4IW_QP_STATE_TERMINATE);
                         if (qhp->ibqp.uobject)
                                 t4_set_wq_in_error(&qhp->wq);
                         ep = qhp->ep;
-                        c4iw_get_ep(&ep->com);
-                        terminate = 1;
+                        if (!internal)
+                                terminate = 1;
                         disconnect = 1;
+                        c4iw_get_ep(&qhp->ep->com);
                         break;
                 case C4IW_QP_STATE_ERROR:
-                        qhp->attr.state = C4IW_QP_STATE_ERROR;
+                        set_state(qhp, C4IW_QP_STATE_ERROR);
                         if (!internal) {
                                 abort = 1;
                                 disconnect = 1;
                                 ep = qhp->ep;
-                                c4iw_get_ep(&ep->com);
+                                c4iw_get_ep(&qhp->ep->com);
                         }
                         goto err;
                         break;
@@ -1259,8 +1242,8 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                 }
                 switch (attrs->next_state) {
                 case C4IW_QP_STATE_IDLE:
-                        flush_qp(qhp, &flag);
-                        qhp->attr.state = C4IW_QP_STATE_IDLE;
+                        flush_qp(qhp);
+                        set_state(qhp, C4IW_QP_STATE_IDLE);
                         qhp->attr.llp_stream_handle = NULL;
                         c4iw_put_ep(&qhp->ep->com);
                         qhp->ep = NULL;
@@ -1282,7 +1265,7 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                         ret = -EINVAL;
                         goto out;
                 }
-                qhp->attr.state = C4IW_QP_STATE_IDLE;
+                set_state(qhp, C4IW_QP_STATE_IDLE);
                 break;
         case C4IW_QP_STATE_TERMINATE:
                 if (!internal) {
@@ -1305,15 +1288,16 @@ err:
 
         /* disassociate the LLP connection */
         qhp->attr.llp_stream_handle = NULL;
-        ep = qhp->ep;
+        if (!ep)
+                ep = qhp->ep;
         qhp->ep = NULL;
-        qhp->attr.state = C4IW_QP_STATE_ERROR;
+        set_state(qhp, C4IW_QP_STATE_ERROR);
         free = 1;
         wake_up(&qhp->wait);
         BUG_ON(!ep);
-        flush_qp(qhp, &flag);
+        flush_qp(qhp);
 out:
-        spin_unlock_irqrestore(&qhp->lock, flag);
+        mutex_unlock(&qhp->mutex);
 
         if (terminate)
                 post_terminate(qhp, NULL, internal ? GFP_ATOMIC : GFP_KERNEL);
@@ -1335,7 +1319,6 @@ out:
          */
         if (free)
                 c4iw_put_ep(&ep->com);
-
         PDBG("%s exit state %d\n", __func__, qhp->attr.state);
         return ret;
 }
@@ -1380,7 +1363,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
         int sqsize, rqsize;
         struct c4iw_ucontext *ucontext;
         int ret;
-        struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4;
+        struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4, *mm5 = NULL;
 
         PDBG("%s ib_pd %p\n", __func__, pd);
 
@@ -1450,6 +1433,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
         qhp->attr.max_ord = 1;
         qhp->attr.max_ird = 1;
         spin_lock_init(&qhp->lock);
+        mutex_init(&qhp->mutex);
         init_waitqueue_head(&qhp->wait);
         atomic_set(&qhp->refcnt, 1);
 
@@ -1478,7 +1462,15 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                         ret = -ENOMEM;
                         goto err6;
                 }
-
+                if (t4_sq_onchip(&qhp->wq.sq)) {
+                        mm5 = kmalloc(sizeof *mm5, GFP_KERNEL);
+                        if (!mm5) {
+                                ret = -ENOMEM;
+                                goto err7;
+                        }
+                        uresp.flags = C4IW_QPF_ONCHIP;
+                } else
+                        uresp.flags = 0;
                 uresp.qid_mask = rhp->rdev.qpmask;
                 uresp.sqid = qhp->wq.sq.qid;
                 uresp.sq_size = qhp->wq.sq.size;
@@ -1487,6 +1479,10 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 uresp.rq_size = qhp->wq.rq.size;
                 uresp.rq_memsize = qhp->wq.rq.memsize;
                 spin_lock(&ucontext->mmap_lock);
+                if (mm5) {
+                        uresp.ma_sync_key = ucontext->key;
+                        ucontext->key += PAGE_SIZE;
+                }
                 uresp.sq_key = ucontext->key;
                 ucontext->key += PAGE_SIZE;
                 uresp.rq_key = ucontext->key;
@@ -1498,9 +1494,9 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 spin_unlock(&ucontext->mmap_lock);
                 ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
                 if (ret)
-                        goto err7;
+                        goto err8;
                 mm1->key = uresp.sq_key;
-                mm1->addr = virt_to_phys(qhp->wq.sq.queue);
+                mm1->addr = qhp->wq.sq.phys_addr;
                 mm1->len = PAGE_ALIGN(qhp->wq.sq.memsize);
                 insert_mmap(ucontext, mm1);
                 mm2->key = uresp.rq_key;
@@ -1515,6 +1511,13 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 mm4->addr = qhp->wq.rq.udb;
                 mm4->len = PAGE_SIZE;
                 insert_mmap(ucontext, mm4);
+                if (mm5) {
+                        mm5->key = uresp.ma_sync_key;
+                        mm5->addr = (pci_resource_start(rhp->rdev.lldi.pdev, 0)
+                                    + A_PCIE_MA_SYNC) & PAGE_MASK;
+                        mm5->len = PAGE_SIZE;
+                        insert_mmap(ucontext, mm5);
+                }
         }
         qhp->ibqp.qp_num = qhp->wq.sq.qid;
         init_timer(&(qhp->timer));
@@ -1522,6 +1525,8 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
              __func__, qhp, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
              qhp->wq.sq.qid);
         return &qhp->ibqp;
+err8:
+        kfree(mm5);
 err7:
         kfree(mm4);
 err6:
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index 83b23dfa250d..4fb50d58b493 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -311,6 +311,9 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
 {
         unsigned long addr = gen_pool_alloc(rdev->pbl_pool, size);
         PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size);
+        if (!addr && printk_ratelimit())
+                printk(KERN_WARNING MOD "%s: Out of PBL memory\n",
+                       pci_name(rdev->lldi.pdev));
         return (u32)addr;
 }
 
@@ -370,6 +373,9 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
 {
         unsigned long addr = gen_pool_alloc(rdev->rqt_pool, size << 6);
         PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size << 6);
+        if (!addr && printk_ratelimit())
+                printk(KERN_WARNING MOD "%s: Out of RQT memory\n",
+                       pci_name(rdev->lldi.pdev));
         return (u32)addr;
 }
 
@@ -416,3 +422,59 @@ void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
 {
         gen_pool_destroy(rdev->rqt_pool);
 }
+
+/*
+ * On-Chip QP Memory.
+ */
+#define MIN_OCQP_SHIFT 12       /* 4KB == min ocqp size */
+
+u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev->ocqp_pool, size);
+        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size);
+        return (u32)addr;
+}
+
+void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __func__, addr, size);
+        gen_pool_free(rdev->ocqp_pool, (unsigned long)addr, size);
+}
+
+int c4iw_ocqp_pool_create(struct c4iw_rdev *rdev)
+{
+        unsigned start, chunk, top;
+
+        rdev->ocqp_pool = gen_pool_create(MIN_OCQP_SHIFT, -1);
+        if (!rdev->ocqp_pool)
+                return -ENOMEM;
+
+        start = rdev->lldi.vr->ocq.start;
+        chunk = rdev->lldi.vr->ocq.size;
+        top = start + chunk;
+
+        while (start < top) {
+                chunk = min(top - start + 1, chunk);
+                if (gen_pool_add(rdev->ocqp_pool, start, chunk, -1)) {
+                        PDBG("%s failed to add OCQP chunk (%x/%x)\n",
+                             __func__, start, chunk);
+                        if (chunk <= 1024 << MIN_OCQP_SHIFT) {
+                                printk(KERN_WARNING MOD
+                                       "Failed to add all OCQP chunks (%x/%x)\n",
+                                       start, top - start);
+                                return 0;
+                        }
+                        chunk >>= 1;
+                } else {
+                        PDBG("%s added OCQP chunk (%x/%x)\n",
+                             __func__, start, chunk);
+                        start += chunk;
+                }
+        }
+        return 0;
+}
+
+void c4iw_ocqp_pool_destroy(struct c4iw_rdev *rdev)
+{
+        gen_pool_destroy(rdev->ocqp_pool);
+}
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 24f369046ef3..c0221eec8817 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -52,6 +52,7 @@
 #define T4_STAG_UNSET 0xffffffff
 #define T4_FW_MAJ 0
 #define T4_EQ_STATUS_ENTRIES (L1_CACHE_BYTES > 64 ? 2 : 1)
+#define A_PCIE_MA_SYNC 0x30b4
 
 struct t4_status_page {
         __be32 rsvd1;   /* flit 0 - hw owns */
@@ -65,7 +66,7 @@ struct t4_status_page {
 
 #define T4_EQ_ENTRY_SIZE 64
 
-#define T4_SQ_NUM_SLOTS 4
+#define T4_SQ_NUM_SLOTS 5
 #define T4_SQ_NUM_BYTES (T4_EQ_ENTRY_SIZE * T4_SQ_NUM_SLOTS)
 #define T4_MAX_SEND_SGE ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_send_wr) - \
                         sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
@@ -78,7 +79,7 @@ struct t4_status_page {
                         sizeof(struct fw_ri_rdma_write_wr) - \
                         sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
 #define T4_MAX_FR_IMMD ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_fr_nsmr_wr) - \
-                        sizeof(struct fw_ri_immd)))
+                        sizeof(struct fw_ri_immd)) & ~31UL)
 #define T4_MAX_FR_DEPTH (T4_MAX_FR_IMMD / sizeof(u64))
 
 #define T4_RQ_NUM_SLOTS 2
@@ -266,10 +267,33 @@ struct t4_swsqe {
         u16                     idx;
 };
 
+static inline pgprot_t t4_pgprot_wc(pgprot_t prot)
+{
+#if defined(__i386__) || defined(__x86_64__) || defined(CONFIG_PPC64)
+        return pgprot_writecombine(prot);
+#else
+        return pgprot_noncached(prot);
+#endif
+}
+
+static inline int t4_ocqp_supported(void)
+{
+#if defined(__i386__) || defined(__x86_64__) || defined(CONFIG_PPC64)
+        return 1;
+#else
+        return 0;
+#endif
+}
+
+enum {
+        T4_SQ_ONCHIP = (1<<0),
+};
+
 struct t4_sq {
         union t4_wr *queue;
         dma_addr_t dma_addr;
         DEFINE_DMA_UNMAP_ADDR(mapping);
+        unsigned long phys_addr;
         struct t4_swsqe *sw_sq;
         struct t4_swsqe *oldest_read;
         u64 udb;
@@ -280,6 +304,7 @@ struct t4_sq {
         u16 cidx;
         u16 pidx;
         u16 wq_pidx;
+        u16 flags;
 };
 
 struct t4_swrqe {
@@ -350,6 +375,11 @@ static inline void t4_rq_consume(struct t4_wq *wq)
                 wq->rq.cidx = 0;
 }
 
+static inline int t4_sq_onchip(struct t4_sq *sq)
+{
+        return sq->flags & T4_SQ_ONCHIP;
+}
+
 static inline int t4_sq_empty(struct t4_wq *wq)
 {
         return wq->sq.in_use == 0;
@@ -396,30 +426,27 @@ static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc)
 
 static inline int t4_wq_in_error(struct t4_wq *wq)
 {
-        return wq->sq.queue[wq->sq.size].status.qp_err;
+        return wq->rq.queue[wq->rq.size].status.qp_err;
 }
 
 static inline void t4_set_wq_in_error(struct t4_wq *wq)
 {
-        wq->sq.queue[wq->sq.size].status.qp_err = 1;
         wq->rq.queue[wq->rq.size].status.qp_err = 1;
 }
 
 static inline void t4_disable_wq_db(struct t4_wq *wq)
 {
-        wq->sq.queue[wq->sq.size].status.db_off = 1;
         wq->rq.queue[wq->rq.size].status.db_off = 1;
 }
 
 static inline void t4_enable_wq_db(struct t4_wq *wq)
 {
-        wq->sq.queue[wq->sq.size].status.db_off = 0;
         wq->rq.queue[wq->rq.size].status.db_off = 0;
 }
 
 static inline int t4_wq_db_enabled(struct t4_wq *wq)
 {
-        return !wq->sq.queue[wq->sq.size].status.db_off;
+        return !wq->rq.queue[wq->rq.size].status.db_off;
 }
 
 struct t4_cq {
@@ -477,8 +504,14 @@ static inline void t4_swcq_consume(struct t4_cq *cq)
 static inline void t4_hwcq_consume(struct t4_cq *cq)
 {
         cq->bits_type_ts = cq->queue[cq->cidx].bits_type_ts;
-        if (++cq->cidx_inc == cq->size)
+        if (++cq->cidx_inc == (cq->size >> 4)) {
+                u32 val;
+
+                val = SEINTARM(0) | CIDXINC(cq->cidx_inc) | TIMERREG(7) |
+                      INGRESSQID(cq->cqid);
+                writel(val, cq->gts);
                 cq->cidx_inc = 0;
+        }
         if (++cq->cidx == cq->size) {
                 cq->cidx = 0;
                 cq->gen ^= 1;
diff --git a/drivers/infiniband/hw/cxgb4/user.h b/drivers/infiniband/hw/cxgb4/user.h
index ed6414abde02..e6669d54770e 100644
--- a/drivers/infiniband/hw/cxgb4/user.h
+++ b/drivers/infiniband/hw/cxgb4/user.h
@@ -50,7 +50,13 @@ struct c4iw_create_cq_resp {
         __u32 qid_mask;
 };
 
+
+enum {
+        C4IW_QPF_ONCHIP = (1<<0)
+};
+
 struct c4iw_create_qp_resp {
+        __u64 ma_sync_key;
         __u64 sq_key;
         __u64 rq_key;
         __u64 sq_db_gts_key;
@@ -62,5 +68,6 @@ struct c4iw_create_qp_resp {
         __u32 sq_size;
         __u32 rq_size;
         __u32 qid_mask;
+        __u32 flags;
 };
 #endif
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 53f4cd4fc19a..43cae84005f0 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -171,7 +171,7 @@ struct ib_mr *ehca_get_dma_mr(struct ib_pd *pd, int mr_access_flags)
                 }
 
                 ret = ehca_reg_maxmr(shca, e_maxmr,
-                                     (void *)ehca_map_vaddr((void *)KERNELBASE),
+                                     (void *)ehca_map_vaddr((void *)(KERNELBASE + PHYSICAL_START)),
                                      mr_access_flags, e_pd,
                                      &e_maxmr->ib.ib_mr.lkey,
                                      &e_maxmr->ib.ib_mr.rkey);
@@ -1636,7 +1636,7 @@ int ehca_reg_internal_maxmr(
 
         /* register internal max-MR on HCA */
         size_maxmr = ehca_mr_len;
-        iova_start = (u64 *)ehca_map_vaddr((void *)KERNELBASE);
+        iova_start = (u64 *)ehca_map_vaddr((void *)(KERNELBASE + PHYSICAL_START));
         ib_pbuf.addr = 0;
         ib_pbuf.size = size_maxmr;
         num_kpages = NUM_CHUNKS(((u64)iova_start % PAGE_SIZE) + size_maxmr,
@@ -2209,7 +2209,7 @@ int ehca_mr_is_maxmr(u64 size,
 {
         /* a MR is treated as max-MR only if it fits following: */
         if ((size == ehca_mr_len) &&
-            (iova_start == (void *)ehca_map_vaddr((void *)KERNELBASE))) {
+            (iova_start == (void *)ehca_map_vaddr((void *)(KERNELBASE + PHYSICAL_START)))) {
                 ehca_gen_dbg("this is a max-MR");
                 return 1;
         } else
diff --git a/drivers/infiniband/hw/ehca/ipz_pt_fn.c b/drivers/infiniband/hw/ehca/ipz_pt_fn.c
index 1596e3085344..1898d6e7cce5 100644
--- a/drivers/infiniband/hw/ehca/ipz_pt_fn.c
+++ b/drivers/infiniband/hw/ehca/ipz_pt_fn.c
@@ -222,15 +222,14 @@ int ipz_queue_ctor(struct ehca_pd *pd, struct ipz_queue *queue,
         queue->small_page = NULL;
 
         /* allocate queue page pointers */
-        queue->queue_pages = kmalloc(nr_of_pages * sizeof(void *), GFP_KERNEL);
+        queue->queue_pages = kzalloc(nr_of_pages * sizeof(void *), GFP_KERNEL);
         if (!queue->queue_pages) {
-                queue->queue_pages = vmalloc(nr_of_pages * sizeof(void *));
+                queue->queue_pages = vzalloc(nr_of_pages * sizeof(void *));
                 if (!queue->queue_pages) {
                         ehca_gen_err("Couldn't allocate queue page list");
                         return 0;
                 }
         }
-        memset(queue->queue_pages, 0, nr_of_pages * sizeof(void *));
 
         /* allocate actual queue pages */
         if (is_small) {
diff --git a/drivers/infiniband/hw/ipath/Makefile b/drivers/infiniband/hw/ipath/Makefile
index fa3df82681df..4496f2820c92 100644
--- a/drivers/infiniband/hw/ipath/Makefile
+++ b/drivers/infiniband/hw/ipath/Makefile
@@ -1,4 +1,4 @@
-EXTRA_CFLAGS += -DIPATH_IDSTR='"QLogic kernel.org driver"' \
+ccflags-y := -DIPATH_IDSTR='"QLogic kernel.org driver"' \
         -DIPATH_KERN_TYPE=0
 
 obj-$(CONFIG_INFINIBAND_IPATH) += ib_ipath.o
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index d4ce8b63e19e..daef61d5e5bb 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -65,7 +65,8 @@ static const struct file_operations diag_file_ops = {
         .write = ipath_diag_write,
         .read = ipath_diag_read,
         .open = ipath_diag_open,
-        .release = ipath_diag_release
+        .release = ipath_diag_release,
+        .llseek = default_llseek,
 };
 
 static ssize_t ipath_diagpkt_write(struct file *fp,
@@ -75,6 +76,7 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
 static const struct file_operations diagpkt_file_ops = {
         .owner = THIS_MODULE,
         .write = ipath_diagpkt_write,
+        .llseek = noop_llseek,
 };
 
 static atomic_t diagpkt_count = ATOMIC_INIT(0);
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 765f0fc1da76..be24ac726114 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -199,12 +199,11 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
                 goto bail;
         }
 
-        dd = vmalloc(sizeof(*dd));
+        dd = vzalloc(sizeof(*dd));
         if (!dd) {
                 dd = ERR_PTR(-ENOMEM);
                 goto bail;
         }
-        memset(dd, 0, sizeof(*dd));
         dd->ipath_unit = -1;
 
         spin_lock_irqsave(&ipath_devs_lock, flags);
@@ -399,7 +398,6 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
         struct ipath_devdata *dd;
         unsigned long long addr;
         u32 bar0 = 0, bar1 = 0;
-        u8 rev;
 
         dd = ipath_alloc_devdata(pdev);
         if (IS_ERR(dd)) {
@@ -530,9 +528,8 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
         for (j = 0; j < 6; j++) {
                 if (!pdev->resource[j].start)
                         continue;
-                ipath_cdbg(VERBOSE, "BAR %d start %llx, end %llx, len %llx\n",
-                           j, (unsigned long long)pdev->resource[j].start,
-                           (unsigned long long)pdev->resource[j].end,
+                ipath_cdbg(VERBOSE, "BAR %d %pR, len %llx\n",
+                           j, &pdev->resource[j],
                            (unsigned long long)pci_resource_len(pdev, j));
         }
 
@@ -542,13 +539,7 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
                 goto bail_regions;
         }
 
-        ret = pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
-        if (ret) {
-                ipath_dev_err(dd, "Failed to read PCI revision ID unit "
-                              "%u: err %d\n", dd->ipath_unit, -ret);
-                goto bail_regions;      /* shouldn't ever happen */
-        }
-        dd->ipath_pcirev = rev;
+        dd->ipath_pcirev = pdev->revision;
 
 #if defined(__powerpc__)
         /* There isn't a generic way to specify writethrough mappings */
@@ -757,7 +748,7 @@ static void __devexit ipath_remove_one(struct pci_dev *pdev)
          */
         ipath_shutdown_device(dd);
 
-        flush_scheduled_work();
+        flush_workqueue(ib_wq);
 
         if (dd->verbs_dev)
                 ipath_unregister_ib_device(dd->verbs_dev);
@@ -2394,7 +2385,7 @@ void ipath_shutdown_device(struct ipath_devdata *dd)
         /*
          * clear SerdesEnable and turn the leds off; do this here because
          * we are unloading, so don't count on interrupts to move along
-         * Turn the LEDs off explictly for the same reason.
+         * Turn the LEDs off explicitly for the same reason.
          */
         dd->ipath_f_quiet_serdes(dd);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 65eb8929db22..ee79a2d97b14 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -40,7 +40,6 @@
 #include <linux/highmem.h>
 #include <linux/io.h>
 #include <linux/jiffies.h>
-#include <linux/smp_lock.h>
 #include <asm/pgtable.h>
 
 #include "ipath_kernel.h"
@@ -63,7 +62,8 @@ static const struct file_operations ipath_file_ops = {
         .open = ipath_open,
         .release = ipath_close,
         .poll = ipath_poll,
-        .mmap = ipath_mmap
+        .mmap = ipath_mmap,
+        .llseek = noop_llseek,
 };
 
 /*
@@ -1530,7 +1530,7 @@ static int init_subports(struct ipath_devdata *dd,
         }
 
         num_subports = uinfo->spu_subport_cnt;
-        pd->subport_uregbase = vmalloc(PAGE_SIZE * num_subports);
+        pd->subport_uregbase = vzalloc(PAGE_SIZE * num_subports);
         if (!pd->subport_uregbase) {
                 ret = -ENOMEM;
                 goto bail;
@@ -1538,13 +1538,13 @@ static int init_subports(struct ipath_devdata *dd,
         /* Note: pd->port_rcvhdrq_size isn't initialized yet. */
         size = ALIGN(dd->ipath_rcvhdrcnt * dd->ipath_rcvhdrentsize *
                      sizeof(u32), PAGE_SIZE) * num_subports;
-        pd->subport_rcvhdr_base = vmalloc(size);
+        pd->subport_rcvhdr_base = vzalloc(size);
         if (!pd->subport_rcvhdr_base) {
                 ret = -ENOMEM;
                 goto bail_ureg;
         }
 
-        pd->subport_rcvegrbuf = vmalloc(pd->port_rcvegrbuf_chunks *
+        pd->subport_rcvegrbuf = vzalloc(pd->port_rcvegrbuf_chunks *
                                         pd->port_rcvegrbuf_size *
                                         num_subports);
         if (!pd->subport_rcvegrbuf) {
@@ -1556,11 +1556,6 @@ static int init_subports(struct ipath_devdata *dd,
         pd->port_subport_id = uinfo->spu_subport_id;
         pd->active_slaves = 1;
         set_bit(IPATH_PORT_MASTER_UNINIT, &pd->port_flag);
-        memset(pd->subport_uregbase, 0, PAGE_SIZE * num_subports);
-        memset(pd->subport_rcvhdr_base, 0, size);
-        memset(pd->subport_rcvegrbuf, 0, pd->port_rcvegrbuf_chunks *
-                                         pd->port_rcvegrbuf_size *
-                                         num_subports);
         goto bail;
 
 bail_rhdr:
@@ -1977,7 +1972,7 @@ static int ipath_do_user_init(struct file *fp,
          * 0 to 1.  So for those chips, we turn it off and then back on.
          * This will (very briefly) affect any other open ports, but the
          * duration is very short, and therefore isn't an issue.  We
-         * explictly set the in-memory tail copy to 0 beforehand, so we
+         * explicitly set the in-memory tail copy to 0 beforehand, so we
          * don't have to wait to be sure the DMA update has happened
          * (chip resets head/tail to 0 on transition to enable).
          */
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index 2fca70836dae..31ae1b108aea 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -57,6 +57,7 @@ static int ipathfs_mknod(struct inode *dir, struct dentry *dentry,
                 goto bail;
         }
 
+        inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         inode->i_private = data;
@@ -103,6 +104,7 @@ static ssize_t atomic_stats_read(struct file *file, char __user *buf,
 
 static const struct file_operations atomic_stats_ops = {
         .read = atomic_stats_read,
+        .llseek = default_llseek,
 };
 
 static ssize_t atomic_counters_read(struct file *file, char __user *buf,
@@ -120,6 +122,7 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
 
 static const struct file_operations atomic_counters_ops = {
         .read = atomic_counters_read,
+        .llseek = default_llseek,
 };
 
 static ssize_t flash_read(struct file *file, char __user *buf,
@@ -224,6 +227,7 @@ bail:
 static const struct file_operations flash_ops = {
         .read = flash_read,
         .write = flash_write,
+        .llseek = default_llseek,
 };
 
 static int create_device_files(struct super_block *sb,
@@ -273,18 +277,14 @@ static int remove_file(struct dentry *parent, char *name)
                 goto bail;
         }
 
-        spin_lock(&dcache_lock);
         spin_lock(&tmp->d_lock);
         if (!(d_unhashed(tmp) && tmp->d_inode)) {
-                dget_locked(tmp);
+                dget_dlock(tmp);
                 __d_drop(tmp);
                 spin_unlock(&tmp->d_lock);
-                spin_unlock(&dcache_lock);
                 simple_unlink(parent->d_inode, tmp);
-        } else {
+        } else
                 spin_unlock(&tmp->d_lock);
-                spin_unlock(&dcache_lock);
-        }
 
         ret = 0;
 bail:
@@ -358,13 +358,13 @@ bail:
         return ret;
 }
 
-static int ipathfs_get_sb(struct file_system_type *fs_type, int flags,
-                        const char *dev_name, void *data, struct vfsmount *mnt)
+static struct dentry *ipathfs_mount(struct file_system_type *fs_type,
+                        int flags, const char *dev_name, void *data)
 {
-        int ret = get_sb_single(fs_type, flags, data,
-                                    ipathfs_fill_super, mnt);
-        if (ret >= 0)
-                ipath_super = mnt->mnt_sb;
+        struct dentry *ret;
+        ret = mount_single(fs_type, flags, data, ipathfs_fill_super);
+        if (!IS_ERR(ret))
+                ipath_super = ret->d_sb;
         return ret;
 }
 
@@ -407,7 +407,7 @@ bail:
 static struct file_system_type ipathfs_fs_type = {
         .owner =        THIS_MODULE,
         .name =         "ipathfs",
-        .get_sb =       ipathfs_get_sb,
+        .mount =        ipathfs_mount,
         .kill_sb =      ipathfs_kill_super,
 };
 
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 776938299e4c..7c1eebe8c7c9 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -335,7 +335,7 @@ done:
  * @dd: the infinipath device
  *
  * sanity check at least some of the values after reset, and
- * ensure no receive or transmit (explictly, in case reset
+ * ensure no receive or transmit (explicitly, in case reset
  * failed
  */
 static int init_chip_reset(struct ipath_devdata *dd)
@@ -442,7 +442,7 @@ static void init_shadow_tids(struct ipath_devdata *dd)
         struct page **pages;
         dma_addr_t *addrs;
 
-        pages = vmalloc(dd->ipath_cfgports * dd->ipath_rcvtidcnt *
+        pages = vzalloc(dd->ipath_cfgports * dd->ipath_rcvtidcnt *
                         sizeof(struct page *));
         if (!pages) {
                 ipath_dev_err(dd, "failed to allocate shadow page * "
@@ -461,9 +461,6 @@ static void init_shadow_tids(struct ipath_devdata *dd)
                 return;
         }
 
-        memset(pages, 0, dd->ipath_cfgports * dd->ipath_rcvtidcnt *
-               sizeof(struct page *));
-
         dd->ipath_pageshadow = pages;
         dd->ipath_physshadow = addrs;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_sysfs.c b/drivers/infiniband/hw/ipath/ipath_sysfs.c
index b8cb2f145ae4..8991677e9a08 100644
--- a/drivers/infiniband/hw/ipath/ipath_sysfs.c
+++ b/drivers/infiniband/hw/ipath/ipath_sysfs.c
@@ -557,6 +557,7 @@ static ssize_t store_reset(struct device *dev,
                 dev_info(dev,"Unit %d is disabled, can't reset\n",
                          dd->ipath_unit);
                 ret = -EINVAL;
+                goto bail;
         }
         ret = ipath_reset_device(dd->ipath_unit);
 bail:
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 7420715256a9..e8a2a915251e 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -86,7 +86,7 @@ static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_swqe *swqe)
         }
 
         /*
-         * A GRH is expected to preceed the data even if not
+         * A GRH is expected to precede the data even if not
          * present on the wire.
          */
         length = swqe->length;
@@ -515,7 +515,7 @@ void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
         }
 
         /*
-         * A GRH is expected to preceed the data even if not
+         * A GRH is expected to precede the data even if not
          * present on the wire.
          */
         wc.byte_len = tlen + sizeof(struct ib_grh);
diff --git a/drivers/infiniband/hw/ipath/ipath_user_pages.c b/drivers/infiniband/hw/ipath/ipath_user_pages.c
index 5e86d73eba2a..cfed5399f074 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_pages.c
+++ b/drivers/infiniband/hw/ipath/ipath_user_pages.c
@@ -53,8 +53,8 @@ static void __ipath_release_user_pages(struct page **p, size_t num_pages,
 }
 
 /* call with current->mm->mmap_sem held */
-static int __get_user_pages(unsigned long start_page, size_t num_pages,
-                        struct page **p, struct vm_area_struct **vma)
+static int __ipath_get_user_pages(unsigned long start_page, size_t num_pages,
+                                  struct page **p, struct vm_area_struct **vma)
 {
         unsigned long lock_limit;
         size_t got;
@@ -165,7 +165,7 @@ int ipath_get_user_pages(unsigned long start_page, size_t num_pages,
 
         down_write(&current->mm->mmap_sem);
 
-        ret = __get_user_pages(start_page, num_pages, p, NULL);
+        ret = __ipath_get_user_pages(start_page, num_pages, p, NULL);
 
         up_write(&current->mm->mmap_sem);
 
@@ -220,7 +220,7 @@ void ipath_release_user_pages_on_close(struct page **p, size_t num_pages)
         work->mm = mm;
         work->num_pages = num_pages;
 
-        schedule_work(&work->work);
+        queue_work(ib_wq, &work->work);
         return;
 
 bail_mm:
diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
index be78f6643c06..f5cb13b21445 100644
--- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c
+++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
@@ -236,7 +236,7 @@ static int ipath_user_sdma_num_pages(const struct iovec *iov)
         return 1 + ((epage - spage) >> PAGE_SHIFT);
 }
 
-/* truncate length to page boundry */
+/* truncate length to page boundary */
 static int ipath_user_sdma_page_length(unsigned long addr, unsigned long len)
 {
         const unsigned long offset = addr & ~PAGE_MASK;
diff --git a/drivers/infiniband/hw/mlx4/Kconfig b/drivers/infiniband/hw/mlx4/Kconfig
index 4175a4bd0c78..bd995b2b50d8 100644
--- a/drivers/infiniband/hw/mlx4/Kconfig
+++ b/drivers/infiniband/hw/mlx4/Kconfig
@@ -1,5 +1,6 @@
 config MLX4_INFINIBAND
         tristate "Mellanox ConnectX HCA support"
+        depends on NETDEVICES && NETDEV_10000 && PCI
         select MLX4_CORE
         ---help---
           This driver provides low-level InfiniBand support for
diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index 11a236f8d884..4b8f9c49397e 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -30,66 +30,163 @@
  * SOFTWARE.
  */
 
+#include <rdma/ib_addr.h>
+#include <rdma/ib_cache.h>
+
 #include <linux/slab.h>
+#include <linux/inet.h>
+#include <linux/string.h>
 
 #include "mlx4_ib.h"
 
-struct ib_ah *mlx4_ib_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
+int mlx4_ib_resolve_grh(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah_attr,
+                        u8 *mac, int *is_mcast, u8 port)
 {
-        struct mlx4_dev *dev = to_mdev(pd->device)->dev;
-        struct mlx4_ib_ah *ah;
+        struct in6_addr in6;
 
-        ah = kmalloc(sizeof *ah, GFP_ATOMIC);
-        if (!ah)
-                return ERR_PTR(-ENOMEM);
+        *is_mcast = 0;
 
-        memset(&ah->av, 0, sizeof ah->av);
+        memcpy(&in6, ah_attr->grh.dgid.raw, sizeof in6);
+        if (rdma_link_local_addr(&in6))
+                rdma_get_ll_mac(&in6, mac);
+        else if (rdma_is_multicast_addr(&in6)) {
+                rdma_get_mcast_mac(&in6, mac);
+                *is_mcast = 1;
+        } else
+                return -EINVAL;
 
-        ah->av.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
-        ah->av.g_slid  = ah_attr->src_path_bits;
-        ah->av.dlid    = cpu_to_be16(ah_attr->dlid);
-        if (ah_attr->static_rate) {
-                ah->av.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
-                while (ah->av.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&
-                       !(1 << ah->av.stat_rate & dev->caps.stat_rate_support))
-                        --ah->av.stat_rate;
-        }
-        ah->av.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
+        return 0;
+}
+
+static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
+                                  struct mlx4_ib_ah *ah)
+{
+        struct mlx4_dev *dev = to_mdev(pd->device)->dev;
+
+        ah->av.ib.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
+        ah->av.ib.g_slid  = ah_attr->src_path_bits;
         if (ah_attr->ah_flags & IB_AH_GRH) {
-                ah->av.g_slid   |= 0x80;
-                ah->av.gid_index = ah_attr->grh.sgid_index;
-                ah->av.hop_limit = ah_attr->grh.hop_limit;
-                ah->av.sl_tclass_flowlabel |=
+                ah->av.ib.g_slid   |= 0x80;
+                ah->av.ib.gid_index = ah_attr->grh.sgid_index;
+                ah->av.ib.hop_limit = ah_attr->grh.hop_limit;
+                ah->av.ib.sl_tclass_flowlabel |=
                         cpu_to_be32((ah_attr->grh.traffic_class << 20) |
                                     ah_attr->grh.flow_label);
-                memcpy(ah->av.dgid, ah_attr->grh.dgid.raw, 16);
+                memcpy(ah->av.ib.dgid, ah_attr->grh.dgid.raw, 16);
+        }
+
+        ah->av.ib.dlid    = cpu_to_be16(ah_attr->dlid);
+        if (ah_attr->static_rate) {
+                ah->av.ib.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
+                while (ah->av.ib.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&
+                       !(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support))
+                        --ah->av.ib.stat_rate;
         }
+        ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
 
         return &ah->ibah;
 }
 
+static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
+                                    struct mlx4_ib_ah *ah)
+{
+        struct mlx4_ib_dev *ibdev = to_mdev(pd->device);
+        struct mlx4_dev *dev = ibdev->dev;
+        union ib_gid sgid;
+        u8 mac[6];
+        int err;
+        int is_mcast;
+        u16 vlan_tag;
+
+        err = mlx4_ib_resolve_grh(ibdev, ah_attr, mac, &is_mcast, ah_attr->port_num);
+        if (err)
+                return ERR_PTR(err);
+
+        memcpy(ah->av.eth.mac, mac, 6);
+        err = ib_get_cached_gid(pd->device, ah_attr->port_num, ah_attr->grh.sgid_index, &sgid);
+        if (err)
+                return ERR_PTR(err);
+        vlan_tag = rdma_get_vlan_id(&sgid);
+        if (vlan_tag < 0x1000)
+                vlan_tag |= (ah_attr->sl & 7) << 13;
+        ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
+        ah->av.eth.gid_index = ah_attr->grh.sgid_index;
+        ah->av.eth.vlan = cpu_to_be16(vlan_tag);
+        if (ah_attr->static_rate) {
+                ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
+                while (ah->av.eth.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&
+                       !(1 << ah->av.eth.stat_rate & dev->caps.stat_rate_support))
+                        --ah->av.eth.stat_rate;
+        }
+
+        /*
+         * HW requires multicast LID so we just choose one.
+         */
+        if (is_mcast)
+                ah->av.ib.dlid = cpu_to_be16(0xc000);
+
+        memcpy(ah->av.eth.dgid, ah_attr->grh.dgid.raw, 16);
+        ah->av.eth.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
+
+        return &ah->ibah;
+}
+
+struct ib_ah *mlx4_ib_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
+{
+        struct mlx4_ib_ah *ah;
+        struct ib_ah *ret;
+
+        ah = kzalloc(sizeof *ah, GFP_ATOMIC);
+        if (!ah)
+                return ERR_PTR(-ENOMEM);
+
+        if (rdma_port_get_link_layer(pd->device, ah_attr->port_num) == IB_LINK_LAYER_ETHERNET) {
+                if (!(ah_attr->ah_flags & IB_AH_GRH)) {
+                        ret = ERR_PTR(-EINVAL);
+                } else {
+                        /*
+                         * TBD: need to handle the case when we get
+                         * called in an atomic context and there we
+                         * might sleep.  We don't expect this
+                         * currently since we're working with link
+                         * local addresses which we can translate
+                         * without going to sleep.
+                         */
+                        ret = create_iboe_ah(pd, ah_attr, ah);
+                }
+
+                if (IS_ERR(ret))
+                        kfree(ah);
+
+                return ret;
+        } else
+                return create_ib_ah(pd, ah_attr, ah); /* never fails */
+}
+
 int mlx4_ib_query_ah(struct ib_ah *ibah, struct ib_ah_attr *ah_attr)
 {
         struct mlx4_ib_ah *ah = to_mah(ibah);
+        enum rdma_link_layer ll;
 
         memset(ah_attr, 0, sizeof *ah_attr);
-        ah_attr->dlid          = be16_to_cpu(ah->av.dlid);
-        ah_attr->sl            = be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 28;
-        ah_attr->port_num      = be32_to_cpu(ah->av.port_pd) >> 24;
-        if (ah->av.stat_rate)
-                ah_attr->static_rate = ah->av.stat_rate - MLX4_STAT_RATE_OFFSET;
-        ah_attr->src_path_bits = ah->av.g_slid & 0x7F;
+        ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
+        ah_attr->port_num = be32_to_cpu(ah->av.ib.port_pd) >> 24;
+        ll = rdma_port_get_link_layer(ibah->device, ah_attr->port_num);
+        ah_attr->dlid = ll == IB_LINK_LAYER_INFINIBAND ? be16_to_cpu(ah->av.ib.dlid) : 0;
+        if (ah->av.ib.stat_rate)
+                ah_attr->static_rate = ah->av.ib.stat_rate - MLX4_STAT_RATE_OFFSET;
+        ah_attr->src_path_bits = ah->av.ib.g_slid & 0x7F;
 
         if (mlx4_ib_ah_grh_present(ah)) {
                 ah_attr->ah_flags = IB_AH_GRH;
 
                 ah_attr->grh.traffic_class =
-                        be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 20;
+                        be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 20;
                 ah_attr->grh.flow_label =
-                        be32_to_cpu(ah->av.sl_tclass_flowlabel) & 0xfffff;
-                ah_attr->grh.hop_limit  = ah->av.hop_limit;
-                ah_attr->grh.sgid_index = ah->av.gid_index;
-                memcpy(ah_attr->grh.dgid.raw, ah->av.dgid, 16);
+                        be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) & 0xfffff;
+                ah_attr->grh.hop_limit  = ah->av.ib.hop_limit;
+                ah_attr->grh.sgid_index = ah->av.ib.gid_index;
+                memcpy(ah_attr->grh.dgid.raw, ah->av.ib.dgid, 16);
         }
 
         return 0;
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 5a219a2fdf16..e8df155bc3b0 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -397,10 +397,14 @@ int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
                 cq->resize_buf = NULL;
                 cq->resize_umem = NULL;
         } else {
+                struct mlx4_ib_cq_buf tmp_buf;
+                int tmp_cqe = 0;
+
                 spin_lock_irq(&cq->lock);
                 if (cq->resize_buf) {
                         mlx4_ib_cq_resize_copy_cqes(cq);
-                        mlx4_ib_free_cq_buf(dev, &cq->buf, cq->ibcq.cqe);
+                        tmp_buf = cq->buf;
+                        tmp_cqe = cq->ibcq.cqe;
                         cq->buf      = cq->resize_buf->buf;
                         cq->ibcq.cqe = cq->resize_buf->cqe;
 
@@ -408,6 +412,9 @@ int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
                         cq->resize_buf = NULL;
                 }
                 spin_unlock_irq(&cq->lock);
+
+                if (tmp_cqe)
+                        mlx4_ib_free_cq_buf(dev, &tmp_buf, tmp_cqe);
         }
 
         goto out;
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index f38d5b118927..57ffa50f509e 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -211,6 +211,8 @@ static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *ma
         if (agent) {
                 send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
                                               IB_MGMT_MAD_DATA, GFP_ATOMIC);
+                if (IS_ERR(send_buf))
+                        return;
                 /*
                  * We rely here on the fact that MLX QPs don't use the
                  * address handle after the send is posted (this is
@@ -311,19 +313,25 @@ int mlx4_ib_mad_init(struct mlx4_ib_dev *dev)
         struct ib_mad_agent *agent;
         int p, q;
         int ret;
+        enum rdma_link_layer ll;
 
-        for (p = 0; p < dev->num_ports; ++p)
+        for (p = 0; p < dev->num_ports; ++p) {
+                ll = rdma_port_get_link_layer(&dev->ib_dev, p + 1);
                 for (q = 0; q <= 1; ++q) {
-                        agent = ib_register_mad_agent(&dev->ib_dev, p + 1,
-                                                      q ? IB_QPT_GSI : IB_QPT_SMI,
-                                                      NULL, 0, send_handler,
-                                                      NULL, NULL);
-                        if (IS_ERR(agent)) {
-                                ret = PTR_ERR(agent);
-                                goto err;
-                        }
-                        dev->send_agent[p][q] = agent;
+                        if (ll == IB_LINK_LAYER_INFINIBAND) {
+                                agent = ib_register_mad_agent(&dev->ib_dev, p + 1,
+                                                              q ? IB_QPT_GSI : IB_QPT_SMI,
+                                                              NULL, 0, send_handler,
+                                                              NULL, NULL);
+                                if (IS_ERR(agent)) {
+                                        ret = PTR_ERR(agent);
+                                        goto err;
+                                }
+                                dev->send_agent[p][q] = agent;
+                        } else
+                                dev->send_agent[p][q] = NULL;
                 }
+        }
 
         return 0;
 
@@ -344,8 +352,10 @@ void mlx4_ib_mad_cleanup(struct mlx4_ib_dev *dev)
         for (p = 0; p < dev->num_ports; ++p) {
                 for (q = 0; q <= 1; ++q) {
                         agent = dev->send_agent[p][q];
-                        dev->send_agent[p][q] = NULL;
-                        ib_unregister_mad_agent(agent);
+                        if (agent) {
+                                dev->send_agent[p][q] = NULL;
+                                ib_unregister_mad_agent(agent);
+                        }
                 }
 
                 if (dev->sm_ah[p])
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 4e94e360e43b..fbe1973f77b0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -35,9 +35,14 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/if_vlan.h>
 
 #include <rdma/ib_smi.h>
 #include <rdma/ib_user_verbs.h>
+#include <rdma/ib_addr.h>
 
 #include <linux/mlx4/driver.h>
 #include <linux/mlx4/cmd.h>
@@ -58,6 +63,15 @@ static const char mlx4_ib_version[] =
         DRV_NAME ": Mellanox ConnectX InfiniBand driver v"
         DRV_VERSION " (" DRV_RELDATE ")\n";
 
+struct update_gid_work {
+        struct work_struct      work;
+        union ib_gid            gids[128];
+        struct mlx4_ib_dev     *dev;
+        int                     port;
+};
+
+static struct workqueue_struct *wq;
+
 static void init_query_mad(struct ib_smp *mad)
 {
         mad->base_version  = 1;
@@ -66,6 +80,8 @@ static void init_query_mad(struct ib_smp *mad)
         mad->method        = IB_MGMT_METHOD_GET;
 }
 
+static union ib_gid zgid;
+
 static int mlx4_ib_query_device(struct ib_device *ibdev,
                                 struct ib_device_attr *props)
 {
@@ -135,7 +151,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->max_srq             = dev->dev->caps.num_srqs - dev->dev->caps.reserved_srqs;
         props->max_srq_wr          = dev->dev->caps.max_srq_wqes - 1;
         props->max_srq_sge         = dev->dev->caps.max_srq_sge;
-        props->max_fast_reg_page_list_len = PAGE_SIZE / sizeof (u64);
+        props->max_fast_reg_page_list_len = MLX4_MAX_FAST_REG_PAGES;
         props->local_ca_ack_delay  = dev->dev->caps.local_ca_ack_delay;
         props->atomic_cap          = dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_ATOMIC ?
                 IB_ATOMIC_HCA : IB_ATOMIC_NONE;
@@ -154,28 +170,19 @@ out:
         return err;
 }
 
-static int mlx4_ib_query_port(struct ib_device *ibdev, u8 port,
-                              struct ib_port_attr *props)
+static enum rdma_link_layer
+mlx4_ib_port_link_layer(struct ib_device *device, u8 port_num)
 {
-        struct ib_smp *in_mad  = NULL;
-        struct ib_smp *out_mad = NULL;
-        int err = -ENOMEM;
-
-        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
-        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
-        if (!in_mad || !out_mad)
-                goto out;
-
-        memset(props, 0, sizeof *props);
-
-        init_query_mad(in_mad);
-        in_mad->attr_id  = IB_SMP_ATTR_PORT_INFO;
-        in_mad->attr_mod = cpu_to_be32(port);
+        struct mlx4_dev *dev = to_mdev(device)->dev;
 
-        err = mlx4_MAD_IFC(to_mdev(ibdev), 1, 1, port, NULL, NULL, in_mad, out_mad);
-        if (err)
-                goto out;
+        return dev->caps.port_mask & (1 << (port_num - 1)) ?
+                IB_LINK_LAYER_INFINIBAND : IB_LINK_LAYER_ETHERNET;
+}
 
+static int ib_link_query_port(struct ib_device *ibdev, u8 port,
+                              struct ib_port_attr *props,
+                              struct ib_smp *out_mad)
+{
         props->lid              = be16_to_cpup((__be16 *) (out_mad->data + 16));
         props->lmc              = out_mad->data[34] & 0x7;
         props->sm_lid           = be16_to_cpup((__be16 *) (out_mad->data + 18));
@@ -196,6 +203,80 @@ static int mlx4_ib_query_port(struct ib_device *ibdev, u8 port,
         props->max_vl_num       = out_mad->data[37] >> 4;
         props->init_type_reply  = out_mad->data[41] >> 4;
 
+        return 0;
+}
+
+static u8 state_to_phys_state(enum ib_port_state state)
+{
+        return state == IB_PORT_ACTIVE ? 5 : 3;
+}
+
+static int eth_link_query_port(struct ib_device *ibdev, u8 port,
+                               struct ib_port_attr *props,
+                               struct ib_smp *out_mad)
+{
+        struct mlx4_ib_iboe *iboe = &to_mdev(ibdev)->iboe;
+        struct net_device *ndev;
+        enum ib_mtu tmp;
+
+        props->active_width     = IB_WIDTH_1X;
+        props->active_speed     = 4;
+        props->port_cap_flags   = IB_PORT_CM_SUP;
+        props->gid_tbl_len      = to_mdev(ibdev)->dev->caps.gid_table_len[port];
+        props->max_msg_sz       = to_mdev(ibdev)->dev->caps.max_msg_sz;
+        props->pkey_tbl_len     = 1;
+        props->bad_pkey_cntr    = be16_to_cpup((__be16 *) (out_mad->data + 46));
+        props->qkey_viol_cntr   = be16_to_cpup((__be16 *) (out_mad->data + 48));
+        props->max_mtu          = IB_MTU_2048;
+        props->subnet_timeout   = 0;
+        props->max_vl_num       = out_mad->data[37] >> 4;
+        props->init_type_reply  = 0;
+        props->state            = IB_PORT_DOWN;
+        props->phys_state       = state_to_phys_state(props->state);
+        props->active_mtu       = IB_MTU_256;
+        spin_lock(&iboe->lock);
+        ndev = iboe->netdevs[port - 1];
+        if (!ndev)
+                goto out;
+
+        tmp = iboe_get_mtu(ndev->mtu);
+        props->active_mtu = tmp ? min(props->max_mtu, tmp) : IB_MTU_256;
+
+        props->state            = (netif_running(ndev) && netif_carrier_ok(ndev)) ?
+                                        IB_PORT_ACTIVE : IB_PORT_DOWN;
+        props->phys_state       = state_to_phys_state(props->state);
+
+out:
+        spin_unlock(&iboe->lock);
+        return 0;
+}
+
+static int mlx4_ib_query_port(struct ib_device *ibdev, u8 port,
+                              struct ib_port_attr *props)
+{
+        struct ib_smp *in_mad  = NULL;
+        struct ib_smp *out_mad = NULL;
+        int err = -ENOMEM;
+
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
+        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
+        if (!in_mad || !out_mad)
+                goto out;
+
+        memset(props, 0, sizeof *props);
+
+        init_query_mad(in_mad);
+        in_mad->attr_id  = IB_SMP_ATTR_PORT_INFO;
+        in_mad->attr_mod = cpu_to_be32(port);
+
+        err = mlx4_MAD_IFC(to_mdev(ibdev), 1, 1, port, NULL, NULL, in_mad, out_mad);
+        if (err)
+                goto out;
+
+        err = mlx4_ib_port_link_layer(ibdev, port) == IB_LINK_LAYER_INFINIBAND ?
+                ib_link_query_port(ibdev, port, props, out_mad) :
+                eth_link_query_port(ibdev, port, props, out_mad);
+
 out:
         kfree(in_mad);
         kfree(out_mad);
@@ -203,8 +284,8 @@ out:
         return err;
 }
 
-static int mlx4_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
-                             union ib_gid *gid)
+static int __mlx4_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
+                               union ib_gid *gid)
 {
         struct ib_smp *in_mad  = NULL;
         struct ib_smp *out_mad = NULL;
@@ -241,6 +322,25 @@ out:
         return err;
 }
 
+static int iboe_query_gid(struct ib_device *ibdev, u8 port, int index,
+                          union ib_gid *gid)
+{
+        struct mlx4_ib_dev *dev = to_mdev(ibdev);
+
+        *gid = dev->iboe.gid_table[port - 1][index];
+
+        return 0;
+}
+
+static int mlx4_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
+                             union ib_gid *gid)
+{
+        if (rdma_port_get_link_layer(ibdev, port) == IB_LINK_LAYER_INFINIBAND)
+                return __mlx4_ib_query_gid(ibdev, port, index, gid);
+        else
+                return iboe_query_gid(ibdev, port, index, gid);
+}
+
 static int mlx4_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
                               u16 *pkey)
 {
@@ -272,14 +372,32 @@ out:
 static int mlx4_ib_modify_device(struct ib_device *ibdev, int mask,
                                  struct ib_device_modify *props)
 {
+        struct mlx4_cmd_mailbox *mailbox;
+
         if (mask & ~IB_DEVICE_MODIFY_NODE_DESC)
                 return -EOPNOTSUPP;
 
-        if (mask & IB_DEVICE_MODIFY_NODE_DESC) {
-                spin_lock(&to_mdev(ibdev)->sm_lock);
-                memcpy(ibdev->node_desc, props->node_desc, 64);
-                spin_unlock(&to_mdev(ibdev)->sm_lock);
-        }
+        if (!(mask & IB_DEVICE_MODIFY_NODE_DESC))
+                return 0;
+
+        spin_lock(&to_mdev(ibdev)->sm_lock);
+        memcpy(ibdev->node_desc, props->node_desc, 64);
+        spin_unlock(&to_mdev(ibdev)->sm_lock);
+
+        /*
+         * If possible, pass node desc to FW, so it can generate
+         * a 144 trap.  If cmd fails, just ignore.
+         */
+        mailbox = mlx4_alloc_cmd_mailbox(to_mdev(ibdev)->dev);
+        if (IS_ERR(mailbox))
+                return 0;
+
+        memset(mailbox->buf, 0, 256);
+        memcpy(mailbox->buf, props->node_desc, 64);
+        mlx4_cmd(to_mdev(ibdev)->dev, mailbox->dma, 1, 0,
+                 MLX4_CMD_SET_NODE, MLX4_CMD_TIME_CLASS_A);
+
+        mlx4_free_cmd_mailbox(to_mdev(ibdev)->dev, mailbox);
 
         return 0;
 }
@@ -289,6 +407,7 @@ static int mlx4_SET_PORT(struct mlx4_ib_dev *dev, u8 port, int reset_qkey_viols,
 {
         struct mlx4_cmd_mailbox *mailbox;
         int err;
+        u8 is_eth = dev->dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH;
 
         mailbox = mlx4_alloc_cmd_mailbox(dev->dev);
         if (IS_ERR(mailbox))
@@ -304,7 +423,7 @@ static int mlx4_SET_PORT(struct mlx4_ib_dev *dev, u8 port, int reset_qkey_viols,
                 ((__be32 *) mailbox->buf)[1] = cpu_to_be32(cap_mask);
         }
 
-        err = mlx4_cmd(dev->dev, mailbox->dma, port, 0, MLX4_CMD_SET_PORT,
+        err = mlx4_cmd(dev->dev, mailbox->dma, port, is_eth, MLX4_CMD_SET_PORT,
                        MLX4_CMD_TIME_CLASS_B);
 
         mlx4_free_cmd_mailbox(dev->dev, mailbox);
@@ -447,18 +566,133 @@ static int mlx4_ib_dealloc_pd(struct ib_pd *pd)
         return 0;
 }
 
+static int add_gid_entry(struct ib_qp *ibqp, union ib_gid *gid)
+{
+        struct mlx4_ib_qp *mqp = to_mqp(ibqp);
+        struct mlx4_ib_dev *mdev = to_mdev(ibqp->device);
+        struct mlx4_ib_gid_entry *ge;
+
+        ge = kzalloc(sizeof *ge, GFP_KERNEL);
+        if (!ge)
+                return -ENOMEM;
+
+        ge->gid = *gid;
+        if (mlx4_ib_add_mc(mdev, mqp, gid)) {
+                ge->port = mqp->port;
+                ge->added = 1;
+        }
+
+        mutex_lock(&mqp->mutex);
+        list_add_tail(&ge->list, &mqp->gid_list);
+        mutex_unlock(&mqp->mutex);
+
+        return 0;
+}
+
+int mlx4_ib_add_mc(struct mlx4_ib_dev *mdev, struct mlx4_ib_qp *mqp,
+                   union ib_gid *gid)
+{
+        u8 mac[6];
+        struct net_device *ndev;
+        int ret = 0;
+
+        if (!mqp->port)
+                return 0;
+
+        spin_lock(&mdev->iboe.lock);
+        ndev = mdev->iboe.netdevs[mqp->port - 1];
+        if (ndev)
+                dev_hold(ndev);
+        spin_unlock(&mdev->iboe.lock);
+
+        if (ndev) {
+                rdma_get_mcast_mac((struct in6_addr *)gid, mac);
+                rtnl_lock();
+                dev_mc_add(mdev->iboe.netdevs[mqp->port - 1], mac);
+                ret = 1;
+                rtnl_unlock();
+                dev_put(ndev);
+        }
+
+        return ret;
+}
+
 static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
 {
-        return mlx4_multicast_attach(to_mdev(ibqp->device)->dev,
-                                     &to_mqp(ibqp)->mqp, gid->raw,
-                                     !!(to_mqp(ibqp)->flags &
-                                        MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK));
+        int err;
+        struct mlx4_ib_dev *mdev = to_mdev(ibqp->device);
+        struct mlx4_ib_qp *mqp = to_mqp(ibqp);
+
+        err = mlx4_multicast_attach(mdev->dev, &mqp->mqp, gid->raw,
+                                    !!(mqp->flags & MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK),
+                                    MLX4_PROT_IB_IPV6);
+        if (err)
+                return err;
+
+        err = add_gid_entry(ibqp, gid);
+        if (err)
+                goto err_add;
+
+        return 0;
+
+err_add:
+        mlx4_multicast_detach(mdev->dev, &mqp->mqp, gid->raw, MLX4_PROT_IB_IPV6);
+        return err;
+}
+
+static struct mlx4_ib_gid_entry *find_gid_entry(struct mlx4_ib_qp *qp, u8 *raw)
+{
+        struct mlx4_ib_gid_entry *ge;
+        struct mlx4_ib_gid_entry *tmp;
+        struct mlx4_ib_gid_entry *ret = NULL;
+
+        list_for_each_entry_safe(ge, tmp, &qp->gid_list, list) {
+                if (!memcmp(raw, ge->gid.raw, 16)) {
+                        ret = ge;
+                        break;
+                }
+        }
+
+        return ret;
 }
 
 static int mlx4_ib_mcg_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
 {
-        return mlx4_multicast_detach(to_mdev(ibqp->device)->dev,
-                                     &to_mqp(ibqp)->mqp, gid->raw);
+        int err;
+        struct mlx4_ib_dev *mdev = to_mdev(ibqp->device);
+        struct mlx4_ib_qp *mqp = to_mqp(ibqp);
+        u8 mac[6];
+        struct net_device *ndev;
+        struct mlx4_ib_gid_entry *ge;
+
+        err = mlx4_multicast_detach(mdev->dev,
+                                    &mqp->mqp, gid->raw, MLX4_PROT_IB_IPV6);
+        if (err)
+                return err;
+
+        mutex_lock(&mqp->mutex);
+        ge = find_gid_entry(mqp, gid->raw);
+        if (ge) {
+                spin_lock(&mdev->iboe.lock);
+                ndev = ge->added ? mdev->iboe.netdevs[ge->port - 1] : NULL;
+                if (ndev)
+                        dev_hold(ndev);
+                spin_unlock(&mdev->iboe.lock);
+                rdma_get_mcast_mac((struct in6_addr *)gid, mac);
+                if (ndev) {
+                        rtnl_lock();
+                        dev_mc_del(mdev->iboe.netdevs[ge->port - 1], mac);
+                        rtnl_unlock();
+                        dev_put(ndev);
+                }
+                list_del(&ge->list);
+                kfree(ge);
+        } else
+                printk(KERN_WARNING "could not find mgid entry\n");
+
+        mutex_unlock(&mqp->mutex);
+
+        return 0;
 }
 
 static int init_node_data(struct mlx4_ib_dev *dev)
@@ -487,7 +721,6 @@ static int init_node_data(struct mlx4_ib_dev *dev)
         if (err)
                 goto out;
 
-        dev->dev->rev_id = be32_to_cpup((__be32 *) (out_mad->data + 32));
         memcpy(&dev->ib_dev.node_guid, out_mad->data + 12, 8);
 
 out:
@@ -543,15 +776,215 @@ static struct device_attribute *mlx4_class_attributes[] = {
         &dev_attr_board_id
 };
 
+static void mlx4_addrconf_ifid_eui48(u8 *eui, u16 vlan_id, struct net_device *dev)
+{
+        memcpy(eui, dev->dev_addr, 3);
+        memcpy(eui + 5, dev->dev_addr + 3, 3);
+        if (vlan_id < 0x1000) {
+                eui[3] = vlan_id >> 8;
+                eui[4] = vlan_id & 0xff;
+        } else {
+                eui[3] = 0xff;
+                eui[4] = 0xfe;
+        }
+        eui[0] ^= 2;
+}
+
+static void update_gids_task(struct work_struct *work)
+{
+        struct update_gid_work *gw = container_of(work, struct update_gid_work, work);
+        struct mlx4_cmd_mailbox *mailbox;
+        union ib_gid *gids;
+        int err;
+        struct mlx4_dev *dev = gw->dev->dev;
+        struct ib_event event;
+
+        mailbox = mlx4_alloc_cmd_mailbox(dev);
+        if (IS_ERR(mailbox)) {
+                printk(KERN_WARNING "update gid table failed %ld\n", PTR_ERR(mailbox));
+                return;
+        }
+
+        gids = mailbox->buf;
+        memcpy(gids, gw->gids, sizeof gw->gids);
+
+        err = mlx4_cmd(dev, mailbox->dma, MLX4_SET_PORT_GID_TABLE << 8 | gw->port,
+                       1, MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B);
+        if (err)
+                printk(KERN_WARNING "set port command failed\n");
+        else {
+                memcpy(gw->dev->iboe.gid_table[gw->port - 1], gw->gids, sizeof gw->gids);
+                event.device = &gw->dev->ib_dev;
+                event.element.port_num = gw->port;
+                event.event    = IB_EVENT_LID_CHANGE;
+                ib_dispatch_event(&event);
+        }
+
+        mlx4_free_cmd_mailbox(dev, mailbox);
+        kfree(gw);
+}
+
+static int update_ipv6_gids(struct mlx4_ib_dev *dev, int port, int clear)
+{
+        struct net_device *ndev = dev->iboe.netdevs[port - 1];
+        struct update_gid_work *work;
+        struct net_device *tmp;
+        int i;
+        u8 *hits;
+        int ret;
+        union ib_gid gid;
+        int free;
+        int found;
+        int need_update = 0;
+        u16 vid;
+
+        work = kzalloc(sizeof *work, GFP_ATOMIC);
+        if (!work)
+                return -ENOMEM;
+
+        hits = kzalloc(128, GFP_ATOMIC);
+        if (!hits) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, tmp) {
+                if (ndev && (tmp == ndev || rdma_vlan_dev_real_dev(tmp) == ndev)) {
+                        gid.global.subnet_prefix = cpu_to_be64(0xfe80000000000000LL);
+                        vid = rdma_vlan_dev_vlan_id(tmp);
+                        mlx4_addrconf_ifid_eui48(&gid.raw[8], vid, ndev);
+                        found = 0;
+                        free = -1;
+                        for (i = 0; i < 128; ++i) {
+                                if (free < 0 &&
+                                    !memcmp(&dev->iboe.gid_table[port - 1][i], &zgid, sizeof zgid))
+                                        free = i;
+                                if (!memcmp(&dev->iboe.gid_table[port - 1][i], &gid, sizeof gid)) {
+                                        hits[i] = 1;
+                                        found = 1;
+                                        break;
+                                }
+                        }
+
+                        if (!found) {
+                                if (tmp == ndev &&
+                                    (memcmp(&dev->iboe.gid_table[port - 1][0],
+                                            &gid, sizeof gid) ||
+                                     !memcmp(&dev->iboe.gid_table[port - 1][0],
+                                             &zgid, sizeof gid))) {
+                                        dev->iboe.gid_table[port - 1][0] = gid;
+                                        ++need_update;
+                                        hits[0] = 1;
+                                } else if (free >= 0) {
+                                        dev->iboe.gid_table[port - 1][free] = gid;
+                                        hits[free] = 1;
+                                        ++need_update;
+                                }
+                        }
+                }
+        }
+        rcu_read_unlock();
+
+        for (i = 0; i < 128; ++i)
+                if (!hits[i]) {
+                        if (memcmp(&dev->iboe.gid_table[port - 1][i], &zgid, sizeof zgid))
+                                ++need_update;
+                        dev->iboe.gid_table[port - 1][i] = zgid;
+                }
+
+        if (need_update) {
+                memcpy(work->gids, dev->iboe.gid_table[port - 1], sizeof work->gids);
+                INIT_WORK(&work->work, update_gids_task);
+                work->port = port;
+                work->dev = dev;
+                queue_work(wq, &work->work);
+        } else
+                kfree(work);
+
+        kfree(hits);
+        return 0;
+
+out:
+        kfree(work);
+        return ret;
+}
+
+static void handle_en_event(struct mlx4_ib_dev *dev, int port, unsigned long event)
+{
+        switch (event) {
+        case NETDEV_UP:
+        case NETDEV_CHANGEADDR:
+                update_ipv6_gids(dev, port, 0);
+                break;
+
+        case NETDEV_DOWN:
+                update_ipv6_gids(dev, port, 1);
+                dev->iboe.netdevs[port - 1] = NULL;
+        }
+}
+
+static void netdev_added(struct mlx4_ib_dev *dev, int port)
+{
+        update_ipv6_gids(dev, port, 0);
+}
+
+static void netdev_removed(struct mlx4_ib_dev *dev, int port)
+{
+        update_ipv6_gids(dev, port, 1);
+}
+
+static int mlx4_ib_netdev_event(struct notifier_block *this, unsigned long event,
+                                void *ptr)
+{
+        struct net_device *dev = ptr;
+        struct mlx4_ib_dev *ibdev;
+        struct net_device *oldnd;
+        struct mlx4_ib_iboe *iboe;
+        int port;
+
+        if (!net_eq(dev_net(dev), &init_net))
+                return NOTIFY_DONE;
+
+        ibdev = container_of(this, struct mlx4_ib_dev, iboe.nb);
+        iboe = &ibdev->iboe;
+
+        spin_lock(&iboe->lock);
+        mlx4_foreach_ib_transport_port(port, ibdev->dev) {
+                oldnd = iboe->netdevs[port - 1];
+                iboe->netdevs[port - 1] =
+                        mlx4_get_protocol_dev(ibdev->dev, MLX4_PROT_ETH, port);
+                if (oldnd != iboe->netdevs[port - 1]) {
+                        if (iboe->netdevs[port - 1])
+                                netdev_added(ibdev, port);
+                        else
+                                netdev_removed(ibdev, port);
+                }
+        }
+
+        if (dev == iboe->netdevs[0] ||
+            (iboe->netdevs[0] && rdma_vlan_dev_real_dev(dev) == iboe->netdevs[0]))
+                handle_en_event(ibdev, 1, event);
+        else if (dev == iboe->netdevs[1]
+                 || (iboe->netdevs[1] && rdma_vlan_dev_real_dev(dev) == iboe->netdevs[1]))
+                handle_en_event(ibdev, 2, event);
+
+        spin_unlock(&iboe->lock);
+
+        return NOTIFY_DONE;
+}
+
 static void *mlx4_ib_add(struct mlx4_dev *dev)
 {
         struct mlx4_ib_dev *ibdev;
         int num_ports = 0;
         int i;
+        int err;
+        struct mlx4_ib_iboe *iboe;
 
         printk_once(KERN_INFO "%s", mlx4_ib_version);
 
-        mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_IB)
+        mlx4_foreach_ib_transport_port(i, dev)
                 num_ports++;
 
         /* No point in registering a device with no ports... */
@@ -564,13 +997,16 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                 return NULL;
         }
 
+        iboe = &ibdev->iboe;
+
         if (mlx4_pd_alloc(dev, &ibdev->priv_pdn))
                 goto err_dealloc;
 
         if (mlx4_uar_alloc(dev, &ibdev->priv_uar))
                 goto err_pd;
 
-        ibdev->uar_map = ioremap(ibdev->priv_uar.pfn << PAGE_SHIFT, PAGE_SIZE);
+        ibdev->uar_map = ioremap((phys_addr_t) ibdev->priv_uar.pfn << PAGE_SHIFT,
+                                 PAGE_SIZE);
         if (!ibdev->uar_map)
                 goto err_uar;
         MLX4_INIT_DOORBELL_LOCK(&ibdev->uar_lock);
@@ -612,6 +1048,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
 
         ibdev->ib_dev.query_device      = mlx4_ib_query_device;
         ibdev->ib_dev.query_port        = mlx4_ib_query_port;
+        ibdev->ib_dev.get_link_layer    = mlx4_ib_port_link_layer;
         ibdev->ib_dev.query_gid         = mlx4_ib_query_gid;
         ibdev->ib_dev.query_pkey        = mlx4_ib_query_pkey;
         ibdev->ib_dev.modify_device     = mlx4_ib_modify_device;
@@ -656,6 +1093,8 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
         ibdev->ib_dev.unmap_fmr         = mlx4_ib_unmap_fmr;
         ibdev->ib_dev.dealloc_fmr       = mlx4_ib_fmr_dealloc;
 
+        spin_lock_init(&iboe->lock);
+
         if (init_node_data(ibdev))
                 goto err_map;
 
@@ -668,16 +1107,28 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
         if (mlx4_ib_mad_init(ibdev))
                 goto err_reg;
 
+        if (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE && !iboe->nb.notifier_call) {
+                iboe->nb.notifier_call = mlx4_ib_netdev_event;
+                err = register_netdevice_notifier(&iboe->nb);
+                if (err)
+                        goto err_reg;
+        }
+
         for (i = 0; i < ARRAY_SIZE(mlx4_class_attributes); ++i) {
                 if (device_create_file(&ibdev->ib_dev.dev,
                                        mlx4_class_attributes[i]))
-                        goto err_reg;
+                        goto err_notif;
         }
 
         ibdev->ib_active = true;
 
         return ibdev;
 
+err_notif:
+        if (unregister_netdevice_notifier(&ibdev->iboe.nb))
+                printk(KERN_WARNING "failure unregistering notifier\n");
+        flush_workqueue(wq);
+
 err_reg:
         ib_unregister_device(&ibdev->ib_dev);
 
@@ -703,11 +1154,16 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
 
         mlx4_ib_mad_cleanup(ibdev);
         ib_unregister_device(&ibdev->ib_dev);
+        if (ibdev->iboe.nb.notifier_call) {
+                if (unregister_netdevice_notifier(&ibdev->iboe.nb))
+                        printk(KERN_WARNING "failure unregistering notifier\n");
+                ibdev->iboe.nb.notifier_call = NULL;
+        }
+        iounmap(ibdev->uar_map);
 
-        for (p = 1; p <= ibdev->num_ports; ++p)
+        mlx4_foreach_port(p, dev, MLX4_PORT_TYPE_IB)
                 mlx4_CLOSE_PORT(dev, p);
 
-        iounmap(ibdev->uar_map);
         mlx4_uar_free(dev, &ibdev->priv_uar);
         mlx4_pd_free(dev, ibdev->priv_pdn);
         ib_dealloc_device(&ibdev->ib_dev);
@@ -747,19 +1203,33 @@ static void mlx4_ib_event(struct mlx4_dev *dev, void *ibdev_ptr,
 }
 
 static struct mlx4_interface mlx4_ib_interface = {
-        .add    = mlx4_ib_add,
-        .remove = mlx4_ib_remove,
-        .event  = mlx4_ib_event
+        .add            = mlx4_ib_add,
+        .remove         = mlx4_ib_remove,
+        .event          = mlx4_ib_event,
+        .protocol       = MLX4_PROT_IB_IPV6
 };
 
 static int __init mlx4_ib_init(void)
 {
-        return mlx4_register_interface(&mlx4_ib_interface);
+        int err;
+
+        wq = create_singlethread_workqueue("mlx4_ib");
+        if (!wq)
+                return -ENOMEM;
+
+        err = mlx4_register_interface(&mlx4_ib_interface);
+        if (err) {
+                destroy_workqueue(wq);
+                return err;
+        }
+
+        return 0;
 }
 
 static void __exit mlx4_ib_cleanup(void)
 {
         mlx4_unregister_interface(&mlx4_ib_interface);
+        destroy_workqueue(wq);
 }
 
 module_init(mlx4_ib_init);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 3486d7675e56..2a322f21049f 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -112,6 +112,13 @@ enum mlx4_ib_qp_flags {
         MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK     = 1 << 1,
 };
 
+struct mlx4_ib_gid_entry {
+        struct list_head        list;
+        union ib_gid            gid;
+        int                     added;
+        u8                      port;
+};
+
 struct mlx4_ib_qp {
         struct ib_qp            ibqp;
         struct mlx4_qp          mqp;
@@ -138,6 +145,8 @@ struct mlx4_ib_qp {
         u8                      resp_depth;
         u8                      sq_no_prefetch;
         u8                      state;
+        int                     mlx_type;
+        struct list_head        gid_list;
 };
 
 struct mlx4_ib_srq {
@@ -157,7 +166,14 @@ struct mlx4_ib_srq {
 
 struct mlx4_ib_ah {
         struct ib_ah            ibah;
-        struct mlx4_av          av;
+        union mlx4_ext_av       av;
+};
+
+struct mlx4_ib_iboe {
+        spinlock_t              lock;
+        struct net_device      *netdevs[MLX4_MAX_PORTS];
+        struct notifier_block   nb;
+        union ib_gid            gid_table[MLX4_MAX_PORTS][128];
 };
 
 struct mlx4_ib_dev {
@@ -176,6 +192,7 @@ struct mlx4_ib_dev {
 
         struct mutex            cap_mask_mutex;
         bool                    ib_active;
+        struct mlx4_ib_iboe     iboe;
 };
 
 static inline struct mlx4_ib_dev *to_mdev(struct ib_device *ibdev)
@@ -314,9 +331,20 @@ int mlx4_ib_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list, int npages,
 int mlx4_ib_unmap_fmr(struct list_head *fmr_list);
 int mlx4_ib_fmr_dealloc(struct ib_fmr *fmr);
 
+int mlx4_ib_resolve_grh(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah_attr,
+                        u8 *mac, int *is_mcast, u8 port);
+
 static inline int mlx4_ib_ah_grh_present(struct mlx4_ib_ah *ah)
 {
-        return !!(ah->av.g_slid & 0x80);
+        u8 port = be32_to_cpu(ah->av.ib.port_pd) >> 24 & 3;
+
+        if (rdma_port_get_link_layer(ah->ibah.device, port) == IB_LINK_LAYER_ETHERNET)
+                return 1;
+
+        return !!(ah->av.ib.g_slid & 0x80);
 }
 
+int mlx4_ib_add_mc(struct mlx4_ib_dev *mdev, struct mlx4_ib_qp *mqp,
+                   union ib_gid *gid);
+
 #endif /* MLX4_IB_H */
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 1d27b9a8e2d6..dca55b19a6f1 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -226,7 +226,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         struct mlx4_ib_fast_reg_page_list *mfrpl;
         int size = page_list_len * sizeof (u64);
 
-        if (size > PAGE_SIZE)
+        if (page_list_len > MLX4_MAX_FAST_REG_PAGES)
                 return ERR_PTR(-EINVAL);
 
         mfrpl = kmalloc(sizeof *mfrpl, GFP_KERNEL);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 6a60827b2301..2001f20a4361 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -33,9 +33,11 @@
 
 #include <linux/log2.h>
 #include <linux/slab.h>
+#include <linux/netdevice.h>
 
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
+#include <rdma/ib_addr.h>
 
 #include <linux/mlx4/qp.h>
 
@@ -48,17 +50,26 @@ enum {
 
 enum {
         MLX4_IB_DEFAULT_SCHED_QUEUE     = 0x83,
-        MLX4_IB_DEFAULT_QP0_SCHED_QUEUE = 0x3f
+        MLX4_IB_DEFAULT_QP0_SCHED_QUEUE = 0x3f,
+        MLX4_IB_LINK_TYPE_IB            = 0,
+        MLX4_IB_LINK_TYPE_ETH           = 1
 };
 
 enum {
         /*
-         * Largest possible UD header: send with GRH and immediate data.
+         * Largest possible UD header: send with GRH and immediate
+         * data plus 18 bytes for an Ethernet header with VLAN/802.1Q
+         * tag.  (LRH would only use 8 bytes, so Ethernet is the
+         * biggest case)
          */
-        MLX4_IB_UD_HEADER_SIZE          = 72,
+        MLX4_IB_UD_HEADER_SIZE          = 82,
         MLX4_IB_LSO_HEADER_SPARE        = 128,
 };
 
+enum {
+        MLX4_IB_IBOE_ETHERTYPE          = 0x8915
+};
+
 struct mlx4_ib_sqp {
         struct mlx4_ib_qp       qp;
         int                     pkey_index;
@@ -462,6 +473,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
         mutex_init(&qp->mutex);
         spin_lock_init(&qp->sq.lock);
         spin_lock_init(&qp->rq.lock);
+        INIT_LIST_HEAD(&qp->gid_list);
 
         qp->state        = IB_QPS_RESET;
         if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
@@ -649,6 +661,16 @@ static void mlx4_ib_unlock_cqs(struct mlx4_ib_cq *send_cq, struct mlx4_ib_cq *re
         }
 }
 
+static void del_gid_entries(struct mlx4_ib_qp *qp)
+{
+        struct mlx4_ib_gid_entry *ge, *tmp;
+
+        list_for_each_entry_safe(ge, tmp, &qp->gid_list, list) {
+                list_del(&ge->list);
+                kfree(ge);
+        }
+}
+
 static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
                               int is_user)
 {
@@ -695,6 +717,8 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
                 if (!qp->ibqp.srq)
                         mlx4_db_free(dev->dev, &qp->db);
         }
+
+        del_gid_entries(qp);
 }
 
 struct ib_qp *mlx4_ib_create_qp(struct ib_pd *pd,
@@ -852,6 +876,14 @@ static void mlx4_set_sched(struct mlx4_qp_path *path, u8 port)
 static int mlx4_set_path(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah,
                          struct mlx4_qp_path *path, u8 port)
 {
+        int err;
+        int is_eth = rdma_port_get_link_layer(&dev->ib_dev, port) ==
+                IB_LINK_LAYER_ETHERNET;
+        u8 mac[6];
+        int is_mcast;
+        u16 vlan_tag;
+        int vidx;
+
         path->grh_mylmc     = ah->src_path_bits & 0x7f;
         path->rlid          = cpu_to_be16(ah->dlid);
         if (ah->static_rate) {
@@ -879,12 +911,49 @@ static int mlx4_set_path(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah,
                 memcpy(path->rgid, ah->grh.dgid.raw, 16);
         }
 
-        path->sched_queue = MLX4_IB_DEFAULT_SCHED_QUEUE |
-                ((port - 1) << 6) | ((ah->sl & 0xf) << 2);
+        if (is_eth) {
+                path->sched_queue = MLX4_IB_DEFAULT_SCHED_QUEUE |
+                        ((port - 1) << 6) | ((ah->sl & 7) << 3) | ((ah->sl & 8) >> 1);
+
+                if (!(ah->ah_flags & IB_AH_GRH))
+                        return -1;
+
+                err = mlx4_ib_resolve_grh(dev, ah, mac, &is_mcast, port);
+                if (err)
+                        return err;
+
+                memcpy(path->dmac, mac, 6);
+                path->ackto = MLX4_IB_LINK_TYPE_ETH;
+                /* use index 0 into MAC table for IBoE */
+                path->grh_mylmc &= 0x80;
+
+                vlan_tag = rdma_get_vlan_id(&dev->iboe.gid_table[port - 1][ah->grh.sgid_index]);
+                if (vlan_tag < 0x1000) {
+                        if (mlx4_find_cached_vlan(dev->dev, port, vlan_tag, &vidx))
+                                return -ENOENT;
+
+                        path->vlan_index = vidx;
+                        path->fl = 1 << 6;
+                }
+        } else
+                path->sched_queue = MLX4_IB_DEFAULT_SCHED_QUEUE |
+                        ((port - 1) << 6) | ((ah->sl & 0xf) << 2);
 
         return 0;
 }
 
+static void update_mcg_macs(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp)
+{
+        struct mlx4_ib_gid_entry *ge, *tmp;
+
+        list_for_each_entry_safe(ge, tmp, &qp->gid_list, list) {
+                if (!ge->added && mlx4_ib_add_mc(dev, qp, &ge->gid)) {
+                        ge->added = 1;
+                        ge->port = qp->port;
+                }
+        }
+}
+
 static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                                const struct ib_qp_attr *attr, int attr_mask,
                                enum ib_qp_state cur_state, enum ib_qp_state new_state)
@@ -980,7 +1049,7 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
         }
 
         if (attr_mask & IB_QP_TIMEOUT) {
-                context->pri_path.ackto = attr->timeout << 3;
+                context->pri_path.ackto |= attr->timeout << 3;
                 optpar |= MLX4_QP_OPTPAR_ACK_TIMEOUT;
         }
 
@@ -1118,8 +1187,10 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                 qp->atomic_rd_en = attr->qp_access_flags;
         if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
                 qp->resp_depth = attr->max_dest_rd_atomic;
-        if (attr_mask & IB_QP_PORT)
+        if (attr_mask & IB_QP_PORT) {
                 qp->port = attr->port_num;
+                update_mcg_macs(dev, qp);
+        }
         if (attr_mask & IB_QP_ALT_PATH)
                 qp->alt_port = attr->alt_port_num;
 
@@ -1221,40 +1292,59 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
         struct mlx4_wqe_mlx_seg *mlx = wqe;
         struct mlx4_wqe_inline_seg *inl = wqe + sizeof *mlx;
         struct mlx4_ib_ah *ah = to_mah(wr->wr.ud.ah);
+        union ib_gid sgid;
         u16 pkey;
         int send_size;
         int header_size;
         int spc;
         int i;
+        int is_eth;
+        int is_vlan = 0;
+        int is_grh;
+        u16 vlan;
 
         send_size = 0;
         for (i = 0; i < wr->num_sge; ++i)
                 send_size += wr->sg_list[i].length;
 
-        ib_ud_header_init(send_size, mlx4_ib_ah_grh_present(ah), 0, &sqp->ud_header);
+        is_eth = rdma_port_get_link_layer(sqp->qp.ibqp.device, sqp->qp.port) == IB_LINK_LAYER_ETHERNET;
+        is_grh = mlx4_ib_ah_grh_present(ah);
+        if (is_eth) {
+                ib_get_cached_gid(ib_dev, be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                  ah->av.ib.gid_index, &sgid);
+                vlan = rdma_get_vlan_id(&sgid);
+                is_vlan = vlan < 0x1000;
+        }
+        ib_ud_header_init(send_size, !is_eth, is_eth, is_vlan, is_grh, 0, &sqp->ud_header);
+
+        if (!is_eth) {
+                sqp->ud_header.lrh.service_level =
+                        be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
+                sqp->ud_header.lrh.destination_lid = ah->av.ib.dlid;
+                sqp->ud_header.lrh.source_lid = cpu_to_be16(ah->av.ib.g_slid & 0x7f);
+        }
 
-        sqp->ud_header.lrh.service_level   =
-                be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 28;
-        sqp->ud_header.lrh.destination_lid = ah->av.dlid;
-        sqp->ud_header.lrh.source_lid      = cpu_to_be16(ah->av.g_slid & 0x7f);
-        if (mlx4_ib_ah_grh_present(ah)) {
+        if (is_grh) {
                 sqp->ud_header.grh.traffic_class =
-                        (be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 20) & 0xff;
+                        (be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 20) & 0xff;
                 sqp->ud_header.grh.flow_label    =
-                        ah->av.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
-                sqp->ud_header.grh.hop_limit     = ah->av.hop_limit;
-                ib_get_cached_gid(ib_dev, be32_to_cpu(ah->av.port_pd) >> 24,
-                                  ah->av.gid_index, &sqp->ud_header.grh.source_gid);
+                        ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+                sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
+                ib_get_cached_gid(ib_dev, be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                  ah->av.ib.gid_index, &sqp->ud_header.grh.source_gid);
                 memcpy(sqp->ud_header.grh.destination_gid.raw,
-                       ah->av.dgid, 16);
+                       ah->av.ib.dgid, 16);
         }
 
         mlx->flags &= cpu_to_be32(MLX4_WQE_CTRL_CQ_UPDATE);
-        mlx->flags |= cpu_to_be32((!sqp->qp.ibqp.qp_num ? MLX4_WQE_MLX_VL15 : 0) |
-                                  (sqp->ud_header.lrh.destination_lid ==
-                                   IB_LID_PERMISSIVE ? MLX4_WQE_MLX_SLR : 0) |
-                                  (sqp->ud_header.lrh.service_level << 8));
-        mlx->rlid   = sqp->ud_header.lrh.destination_lid;
+
+        if (!is_eth) {
+                mlx->flags |= cpu_to_be32((!sqp->qp.ibqp.qp_num ? MLX4_WQE_MLX_VL15 : 0) |
+                                          (sqp->ud_header.lrh.destination_lid ==
+                                           IB_LID_PERMISSIVE ? MLX4_WQE_MLX_SLR : 0) |
+                                          (sqp->ud_header.lrh.service_level << 8));
+                mlx->rlid = sqp->ud_header.lrh.destination_lid;
+        }
 
         switch (wr->opcode) {
         case IB_WR_SEND:
@@ -1270,9 +1360,29 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                 return -EINVAL;
         }
 
-        sqp->ud_header.lrh.virtual_lane    = !sqp->qp.ibqp.qp_num ? 15 : 0;
-        if (sqp->ud_header.lrh.destination_lid == IB_LID_PERMISSIVE)
-                sqp->ud_header.lrh.source_lid = IB_LID_PERMISSIVE;
+        if (is_eth) {
+                u8 *smac;
+
+                memcpy(sqp->ud_header.eth.dmac_h, ah->av.eth.mac, 6);
+                /* FIXME: cache smac value? */
+                smac = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1]->dev_addr;
+                memcpy(sqp->ud_header.eth.smac_h, smac, 6);
+                if (!memcmp(sqp->ud_header.eth.smac_h, sqp->ud_header.eth.dmac_h, 6))
+                        mlx->flags |= cpu_to_be32(MLX4_WQE_CTRL_FORCE_LOOPBACK);
+                if (!is_vlan) {
+                        sqp->ud_header.eth.type = cpu_to_be16(MLX4_IB_IBOE_ETHERTYPE);
+                } else {
+                        u16 pcp;
+
+                        sqp->ud_header.vlan.type = cpu_to_be16(MLX4_IB_IBOE_ETHERTYPE);
+                        pcp = (be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 27 & 3) << 13;
+                        sqp->ud_header.vlan.tag = cpu_to_be16(vlan | pcp);
+                }
+        } else {
+                sqp->ud_header.lrh.virtual_lane    = !sqp->qp.ibqp.qp_num ? 15 : 0;
+                if (sqp->ud_header.lrh.destination_lid == IB_LID_PERMISSIVE)
+                        sqp->ud_header.lrh.source_lid = IB_LID_PERMISSIVE;
+        }
         sqp->ud_header.bth.solicited_event = !!(wr->send_flags & IB_SEND_SOLICITED);
         if (!sqp->qp.ibqp.qp_num)
                 ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey);
@@ -1429,11 +1539,14 @@ static void set_masked_atomic_seg(struct mlx4_wqe_masked_atomic_seg *aseg,
 }
 
 static void set_datagram_seg(struct mlx4_wqe_datagram_seg *dseg,
-                             struct ib_send_wr *wr)
+                             struct ib_send_wr *wr, __be16 *vlan)
 {
         memcpy(dseg->av, &to_mah(wr->wr.ud.ah)->av, sizeof (struct mlx4_av));
         dseg->dqpn = cpu_to_be32(wr->wr.ud.remote_qpn);
         dseg->qkey = cpu_to_be32(wr->wr.ud.remote_qkey);
+        dseg->vlan = to_mah(wr->wr.ud.ah)->av.eth.vlan;
+        memcpy(dseg->mac, to_mah(wr->wr.ud.ah)->av.eth.mac, 6);
+        *vlan = dseg->vlan;
 }
 
 static void set_mlx_icrc_seg(void *dseg)
@@ -1536,6 +1649,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         __be32 uninitialized_var(lso_hdr_sz);
         __be32 blh;
         int i;
+        __be16 vlan = cpu_to_be16(0xffff);
 
         spin_lock_irqsave(&qp->sq.lock, flags);
 
@@ -1639,7 +1753,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         break;
 
                 case IB_QPT_UD:
-                        set_datagram_seg(wqe, wr);
+                        set_datagram_seg(wqe, wr, &vlan);
                         wqe  += sizeof (struct mlx4_wqe_datagram_seg);
                         size += sizeof (struct mlx4_wqe_datagram_seg) / 16;
 
@@ -1702,6 +1816,11 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 ctrl->fence_size = (wr->send_flags & IB_SEND_FENCE ?
                                     MLX4_WQE_CTRL_FENCE : 0) | size;
 
+                if (be16_to_cpu(vlan) < 0x1000) {
+                        ctrl->ins_vlan = 1 << 6;
+                        ctrl->vlan_tag = vlan;
+                }
+
                 /*
                  * Make sure descriptor is fully written before
                  * setting ownership bit (because HW can start
@@ -1866,17 +1985,27 @@ static int to_ib_qp_access_flags(int mlx4_flags)
         return ib_flags;
 }
 
-static void to_ib_ah_attr(struct mlx4_dev *dev, struct ib_ah_attr *ib_ah_attr,
+static void to_ib_ah_attr(struct mlx4_ib_dev *ibdev, struct ib_ah_attr *ib_ah_attr,
                                 struct mlx4_qp_path *path)
 {
+        struct mlx4_dev *dev = ibdev->dev;
+        int is_eth;
+
         memset(ib_ah_attr, 0, sizeof *ib_ah_attr);
         ib_ah_attr->port_num      = path->sched_queue & 0x40 ? 2 : 1;
 
         if (ib_ah_attr->port_num == 0 || ib_ah_attr->port_num > dev->caps.num_ports)
                 return;
 
+        is_eth = rdma_port_get_link_layer(&ibdev->ib_dev, ib_ah_attr->port_num) ==
+                IB_LINK_LAYER_ETHERNET;
+        if (is_eth)
+                ib_ah_attr->sl = ((path->sched_queue >> 3) & 0x7) |
+                ((path->sched_queue & 4) << 1);
+        else
+                ib_ah_attr->sl = (path->sched_queue >> 2) & 0xf;
+
         ib_ah_attr->dlid          = be16_to_cpu(path->rlid);
-        ib_ah_attr->sl            = (path->sched_queue >> 2) & 0xf;
         ib_ah_attr->src_path_bits = path->grh_mylmc & 0x7f;
         ib_ah_attr->static_rate   = path->static_rate ? path->static_rate - 5 : 0;
         ib_ah_attr->ah_flags      = (path->grh_mylmc & (1 << 7)) ? IB_AH_GRH : 0;
@@ -1929,8 +2058,8 @@ int mlx4_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr
                 to_ib_qp_access_flags(be32_to_cpu(context.params2));
 
         if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC) {
-                to_ib_ah_attr(dev->dev, &qp_attr->ah_attr, &context.pri_path);
-                to_ib_ah_attr(dev->dev, &qp_attr->alt_ah_attr, &context.alt_path);
+                to_ib_ah_attr(dev, &qp_attr->ah_attr, &context.pri_path);
+                to_ib_ah_attr(dev, &qp_attr->alt_ah_attr, &context.alt_path);
                 qp_attr->alt_pkey_index = context.alt_path.pkey_index & 0x7f;
                 qp_attr->alt_port_num   = qp_attr->alt_ah_attr.port_num;
         }
diff --git a/drivers/infiniband/hw/mthca/Kconfig b/drivers/infiniband/hw/mthca/Kconfig
index 03efc074967e..da314c3fec23 100644
--- a/drivers/infiniband/hw/mthca/Kconfig
+++ b/drivers/infiniband/hw/mthca/Kconfig
@@ -7,7 +7,7 @@ config INFINIBAND_MTHCA
           ("Tavor") and the MT25208 PCI Express HCA ("Arbel").
 
 config INFINIBAND_MTHCA_DEBUG
-        bool "Verbose debugging output" if EMBEDDED
+        bool "Verbose debugging output" if EXPERT
         depends on INFINIBAND_MTHCA
         default y
         ---help---
diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c
index 0aa0110e4b6c..e4a08c2819e4 100644
--- a/drivers/infiniband/hw/mthca/mthca_catas.c
+++ b/drivers/infiniband/hw/mthca/mthca_catas.c
@@ -146,7 +146,7 @@ static void poll_catas(unsigned long dev_ptr)
 
 void mthca_start_catas_poll(struct mthca_dev *dev)
 {
-        unsigned long addr;
+        phys_addr_t addr;
 
         init_timer(&dev->catas_err.timer);
         dev->catas_err.map  = NULL;
@@ -158,7 +158,8 @@ void mthca_start_catas_poll(struct mthca_dev *dev)
         dev->catas_err.map = ioremap(addr, dev->catas_err.size * 4);
         if (!dev->catas_err.map) {
                 mthca_warn(dev, "couldn't map catastrophic error region "
-                           "at 0x%lx/0x%x\n", addr, dev->catas_err.size * 4);
+                           "at 0x%llx/0x%x\n", (unsigned long long) addr,
+                           dev->catas_err.size * 4);
                 return;
         }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index f4ceecd9684b..7bfa2a164955 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -713,7 +713,7 @@ int mthca_RUN_FW(struct mthca_dev *dev, u8 *status)
 
 static void mthca_setup_cmd_doorbells(struct mthca_dev *dev, u64 base)
 {
-        unsigned long addr;
+        phys_addr_t addr;
         u16 max_off = 0;
         int i;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 8e8c728aff88..76785c653c13 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -653,7 +653,7 @@ static int mthca_map_reg(struct mthca_dev *dev,
                          unsigned long offset, unsigned long size,
                          void __iomem **map)
 {
-        unsigned long base = pci_resource_start(dev->pdev, 0);
+        phys_addr_t base = pci_resource_start(dev->pdev, 0);
 
         *map = ioremap(base + offset, size);
         if (!*map)
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 5648659ff0b0..03a59534f59e 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -171,6 +171,8 @@ static void forward_trap(struct mthca_dev *dev,
         if (agent) {
                 send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
                                               IB_MGMT_MAD_DATA, GFP_ATOMIC);
+                if (IS_ERR(send_buf))
+                        return;
                 /*
                  * We rely here on the fact that MLX QPs don't use the
                  * address handle after the send is posted (this is
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 5eee6665919a..f24b79b805f2 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -790,7 +790,7 @@ static int mthca_setup_hca(struct mthca_dev *dev)
                 goto err_uar_table_free;
         }
 
-        dev->kar = ioremap(dev->driver_uar.pfn << PAGE_SHIFT, PAGE_SIZE);
+        dev->kar = ioremap((phys_addr_t) dev->driver_uar.pfn << PAGE_SHIFT, PAGE_SIZE);
         if (!dev->kar) {
                 mthca_err(dev, "Couldn't map kernel access region, "
                           "aborting.\n");
@@ -1043,6 +1043,9 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type)
                 }
         }
 
+        /* We can handle large RDMA requests, so allow larger segments. */
+        dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024);
+
         mdev = (struct mthca_dev *) ib_alloc_device(sizeof *mdev);
         if (!mdev) {
                 dev_err(&pdev->dev, "Device struct alloc failed, "
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 065b20899876..44045c8846db 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -853,7 +853,7 @@ void mthca_arbel_fmr_unmap(struct mthca_dev *dev, struct mthca_fmr *fmr)
 
 int mthca_init_mr_table(struct mthca_dev *dev)
 {
-        unsigned long addr;
+        phys_addr_t addr;
         int mpts, mtts, err, i;
 
         err = mthca_alloc_init(&dev->mr_table.mpt_alloc,
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d2d172e6289c..a34c9d38e822 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1493,7 +1493,7 @@ static int build_mlx_header(struct mthca_dev *dev, struct mthca_sqp *sqp,
         int err;
         u16 pkey;
 
-        ib_ud_header_init(256, /* assume a MAD */
+        ib_ud_header_init(256, /* assume a MAD */ 1, 0, 0,
                           mthca_ah_grh_present(to_mah(wr->wr.ud.ah)), 0,
                           &sqp->ud_header);
 
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 0c9f0aa5d4ea..2d668c69f6d9 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -144,6 +144,7 @@ static int nes_inetaddr_event(struct notifier_block *notifier,
         struct nes_device *nesdev;
         struct net_device *netdev;
         struct nes_vnic *nesvnic;
+        unsigned int is_bonded;
 
         nes_debug(NES_DBG_NETDEV, "nes_inetaddr_event: ip address %pI4, netmask %pI4.\n",
                   &ifa->ifa_address, &ifa->ifa_mask);
@@ -152,7 +153,9 @@ static int nes_inetaddr_event(struct notifier_block *notifier,
                                 nesdev, nesdev->netdev[0]->name);
                 netdev = nesdev->netdev[0];
                 nesvnic = netdev_priv(netdev);
-                if (netdev == event_netdev) {
+                is_bonded = netif_is_bond_slave(netdev) &&
+                            (netdev->master == event_netdev);
+                if ((netdev == event_netdev) || is_bonded) {
                         if (nesvnic->rdma_enabled == 0) {
                                 nes_debug(NES_DBG_NETDEV, "Returning without processing event for %s since"
                                                 " RDMA is not enabled.\n",
@@ -169,7 +172,10 @@ static int nes_inetaddr_event(struct notifier_block *notifier,
                                         nes_manage_arp_cache(netdev, netdev->dev_addr,
                                                         ntohl(nesvnic->local_ipaddr), NES_ARP_DELETE);
                                         nesvnic->local_ipaddr = 0;
-                                        return NOTIFY_OK;
+                                        if (is_bonded)
+                                                continue;
+                                        else
+                                                return NOTIFY_OK;
                                         break;
                                 case NETDEV_UP:
                                         nes_debug(NES_DBG_NETDEV, "event:UP\n");
@@ -178,15 +184,24 @@ static int nes_inetaddr_event(struct notifier_block *notifier,
                                                 nes_debug(NES_DBG_NETDEV, "Interface already has local_ipaddr\n");
                                                 return NOTIFY_OK;
                                         }
+                                        /* fall through */
+                                case NETDEV_CHANGEADDR:
                                         /* Add the address to the IP table */
-                                        nesvnic->local_ipaddr = ifa->ifa_address;
+                                        if (netdev->master)
+                                                nesvnic->local_ipaddr =
+                                                        ((struct in_device *)netdev->master->ip_ptr)->ifa_list->ifa_address;
+                                        else
+                                                nesvnic->local_ipaddr = ifa->ifa_address;
 
                                         nes_write_indexed(nesdev,
                                                         NES_IDX_DST_IP_ADDR+(0x10*PCI_FUNC(nesdev->pcidev->devfn)),
-                                                        ntohl(ifa->ifa_address));
+                                                        ntohl(nesvnic->local_ipaddr));
                                         nes_manage_arp_cache(netdev, netdev->dev_addr,
                                                         ntohl(nesvnic->local_ipaddr), NES_ARP_ADD);
-                                        return NOTIFY_OK;
+                                        if (is_bonded)
+                                                continue;
+                                        else
+                                                return NOTIFY_OK;
                                         break;
                                 default:
                                         break;
@@ -660,6 +675,8 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
         }
         nes_notifiers_registered++;
 
+        INIT_DELAYED_WORK(&nesdev->work, nes_recheck_link_status);
+
         /* Initialize network devices */
         if ((netdev = nes_netdev_init(nesdev, mmio_regs)) == NULL)
                 goto bail7;
@@ -677,7 +694,7 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
         nesdev->netdev_count++;
         nesdev->nesadapter->netdev_count++;
 
-        printk(KERN_ERR PFX "%s: NetEffect RNIC driver successfully loaded.\n",
+        printk(KERN_INFO PFX "%s: NetEffect RNIC driver successfully loaded.\n",
                         pci_name(pcidev));
         return 0;
 
@@ -742,6 +759,7 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
         struct nes_device *nesdev = pci_get_drvdata(pcidev);
         struct net_device *netdev;
         int netdev_index = 0;
+        unsigned long flags;
 
                 if (nesdev->netdev_count) {
                         netdev = nesdev->netdev[netdev_index];
@@ -768,6 +786,14 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
         free_irq(pcidev->irq, nesdev);
         tasklet_kill(&nesdev->dpc_tasklet);
 
+        spin_lock_irqsave(&nesdev->nesadapter->phy_lock, flags);
+        if (nesdev->link_recheck) {
+                spin_unlock_irqrestore(&nesdev->nesadapter->phy_lock, flags);
+                cancel_delayed_work_sync(&nesdev->work);
+        } else {
+                spin_unlock_irqrestore(&nesdev->nesadapter->phy_lock, flags);
+        }
+
         /* Deallocate the Adapter Structure */
         nes_destroy_adapter(nesdev->nesadapter);
 
@@ -1112,7 +1138,9 @@ static ssize_t nes_store_wqm_quanta(struct device_driver *ddp,
         u32 i = 0;
         struct nes_device *nesdev;
 
-        strict_strtoul(buf, 0, &wqm_quanta_value);
+        if (kstrtoul(buf, 0, &wqm_quanta_value) < 0)
+                return -EINVAL;
+
         list_for_each_entry(nesdev, &nes_dev_list, list) {
                 if (i == ee_flsh_adapter) {
                         nesdev->nesadapter->wqm_quanta = wqm_quanta_value;
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index b3d145e82b4c..6fe79876009e 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -268,6 +268,9 @@ struct nes_device {
         u8                     napi_isr_ran;
         u8                     disable_rx_flow_control;
         u8                     disable_tx_flow_control;
+
+        struct delayed_work    work;
+        u8                     link_recheck;
 };
 
 
@@ -507,6 +510,7 @@ void nes_nic_ce_handler(struct nes_device *, struct nes_hw_nic_cq *);
 void nes_iwarp_ce_handler(struct nes_device *, struct nes_hw_cq *);
 int nes_destroy_cqp(struct nes_device *);
 int nes_nic_cm_xmit(struct sk_buff *, struct net_device *);
+void nes_recheck_link_status(struct work_struct *work);
 
 /* nes_nic.c */
 struct net_device *nes_netdev_init(struct nes_device *, void __iomem *);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 61e0efd4ccfb..e74cdf9ef471 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1104,20 +1104,24 @@ static inline int mini_cm_accelerated(struct nes_cm_core *cm_core,
 static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpindex)
 {
         struct rtable *rt;
-        struct flowi fl;
         struct neighbour *neigh;
         int rc = arpindex;
+        struct net_device *netdev;
         struct nes_adapter *nesadapter = nesvnic->nesdev->nesadapter;
 
-        memset(&fl, 0, sizeof fl);
-        fl.nl_u.ip4_u.daddr = htonl(dst_ip);
-        if (ip_route_output_key(&init_net, &rt, &fl)) {
+        rt = ip_route_output(&init_net, htonl(dst_ip), 0, 0, 0);
+        if (IS_ERR(rt)) {
                 printk(KERN_ERR "%s: ip_route_output_key failed for 0x%08X\n",
                                 __func__, dst_ip);
                 return rc;
         }
 
-        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, nesvnic->netdev);
+        if (netif_is_bond_slave(nesvnic->netdev))
+                netdev = nesvnic->netdev->master;
+        else
+                netdev = nesvnic->netdev;
+
+        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, netdev);
         if (neigh) {
                 if (neigh->nud_state & NUD_VALID) {
                         nes_debug(NES_DBG_CM, "Neighbor MAC address for 0x%08X"
@@ -1393,7 +1397,7 @@ static void handle_fin_pkt(struct nes_cm_node *cm_node)
                 cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSING;
                 send_ack(cm_node, NULL);
-                /* Wait for ACK as this is simultanous close..
+                /* Wait for ACK as this is simultaneous close..
                 * After we receive ACK, do not send anything..
                 * Just rm the node.. Done.. */
                 break;
@@ -1424,7 +1428,6 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
 {
 
         int     reset = 0;      /* whether to send reset in case of err.. */
-        int     passive_state;
         atomic_inc(&cm_resets_recvd);
         nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
                         " refcnt=%d\n", cm_node, cm_node->state,
@@ -1439,7 +1442,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 active_open_err(cm_node, skb, reset);
                 break;
         case NES_CM_STATE_MPAREQ_RCVD:
-                passive_state = atomic_add_return(1, &cm_node->passive_state);
+                atomic_inc(&cm_node->passive_state);
                 dev_kfree_skb_any(skb);
                 break;
         case NES_CM_STATE_ESTABLISHED:
@@ -2560,7 +2563,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
         u16 last_ae;
         u8 original_hw_tcp_state;
         u8 original_ibqp_state;
-        enum iw_cm_event_status disconn_status = IW_CM_EVENT_STATUS_OK;
+        int disconn_status = 0;
         int issue_disconn = 0;
         int issue_close = 0;
         int issue_flush = 0;
@@ -2602,7 +2605,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
                         (last_ae == NES_AEQE_AEID_LLP_CONNECTION_RESET))) {
                 issue_disconn = 1;
                 if (last_ae == NES_AEQE_AEID_LLP_CONNECTION_RESET)
-                        disconn_status = IW_CM_EVENT_STATUS_RESET;
+                        disconn_status = -ECONNRESET;
         }
 
         if (((original_hw_tcp_state == NES_AEQE_TCP_STATE_CLOSED) ||
@@ -2663,7 +2666,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
                         cm_id->provider_data = nesqp;
                         /* Send up the close complete event */
                         cm_event.event = IW_CM_EVENT_CLOSE;
-                        cm_event.status = IW_CM_EVENT_STATUS_OK;
+                        cm_event.status = 0;
                         cm_event.provider_data = cm_id->provider_data;
                         cm_event.local_addr = cm_id->local_addr;
                         cm_event.remote_addr = cm_id->remote_addr;
@@ -2701,7 +2704,7 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         nesibdev = nesvnic->nesibdev;
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         if (nesqp->active_conn) {
 
@@ -2791,7 +2794,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         atomic_inc(&cm_accepts);
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         /* allocate the ietf frame and space for private data */
         nesqp->ietf_frame = pci_alloc_consistent(nesdev->pcidev,
@@ -2963,7 +2966,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         nes_add_ref(&nesqp->ibqp);
 
         cm_event.event = IW_CM_EVENT_ESTABLISHED;
-        cm_event.status = IW_CM_EVENT_STATUS_ACCEPTED;
+        cm_event.status = 0;
         cm_event.provider_data = (void *)nesqp;
         cm_event.local_addr = cm_id->local_addr;
         cm_event.remote_addr = cm_id->remote_addr;
@@ -3374,7 +3377,7 @@ static void cm_event_connected(struct nes_cm_event *event)
 
         /* notify OF layer we successfully created the requested connection */
         cm_event.event = IW_CM_EVENT_CONNECT_REPLY;
-        cm_event.status = IW_CM_EVENT_STATUS_ACCEPTED;
+        cm_event.status = 0;
         cm_event.provider_data = cm_id->provider_data;
         cm_event.local_addr.sin_family = AF_INET;
         cm_event.local_addr.sin_port = cm_id->local_addr.sin_port;
@@ -3481,7 +3484,7 @@ static void cm_event_reset(struct nes_cm_event *event)
         nesqp->cm_id = NULL;
         /* cm_id->provider_data = NULL; */
         cm_event.event = IW_CM_EVENT_DISCONNECT;
-        cm_event.status = IW_CM_EVENT_STATUS_RESET;
+        cm_event.status = -ECONNRESET;
         cm_event.provider_data = cm_id->provider_data;
         cm_event.local_addr = cm_id->local_addr;
         cm_event.remote_addr = cm_id->remote_addr;
@@ -3492,7 +3495,7 @@ static void cm_event_reset(struct nes_cm_event *event)
         ret = cm_id->event_handler(cm_id, &cm_event);
         atomic_inc(&cm_closes);
         cm_event.event = IW_CM_EVENT_CLOSE;
-        cm_event.status = IW_CM_EVENT_STATUS_OK;
+        cm_event.status = 0;
         cm_event.provider_data = cm_id->provider_data;
         cm_event.local_addr = cm_id->local_addr;
         cm_event.remote_addr = cm_id->remote_addr;
@@ -3531,7 +3534,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
                         cm_node, cm_id, jiffies);
 
         cm_event.event = IW_CM_EVENT_CONNECT_REQUEST;
-        cm_event.status = IW_CM_EVENT_STATUS_OK;
+        cm_event.status = 0;
         cm_event.provider_data = (void *)cm_node;
 
         cm_event.local_addr.sin_family = AF_INET;
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 1980a461c499..96fa9a4cafdf 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -80,7 +80,7 @@ static void nes_terminate_start_timer(struct nes_qp *nesqp);
 
 #ifdef CONFIG_INFINIBAND_NES_DEBUG
 static unsigned char *nes_iwarp_state_str[] = {
-        "Non-Existant",
+        "Non-Existent",
         "Idle",
         "RTS",
         "Closing",
@@ -91,7 +91,7 @@ static unsigned char *nes_iwarp_state_str[] = {
 };
 
 static unsigned char *nes_tcp_state_str[] = {
-        "Non-Existant",
+        "Non-Existent",
         "Closed",
         "Listen",
         "SYN Sent",
@@ -2608,6 +2608,15 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                                                 netif_start_queue(nesvnic->netdev);
                                         nesvnic->linkup = 1;
                                         netif_carrier_on(nesvnic->netdev);
+
+                                        spin_lock(&nesvnic->port_ibevent_lock);
+                                        if (nesvnic->of_device_registered) {
+                                                if (nesdev->iw_status == 0) {
+                                                        nesdev->iw_status = 1;
+                                                        nes_port_ibevent(nesvnic);
+                                                }
+                                        }
+                                        spin_unlock(&nesvnic->port_ibevent_lock);
                                 }
                         }
                 } else {
@@ -2633,9 +2642,25 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                                                 netif_stop_queue(nesvnic->netdev);
                                         nesvnic->linkup = 0;
                                         netif_carrier_off(nesvnic->netdev);
+
+                                        spin_lock(&nesvnic->port_ibevent_lock);
+                                        if (nesvnic->of_device_registered) {
+                                                if (nesdev->iw_status == 1) {
+                                                        nesdev->iw_status = 0;
+                                                        nes_port_ibevent(nesvnic);
+                                                }
+                                        }
+                                        spin_unlock(&nesvnic->port_ibevent_lock);
                                 }
                         }
                 }
+                if (nesadapter->phy_type[mac_index] == NES_PHY_TYPE_SFP_D) {
+                        if (nesdev->link_recheck)
+                                cancel_delayed_work(&nesdev->work);
+                        nesdev->link_recheck = 1;
+                        schedule_delayed_work(&nesdev->work,
+                                              NES_LINK_RECHECK_DELAY);
+                }
         }
 
         spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
@@ -2643,6 +2668,84 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
         nesadapter->mac_sw_state[mac_number] = NES_MAC_SW_IDLE;
 }
 
+void nes_recheck_link_status(struct work_struct *work)
+{
+        unsigned long flags;
+        struct nes_device *nesdev = container_of(work, struct nes_device, work.work);
+        struct nes_adapter *nesadapter = nesdev->nesadapter;
+        struct nes_vnic *nesvnic;
+        u32 mac_index = nesdev->mac_index;
+        u16 phy_data;
+        u16 temp_phy_data;
+
+        spin_lock_irqsave(&nesadapter->phy_lock, flags);
+
+        /* check link status */
+        nes_read_10G_phy_reg(nesdev, nesadapter->phy_index[mac_index], 1, 0x9003);
+        temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+
+        nes_read_10G_phy_reg(nesdev, nesadapter->phy_index[mac_index], 3, 0x0021);
+        nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+        nes_read_10G_phy_reg(nesdev, nesadapter->phy_index[mac_index], 3, 0x0021);
+        phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+
+        phy_data = (!temp_phy_data && (phy_data == 0x8000)) ? 0x4 : 0x0;
+
+        nes_debug(NES_DBG_PHY, "%s: Phy data = 0x%04X, link was %s.\n",
+                __func__, phy_data,
+                nesadapter->mac_link_down[mac_index] ? "DOWN" : "UP");
+
+        if (phy_data & 0x0004) {
+                nesadapter->mac_link_down[mac_index] = 0;
+                list_for_each_entry(nesvnic, &nesadapter->nesvnic_list[mac_index], list) {
+                        if (nesvnic->linkup == 0) {
+                                printk(PFX "The Link is now up for port %s, netdev %p.\n",
+                                                nesvnic->netdev->name, nesvnic->netdev);
+                                if (netif_queue_stopped(nesvnic->netdev))
+                                        netif_start_queue(nesvnic->netdev);
+                                nesvnic->linkup = 1;
+                                netif_carrier_on(nesvnic->netdev);
+
+                                spin_lock(&nesvnic->port_ibevent_lock);
+                                if (nesvnic->of_device_registered) {
+                                        if (nesdev->iw_status == 0) {
+                                                nesdev->iw_status = 1;
+                                                nes_port_ibevent(nesvnic);
+                                        }
+                                }
+                                spin_unlock(&nesvnic->port_ibevent_lock);
+                        }
+                }
+
+        } else {
+                nesadapter->mac_link_down[mac_index] = 1;
+                list_for_each_entry(nesvnic, &nesadapter->nesvnic_list[mac_index], list) {
+                        if (nesvnic->linkup == 1) {
+                                printk(PFX "The Link is now down for port %s, netdev %p.\n",
+                                                nesvnic->netdev->name, nesvnic->netdev);
+                                if (!(netif_queue_stopped(nesvnic->netdev)))
+                                        netif_stop_queue(nesvnic->netdev);
+                                nesvnic->linkup = 0;
+                                netif_carrier_off(nesvnic->netdev);
+
+                                spin_lock(&nesvnic->port_ibevent_lock);
+                                if (nesvnic->of_device_registered) {
+                                        if (nesdev->iw_status == 1) {
+                                                nesdev->iw_status = 0;
+                                                nes_port_ibevent(nesvnic);
+                                        }
+                                }
+                                spin_unlock(&nesvnic->port_ibevent_lock);
+                        }
+                }
+        }
+        if (nesdev->link_recheck++ < NES_LINK_RECHECK_MAX)
+                schedule_delayed_work(&nesdev->work, NES_LINK_RECHECK_DELAY);
+        else
+                nesdev->link_recheck = 0;
+
+        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
+}
 
 
 static void nes_nic_napi_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *cq)
@@ -2782,9 +2885,8 @@ void nes_nic_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *cq)
                                         if ((cqe_errv &
                                                         (NES_NIC_ERRV_BITS_IPV4_CSUM_ERR | NES_NIC_ERRV_BITS_TCPUDP_CSUM_ERR |
                                                         NES_NIC_ERRV_BITS_IPH_ERR | NES_NIC_ERRV_BITS_WQE_OVERRUN)) == 0) {
-                                                if (nesvnic->rx_checksum_disabled == 0) {
+                                                if (nesvnic->netdev->features & NETIF_F_RXCSUM)
                                                         rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
-                                                }
                                         } else
                                                 nes_debug(NES_DBG_CQ, "%s: unsuccessfully checksummed TCP or UDP packet."
                                                                 " errv = 0x%X, pkt_type = 0x%X.\n",
@@ -2794,7 +2896,7 @@ void nes_nic_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *cq)
                                         if ((cqe_errv &
                                                         (NES_NIC_ERRV_BITS_IPV4_CSUM_ERR | NES_NIC_ERRV_BITS_IPH_ERR |
                                                         NES_NIC_ERRV_BITS_WQE_OVERRUN)) == 0) {
-                                                if (nesvnic->rx_checksum_disabled == 0) {
+                                                if (nesvnic->netdev->features & NETIF_F_RXCSUM) {
                                                         rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
                                                         /* nes_debug(NES_DBG_CQ, "%s: Reporting successfully checksummed IPv4 packet.\n",
                                                                   nesvnic->netdev->name); */
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index 1204c3432b63..91594116f947 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -1193,6 +1193,8 @@ struct nes_listener {
 
 struct nes_ib_device;
 
+#define NES_EVENT_DELAY msecs_to_jiffies(100)
+
 struct nes_vnic {
         struct nes_ib_device *nesibdev;
         u64 sq_full;
@@ -1243,10 +1245,13 @@ struct nes_vnic {
         u8  next_qp_nic_index;
         u8  of_device_registered;
         u8  rdma_enabled;
-        u8  rx_checksum_disabled;
         u32 lro_max_aggr;
         struct net_lro_mgr lro_mgr;
         struct net_lro_desc lro_desc[NES_MAX_LRO_DESCRIPTORS];
+        struct timer_list event_timer;
+        enum ib_event_type delayed_event;
+        enum ib_event_type last_dispatched_event;
+        spinlock_t port_ibevent_lock;
 };
 
 struct nes_ib_device {
@@ -1348,6 +1353,10 @@ struct nes_terminate_hdr {
 #define BAD_FRAME_OFFSET        64
 #define CQE_MAJOR_DRV           0x8000
 
+/* Used for link status recheck after interrupt processing */
+#define NES_LINK_RECHECK_DELAY  msecs_to_jiffies(50)
+#define NES_LINK_RECHECK_MAX    60
+
 #define nes_vlan_rx vlan_hwaccel_receive_skb
 #define nes_netif_rx netif_receive_skb
 
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 10560c796fd6..d3a1c41cfd27 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -144,6 +144,7 @@ static int nes_netdev_open(struct net_device *netdev)
         u32 nic_active_bit;
         u32 nic_active;
         struct list_head *list_pos, *list_temp;
+        unsigned long flags;
 
         assert(nesdev != NULL);
 
@@ -233,18 +234,36 @@ static int nes_netdev_open(struct net_device *netdev)
                 first_nesvnic = nesvnic;
         }
 
-        if (nesvnic->of_device_registered) {
-                nesdev->iw_status = 1;
-                nesdev->nesadapter->send_term_ok = 1;
-                nes_port_ibevent(nesvnic);
-        }
-
         if (first_nesvnic->linkup) {
                 /* Enable network packets */
                 nesvnic->linkup = 1;
                 netif_start_queue(netdev);
                 netif_carrier_on(netdev);
         }
+
+        spin_lock_irqsave(&nesdev->nesadapter->phy_lock, flags);
+        if (nesdev->nesadapter->phy_type[nesdev->mac_index] == NES_PHY_TYPE_SFP_D) {
+                if (nesdev->link_recheck)
+                        cancel_delayed_work(&nesdev->work);
+                nesdev->link_recheck = 1;
+                schedule_delayed_work(&nesdev->work, NES_LINK_RECHECK_DELAY);
+        }
+        spin_unlock_irqrestore(&nesdev->nesadapter->phy_lock, flags);
+
+        spin_lock_irqsave(&nesvnic->port_ibevent_lock, flags);
+        if (nesvnic->of_device_registered) {
+                nesdev->nesadapter->send_term_ok = 1;
+                if (nesvnic->linkup == 1) {
+                        if (nesdev->iw_status == 0) {
+                                nesdev->iw_status = 1;
+                                nes_port_ibevent(nesvnic);
+                        }
+                } else {
+                        nesdev->iw_status = 0;
+                }
+        }
+        spin_unlock_irqrestore(&nesvnic->port_ibevent_lock, flags);
+
         napi_enable(&nesvnic->napi);
         nesvnic->netdev_open = 1;
 
@@ -263,6 +282,7 @@ static int nes_netdev_stop(struct net_device *netdev)
         u32 nic_active;
         struct nes_vnic *first_nesvnic = NULL;
         struct list_head *list_pos, *list_temp;
+        unsigned long flags;
 
         nes_debug(NES_DBG_SHUTDOWN, "nesvnic=%p, nesdev=%p, netdev=%p %s\n",
                         nesvnic, nesdev, netdev, netdev->name);
@@ -271,6 +291,7 @@ static int nes_netdev_stop(struct net_device *netdev)
 
         if (netif_msg_ifdown(nesvnic))
                 printk(KERN_INFO PFX "%s: disabling interface\n", netdev->name);
+        netif_carrier_off(netdev);
 
         /* Disable network packets */
         napi_disable(&nesvnic->napi);
@@ -314,12 +335,17 @@ static int nes_netdev_stop(struct net_device *netdev)
         nic_active &= nic_active_mask;
         nes_write_indexed(nesdev, NES_IDX_NIC_BROADCAST_ON, nic_active);
 
-
+        spin_lock_irqsave(&nesvnic->port_ibevent_lock, flags);
         if (nesvnic->of_device_registered) {
                 nesdev->nesadapter->send_term_ok = 0;
                 nesdev->iw_status = 0;
-                nes_port_ibevent(nesvnic);
+                if (nesvnic->linkup == 1)
+                        nes_port_ibevent(nesvnic);
         }
+        del_timer_sync(&nesvnic->event_timer);
+        nesvnic->event_timer.function = NULL;
+        spin_unlock_irqrestore(&nesvnic->port_ibevent_lock, flags);
+
         nes_destroy_nic_qp(nesvnic);
 
         nesvnic->netdev_open = 0;
@@ -876,7 +902,7 @@ static void nes_netdev_set_multicast_list(struct net_device *netdev)
                 nes_write_indexed(nesdev, NES_IDX_NIC_UNICAST_ALL, nic_active);
         }
 
-        nes_debug(NES_DBG_NIC_RX, "Number of MC entries = %d, Promiscous = %d, All Multicast = %d.\n",
+        nes_debug(NES_DBG_NIC_RX, "Number of MC entries = %d, Promiscuous = %d, All Multicast = %d.\n",
                   mc_count, !!(netdev->flags & IFF_PROMISC),
                   !!(netdev->flags & IFF_ALLMULTI));
         if (!mc_all_on) {
@@ -907,8 +933,8 @@ static void nes_netdev_set_multicast_list(struct net_device *netdev)
                                         nesvnic->nic_index &&
                                         mc_index < max_pft_entries_avaiable) {
                                                 nes_debug(NES_DBG_NIC_RX,
-                                        "mc_index=%d skipping nic_index=%d,\
-                                        used for=%d \n", mc_index,
+                                        "mc_index=%d skipping nic_index=%d, "
+                                        "used for=%d \n", mc_index,
                                         nesvnic->nic_index,
                                         nesadapter->pft_mcast_map[mc_index]);
                                 mc_index++;
@@ -1067,34 +1093,6 @@ static const char nes_ethtool_stringset[][ETH_GSTRING_LEN] = {
 };
 #define NES_ETHTOOL_STAT_COUNT  ARRAY_SIZE(nes_ethtool_stringset)
 
-/**
- * nes_netdev_get_rx_csum
- */
-static u32 nes_netdev_get_rx_csum (struct net_device *netdev)
-{
-        struct nes_vnic *nesvnic = netdev_priv(netdev);
-
-        if (nesvnic->rx_checksum_disabled)
-                return 0;
-        else
-                return 1;
-}
-
-
-/**
- * nes_netdev_set_rc_csum
- */
-static int nes_netdev_set_rx_csum(struct net_device *netdev, u32 enable)
-{
-        struct nes_vnic *nesvnic = netdev_priv(netdev);
-
-        if (enable)
-                nesvnic->rx_checksum_disabled = 0;
-        else
-                nesvnic->rx_checksum_disabled = 1;
-        return 0;
-}
-
 
 /**
  * nes_netdev_get_sset_count
@@ -1495,7 +1493,7 @@ static int nes_netdev_get_settings(struct net_device *netdev, struct ethtool_cmd
         et_cmd->maxrxpkt = 511;
 
         if (nesadapter->OneG_Mode) {
-                et_cmd->speed = SPEED_1000;
+                ethtool_cmd_speed_set(et_cmd, SPEED_1000);
                 if (phy_type == NES_PHY_TYPE_PUMA_1G) {
                         et_cmd->supported   = SUPPORTED_1000baseT_Full;
                         et_cmd->advertising = ADVERTISED_1000baseT_Full;
@@ -1534,7 +1532,7 @@ static int nes_netdev_get_settings(struct net_device *netdev, struct ethtool_cmd
                 et_cmd->advertising = ADVERTISED_10000baseT_Full;
                 et_cmd->phy_address = mac_index;
         }
-        et_cmd->speed = SPEED_10000;
+        ethtool_cmd_speed_set(et_cmd, SPEED_10000);
         et_cmd->autoneg = AUTONEG_DISABLE;
         return 0;
 }
@@ -1572,19 +1570,10 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
 }
 
 
-static int nes_netdev_set_flags(struct net_device *netdev, u32 flags)
-{
-        return ethtool_op_set_flags(netdev, flags, ETH_FLAG_LRO);
-}
-
-
 static const struct ethtool_ops nes_ethtool_ops = {
         .get_link = ethtool_op_get_link,
         .get_settings = nes_netdev_get_settings,
         .set_settings = nes_netdev_set_settings,
-        .get_tx_csum = ethtool_op_get_tx_csum,
-        .get_rx_csum = nes_netdev_get_rx_csum,
-        .get_sg = ethtool_op_get_sg,
         .get_strings = nes_netdev_get_strings,
         .get_sset_count = nes_netdev_get_sset_count,
         .get_ethtool_stats = nes_netdev_get_ethtool_stats,
@@ -1593,13 +1582,6 @@ static const struct ethtool_ops nes_ethtool_ops = {
         .set_coalesce = nes_netdev_set_coalesce,
         .get_pauseparam = nes_netdev_get_pauseparam,
         .set_pauseparam = nes_netdev_set_pauseparam,
-        .set_tx_csum = ethtool_op_set_tx_csum,
-        .set_rx_csum = nes_netdev_set_rx_csum,
-        .set_sg = ethtool_op_set_sg,
-        .get_tso = ethtool_op_get_tso,
-        .set_tso = ethtool_op_set_tso,
-        .get_flags = ethtool_op_get_flags,
-        .set_flags = nes_netdev_set_flags,
 };
 
 
@@ -1701,12 +1683,11 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
         netdev->dev_addr[5] = (u8)u64temp;
         memcpy(netdev->perm_addr, netdev->dev_addr, 6);
 
-        if ((nesvnic->logical_port < 2) || (nesdev->nesadapter->hw_rev != NE020_REV)) {
-                netdev->features |= NETIF_F_TSO | NETIF_F_SG | NETIF_F_IP_CSUM;
-                netdev->features |= NETIF_F_GSO | NETIF_F_TSO | NETIF_F_SG | NETIF_F_IP_CSUM;
-        } else {
-                netdev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
-        }
+        netdev->hw_features = NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_IP_CSUM;
+        if ((nesvnic->logical_port < 2) || (nesdev->nesadapter->hw_rev != NE020_REV))
+                netdev->hw_features |= NETIF_F_TSO;
+        netdev->features |= netdev->hw_features;
+        netdev->hw_features |= NETIF_F_LRO;
 
         nes_debug(NES_DBG_INIT, "nesvnic = %p, reported features = 0x%lX, QPid = %d,"
                         " nic_index = %d, logical_port = %d, mac_index = %d.\n",
@@ -1749,7 +1730,10 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
                 nesvnic->rdma_enabled = 0;
         }
         nesvnic->nic_cq.cq_number = nesvnic->nic.qp_id;
+        init_timer(&nesvnic->event_timer);
+        nesvnic->event_timer.function = NULL;
         spin_lock_init(&nesvnic->tx_lock);
+        spin_lock_init(&nesvnic->port_ibevent_lock);
         nesdev->netdev[nesdev->netdev_count] = netdev;
 
         nes_debug(NES_DBG_INIT, "Adding nesvnic (%p) to the adapters nesvnic_list for MAC%d.\n",
@@ -1762,8 +1746,11 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
               (((PCI_FUNC(nesdev->pcidev->devfn) == 1) && (nesdev->mac_index == 2)) ||
                ((PCI_FUNC(nesdev->pcidev->devfn) == 2) && (nesdev->mac_index == 1)))))) {
                 u32 u32temp;
-                u32 link_mask;
-                u32 link_val;
+                u32 link_mask = 0;
+                u32 link_val = 0;
+                u16 temp_phy_data;
+                u16 phy_data = 0;
+                unsigned long flags;
 
                 u32temp = nes_read_indexed(nesdev, NES_IDX_PHY_PCS_CONTROL_STATUS0 +
                                 (0x200 * (nesdev->mac_index & 1)));
@@ -1785,6 +1772,23 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
                                 link_val = 0x02020000;
                         }
                         break;
+                case NES_PHY_TYPE_SFP_D:
+                        spin_lock_irqsave(&nesdev->nesadapter->phy_lock, flags);
+                        nes_read_10G_phy_reg(nesdev,
+                                             nesdev->nesadapter->phy_index[nesdev->mac_index],
+                                             1, 0x9003);
+                        temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+                        nes_read_10G_phy_reg(nesdev,
+                                             nesdev->nesadapter->phy_index[nesdev->mac_index],
+                                             3, 0x0021);
+                        nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+                        nes_read_10G_phy_reg(nesdev,
+                                             nesdev->nesadapter->phy_index[nesdev->mac_index],
+                                             3, 0x0021);
+                        phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+                        spin_unlock_irqrestore(&nesdev->nesadapter->phy_lock, flags);
+                        phy_data = (!temp_phy_data && (phy_data == 0x8000)) ? 0x4 : 0x0;
+                        break;
                 default:
                         link_mask = 0x0f1f0000;
                         link_val = 0x0f0f0000;
@@ -1794,8 +1798,14 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
                 u32temp = nes_read_indexed(nesdev,
                                            NES_IDX_PHY_PCS_CONTROL_STATUS0 +
                                            (0x200 * (nesdev->mac_index & 1)));
-                if ((u32temp & link_mask) == link_val)
-                        nesvnic->linkup = 1;
+
+                if (phy_type == NES_PHY_TYPE_SFP_D) {
+                        if (phy_data & 0x0004)
+                                nesvnic->linkup = 1;
+                } else {
+                        if ((u32temp & link_mask) == link_val)
+                                nesvnic->linkup = 1;
+                }
 
                 /* clear the MAC interrupt status, assumes direct logical to physical mapping */
                 u32temp = nes_read_indexed(nesdev, NES_IDX_MAC_INT_STATUS + (0x200 * nesdev->mac_index));
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 9046e6675686..95ca93ceedac 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -476,9 +476,9 @@ static struct ib_fast_reg_page_list *nes_alloc_fast_reg_page_list(
         }
         nes_debug(NES_DBG_MR, "nes_alloc_fast_reg_pbl: nes_frpl = %p, "
                   "ibfrpl = %p, ibfrpl.page_list = %p, pbl.kva = %p, "
-                  "pbl.paddr= %p\n", pnesfrpl, &pnesfrpl->ibfrpl,
+                  "pbl.paddr = %llx\n", pnesfrpl, &pnesfrpl->ibfrpl,
                   pnesfrpl->ibfrpl.page_list, pnesfrpl->nes_wqe_pbl.kva,
-                  (void *)pnesfrpl->nes_wqe_pbl.paddr);
+                  (unsigned long long) pnesfrpl->nes_wqe_pbl.paddr);
 
         return pifrpl;
 }
@@ -584,7 +584,9 @@ static int nes_query_port(struct ib_device *ibdev, u8 port, struct ib_port_attr
         props->lmc = 0;
         props->sm_lid = 0;
         props->sm_sl = 0;
-        if (nesvnic->linkup)
+        if (netif_queue_stopped(netdev))
+                props->state = IB_PORT_DOWN;
+        else if (nesvnic->linkup)
                 props->state = IB_PORT_ACTIVE;
         else
                 props->state = IB_PORT_DOWN;
@@ -785,7 +787,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
 
         nes_debug(NES_DBG_PD, "nesvnic=%p, netdev=%p %s, ibdev=%p, context=%p, netdev refcnt=%u\n",
                         nesvnic, nesdev->netdev[0], nesdev->netdev[0]->name, ibdev, context,
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         err = nes_alloc_resource(nesadapter, nesadapter->allocated_pds,
                         nesadapter->max_pd, &pd_num, &nesadapter->next_pd);
@@ -1416,7 +1418,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
         /* update the QP table */
         nesdev->nesadapter->qp_table[nesqp->hwqp.qp_id-NES_FIRST_QPN] = nesqp;
         nes_debug(NES_DBG_QP, "netdev refcnt=%u\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         return &nesqp->ibqp;
 }
@@ -1482,7 +1484,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
                         (nesqp->ibqp_state == IB_QPS_RTR)) && (nesqp->cm_id)) {
                 cm_id = nesqp->cm_id;
                 cm_event.event = IW_CM_EVENT_CONNECT_REPLY;
-                cm_event.status = IW_CM_EVENT_STATUS_TIMEOUT;
+                cm_event.status = -ETIMEDOUT;
                 cm_event.local_addr = cm_id->local_addr;
                 cm_event.remote_addr = cm_id->remote_addr;
                 cm_event.private_data = NULL;
@@ -3483,13 +3485,13 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                         for (i = 0; i < ib_wr->wr.fast_reg.page_list_len; i++)
                                 dst_page_list[i] = cpu_to_le64(src_page_list[i]);
 
-                        nes_debug(NES_DBG_IW_TX, "SQ_FMR: iova_start: %p, "
-                                  "length: %d, rkey: %0x, pgl_paddr: %p, "
+                        nes_debug(NES_DBG_IW_TX, "SQ_FMR: iova_start: %llx, "
+                                  "length: %d, rkey: %0x, pgl_paddr: %llx, "
                                   "page_list_len: %u, wqe_misc: %x\n",
-                                  (void *)ib_wr->wr.fast_reg.iova_start,
+                                  (unsigned long long) ib_wr->wr.fast_reg.iova_start,
                                   ib_wr->wr.fast_reg.length,
                                   ib_wr->wr.fast_reg.rkey,
-                                  (void *)pnesfrpl->nes_wqe_pbl.paddr,
+                                  (unsigned long long) pnesfrpl->nes_wqe_pbl.paddr,
                                   ib_wr->wr.fast_reg.page_list_len,
                                   wqe_misc);
                         break;
@@ -3934,6 +3936,30 @@ struct nes_ib_device *nes_init_ofa_device(struct net_device *netdev)
         return nesibdev;
 }
 
+
+/**
+ * nes_handle_delayed_event
+ */
+static void nes_handle_delayed_event(unsigned long data)
+{
+        struct nes_vnic *nesvnic = (void *) data;
+
+        if (nesvnic->delayed_event != nesvnic->last_dispatched_event) {
+                struct ib_event event;
+
+                event.device = &nesvnic->nesibdev->ibdev;
+                if (!event.device)
+                        goto stop_timer;
+                event.event = nesvnic->delayed_event;
+                event.element.port_num = nesvnic->logical_port + 1;
+                ib_dispatch_event(&event);
+        }
+
+stop_timer:
+        nesvnic->event_timer.function = NULL;
+}
+
+
 void  nes_port_ibevent(struct nes_vnic *nesvnic)
 {
         struct nes_ib_device *nesibdev = nesvnic->nesibdev;
@@ -3942,7 +3968,18 @@ void  nes_port_ibevent(struct nes_vnic *nesvnic)
         event.device = &nesibdev->ibdev;
         event.element.port_num = nesvnic->logical_port + 1;
         event.event = nesdev->iw_status ? IB_EVENT_PORT_ACTIVE : IB_EVENT_PORT_ERR;
-        ib_dispatch_event(&event);
+
+        if (!nesvnic->event_timer.function) {
+                ib_dispatch_event(&event);
+                nesvnic->last_dispatched_event = event.event;
+                nesvnic->event_timer.function = nes_handle_delayed_event;
+                nesvnic->event_timer.data = (unsigned long) nesvnic;
+                nesvnic->event_timer.expires = jiffies + NES_EVENT_DELAY;
+                add_timer(&nesvnic->event_timer);
+        } else {
+                mod_timer(&nesvnic->event_timer, jiffies + NES_EVENT_DELAY);
+        }
+        nesvnic->delayed_event = event.event;
 }
 
 
diff --git a/drivers/infiniband/hw/qib/Kconfig b/drivers/infiniband/hw/qib/Kconfig
index 7c03a70c55a2..8349f9c5064c 100644
--- a/drivers/infiniband/hw/qib/Kconfig
+++ b/drivers/infiniband/hw/qib/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_QIB
         tristate "QLogic PCIe HCA support"
-        depends on 64BIT && NET
+        depends on 64BIT
         ---help---
         This is a low-level driver for QLogic PCIe QLE InfiniBand host
         channel adapters.  This driver does not support the QLogic
diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
index 61de0654820e..769a1d9da4b7 100644
--- a/drivers/infiniband/hw/qib/qib.h
+++ b/drivers/infiniband/hw/qib/qib.h
@@ -653,7 +653,7 @@ struct diag_observer_list_elt;
 
 /* device data struct now contains only "general per-device" info.
  * fields related to a physical IB port are in a qib_pportdata struct,
- * described above) while fields only used by a particualr chip-type are in
+ * described above) while fields only used by a particular chip-type are in
  * a qib_chipdata struct, whose contents are opaque to this file.
  */
 struct qib_devdata {
@@ -766,7 +766,7 @@ struct qib_devdata {
         void (*f_sdma_hw_start_up)(struct qib_pportdata *);
         void (*f_sdma_init_early)(struct qib_pportdata *);
         void (*f_set_cntr_sample)(struct qib_pportdata *, u32, u32);
-        void (*f_update_usrhead)(struct qib_ctxtdata *, u64, u32, u32);
+        void (*f_update_usrhead)(struct qib_ctxtdata *, u64, u32, u32, u32);
         u32 (*f_hdrqempty)(struct qib_ctxtdata *);
         u64 (*f_portcntr)(struct qib_pportdata *, u32);
         u32 (*f_read_cntrs)(struct qib_devdata *, loff_t, char **,
@@ -1406,7 +1406,7 @@ extern struct mutex qib_mutex;
  */
 #define qib_early_err(dev, fmt, ...) \
         do { \
-                dev_info(dev, KERN_ERR QIB_DRV_NAME ": " fmt, ##__VA_ARGS__); \
+                dev_err(dev, fmt, ##__VA_ARGS__); \
         } while (0)
 
 #define qib_dev_err(dd, fmt, ...) \
diff --git a/drivers/infiniband/hw/qib/qib_cq.c b/drivers/infiniband/hw/qib/qib_cq.c
index a86cbf880f98..5246aa486bbe 100644
--- a/drivers/infiniband/hw/qib/qib_cq.c
+++ b/drivers/infiniband/hw/qib/qib_cq.c
@@ -100,7 +100,8 @@ void qib_cq_enter(struct qib_cq *cq, struct ib_wc *entry, int solicited)
         wc->head = next;
 
         if (cq->notify == IB_CQ_NEXT_COMP ||
-            (cq->notify == IB_CQ_SOLICITED && solicited)) {
+            (cq->notify == IB_CQ_SOLICITED &&
+             (solicited || entry->status != IB_WC_SUCCESS))) {
                 cq->notify = IB_CQ_NONE;
                 cq->triggered++;
                 /*
diff --git a/drivers/infiniband/hw/qib/qib_diag.c b/drivers/infiniband/hw/qib/qib_diag.c
index 05dcf0d9a7d3..204c4dd9dce0 100644
--- a/drivers/infiniband/hw/qib/qib_diag.c
+++ b/drivers/infiniband/hw/qib/qib_diag.c
@@ -136,7 +136,8 @@ static const struct file_operations diag_file_ops = {
         .write = qib_diag_write,
         .read = qib_diag_read,
         .open = qib_diag_open,
-        .release = qib_diag_release
+        .release = qib_diag_release,
+        .llseek = default_llseek,
 };
 
 static atomic_t diagpkt_count = ATOMIC_INIT(0);
@@ -149,6 +150,7 @@ static ssize_t qib_diagpkt_write(struct file *fp, const char __user *data,
 static const struct file_operations diagpkt_file_ops = {
         .owner = THIS_MODULE,
         .write = qib_diagpkt_write,
+        .llseek = noop_llseek,
 };
 
 int qib_diag_add(struct qib_devdata *dd)
diff --git a/drivers/infiniband/hw/qib/qib_driver.c b/drivers/infiniband/hw/qib/qib_driver.c
index 9cd193603fb1..23e584f4c36c 100644
--- a/drivers/infiniband/hw/qib/qib_driver.c
+++ b/drivers/infiniband/hw/qib/qib_driver.c
@@ -71,6 +71,11 @@ MODULE_DESCRIPTION("QLogic IB driver");
  */
 #define QIB_PIO_MAXIBHDR 128
 
+/*
+ * QIB_MAX_PKT_RCV is the max # if packets processed per receive interrupt.
+ */
+#define QIB_MAX_PKT_RECV 64
+
 struct qlogic_ib_stats qib_stats;
 
 const char *qib_get_unit_name(int unit)
@@ -284,14 +289,147 @@ static inline void *qib_get_egrbuf(const struct qib_ctxtdata *rcd, u32 etail)
  * Returns 1 if error was a CRC, else 0.
  * Needed for some chip's synthesized error counters.
  */
-static u32 qib_rcv_hdrerr(struct qib_pportdata *ppd, u32 ctxt,
-                          u32 eflags, u32 l, u32 etail, __le32 *rhf_addr,
-                          struct qib_message_header *hdr)
+static u32 qib_rcv_hdrerr(struct qib_ctxtdata *rcd, struct qib_pportdata *ppd,
+                          u32 ctxt, u32 eflags, u32 l, u32 etail,
+                          __le32 *rhf_addr, struct qib_message_header *rhdr)
 {
         u32 ret = 0;
 
         if (eflags & (QLOGIC_IB_RHF_H_ICRCERR | QLOGIC_IB_RHF_H_VCRCERR))
                 ret = 1;
+        else if (eflags == QLOGIC_IB_RHF_H_TIDERR) {
+                /* For TIDERR and RC QPs premptively schedule a NAK */
+                struct qib_ib_header *hdr = (struct qib_ib_header *) rhdr;
+                struct qib_other_headers *ohdr = NULL;
+                struct qib_ibport *ibp = &ppd->ibport_data;
+                struct qib_qp *qp = NULL;
+                u32 tlen = qib_hdrget_length_in_bytes(rhf_addr);
+                u16 lid  = be16_to_cpu(hdr->lrh[1]);
+                int lnh = be16_to_cpu(hdr->lrh[0]) & 3;
+                u32 qp_num;
+                u32 opcode;
+                u32 psn;
+                int diff;
+                unsigned long flags;
+
+                /* Sanity check packet */
+                if (tlen < 24)
+                        goto drop;
+
+                if (lid < QIB_MULTICAST_LID_BASE) {
+                        lid &= ~((1 << ppd->lmc) - 1);
+                        if (unlikely(lid != ppd->lid))
+                                goto drop;
+                }
+
+                /* Check for GRH */
+                if (lnh == QIB_LRH_BTH)
+                        ohdr = &hdr->u.oth;
+                else if (lnh == QIB_LRH_GRH) {
+                        u32 vtf;
+
+                        ohdr = &hdr->u.l.oth;
+                        if (hdr->u.l.grh.next_hdr != IB_GRH_NEXT_HDR)
+                                goto drop;
+                        vtf = be32_to_cpu(hdr->u.l.grh.version_tclass_flow);
+                        if ((vtf >> IB_GRH_VERSION_SHIFT) != IB_GRH_VERSION)
+                                goto drop;
+                } else
+                        goto drop;
+
+                /* Get opcode and PSN from packet */
+                opcode = be32_to_cpu(ohdr->bth[0]);
+                opcode >>= 24;
+                psn = be32_to_cpu(ohdr->bth[2]);
+
+                /* Get the destination QP number. */
+                qp_num = be32_to_cpu(ohdr->bth[1]) & QIB_QPN_MASK;
+                if (qp_num != QIB_MULTICAST_QPN) {
+                        int ruc_res;
+                        qp = qib_lookup_qpn(ibp, qp_num);
+                        if (!qp)
+                                goto drop;
+
+                        /*
+                         * Handle only RC QPs - for other QP types drop error
+                         * packet.
+                         */
+                        spin_lock(&qp->r_lock);
+
+                        /* Check for valid receive state. */
+                        if (!(ib_qib_state_ops[qp->state] &
+                              QIB_PROCESS_RECV_OK)) {
+                                ibp->n_pkt_drops++;
+                                goto unlock;
+                        }
+
+                        switch (qp->ibqp.qp_type) {
+                        case IB_QPT_RC:
+                                spin_lock_irqsave(&qp->s_lock, flags);
+                                ruc_res =
+                                        qib_ruc_check_hdr(
+                                                ibp, hdr,
+                                                lnh == QIB_LRH_GRH,
+                                                qp,
+                                                be32_to_cpu(ohdr->bth[0]));
+                                if (ruc_res) {
+                                        spin_unlock_irqrestore(&qp->s_lock,
+                                                               flags);
+                                        goto unlock;
+                                }
+                                spin_unlock_irqrestore(&qp->s_lock, flags);
+
+                                /* Only deal with RDMA Writes for now */
+                                if (opcode <
+                                    IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) {
+                                        diff = qib_cmp24(psn, qp->r_psn);
+                                        if (!qp->r_nak_state && diff >= 0) {
+                                                ibp->n_rc_seqnak++;
+                                                qp->r_nak_state =
+                                                        IB_NAK_PSN_ERROR;
+                                                /* Use the expected PSN. */
+                                                qp->r_ack_psn = qp->r_psn;
+                                                /*
+                                                 * Wait to send the sequence
+                                                 * NAK until all packets
+                                                 * in the receive queue have
+                                                 * been processed.
+                                                 * Otherwise, we end up
+                                                 * propagating congestion.
+                                                 */
+                                                if (list_empty(&qp->rspwait)) {
+                                                        qp->r_flags |=
+                                                                QIB_R_RSP_NAK;
+                                                        atomic_inc(
+                                                                &qp->refcount);
+                                                        list_add_tail(
+                                                         &qp->rspwait,
+                                                         &rcd->qp_wait_list);
+                                                }
+                                        } /* Out of sequence NAK */
+                                } /* QP Request NAKs */
+                                break;
+                        case IB_QPT_SMI:
+                        case IB_QPT_GSI:
+                        case IB_QPT_UD:
+                        case IB_QPT_UC:
+                        default:
+                                /* For now don't handle any other QP types */
+                                break;
+                        }
+
+unlock:
+                        spin_unlock(&qp->r_lock);
+                        /*
+                         * Notify qib_destroy_qp() if it is waiting
+                         * for us to finish.
+                         */
+                        if (atomic_dec_and_test(&qp->refcount))
+                                wake_up(&qp->wait);
+                } /* Unicast QP */
+        } /* Valid packet with TIDErr */
+
+drop:
         return ret;
 }
 
@@ -335,7 +473,7 @@ u32 qib_kreceive(struct qib_ctxtdata *rcd, u32 *llic, u32 *npkts)
                 smp_rmb();  /* prevent speculative reads of dma'ed hdrq */
         }
 
-        for (last = 0, i = 1; !last && i <= 64; i += !last) {
+        for (last = 0, i = 1; !last; i += !last) {
                 hdr = dd->f_get_msgheader(dd, rhf_addr);
                 eflags = qib_hdrget_err_flags(rhf_addr);
                 etype = qib_hdrget_rcv_type(rhf_addr);
@@ -371,7 +509,7 @@ u32 qib_kreceive(struct qib_ctxtdata *rcd, u32 *llic, u32 *npkts)
                  * packets; only qibhdrerr should be set.
                  */
                 if (unlikely(eflags))
-                        crcs += qib_rcv_hdrerr(ppd, rcd->ctxt, eflags, l,
+                        crcs += qib_rcv_hdrerr(rcd, ppd, rcd->ctxt, eflags, l,
                                                etail, rhf_addr, hdr);
                 else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
                         qib_ib_rcv(rcd, hdr, ebuf, tlen);
@@ -384,6 +522,9 @@ move_along:
                 l += rsize;
                 if (l >= maxcnt)
                         l = 0;
+                if (i == QIB_MAX_PKT_RECV)
+                        last = 1;
+
                 rhf_addr = (__le32 *) rcd->rcvhdrq + l + dd->rhf_offset;
                 if (dd->flags & QIB_NODMA_RTAIL) {
                         u32 seq = qib_hdrget_seq(rhf_addr);
@@ -402,7 +543,7 @@ move_along:
                  */
                 lval = l;
                 if (!last && !(i & 0xf)) {
-                        dd->f_update_usrhead(rcd, lval, updegr, etail);
+                        dd->f_update_usrhead(rcd, lval, updegr, etail, i);
                         updegr = 0;
                 }
         }
@@ -444,7 +585,7 @@ bail:
          * if no packets were processed.
          */
         lval = (u64)rcd->head | dd->rhdrhead_intr_off;
-        dd->f_update_usrhead(rcd, lval, updegr, etail);
+        dd->f_update_usrhead(rcd, lval, updegr, etail, i);
         return crcs;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 6b11645edf35..406fca50d036 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -63,7 +63,8 @@ static const struct file_operations qib_file_ops = {
         .open = qib_open,
         .release = qib_close,
         .poll = qib_poll,
-        .mmap = qib_mmapf
+        .mmap = qib_mmapf,
+        .llseek = noop_llseek,
 };
 
 /*
@@ -1378,17 +1379,17 @@ static int get_a_ctxt(struct file *fp, const struct qib_user_info *uinfo,
                 /* find device (with ACTIVE ports) with fewest ctxts in use */
                 for (ndev = 0; ndev < devmax; ndev++) {
                         struct qib_devdata *dd = qib_lookup(ndev);
-                        unsigned cused = 0, cfree = 0;
+                        unsigned cused = 0, cfree = 0, pusable = 0;
                         if (!dd)
                                 continue;
                         if (port && port <= dd->num_pports &&
                             usable(dd->pport + port - 1))
-                                dusable = 1;
+                                pusable = 1;
                         else
                                 for (i = 0; i < dd->num_pports; i++)
                                         if (usable(dd->pport + i))
-                                                dusable++;
-                        if (!dusable)
+                                                pusable++;
+                        if (!pusable)
                                 continue;
                         for (ctxt = dd->first_user_ctxt; ctxt < dd->cfgctxts;
                              ctxt++)
@@ -1396,7 +1397,7 @@ static int get_a_ctxt(struct file *fp, const struct qib_user_info *uinfo,
                                         cused++;
                                 else
                                         cfree++;
-                        if (cfree && cused < inuse) {
+                        if (pusable && cfree && cused < inuse) {
                                 udd = dd;
                                 inuse = cused;
                         }
@@ -1538,7 +1539,7 @@ done_chk_sdma:
 
                 /*
                  * If process has NOT already set it's affinity, select and
-                 * reserve a processor for it, as a rendevous for all
+                 * reserve a processor for it, as a rendezvous for all
                  * users of the driver.  If they don't actually later
                  * set affinity to this cpu, or set it to some other cpu,
                  * it just means that sooner or later we don't recommend
@@ -1656,7 +1657,7 @@ static int qib_do_user_init(struct file *fp,
          * 0 to 1.  So for those chips, we turn it off and then back on.
          * This will (very briefly) affect any other open ctxts, but the
          * duration is very short, and therefore isn't an issue.  We
-         * explictly set the in-memory tail copy to 0 beforehand, so we
+         * explicitly set the in-memory tail copy to 0 beforehand, so we
          * don't have to wait to be sure the DMA update has happened
          * (chip resets head/tail to 0 on transition to enable).
          */
@@ -1722,7 +1723,7 @@ static int qib_close(struct inode *in, struct file *fp)
 
         mutex_lock(&qib_mutex);
 
-        fd = (struct qib_filedata *) fp->private_data;
+        fd = fp->private_data;
         fp->private_data = NULL;
         rcd = fd->rcd;
         if (!rcd) {
@@ -1808,7 +1809,7 @@ static int qib_ctxt_info(struct file *fp, struct qib_ctxt_info __user *uinfo)
         struct qib_ctxtdata *rcd = ctxt_fp(fp);
         struct qib_filedata *fd;
 
-        fd = (struct qib_filedata *) fp->private_data;
+        fd = fp->private_data;
 
         info.num_active = qib_count_active_units();
         info.unit = rcd->dd->unit;
diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
index 9f989c0ba9d3..df7fa251dcdc 100644
--- a/drivers/infiniband/hw/qib/qib_fs.c
+++ b/drivers/infiniband/hw/qib/qib_fs.c
@@ -58,6 +58,7 @@ static int qibfs_mknod(struct inode *dir, struct dentry *dentry,
                 goto bail;
         }
 
+        inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_uid = 0;
         inode->i_gid = 0;
@@ -367,6 +368,7 @@ bail:
 static const struct file_operations flash_ops = {
         .read = flash_read,
         .write = flash_write,
+        .llseek = default_llseek,
 };
 
 static int add_cntr_files(struct super_block *sb, struct qib_devdata *dd)
@@ -451,17 +453,14 @@ static int remove_file(struct dentry *parent, char *name)
                 goto bail;
         }
 
-        spin_lock(&dcache_lock);
         spin_lock(&tmp->d_lock);
         if (!(d_unhashed(tmp) && tmp->d_inode)) {
-                dget_locked(tmp);
+                dget_dlock(tmp);
                 __d_drop(tmp);
                 spin_unlock(&tmp->d_lock);
-                spin_unlock(&dcache_lock);
                 simple_unlink(parent->d_inode, tmp);
         } else {
                 spin_unlock(&tmp->d_lock);
-                spin_unlock(&dcache_lock);
         }
 
         ret = 0;
@@ -553,13 +552,13 @@ bail:
         return ret;
 }
 
-static int qibfs_get_sb(struct file_system_type *fs_type, int flags,
-                        const char *dev_name, void *data, struct vfsmount *mnt)
+static struct dentry *qibfs_mount(struct file_system_type *fs_type, int flags,
+                        const char *dev_name, void *data)
 {
-        int ret = get_sb_single(fs_type, flags, data,
-                                qibfs_fill_super, mnt);
-        if (ret >= 0)
-                qib_super = mnt->mnt_sb;
+        struct dentry *ret;
+        ret = mount_single(fs_type, flags, data, qibfs_fill_super);
+        if (!IS_ERR(ret))
+                qib_super = ret->d_sb;
         return ret;
 }
 
@@ -601,7 +600,7 @@ int qibfs_remove(struct qib_devdata *dd)
 static struct file_system_type qibfs_fs_type = {
         .owner =        THIS_MODULE,
         .name =         "ipathfs",
-        .get_sb =       qibfs_get_sb,
+        .mount =        qibfs_mount,
         .kill_sb =      qibfs_kill_super,
 };
 
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index a5e29dbb9537..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isnt' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
@@ -2074,7 +2074,7 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
 }
 
 static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
-                                    u32 updegr, u32 egrhd)
+                                    u32 updegr, u32 egrhd, u32 npkts)
 {
         qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
         if (updegr)
@@ -2171,7 +2171,7 @@ static void rcvctrl_6120_mod(struct qib_pportdata *ppd, unsigned int op,
                  * Init the context registers also; if we were
                  * disabled, tail and head should both be zero
                  * already from the enable, but since we don't
-                 * know, we have to do it explictly.
+                 * know, we have to do it explicitly.
                  */
                 val = qib_read_ureg32(dd, ur_rcvegrindextail, ctxt);
                 qib_write_ureg(dd, ur_rcvegrindexhead, val, ctxt);
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 6fd8d74e7392..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -1692,8 +1692,7 @@ static void qib_7220_quiet_serdes(struct qib_pportdata *ppd)
         ppd->lflags &= ~QIBL_IB_AUTONEG_INPROG;
         spin_unlock_irqrestore(&ppd->lflags_lock, flags);
         wake_up(&ppd->cpspec->autoneg_wait);
-        cancel_delayed_work(&ppd->cpspec->autoneg_work);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&ppd->cpspec->autoneg_work);
 
         shutdown_7220_relock_poll(ppd->dd);
         val = qib_read_kreg64(ppd->dd, kr_xgxs_cfg);
@@ -2112,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isnt' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
@@ -2297,7 +2296,7 @@ static void qib_7220_config_ctxts(struct qib_devdata *dd)
         nchipctxts = qib_read_kreg32(dd, kr_portcnt);
         dd->cspec->numctxts = nchipctxts;
         if (qib_n_krcv_queues > 1) {
-                dd->qpn_mask = 0x3f;
+                dd->qpn_mask = 0x3e;
                 dd->first_user_ctxt = qib_n_krcv_queues * dd->num_pports;
                 if (dd->first_user_ctxt > nchipctxts)
                         dd->first_user_ctxt = nchipctxts;
@@ -2480,7 +2479,7 @@ static int qib_7220_set_ib_cfg(struct qib_pportdata *ppd, int which, u32 val)
                  * we command the link down.  As with width, only write the
                  * actual register if the link is currently down, otherwise
                  * takes effect on next link change.  Since setting is being
-                 * explictly requested (via MAD or sysfs), clear autoneg
+                 * explicitly requested (via MAD or sysfs), clear autoneg
                  * failure status if speed autoneg is enabled.
                  */
                 ppd->link_speed_enabled = val;
@@ -2703,7 +2702,7 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
 }
 
 static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
-                                    u32 updegr, u32 egrhd)
+                                    u32 updegr, u32 egrhd, u32 npkts)
 {
         qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
         if (updegr)
@@ -2779,7 +2778,7 @@ static void rcvctrl_7220_mod(struct qib_pportdata *ppd, unsigned int op,
                  * Init the context registers also; if we were
                  * disabled, tail and head should both be zero
                  * already from the enable, but since we don't
-                 * know, we have to do it explictly.
+                 * know, we have to do it explicitly.
                  */
                 val = qib_read_ureg32(dd, ur_rcvegrindextail, ctxt);
                 qib_write_ureg(dd, ur_rcvegrindexhead, val, ctxt);
@@ -3515,8 +3514,8 @@ static void try_7220_autoneg(struct qib_pportdata *ppd)
 
         toggle_7220_rclkrls(ppd->dd);
         /* 2 msec is minimum length of a poll cycle */
-        schedule_delayed_work(&ppd->cpspec->autoneg_work,
-                              msecs_to_jiffies(2));
+        queue_delayed_work(ib_wq, &ppd->cpspec->autoneg_work,
+                           msecs_to_jiffies(2));
 }
 
 /*
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 584d443b5335..8ec5237031a0 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -71,6 +71,9 @@ static void qib_7322_mini_pcs_reset(struct qib_pportdata *);
 
 static u32 ahb_mod(struct qib_devdata *, int, int, int, u32, u32);
 static void ibsd_wr_allchans(struct qib_pportdata *, int, unsigned, unsigned);
+static void serdes_7322_los_enable(struct qib_pportdata *, int);
+static int serdes_7322_init_old(struct qib_pportdata *);
+static int serdes_7322_init_new(struct qib_pportdata *);
 
 #define BMASK(msb, lsb) (((1 << ((msb) + 1 - (lsb))) - 1) << (lsb))
 
@@ -111,6 +114,21 @@ static ushort qib_singleport;
 module_param_named(singleport, qib_singleport, ushort, S_IRUGO);
 MODULE_PARM_DESC(singleport, "Use only IB port 1; more per-port buffer space");
 
+/*
+ * Receive header queue sizes
+ */
+static unsigned qib_rcvhdrcnt;
+module_param_named(rcvhdrcnt, qib_rcvhdrcnt, uint, S_IRUGO);
+MODULE_PARM_DESC(rcvhdrcnt, "receive header count");
+
+static unsigned qib_rcvhdrsize;
+module_param_named(rcvhdrsize, qib_rcvhdrsize, uint, S_IRUGO);
+MODULE_PARM_DESC(rcvhdrsize, "receive header size in 32-bit words");
+
+static unsigned qib_rcvhdrentsize;
+module_param_named(rcvhdrentsize, qib_rcvhdrentsize, uint, S_IRUGO);
+MODULE_PARM_DESC(rcvhdrentsize, "receive header entry size in 32-bit words");
+
 #define MAX_ATTEN_LEN 64 /* plenty for any real system */
 /* for read back, default index is ~5m copper cable */
 static char txselect_list[MAX_ATTEN_LEN] = "10";
@@ -314,7 +332,7 @@ MODULE_PARM_DESC(txselect, \
 #define krp_serdesctrl KREG_IBPORT_IDX(IBSerdesCtrl)
 
 /*
- * Per-context kernel registers.  Acess only with qib_read_kreg_ctxt()
+ * Per-context kernel registers.  Access only with qib_read_kreg_ctxt()
  * or qib_write_kreg_ctxt()
  */
 #define krc_rcvhdraddr KREG_IDX(RcvHdrAddr0)
@@ -451,6 +469,8 @@ static u8 ib_rate_to_delay[IB_RATE_120_GBPS + 1] = {
 #define IB_7322_LT_STATE_RECOVERIDLE     0x0f
 #define IB_7322_LT_STATE_CFGENH          0x10
 #define IB_7322_LT_STATE_CFGTEST         0x11
+#define IB_7322_LT_STATE_CFGWAITRMTTEST  0x12
+#define IB_7322_LT_STATE_CFGWAITENH      0x13
 
 /* link state machine states from IBC */
 #define IB_7322_L_STATE_DOWN             0x0
@@ -480,8 +500,10 @@ static const u8 qib_7322_physportstate[0x20] = {
                 IB_PHYSPORTSTATE_LINK_ERR_RECOVER,
         [IB_7322_LT_STATE_CFGENH] = IB_PHYSPORTSTATE_CFG_ENH,
         [IB_7322_LT_STATE_CFGTEST] = IB_PHYSPORTSTATE_CFG_TRAIN,
-        [0x12] = IB_PHYSPORTSTATE_CFG_TRAIN,
-        [0x13] = IB_PHYSPORTSTATE_CFG_WAIT_ENH,
+        [IB_7322_LT_STATE_CFGWAITRMTTEST] =
+                IB_PHYSPORTSTATE_CFG_TRAIN,
+        [IB_7322_LT_STATE_CFGWAITENH] =
+                IB_PHYSPORTSTATE_CFG_WAIT_ENH,
         [0x14] = IB_PHYSPORTSTATE_CFG_TRAIN,
         [0x15] = IB_PHYSPORTSTATE_CFG_TRAIN,
         [0x16] = IB_PHYSPORTSTATE_CFG_TRAIN,
@@ -544,6 +566,7 @@ static void write_tx_serdes_param(struct qib_pportdata *, struct txdds_ent *);
 
 #define TXDDS_TABLE_SZ 16 /* number of entries per speed in onchip table */
 #define TXDDS_EXTRA_SZ 13 /* number of extra tx settings entries */
+#define TXDDS_MFG_SZ 2    /* number of mfg tx settings entries */
 #define SERDES_CHANS 4 /* yes, it's obvious, but one less magic number */
 
 #define H1_FORCE_VAL 8
@@ -1673,10 +1696,14 @@ static void handle_serdes_issues(struct qib_pportdata *ppd, u64 ibcst)
                 break;
         }
 
-        if (ibclt == IB_7322_LT_STATE_CFGTEST &&
+        if (((ibclt >= IB_7322_LT_STATE_CFGTEST &&
+              ibclt <= IB_7322_LT_STATE_CFGWAITENH) ||
+             ibclt == IB_7322_LT_STATE_LINKUP) &&
             (ibcst & SYM_MASK(IBCStatusA_0, LinkSpeedQDR))) {
                 force_h1(ppd);
                 ppd->cpspec->qdr_reforce = 1;
+                if (!ppd->dd->cspec->r1)
+                        serdes_7322_los_enable(ppd, 0);
         } else if (ppd->cpspec->qdr_reforce &&
                 (ibcst & SYM_MASK(IBCStatusA_0, LinkSpeedQDR)) &&
                  (ibclt == IB_7322_LT_STATE_CFGENH ||
@@ -1692,18 +1719,37 @@ static void handle_serdes_issues(struct qib_pportdata *ppd, u64 ibcst)
               ibclt <= IB_7322_LT_STATE_SLEEPQUIET)))
                 adj_tx_serdes(ppd);
 
-        if (!ppd->cpspec->qdr_dfe_on && ibclt != IB_7322_LT_STATE_LINKUP &&
-            ibclt <= IB_7322_LT_STATE_SLEEPQUIET) {
-                ppd->cpspec->qdr_dfe_on = 1;
-                ppd->cpspec->qdr_dfe_time = 0;
-                /* On link down, reenable QDR adaptation */
-                qib_write_kreg_port(ppd, krp_static_adapt_dis(2),
-                        ppd->dd->cspec->r1 ?
-                                    QDR_STATIC_ADAPT_DOWN_R1 :
-                                    QDR_STATIC_ADAPT_DOWN);
+        if (ibclt != IB_7322_LT_STATE_LINKUP) {
+                u8 ltstate = qib_7322_phys_portstate(ibcst);
+                u8 pibclt = (u8)SYM_FIELD(ppd->lastibcstat, IBCStatusA_0,
+                                          LinkTrainingState);
+                if (!ppd->dd->cspec->r1 &&
+                    pibclt == IB_7322_LT_STATE_LINKUP &&
+                    ltstate != IB_PHYSPORTSTATE_LINK_ERR_RECOVER &&
+                    ltstate != IB_PHYSPORTSTATE_RECOVERY_RETRAIN &&
+                    ltstate != IB_PHYSPORTSTATE_RECOVERY_WAITRMT &&
+                    ltstate != IB_PHYSPORTSTATE_RECOVERY_IDLE)
+                        /* If the link went down (but no into recovery,
+                         * turn LOS back on */
+                        serdes_7322_los_enable(ppd, 1);
+                if (!ppd->cpspec->qdr_dfe_on &&
+                    ibclt <= IB_7322_LT_STATE_SLEEPQUIET) {
+                        ppd->cpspec->qdr_dfe_on = 1;
+                        ppd->cpspec->qdr_dfe_time = 0;
+                        /* On link down, reenable QDR adaptation */
+                        qib_write_kreg_port(ppd, krp_static_adapt_dis(2),
+                                            ppd->dd->cspec->r1 ?
+                                            QDR_STATIC_ADAPT_DOWN_R1 :
+                                            QDR_STATIC_ADAPT_DOWN);
+                        printk(KERN_INFO QIB_DRV_NAME
+                                " IB%u:%u re-enabled QDR adaptation "
+                                "ibclt %x\n", ppd->dd->unit, ppd->port, ibclt);
+                }
         }
 }
 
+static int qib_7322_set_ib_cfg(struct qib_pportdata *, int, u32);
+
 /*
  * This is per-pport error handling.
  * will likely get it's own MSIx interrupt (one for each port,
@@ -2323,6 +2369,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
         qib_write_kreg_port(ppd, krp_rcvctrl, ppd->p_rcvctrl);
         spin_unlock_irqrestore(&dd->cspec->rcvmod_lock, flags);
 
+        /* Hold the link state machine for mezz boards */
+        if (IS_QMH(dd) || IS_QME(dd))
+                qib_set_ib_7322_lstate(ppd, 0,
+                                       QLOGIC_IB_IBCC_LINKINITCMD_DISABLE);
+
         /* Also enable IBSTATUSCHG interrupt.  */
         val = qib_read_kreg_port(ppd, krp_errmask);
         qib_write_kreg_port(ppd, krp_errmask,
@@ -2348,10 +2399,9 @@ static void qib_7322_mini_quiet_serdes(struct qib_pportdata *ppd)
         ppd->lflags &= ~QIBL_IB_AUTONEG_INPROG;
         spin_unlock_irqrestore(&ppd->lflags_lock, flags);
         wake_up(&ppd->cpspec->autoneg_wait);
-        cancel_delayed_work(&ppd->cpspec->autoneg_work);
+        cancel_delayed_work_sync(&ppd->cpspec->autoneg_work);
         if (ppd->dd->cspec->r1)
-                cancel_delayed_work(&ppd->cpspec->ipg_work);
-        flush_scheduled_work();
+                cancel_delayed_work_sync(&ppd->cpspec->ipg_work);
 
         ppd->cpspec->chase_end = 0;
         if (ppd->cpspec->chase_timer.data) /* if initted */
@@ -2648,7 +2698,7 @@ static noinline void unknown_7322_gpio_intr(struct qib_devdata *dd)
                         if (!(pins & mask)) {
                                 ++handled;
                                 qd->t_insert = get_jiffies_64();
-                                schedule_work(&qd->work);
+                                queue_work(ib_wq, &qd->work);
                         }
                 }
         }
@@ -2785,7 +2835,6 @@ static irqreturn_t qib_7322intr(int irq, void *data)
                                 ctxtrbits &= ~rmask;
                                 if (dd->rcd[i]) {
                                         qib_kreceive(dd->rcd[i], NULL, &npkts);
-                                        adjust_rcv_timeout(dd->rcd[i], npkts);
                                 }
                         }
                         rmask <<= 1;
@@ -2835,7 +2884,6 @@ static irqreturn_t qib_7322pintr(int irq, void *data)
                        (1ULL << QIB_I_RCVURG_LSB)) << rcd->ctxt);
 
         qib_kreceive(rcd, NULL, &npkts);
-        adjust_rcv_timeout(rcd, npkts);
 
         return IRQ_HANDLED;
 }
@@ -3157,6 +3205,10 @@ static unsigned qib_7322_boardname(struct qib_devdata *dd)
         case BOARD_QME7342:
                 n = "InfiniPath_QME7342";
                 break;
+        case 8:
+                n = "InfiniPath_QME7362";
+                dd->flags |= QIB_HAS_QSFP;
+                break;
         case 15:
                 n = "InfiniPath_QLE7342_TEST";
                 dd->flags |= QIB_HAS_QSFP;
@@ -3253,7 +3305,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isnt' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
         dd->flags |= QIB_DOING_RESET;
@@ -3475,11 +3527,6 @@ static void qib_7322_config_ctxts(struct qib_devdata *dd)
         nchipctxts = qib_read_kreg32(dd, kr_contextcnt);
         dd->cspec->numctxts = nchipctxts;
         if (qib_n_krcv_queues > 1 && dd->num_pports) {
-                /*
-                 * Set the mask for which bits from the QPN are used
-                 * to select a context number.
-                 */
-                dd->qpn_mask = 0x3f;
                 dd->first_user_ctxt = NUM_IB_PORTS +
                         (qib_n_krcv_queues - 1) * dd->num_pports;
                 if (dd->first_user_ctxt > nchipctxts)
@@ -3530,8 +3577,11 @@ static void qib_7322_config_ctxts(struct qib_devdata *dd)
 
         /* kr_rcvegrcnt changes based on the number of contexts enabled */
         dd->cspec->rcvegrcnt = qib_read_kreg32(dd, kr_rcvegrcnt);
-        dd->rcvhdrcnt = max(dd->cspec->rcvegrcnt,
-                                dd->num_pports > 1 ? 1024U : 2048U);
+        if (qib_rcvhdrcnt)
+                dd->rcvhdrcnt = max(dd->cspec->rcvegrcnt, qib_rcvhdrcnt);
+        else
+                dd->rcvhdrcnt = max(dd->cspec->rcvegrcnt,
+                                    dd->num_pports > 1 ? 1024U : 2048U);
 }
 
 static int qib_7322_get_ib_cfg(struct qib_pportdata *ppd, int which)
@@ -3683,7 +3733,7 @@ static int qib_7322_set_ib_cfg(struct qib_pportdata *ppd, int which, u32 val)
                 /*
                  * As with width, only write the actual register if the
                  * link is currently down, otherwise takes effect on next
-                 * link change.  Since setting is being explictly requested
+                 * link change.  Since setting is being explicitly requested
                  * (via MAD or sysfs), clear autoneg failure status if speed
                  * autoneg is enabled.
                  */
@@ -4002,8 +4052,14 @@ static int qib_7322_set_ib_table(struct qib_pportdata *ppd, int which, void *t)
 }
 
 static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
-                                    u32 updegr, u32 egrhd)
+                                    u32 updegr, u32 egrhd, u32 npkts)
 {
+        /*
+         * Need to write timeout register before updating rcvhdrhead to ensure
+         * that the timer is enabled on reception of a packet.
+         */
+        if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
+                adjust_rcv_timeout(rcd, npkts);
         qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
         qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
         if (updegr)
@@ -4113,7 +4169,7 @@ static void rcvctrl_7322_mod(struct qib_pportdata *ppd, unsigned int op,
                  * Init the context registers also; if we were
                  * disabled, tail and head should both be zero
                  * already from the enable, but since we don't
-                 * know, we have to do it explictly.
+                 * know, we have to do it explicitly.
                  */
                 val = qib_read_ureg32(dd, ur_rcvegrindextail, ctxt);
                 qib_write_ureg(dd, ur_rcvegrindexhead, val, ctxt);
@@ -4926,8 +4982,8 @@ static void try_7322_autoneg(struct qib_pportdata *ppd)
         set_7322_ibspeed_fast(ppd, QIB_IB_DDR);
         qib_7322_mini_pcs_reset(ppd);
         /* 2 msec is minimum length of a poll cycle */
-        schedule_delayed_work(&ppd->cpspec->autoneg_work,
-                              msecs_to_jiffies(2));
+        queue_delayed_work(ib_wq, &ppd->cpspec->autoneg_work,
+                           msecs_to_jiffies(2));
 }
 
 /*
@@ -5057,7 +5113,8 @@ static void try_7322_ipg(struct qib_pportdata *ppd)
                 ib_free_send_mad(send_buf);
 retry:
         delay = 2 << ppd->cpspec->ipg_tries;
-        schedule_delayed_work(&ppd->cpspec->ipg_work, msecs_to_jiffies(delay));
+        queue_delayed_work(ib_wq, &ppd->cpspec->ipg_work,
+                           msecs_to_jiffies(delay));
 }
 
 /*
@@ -5522,7 +5579,7 @@ static void qsfp_7322_event(struct work_struct *work)
                 u64 now = get_jiffies_64();
                 if (time_after64(now, pwrup))
                         break;
-                msleep(1);
+                msleep(20);
         }
         ret = qib_refresh_qsfp_cache(ppd, &qd->cache);
         /*
@@ -5531,9 +5588,16 @@ static void qsfp_7322_event(struct work_struct *work)
          * even on failure to read cable information.  We don't
          * get here for QME, so IS_QME check not needed here.
          */
-        le2 = (!ret && qd->cache.atten[1] >= qib_long_atten &&
-               !ppd->dd->cspec->r1 && QSFP_IS_CU(qd->cache.tech)) ?
-                LE2_5m : LE2_DEFAULT;
+        if (!ret && !ppd->dd->cspec->r1) {
+                if (QSFP_IS_ACTIVE_FAR(qd->cache.tech))
+                        le2 = LE2_QME;
+                else if (qd->cache.atten[1] >= qib_long_atten &&
+                         QSFP_IS_CU(qd->cache.tech))
+                        le2 = LE2_5m;
+                else
+                        le2 = LE2_DEFAULT;
+        } else
+                le2 = LE2_DEFAULT;
         ibsd_wr_allchans(ppd, 13, (le2 << 7), BMASK(9, 7));
         init_txdds_table(ppd, 0);
 }
@@ -5579,6 +5643,7 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
         u32 pidx, unit, port, deflt, h1;
         unsigned long val;
         int any = 0, seth1;
+        int txdds_size;
 
         str = txselect_list;
 
@@ -5587,6 +5652,10 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
         for (pidx = 0; pidx < dd->num_pports; ++pidx)
                 dd->pport[pidx].cpspec->no_eep = deflt;
 
+        txdds_size = TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ;
+        if (IS_QME(dd) || IS_QMH(dd))
+                txdds_size += TXDDS_MFG_SZ;
+
         while (*nxt && nxt[1]) {
                 str = ++nxt;
                 unit = simple_strtoul(str, &nxt, 0);
@@ -5609,7 +5678,7 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
                                 ;
                         continue;
                 }
-                if (val >= TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ)
+                if (val >= txdds_size)
                         continue;
                 seth1 = 0;
                 h1 = 0; /* gcc thinks it might be used uninitted */
@@ -5633,6 +5702,11 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
                                 ppd->cpspec->h1_val = h1;
                         /* now change the IBC and serdes, overriding generic */
                         init_txdds_table(ppd, 1);
+                        /* Re-enable the physical state machine on mezz boards
+                         * now that the correct settings have been set. */
+                        if (IS_QMH(dd) || IS_QME(dd))
+                                qib_set_ib_7322_lstate(ppd, 0,
+                                            QLOGIC_IB_IBCC_LINKINITCMD_SLEEP);
                         any++;
                 }
                 if (*nxt == '\n')
@@ -5661,10 +5735,11 @@ static int setup_txselect(const char *str, struct kernel_param *kp)
                 return -ENOSPC;
         }
         val = simple_strtoul(str, &n, 0);
-        if (n == str || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ)) {
+        if (n == str || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
+                                TXDDS_MFG_SZ)) {
                 printk(KERN_INFO QIB_DRV_NAME
                        "txselect_values must start with a number < %d\n",
-                        TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ);
+                        TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ);
                 return -EINVAL;
         }
         strcpy(txselect_list, str);
@@ -5810,7 +5885,8 @@ static void write_7322_initregs(struct qib_devdata *dd)
                 unsigned n, regno;
                 unsigned long flags;
 
-                if (!dd->qpn_mask || !dd->pport[pidx].link_speed_supported)
+                if (dd->n_krcv_queues < 2 ||
+                        !dd->pport[pidx].link_speed_supported)
                         continue;
 
                 ppd = &dd->pport[pidx];
@@ -6097,8 +6173,10 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
                 ppd++;
         }
 
-        dd->rcvhdrentsize = QIB_RCVHDR_ENTSIZE;
-        dd->rcvhdrsize = QIB_DFLT_RCVHDRSIZE;
+        dd->rcvhdrentsize = qib_rcvhdrentsize ?
+                qib_rcvhdrentsize : QIB_RCVHDR_ENTSIZE;
+        dd->rcvhdrsize = qib_rcvhdrsize ?
+                qib_rcvhdrsize : QIB_DFLT_RCVHDRSIZE;
         dd->rhf_offset = dd->rcvhdrentsize - sizeof(u64) / sizeof(u32);
 
         /* we always allocate at least 2048 bytes for eager buffers */
@@ -6495,7 +6573,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
                 /* make sure we see an updated copy next time around */
                 sendctrl_7322_mod(dd->pport, QIB_SENDCTRL_AVAIL_BLIP);
                 sleeps++;
-                msleep(1);
+                msleep(20);
         }
 
         switch (which) {
@@ -6993,6 +7071,12 @@ static const struct txdds_ent txdds_extra_qdr[TXDDS_EXTRA_SZ] = {
         {  0, 1,  0, 12 },      /* QMH7342 backplane settings */
 };
 
+static const struct txdds_ent txdds_extra_mfg[TXDDS_MFG_SZ] = {
+        /* amp, pre, main, post */
+        { 0, 0, 0, 0 },         /* QME7342 mfg settings */
+        { 0, 0, 0, 6 },         /* QME7342 P2 mfg settings */
+};
+
 static const struct txdds_ent *get_atten_table(const struct txdds_ent *txdds,
                                                unsigned atten)
 {
@@ -7066,6 +7150,16 @@ static void find_best_ent(struct qib_pportdata *ppd,
                 *sdr_dds = &txdds_extra_sdr[idx];
                 *ddr_dds = &txdds_extra_ddr[idx];
                 *qdr_dds = &txdds_extra_qdr[idx];
+        } else if ((IS_QME(ppd->dd) || IS_QMH(ppd->dd)) &&
+                   ppd->cpspec->no_eep < (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
+                                          TXDDS_MFG_SZ)) {
+                idx = ppd->cpspec->no_eep - (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ);
+                printk(KERN_INFO QIB_DRV_NAME
+                        " IB%u:%u use idx %u into txdds_mfg\n",
+                        ppd->dd->unit, ppd->port, idx);
+                *sdr_dds = &txdds_extra_mfg[idx];
+                *ddr_dds = &txdds_extra_mfg[idx];
+                *qdr_dds = &txdds_extra_mfg[idx];
         } else {
                 /* this shouldn't happen, it's range checked */
                 *sdr_dds = txdds_sdr + qib_long_atten;
@@ -7210,9 +7304,35 @@ static void ibsd_wr_allchans(struct qib_pportdata *ppd, int addr, unsigned data,
         }
 }
 
+static void serdes_7322_los_enable(struct qib_pportdata *ppd, int enable)
+{
+        u64 data = qib_read_kreg_port(ppd, krp_serdesctrl);
+        u8 state = SYM_FIELD(data, IBSerdesCtrl_0, RXLOSEN);
+
+        if (enable && !state) {
+                printk(KERN_INFO QIB_DRV_NAME " IB%u:%u Turning LOS on\n",
+                        ppd->dd->unit, ppd->port);
+                data |= SYM_MASK(IBSerdesCtrl_0, RXLOSEN);
+        } else if (!enable && state) {
+                printk(KERN_INFO QIB_DRV_NAME " IB%u:%u Turning LOS off\n",
+                        ppd->dd->unit, ppd->port);
+                data &= ~SYM_MASK(IBSerdesCtrl_0, RXLOSEN);
+        }
+        qib_write_kreg_port(ppd, krp_serdesctrl, data);
+}
+
 static int serdes_7322_init(struct qib_pportdata *ppd)
 {
-        u64 data;
+        int ret = 0;
+        if (ppd->dd->cspec->r1)
+                ret = serdes_7322_init_old(ppd);
+        else
+                ret = serdes_7322_init_new(ppd);
+        return ret;
+}
+
+static int serdes_7322_init_old(struct qib_pportdata *ppd)
+{
         u32 le_val;
 
         /*
@@ -7270,11 +7390,7 @@ static int serdes_7322_init(struct qib_pportdata *ppd)
         ibsd_wr_allchans(ppd, 20, (2 << 10), BMASK(12, 10)); /* DDR */
         ibsd_wr_allchans(ppd, 20, (4 << 13), BMASK(15, 13)); /* SDR */
 
-        data = qib_read_kreg_port(ppd, krp_serdesctrl);
-        /* Turn off IB latency mode */
-        data &= ~SYM_MASK(IBSerdesCtrl_0, IB_LAT_MODE);
-        qib_write_kreg_port(ppd, krp_serdesctrl, data |
-                SYM_MASK(IBSerdesCtrl_0, RXLOSEN));
+        serdes_7322_los_enable(ppd, 1);
 
         /* rxbistena; set 0 to avoid effects of it switch later */
         ibsd_wr_allchans(ppd, 9, 0 << 15, 1 << 15);
@@ -7314,6 +7430,206 @@ static int serdes_7322_init(struct qib_pportdata *ppd)
         return 0;
 }
 
+static int serdes_7322_init_new(struct qib_pportdata *ppd)
+{
+        u64 tstart;
+        u32 le_val, rxcaldone;
+        int chan, chan_done = (1 << SERDES_CHANS) - 1;
+
+        /*
+         * Initialize the Tx DDS tables.  Also done every QSFP event,
+         * for adapters with QSFP
+         */
+        init_txdds_table(ppd, 0);
+
+        /* Clear cmode-override, may be set from older driver */
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 10, 0 << 14, 1 << 14);
+
+        /* ensure no tx overrides from earlier driver loads */
+        qib_write_kreg_port(ppd, krp_tx_deemph_override,
+                SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0,
+                reset_tx_deemphasis_override));
+
+        /* START OF LSI SUGGESTED SERDES BRINGUP */
+        /* Reset - Calibration Setup */
+        /*       Stop DFE adaptaion */
+        ibsd_wr_allchans(ppd, 1, 0, BMASK(9, 1));
+        /*       Disable LE1 */
+        ibsd_wr_allchans(ppd, 13, 0, BMASK(5, 5));
+        /*       Disable autoadapt for LE1 */
+        ibsd_wr_allchans(ppd, 1, 0, BMASK(15, 15));
+        /*       Disable LE2 */
+        ibsd_wr_allchans(ppd, 13, 0, BMASK(6, 6));
+        /*       Disable VGA */
+        ibsd_wr_allchans(ppd, 5, 0, BMASK(0, 0));
+        /*       Disable AFE Offset Cancel */
+        ibsd_wr_allchans(ppd, 12, 0, BMASK(12, 12));
+        /*       Disable Timing Loop */
+        ibsd_wr_allchans(ppd, 2, 0, BMASK(3, 3));
+        /*       Disable Frequency Loop */
+        ibsd_wr_allchans(ppd, 2, 0, BMASK(4, 4));
+        /*       Disable Baseline Wander Correction */
+        ibsd_wr_allchans(ppd, 13, 0, BMASK(13, 13));
+        /*       Disable RX Calibration */
+        ibsd_wr_allchans(ppd, 4, 0, BMASK(10, 10));
+        /*       Disable RX Offset Calibration */
+        ibsd_wr_allchans(ppd, 12, 0, BMASK(4, 4));
+        /*       Select BB CDR */
+        ibsd_wr_allchans(ppd, 2, (1 << 15), BMASK(15, 15));
+        /*       CDR Step Size */
+        ibsd_wr_allchans(ppd, 5, 0, BMASK(9, 8));
+        /*       Enable phase Calibration */
+        ibsd_wr_allchans(ppd, 12, (1 << 5), BMASK(5, 5));
+        /*       DFE Bandwidth [2:14-12] */
+        ibsd_wr_allchans(ppd, 2, (4 << 12), BMASK(14, 12));
+        /*       DFE Config (4 taps only) */
+        ibsd_wr_allchans(ppd, 16, 0, BMASK(1, 0));
+        /*       Gain Loop Bandwidth */
+        if (!ppd->dd->cspec->r1) {
+                ibsd_wr_allchans(ppd, 12, 1 << 12, BMASK(12, 12));
+                ibsd_wr_allchans(ppd, 12, 2 << 8, BMASK(11, 8));
+        } else {
+                ibsd_wr_allchans(ppd, 19, (3 << 11), BMASK(13, 11));
+        }
+        /*       Baseline Wander Correction Gain [13:4-0] (leave as default) */
+        /*       Baseline Wander Correction Gain [3:7-5] (leave as default) */
+        /*       Data Rate Select [5:7-6] (leave as default) */
+        /*       RX Parallel Word Width [3:10-8] (leave as default) */
+
+        /* RX REST */
+        /*       Single- or Multi-channel reset */
+        /*       RX Analog reset */
+        /*       RX Digital reset */
+        ibsd_wr_allchans(ppd, 0, 0, BMASK(15, 13));
+        msleep(20);
+        /*       RX Analog reset */
+        ibsd_wr_allchans(ppd, 0, (1 << 14), BMASK(14, 14));
+        msleep(20);
+        /*       RX Digital reset */
+        ibsd_wr_allchans(ppd, 0, (1 << 13), BMASK(13, 13));
+        msleep(20);
+
+        /* setup LoS params; these are subsystem, so chan == 5 */
+        /* LoS filter threshold_count on, ch 0-3, set to 8 */
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 5, 8 << 11, BMASK(14, 11));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 7, 8 << 4, BMASK(7, 4));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 8, 8 << 11, BMASK(14, 11));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 10, 8 << 4, BMASK(7, 4));
+
+        /* LoS filter threshold_count off, ch 0-3, set to 4 */
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 6, 4 << 0, BMASK(3, 0));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 7, 4 << 8, BMASK(11, 8));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 9, 4 << 0, BMASK(3, 0));
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 10, 4 << 8, BMASK(11, 8));
+
+        /* LoS filter select enabled */
+        ahb_mod(ppd->dd, IBSD(ppd->hw_pidx), 5, 9, 1 << 15, 1 << 15);
+
+        /* LoS target data:  SDR=4, DDR=2, QDR=1 */
+        ibsd_wr_allchans(ppd, 14, (1 << 3), BMASK(5, 3)); /* QDR */
+        ibsd_wr_allchans(ppd, 20, (2 << 10), BMASK(12, 10)); /* DDR */
+        ibsd_wr_allchans(ppd, 20, (4 << 13), BMASK(15, 13)); /* SDR */
+
+        /* Turn on LOS on initial SERDES init */
+        serdes_7322_los_enable(ppd, 1);
+        /* FLoop LOS gate: PPM filter  enabled */
+        ibsd_wr_allchans(ppd, 38, 0 << 10, 1 << 10);
+
+        /* RX LATCH CALIBRATION */
+        /*       Enable Eyefinder Phase Calibration latch */
+        ibsd_wr_allchans(ppd, 15, 1, BMASK(0, 0));
+        /*       Enable RX Offset Calibration latch */
+        ibsd_wr_allchans(ppd, 12, (1 << 4), BMASK(4, 4));
+        msleep(20);
+        /*       Start Calibration */
+        ibsd_wr_allchans(ppd, 4, (1 << 10), BMASK(10, 10));
+        tstart = get_jiffies_64();
+        while (chan_done &&
+               !time_after64(get_jiffies_64(),
+                        tstart + msecs_to_jiffies(500))) {
+                msleep(20);
+                for (chan = 0; chan < SERDES_CHANS; ++chan) {
+                        rxcaldone = ahb_mod(ppd->dd, IBSD(ppd->hw_pidx),
+                                            (chan + (chan >> 1)),
+                                            25, 0, 0);
+                        if ((~rxcaldone & (u32)BMASK(9, 9)) == 0 &&
+                            (~chan_done & (1 << chan)) == 0)
+                                chan_done &= ~(1 << chan);
+                }
+        }
+        if (chan_done) {
+                printk(KERN_INFO QIB_DRV_NAME
+                         " Serdes %d calibration not done after .5 sec: 0x%x\n",
+                         IBSD(ppd->hw_pidx), chan_done);
+        } else {
+                for (chan = 0; chan < SERDES_CHANS; ++chan) {
+                        rxcaldone = ahb_mod(ppd->dd, IBSD(ppd->hw_pidx),
+                                            (chan + (chan >> 1)),
+                                            25, 0, 0);
+                        if ((~rxcaldone & (u32)BMASK(10, 10)) == 0)
+                                printk(KERN_INFO QIB_DRV_NAME
+                                         " Serdes %d chan %d calibration "
+                                         "failed\n", IBSD(ppd->hw_pidx), chan);
+                }
+        }
+
+        /*       Turn off Calibration */
+        ibsd_wr_allchans(ppd, 4, 0, BMASK(10, 10));
+        msleep(20);
+
+        /* BRING RX UP */
+        /*       Set LE2 value (May be overridden in qsfp_7322_event) */
+        le_val = IS_QME(ppd->dd) ? LE2_QME : LE2_DEFAULT;
+        ibsd_wr_allchans(ppd, 13, (le_val << 7), BMASK(9, 7));
+        /*       Set LE2 Loop bandwidth */
+        ibsd_wr_allchans(ppd, 3, (7 << 5), BMASK(7, 5));
+        /*       Enable LE2 */
+        ibsd_wr_allchans(ppd, 13, (1 << 6), BMASK(6, 6));
+        msleep(20);
+        /*       Enable H0 only */
+        ibsd_wr_allchans(ppd, 1, 1, BMASK(9, 1));
+        /* gain hi stop 32 (22) (6:1) lo stop 7 (10:7) target 22 (13) (15:11) */
+        le_val = (ppd->dd->cspec->r1 || IS_QME(ppd->dd)) ? 0xb6c0 : 0x6bac;
+        ibsd_wr_allchans(ppd, 21, le_val, 0xfffe);
+        /*       Enable VGA */
+        ibsd_wr_allchans(ppd, 5, 0, BMASK(0, 0));
+        msleep(20);
+        /*       Set Frequency Loop Bandwidth */
+        ibsd_wr_allchans(ppd, 2, (7 << 5), BMASK(8, 5));
+        /*       Enable Frequency Loop */
+        ibsd_wr_allchans(ppd, 2, (1 << 4), BMASK(4, 4));
+        /*       Set Timing Loop Bandwidth */
+        ibsd_wr_allchans(ppd, 2, 0, BMASK(11, 9));
+        /*       Enable Timing Loop */
+        ibsd_wr_allchans(ppd, 2, (1 << 3), BMASK(3, 3));
+        msleep(50);
+        /*       Enable DFE
+         *       Set receive adaptation mode.  SDR and DDR adaptation are
+         *       always on, and QDR is initially enabled; later disabled.
+         */
+        qib_write_kreg_port(ppd, krp_static_adapt_dis(0), 0ULL);
+        qib_write_kreg_port(ppd, krp_static_adapt_dis(1), 0ULL);
+        qib_write_kreg_port(ppd, krp_static_adapt_dis(2),
+                            ppd->dd->cspec->r1 ?
+                            QDR_STATIC_ADAPT_DOWN_R1 : QDR_STATIC_ADAPT_DOWN);
+        ppd->cpspec->qdr_dfe_on = 1;
+        /*       Disable LE1  */
+        ibsd_wr_allchans(ppd, 13, (0 << 5), (1 << 5));
+        /*       Disable auto adapt for LE1 */
+        ibsd_wr_allchans(ppd, 1, (0 << 15), BMASK(15, 15));
+        msleep(20);
+        /*       Enable AFE Offset Cancel */
+        ibsd_wr_allchans(ppd, 12, (1 << 12), BMASK(12, 12));
+        /*       Enable Baseline Wander Correction */
+        ibsd_wr_allchans(ppd, 12, (1 << 13), BMASK(13, 13));
+        /* Termination: rxtermctrl_r2d addr 11 bits [12:11] = 1 */
+        ibsd_wr_allchans(ppd, 11, (1 << 11), BMASK(12, 11));
+        /* VGA output common mode */
+        ibsd_wr_allchans(ppd, 12, (3 << 2), BMASK(3, 2));
+
+        return 0;
+}
+
 /* start adjust QMH serdes parameters */
 
 static void set_man_code(struct qib_pportdata *ppd, int chan, int code)
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index f1d16d3a01f6..a01f3fce8eb3 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -80,7 +80,6 @@ unsigned qib_wc_pat = 1; /* default (1) is to use PAT, not MTRR */
 module_param_named(wc_pat, qib_wc_pat, uint, S_IRUGO);
 MODULE_PARM_DESC(wc_pat, "enable write-combining via PAT mechanism");
 
-struct workqueue_struct *qib_wq;
 struct workqueue_struct *qib_cq_wq;
 
 static void verify_interrupt(unsigned long);
@@ -92,9 +91,11 @@ unsigned long *qib_cpulist;
 /* set number of contexts we'll actually use */
 void qib_set_ctxtcnt(struct qib_devdata *dd)
 {
-        if (!qib_cfgctxts)
+        if (!qib_cfgctxts) {
                 dd->cfgctxts = dd->first_user_ctxt + num_online_cpus();
-        else if (qib_cfgctxts < dd->num_pports)
+                if (dd->cfgctxts > dd->ctxtcnt)
+                        dd->cfgctxts = dd->ctxtcnt;
+        } else if (qib_cfgctxts < dd->num_pports)
                 dd->cfgctxts = dd->ctxtcnt;
         else if (qib_cfgctxts <= dd->ctxtcnt)
                 dd->cfgctxts = qib_cfgctxts;
@@ -268,23 +269,20 @@ static void init_shadow_tids(struct qib_devdata *dd)
         struct page **pages;
         dma_addr_t *addrs;
 
-        pages = vmalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(struct page *));
+        pages = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(struct page *));
         if (!pages) {
                 qib_dev_err(dd, "failed to allocate shadow page * "
                             "array, no expected sends!\n");
                 goto bail;
         }
 
-        addrs = vmalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(dma_addr_t));
+        addrs = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(dma_addr_t));
         if (!addrs) {
                 qib_dev_err(dd, "failed to allocate shadow dma handle "
                             "array, no expected sends!\n");
                 goto bail_free;
         }
 
-        memset(pages, 0, dd->cfgctxts * dd->rcvtidcnt * sizeof(struct page *));
-        memset(addrs, 0, dd->cfgctxts * dd->rcvtidcnt * sizeof(dma_addr_t));
-
         dd->pageshadow = pages;
         dd->physshadow = addrs;
         return;
@@ -348,7 +346,7 @@ done:
  * @dd: the qlogic_ib device
  *
  * sanity check at least some of the values after reset, and
- * ensure no receive or transmit (explictly, in case reset
+ * ensure no receive or transmit (explicitly, in case reset
  * failed
  */
 static int init_after_reset(struct qib_devdata *dd)
@@ -1045,24 +1043,10 @@ static int __init qlogic_ib_init(void)
         if (ret)
                 goto bail;
 
-        /*
-         * We create our own workqueue mainly because we want to be
-         * able to flush it when devices are being removed.  We can't
-         * use schedule_work()/flush_scheduled_work() because both
-         * unregister_netdev() and linkwatch_event take the rtnl lock,
-         * so flush_scheduled_work() can deadlock during device
-         * removal.
-         */
-        qib_wq = create_workqueue("qib");
-        if (!qib_wq) {
-                ret = -ENOMEM;
-                goto bail_dev;
-        }
-
         qib_cq_wq = create_singlethread_workqueue("qib_cq");
         if (!qib_cq_wq) {
                 ret = -ENOMEM;
-                goto bail_wq;
+                goto bail_dev;
         }
 
         /*
@@ -1092,8 +1076,6 @@ bail_unit:
         idr_destroy(&qib_unit_table);
 bail_cq_wq:
         destroy_workqueue(qib_cq_wq);
-bail_wq:
-        destroy_workqueue(qib_wq);
 bail_dev:
         qib_dev_cleanup();
 bail:
@@ -1117,7 +1099,6 @@ static void __exit qlogic_ib_cleanup(void)
 
         pci_unregister_driver(&qib_driver);
 
-        destroy_workqueue(qib_wq);
         destroy_workqueue(qib_cq_wq);
 
         qib_cpulist_count = 0;
@@ -1243,6 +1224,7 @@ static int __devinit qib_init_one(struct pci_dev *pdev,
                 qib_early_err(&pdev->dev, "QLogic PCIE device 0x%x cannot "
                       "work if CONFIG_PCI_MSI is not enabled\n",
                       ent->device);
+                dd = ERR_PTR(-ENODEV);
 #endif
                 break;
 
@@ -1289,7 +1271,7 @@ static int __devinit qib_init_one(struct pci_dev *pdev,
 
         if (qib_mini_init || initfail || ret) {
                 qib_stop_timers(dd);
-                flush_scheduled_work();
+                flush_workqueue(ib_wq);
                 for (pidx = 0; pidx < dd->num_pports; ++pidx)
                         dd->f_quiet_serdes(dd->pport + pidx);
                 if (qib_mini_init)
@@ -1338,8 +1320,8 @@ static void __devexit qib_remove_one(struct pci_dev *pdev)
 
         qib_stop_timers(dd);
 
-        /* wait until all of our (qsfp) schedule_work() calls complete */
-        flush_scheduled_work();
+        /* wait until all of our (qsfp) queue_work() calls complete */
+        flush_workqueue(ib_wq);
 
         ret = qibfs_remove(dd);
         if (ret)
diff --git a/drivers/infiniband/hw/qib/qib_intr.c b/drivers/infiniband/hw/qib/qib_intr.c
index 54a40828a106..6ae57d23004a 100644
--- a/drivers/infiniband/hw/qib/qib_intr.c
+++ b/drivers/infiniband/hw/qib/qib_intr.c
@@ -96,8 +96,12 @@ void qib_handle_e_ibstatuschanged(struct qib_pportdata *ppd, u64 ibcs)
          * states, or if it transitions from any of the up (INIT or better)
          * states into any of the down states (except link recovery), then
          * call the chip-specific code to take appropriate actions.
+         *
+         * ppd->lflags could be 0 if this is the first time the interrupt
+         * handlers has been called but the link is already up.
          */
-        if (lstate >= IB_PORT_INIT && (ppd->lflags & QIBL_LINKDOWN) &&
+        if (lstate >= IB_PORT_INIT &&
+            (!ppd->lflags || (ppd->lflags & QIBL_LINKDOWN)) &&
             ltstate == IB_PHYSPORTSTATE_LINKUP) {
                 /* transitioned to UP */
                 if (dd->f_ib_updown(ppd, 1, ibcs))
@@ -131,7 +135,8 @@ void qib_handle_e_ibstatuschanged(struct qib_pportdata *ppd, u64 ibcs)
                         /* start a 75msec timer to clear symbol errors */
                         mod_timer(&ppd->symerr_clear_timer,
                                   msecs_to_jiffies(75));
-                } else if (ltstate == IB_PHYSPORTSTATE_LINKUP) {
+                } else if (ltstate == IB_PHYSPORTSTATE_LINKUP &&
+                           !(ppd->lflags & QIBL_LINKACTIVE)) {
                         /* active, but not active defered */
                         qib_hol_up(ppd); /* useful only for 6120 now */
                         *ppd->statusp |=
diff --git a/drivers/infiniband/hw/qib/qib_keys.c b/drivers/infiniband/hw/qib/qib_keys.c
index 4b80eb153d57..8fd19a47df0c 100644
--- a/drivers/infiniband/hw/qib/qib_keys.c
+++ b/drivers/infiniband/hw/qib/qib_keys.c
@@ -136,7 +136,6 @@ int qib_lkey_ok(struct qib_lkey_table *rkt, struct qib_pd *pd,
         struct qib_mregion *mr;
         unsigned n, m;
         size_t off;
-        int ret = 0;
         unsigned long flags;
 
         /*
@@ -152,6 +151,8 @@ int qib_lkey_ok(struct qib_lkey_table *rkt, struct qib_pd *pd,
                 if (!dev->dma_mr)
                         goto bail;
                 atomic_inc(&dev->dma_mr->refcount);
+                spin_unlock_irqrestore(&rkt->lock, flags);
+
                 isge->mr = dev->dma_mr;
                 isge->vaddr = (void *) sge->addr;
                 isge->length = sge->length;
@@ -170,19 +171,34 @@ int qib_lkey_ok(struct qib_lkey_table *rkt, struct qib_pd *pd,
                      off + sge->length > mr->length ||
                      (mr->access_flags & acc) != acc))
                 goto bail;
+        atomic_inc(&mr->refcount);
+        spin_unlock_irqrestore(&rkt->lock, flags);
 
         off += mr->offset;
-        m = 0;
-        n = 0;
-        while (off >= mr->map[m]->segs[n].length) {
-                off -= mr->map[m]->segs[n].length;
-                n++;
-                if (n >= QIB_SEGSZ) {
-                        m++;
-                        n = 0;
+        if (mr->page_shift) {
+                /*
+                page sizes are uniform power of 2 so no loop is necessary
+                entries_spanned_by_off is the number of times the loop below
+                would have executed.
+                */
+                size_t entries_spanned_by_off;
+
+                entries_spanned_by_off = off >> mr->page_shift;
+                off -= (entries_spanned_by_off << mr->page_shift);
+                m = entries_spanned_by_off/QIB_SEGSZ;
+                n = entries_spanned_by_off%QIB_SEGSZ;
+        } else {
+                m = 0;
+                n = 0;
+                while (off >= mr->map[m]->segs[n].length) {
+                        off -= mr->map[m]->segs[n].length;
+                        n++;
+                        if (n >= QIB_SEGSZ) {
+                                m++;
+                                n = 0;
+                        }
                 }
         }
-        atomic_inc(&mr->refcount);
         isge->mr = mr;
         isge->vaddr = mr->map[m]->segs[n].vaddr + off;
         isge->length = mr->map[m]->segs[n].length - off;
@@ -190,10 +206,10 @@ int qib_lkey_ok(struct qib_lkey_table *rkt, struct qib_pd *pd,
         isge->m = m;
         isge->n = n;
 ok:
-        ret = 1;
+        return 1;
 bail:
         spin_unlock_irqrestore(&rkt->lock, flags);
-        return ret;
+        return 0;
 }
 
 /**
@@ -214,7 +230,6 @@ int qib_rkey_ok(struct qib_qp *qp, struct qib_sge *sge,
         struct qib_mregion *mr;
         unsigned n, m;
         size_t off;
-        int ret = 0;
         unsigned long flags;
 
         /*
@@ -231,6 +246,8 @@ int qib_rkey_ok(struct qib_qp *qp, struct qib_sge *sge,
                 if (!dev->dma_mr)
                         goto bail;
                 atomic_inc(&dev->dma_mr->refcount);
+                spin_unlock_irqrestore(&rkt->lock, flags);
+
                 sge->mr = dev->dma_mr;
                 sge->vaddr = (void *) vaddr;
                 sge->length = len;
@@ -248,19 +265,34 @@ int qib_rkey_ok(struct qib_qp *qp, struct qib_sge *sge,
         if (unlikely(vaddr < mr->iova || off + len > mr->length ||
                      (mr->access_flags & acc) == 0))
                 goto bail;
+        atomic_inc(&mr->refcount);
+        spin_unlock_irqrestore(&rkt->lock, flags);
 
         off += mr->offset;
-        m = 0;
-        n = 0;
-        while (off >= mr->map[m]->segs[n].length) {
-                off -= mr->map[m]->segs[n].length;
-                n++;
-                if (n >= QIB_SEGSZ) {
-                        m++;
-                        n = 0;
+        if (mr->page_shift) {
+                /*
+                page sizes are uniform power of 2 so no loop is necessary
+                entries_spanned_by_off is the number of times the loop below
+                would have executed.
+                */
+                size_t entries_spanned_by_off;
+
+                entries_spanned_by_off = off >> mr->page_shift;
+                off -= (entries_spanned_by_off << mr->page_shift);
+                m = entries_spanned_by_off/QIB_SEGSZ;
+                n = entries_spanned_by_off%QIB_SEGSZ;
+        } else {
+                m = 0;
+                n = 0;
+                while (off >= mr->map[m]->segs[n].length) {
+                        off -= mr->map[m]->segs[n].length;
+                        n++;
+                        if (n >= QIB_SEGSZ) {
+                                m++;
+                                n = 0;
+                        }
                 }
         }
-        atomic_inc(&mr->refcount);
         sge->mr = mr;
         sge->vaddr = mr->map[m]->segs[n].vaddr + off;
         sge->length = mr->map[m]->segs[n].length - off;
@@ -268,10 +300,10 @@ int qib_rkey_ok(struct qib_qp *qp, struct qib_sge *sge,
         sge->m = m;
         sge->n = n;
 ok:
-        ret = 1;
+        return 1;
 bail:
         spin_unlock_irqrestore(&rkt->lock, flags);
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 94b0d1f3a8f0..8fd3df5bf04d 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -464,8 +464,9 @@ static int subn_get_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         memset(smp->data, 0, sizeof(smp->data));
 
         /* Only return the mkey if the protection field allows it. */
-        if (smp->method == IB_MGMT_METHOD_SET || ibp->mkey == smp->mkey ||
-            ibp->mkeyprot == 0)
+        if (!(smp->method == IB_MGMT_METHOD_GET &&
+              ibp->mkey != smp->mkey &&
+              ibp->mkeyprot == 1))
                 pip->mkey = ibp->mkey;
         pip->gid_prefix = ibp->gid_prefix;
         lid = ppd->lid;
@@ -668,8 +669,8 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         lid = be16_to_cpu(pip->lid);
         /* Must be a valid unicast LID address. */
         if (lid == 0 || lid >= QIB_MULTICAST_LID_BASE)
-                goto err;
-        if (ppd->lid != lid || ppd->lmc != (pip->mkeyprot_resv_lmc & 7)) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+        else if (ppd->lid != lid || ppd->lmc != (pip->mkeyprot_resv_lmc & 7)) {
                 if (ppd->lid != lid)
                         qib_set_uevent_bits(ppd, _QIB_EVENT_LID_CHANGE_BIT);
                 if (ppd->lmc != (pip->mkeyprot_resv_lmc & 7))
@@ -683,8 +684,8 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         msl = pip->neighbormtu_mastersmsl & 0xF;
         /* Must be a valid unicast LID address. */
         if (smlid == 0 || smlid >= QIB_MULTICAST_LID_BASE)
-                goto err;
-        if (smlid != ibp->sm_lid || msl != ibp->sm_sl) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+        else if (smlid != ibp->sm_lid || msl != ibp->sm_sl) {
                 spin_lock_irqsave(&ibp->lock, flags);
                 if (ibp->sm_ah) {
                         if (smlid != ibp->sm_lid)
@@ -705,10 +706,11 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         lwe = pip->link_width_enabled;
         if (lwe) {
                 if (lwe == 0xFF)
-                        lwe = ppd->link_width_supported;
+                        set_link_width_enabled(ppd, ppd->link_width_supported);
                 else if (lwe >= 16 || (lwe & ~ppd->link_width_supported))
-                        goto err;
-                set_link_width_enabled(ppd, lwe);
+                        smp->status |= IB_SMP_INVALID_FIELD;
+                else if (lwe != ppd->link_width_enabled)
+                        set_link_width_enabled(ppd, lwe);
         }
 
         lse = pip->linkspeedactive_enabled & 0xF;
@@ -719,10 +721,12 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                  * speeds.
                  */
                 if (lse == 15)
-                        lse = ppd->link_speed_supported;
+                        set_link_speed_enabled(ppd,
+                                               ppd->link_speed_supported);
                 else if (lse >= 8 || (lse & ~ppd->link_speed_supported))
-                        goto err;
-                set_link_speed_enabled(ppd, lse);
+                        smp->status |= IB_SMP_INVALID_FIELD;
+                else if (lse != ppd->link_speed_enabled)
+                        set_link_speed_enabled(ppd, lse);
         }
 
         /* Set link down default state. */
@@ -738,7 +742,7 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                                         IB_LINKINITCMD_POLL);
                 break;
         default:
-                goto err;
+                smp->status |= IB_SMP_INVALID_FIELD;
         }
 
         ibp->mkeyprot = pip->mkeyprot_resv_lmc >> 6;
@@ -748,15 +752,17 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
 
         mtu = ib_mtu_enum_to_int((pip->neighbormtu_mastersmsl >> 4) & 0xF);
         if (mtu == -1)
-                goto err;
-        qib_set_mtu(ppd, mtu);
+                smp->status |= IB_SMP_INVALID_FIELD;
+        else
+                qib_set_mtu(ppd, mtu);
 
         /* Set operational VLs */
         vls = (pip->operationalvl_pei_peo_fpi_fpo >> 4) & 0xF;
         if (vls) {
                 if (vls > ppd->vls_supported)
-                        goto err;
-                (void) dd->f_set_ib_cfg(ppd, QIB_IB_CFG_OP_VLS, vls);
+                        smp->status |= IB_SMP_INVALID_FIELD;
+                else
+                        (void) dd->f_set_ib_cfg(ppd, QIB_IB_CFG_OP_VLS, vls);
         }
 
         if (pip->mkey_violations == 0)
@@ -770,10 +776,10 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
 
         ore = pip->localphyerrors_overrunerrors;
         if (set_phyerrthreshold(ppd, (ore >> 4) & 0xF))
-                goto err;
+                smp->status |= IB_SMP_INVALID_FIELD;
 
         if (set_overrunthreshold(ppd, (ore & 0xF)))
-                goto err;
+                smp->status |= IB_SMP_INVALID_FIELD;
 
         ibp->subnet_timeout = pip->clientrereg_resv_subnetto & 0x1F;
 
@@ -792,7 +798,7 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         state = pip->linkspeed_portstate & 0xF;
         lstate = (pip->portphysstate_linkdown >> 4) & 0xF;
         if (lstate && !(state == IB_PORT_DOWN || state == IB_PORT_NOP))
-                goto err;
+                smp->status |= IB_SMP_INVALID_FIELD;
 
         /*
          * Only state changes of DOWN, ARM, and ACTIVE are valid
@@ -812,8 +818,10 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                         lstate = QIB_IB_LINKDOWN;
                 else if (lstate == 3)
                         lstate = QIB_IB_LINKDOWN_DISABLE;
-                else
-                        goto err;
+                else {
+                        smp->status |= IB_SMP_INVALID_FIELD;
+                        break;
+                }
                 spin_lock_irqsave(&ppd->lflags_lock, flags);
                 ppd->lflags &= ~QIBL_LINKV;
                 spin_unlock_irqrestore(&ppd->lflags_lock, flags);
@@ -835,8 +843,7 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                 qib_set_linkstate(ppd, QIB_IB_LINKACTIVE);
                 break;
         default:
-                /* XXX We have already partially updated our state! */
-                goto err;
+                smp->status |= IB_SMP_INVALID_FIELD;
         }
 
         ret = subn_get_portinfo(smp, ibdev, port);
@@ -844,7 +851,7 @@ static int subn_set_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
         if (clientrereg)
                 pip->clientrereg_resv_subnetto |= 0x80;
 
-        goto done;
+        goto get_only;
 
 err:
         smp->status |= IB_SMP_INVALID_FIELD;
diff --git a/drivers/infiniband/hw/qib/qib_mad.h b/drivers/infiniband/hw/qib/qib_mad.h
index 147aff9117d7..7840ab593bcf 100644
--- a/drivers/infiniband/hw/qib/qib_mad.h
+++ b/drivers/infiniband/hw/qib/qib_mad.h
@@ -73,7 +73,7 @@ struct ib_mad_notice_attr {
 
                 struct {
                         __be16  reserved;
-                        __be16  lid;            /* LID where change occured */
+                        __be16  lid;            /* LID where change occurred */
                         u8      reserved2;
                         u8      local_changes;  /* low bit - local changes */
                         __be32  new_cap_mask;   /* new capability mask */
diff --git a/drivers/infiniband/hw/qib/qib_mr.c b/drivers/infiniband/hw/qib/qib_mr.c
index 5f95f0f6385d..08944e2ee334 100644
--- a/drivers/infiniband/hw/qib/qib_mr.c
+++ b/drivers/infiniband/hw/qib/qib_mr.c
@@ -39,7 +39,6 @@
 /* Fast memory region */
 struct qib_fmr {
         struct ib_fmr ibfmr;
-        u8 page_shift;
         struct qib_mregion mr;        /* must be last */
 };
 
@@ -107,6 +106,7 @@ static struct qib_mr *alloc_mr(int count, struct qib_lkey_table *lk_table)
                         goto bail;
         }
         mr->mr.mapsz = m;
+        mr->mr.page_shift = 0;
         mr->mr.max_segs = count;
 
         /*
@@ -231,6 +231,8 @@ struct ib_mr *qib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
         mr->mr.access_flags = mr_access_flags;
         mr->umem = umem;
 
+        if (is_power_of_2(umem->page_size))
+                mr->mr.page_shift = ilog2(umem->page_size);
         m = 0;
         n = 0;
         list_for_each_entry(chunk, &umem->chunk_list, list) {
@@ -390,7 +392,7 @@ struct ib_fmr *qib_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
         fmr->mr.offset = 0;
         fmr->mr.access_flags = mr_access_flags;
         fmr->mr.max_segs = fmr_attr->max_pages;
-        fmr->page_shift = fmr_attr->page_shift;
+        fmr->mr.page_shift = fmr_attr->page_shift;
 
         atomic_set(&fmr->mr.refcount, 0);
         ret = &fmr->ibfmr;
@@ -437,7 +439,7 @@ int qib_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list,
         spin_lock_irqsave(&rkt->lock, flags);
         fmr->mr.user_base = iova;
         fmr->mr.iova = iova;
-        ps = 1 << fmr->page_shift;
+        ps = 1 << fmr->mr.page_shift;
         fmr->mr.length = list_len * ps;
         m = 0;
         n = 0;
diff --git a/drivers/infiniband/hw/qib/qib_pcie.c b/drivers/infiniband/hw/qib/qib_pcie.c
index 7fa6e5592630..891cc2ff5f00 100644
--- a/drivers/infiniband/hw/qib/qib_pcie.c
+++ b/drivers/infiniband/hw/qib/qib_pcie.c
@@ -103,16 +103,20 @@ int qib_pcie_init(struct pci_dev *pdev, const struct pci_device_id *ent)
                 ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
         } else
                 ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
-        if (ret)
+        if (ret) {
                 qib_early_err(&pdev->dev,
                               "Unable to set DMA consistent mask: %d\n", ret);
+                goto bail;
+        }
 
         pci_set_master(pdev);
         ret = pci_enable_pcie_error_reporting(pdev);
-        if (ret)
+        if (ret) {
                 qib_early_err(&pdev->dev,
                               "Unable to enable pcie error reporting: %d\n",
                               ret);
+                ret = 0;
+        }
         goto done;
 
 bail:
@@ -522,11 +526,8 @@ static int qib_tune_pcie_coalesce(struct qib_devdata *dd)
          */
         devid = parent->device;
         if (devid >= 0x25e2 && devid <= 0x25fa) {
-                u8 rev;
-
                 /* 5000 P/V/X/Z */
-                pci_read_config_byte(parent, PCI_REVISION_ID, &rev);
-                if (rev <= 0xb2)
+                if (parent->revision <= 0xb2)
                         bits = 1U << 10;
                 else
                         bits = 7U << 10;
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 6c39851d2ded..e16751f8639e 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -48,13 +48,12 @@ static inline unsigned mk_qpn(struct qib_qpn_table *qpt,
 
 static inline unsigned find_next_offset(struct qib_qpn_table *qpt,
                                         struct qpn_map *map, unsigned off,
-                                        unsigned r)
+                                        unsigned n)
 {
         if (qpt->mask) {
                 off++;
-                if ((off & qpt->mask) >> 1 != r)
-                        off = ((off & qpt->mask) ?
-                                (off | qpt->mask) + 1 : off) | (r << 1);
+                if (((off & qpt->mask) >> 1) >= n)
+                        off = (off | qpt->mask) + 2;
         } else
                 off = find_next_zero_bit(map->page, BITS_PER_PAGE, off);
         return off;
@@ -123,7 +122,6 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
         u32 i, offset, max_scan, qpn;
         struct qpn_map *map;
         u32 ret;
-        int r;
 
         if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
                 unsigned n;
@@ -139,15 +137,11 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
                 goto bail;
         }
 
-        r = smp_processor_id();
-        if (r >= dd->n_krcv_queues)
-                r %= dd->n_krcv_queues;
-        qpn = qpt->last + 1;
+        qpn = qpt->last + 2;
         if (qpn >= QPN_MAX)
                 qpn = 2;
-        if (qpt->mask && ((qpn & qpt->mask) >> 1) != r)
-                qpn = ((qpn & qpt->mask) ? (qpn | qpt->mask) + 1 : qpn) |
-                        (r << 1);
+        if (qpt->mask && ((qpn & qpt->mask) >> 1) >= dd->n_krcv_queues)
+                qpn = (qpn | qpt->mask) + 2;
         offset = qpn & BITS_PER_PAGE_MASK;
         map = &qpt->map[qpn / BITS_PER_PAGE];
         max_scan = qpt->nmaps - !offset;
@@ -163,7 +157,8 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
                                 ret = qpn;
                                 goto bail;
                         }
-                        offset = find_next_offset(qpt, map, offset, r);
+                        offset = find_next_offset(qpt, map, offset,
+                                dd->n_krcv_queues);
                         qpn = mk_qpn(qpt, map, offset);
                         /*
                          * This test differs from alloc_pidmap().
@@ -183,13 +178,13 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
                         if (qpt->nmaps == QPNMAP_ENTRIES)
                                 break;
                         map = &qpt->map[qpt->nmaps++];
-                        offset = qpt->mask ? (r << 1) : 0;
+                        offset = 0;
                 } else if (map < &qpt->map[qpt->nmaps]) {
                         ++map;
-                        offset = qpt->mask ? (r << 1) : 0;
+                        offset = 0;
                 } else {
                         map = &qpt->map[0];
-                        offset = qpt->mask ? (r << 1) : 2;
+                        offset = 2;
                 }
                 qpn = mk_qpn(qpt, map, offset);
         }
@@ -468,6 +463,10 @@ int qib_error_qp(struct qib_qp *qp, enum ib_wc_status err)
                 qp->s_flags &= ~(QIB_S_TIMER | QIB_S_WAIT_RNR);
                 del_timer(&qp->s_timer);
         }
+
+        if (qp->s_flags & QIB_S_ANY_WAIT_SEND)
+                qp->s_flags &= ~QIB_S_ANY_WAIT_SEND;
+
         spin_lock(&dev->pending_lock);
         if (!list_empty(&qp->iowait) && !(qp->s_flags & QIB_S_BUSY)) {
                 qp->s_flags &= ~QIB_S_ANY_WAIT_IO;
@@ -1061,7 +1060,6 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
                 }
                 qp->ibqp.qp_num = err;
                 qp->port_num = init_attr->port_num;
-                qp->processor_id = smp_processor_id();
                 qib_reset_qp(qp, init_attr->qp_type);
                 break;
 
diff --git a/drivers/infiniband/hw/qib/qib_qsfp.c b/drivers/infiniband/hw/qib/qib_qsfp.c
index 35b3604b691d..3374a52232c1 100644
--- a/drivers/infiniband/hw/qib/qib_qsfp.c
+++ b/drivers/infiniband/hw/qib/qib_qsfp.c
@@ -485,7 +485,7 @@ void qib_qsfp_init(struct qib_qsfp_data *qd,
                 goto bail;
         /* We see a module, but it may be unwise to look yet. Just schedule */
         qd->t_insert = get_jiffies_64();
-        schedule_work(&qd->work);
+        queue_work(ib_wq, &qd->work);
 bail:
         return;
 }
@@ -493,10 +493,9 @@ bail:
 void qib_qsfp_deinit(struct qib_qsfp_data *qd)
 {
         /*
-         * There is nothing to do here for now.  our
-         * work is scheduled with schedule_work(), and
-         * flush_scheduled_work() from remove_one will
-         * block until all work ssetup with schedule_work()
+         * There is nothing to do here for now.  our work is scheduled
+         * with queue_work(), and flush_workqueue() from remove_one
+         * will block until all work setup with queue_work()
          * completes.
          */
 }
diff --git a/drivers/infiniband/hw/qib/qib_qsfp.h b/drivers/infiniband/hw/qib/qib_qsfp.h
index 19b527bafd57..c109bbdc90ac 100644
--- a/drivers/infiniband/hw/qib/qib_qsfp.h
+++ b/drivers/infiniband/hw/qib/qib_qsfp.h
@@ -79,6 +79,8 @@
 extern const char *const qib_qsfp_devtech[16];
 /* Active Equalization includes fiber, copper full EQ, and copper near Eq */
 #define QSFP_IS_ACTIVE(tech) ((0xA2FF >> ((tech) >> 4)) & 1)
+/* Active Equalization includes fiber, copper full EQ, and copper far Eq */
+#define QSFP_IS_ACTIVE_FAR(tech) ((0x32FF >> ((tech) >> 4)) & 1)
 /* Attenuation should be valid for copper other than full/near Eq */
 #define QSFP_HAS_ATTEN(tech) ((0x4D00 >> ((tech) >> 4)) & 1)
 /* Length is only valid if technology is "copper" */
diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c
index a0931119bd78..eca0c41f1226 100644
--- a/drivers/infiniband/hw/qib/qib_rc.c
+++ b/drivers/infiniband/hw/qib/qib_rc.c
@@ -1005,7 +1005,8 @@ void qib_rc_send_complete(struct qib_qp *qp, struct qib_ib_header *hdr)
          * there are still requests that haven't been acked.
          */
         if ((psn & IB_BTH_REQ_ACK) && qp->s_acked != qp->s_tail &&
-            !(qp->s_flags & (QIB_S_TIMER | QIB_S_WAIT_RNR | QIB_S_WAIT_PSN)))
+            !(qp->s_flags & (QIB_S_TIMER | QIB_S_WAIT_RNR | QIB_S_WAIT_PSN)) &&
+            (ib_qib_state_ops[qp->state] & QIB_PROCESS_RECV_OK))
                 start_timer(qp);
 
         while (qp->s_last != qp->s_acked) {
@@ -1407,6 +1408,7 @@ static void qib_rc_rcv_resp(struct qib_ibport *ibp,
                             struct qib_ctxtdata *rcd)
 {
         struct qib_swqe *wqe;
+        struct qib_pportdata *ppd = ppd_from_ibp(ibp);
         enum ib_wc_status status;
         unsigned long flags;
         int diff;
@@ -1414,7 +1416,32 @@ static void qib_rc_rcv_resp(struct qib_ibport *ibp,
         u32 aeth;
         u64 val;
 
+        if (opcode != OP(RDMA_READ_RESPONSE_MIDDLE)) {
+                /*
+                 * If ACK'd PSN on SDMA busy list try to make progress to
+                 * reclaim SDMA credits.
+                 */
+                if ((qib_cmp24(psn, qp->s_sending_psn) >= 0) &&
+                    (qib_cmp24(qp->s_sending_psn, qp->s_sending_hpsn) <= 0)) {
+
+                        /*
+                         * If send tasklet not running attempt to progress
+                         * SDMA queue.
+                         */
+                        if (!(qp->s_flags & QIB_S_BUSY)) {
+                                /* Acquire SDMA Lock */
+                                spin_lock_irqsave(&ppd->sdma_lock, flags);
+                                /* Invoke sdma make progress */
+                                qib_sdma_make_progress(ppd);
+                                /* Release SDMA Lock */
+                                spin_unlock_irqrestore(&ppd->sdma_lock, flags);
+                        }
+                }
+        }
+
         spin_lock_irqsave(&qp->s_lock, flags);
+        if (!(ib_qib_state_ops[qp->state] & QIB_PROCESS_RECV_OK))
+                goto ack_done;
 
         /* Ignore invalid responses. */
         if (qib_cmp24(psn, qp->s_next_psn) >= 0)
@@ -2068,7 +2095,10 @@ send_last:
                         goto nack_op_err;
                 if (!ret)
                         goto rnr_nak;
-                goto send_last_imm;
+                wc.ex.imm_data = ohdr->u.rc.imm_data;
+                hdrsize += 4;
+                wc.wc_flags = IB_WC_WITH_IMM;
+                goto send_last;
 
         case OP(RDMA_READ_REQUEST): {
                 struct qib_ack_entry *e;
diff --git a/drivers/infiniband/hw/qib/qib_twsi.c b/drivers/infiniband/hw/qib/qib_twsi.c
index 6f31ca5039db..ddde72e11edb 100644
--- a/drivers/infiniband/hw/qib/qib_twsi.c
+++ b/drivers/infiniband/hw/qib/qib_twsi.c
@@ -41,7 +41,7 @@
  * QLogic_IB "Two Wire Serial Interface" driver.
  * Originally written for a not-quite-i2c serial eeprom, which is
  * still used on some supported boards. Later boards have added a
- * variety of other uses, most board-specific, so teh bit-boffing
+ * variety of other uses, most board-specific, so the bit-boffing
  * part has been split off to this file, while the other parts
  * have been moved to chip-specific files.
  *
diff --git a/drivers/infiniband/hw/qib/qib_uc.c b/drivers/infiniband/hw/qib/qib_uc.c
index b9c8b6346c1b..32ccf3c824ca 100644
--- a/drivers/infiniband/hw/qib/qib_uc.c
+++ b/drivers/infiniband/hw/qib/qib_uc.c
@@ -457,8 +457,10 @@ rdma_first:
                 }
                 if (opcode == OP(RDMA_WRITE_ONLY))
                         goto rdma_last;
-                else if (opcode == OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE))
+                else if (opcode == OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE)) {
+                        wc.ex.imm_data = ohdr->u.rc.imm_data;
                         goto rdma_last_imm;
+                }
                 /* FALLTHROUGH */
         case OP(RDMA_WRITE_MIDDLE):
                 /* Check for invalid length PMTU or posted rwqe len. */
@@ -471,8 +473,8 @@ rdma_first:
                 break;
 
         case OP(RDMA_WRITE_LAST_WITH_IMMEDIATE):
-rdma_last_imm:
                 wc.ex.imm_data = ohdr->u.imm_data;
+rdma_last_imm:
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
 
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index e1b3da2a1f85..828609fa4d28 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -116,7 +116,7 @@ static void qib_ud_loopback(struct qib_qp *sqp, struct qib_swqe *swqe)
         }
 
         /*
-         * A GRH is expected to preceed the data even if not
+         * A GRH is expected to precede the data even if not
          * present on the wire.
          */
         length = swqe->length;
@@ -445,13 +445,14 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
         qkey = be32_to_cpu(ohdr->u.ud.deth[0]);
         src_qp = be32_to_cpu(ohdr->u.ud.deth[1]) & QIB_QPN_MASK;
 
-        /* Get the number of bytes the message was padded by. */
+        /*
+         * Get the number of bytes the message was padded by
+         * and drop incomplete packets.
+         */
         pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
-        if (unlikely(tlen < (hdrsize + pad + 4))) {
-                /* Drop incomplete packets. */
-                ibp->n_pkt_drops++;
-                goto bail;
-        }
+        if (unlikely(tlen < (hdrsize + pad + 4)))
+                goto drop;
+
         tlen -= hdrsize + pad + 4;
 
         /*
@@ -460,10 +461,8 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
          */
         if (qp->ibqp.qp_num) {
                 if (unlikely(hdr->lrh[1] == IB_LID_PERMISSIVE ||
-                             hdr->lrh[3] == IB_LID_PERMISSIVE)) {
-                        ibp->n_pkt_drops++;
-                        goto bail;
-                }
+                             hdr->lrh[3] == IB_LID_PERMISSIVE))
+                        goto drop;
                 if (qp->ibqp.qp_num > 1) {
                         u16 pkey1, pkey2;
 
@@ -476,7 +475,7 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
                                                 0xF,
                                               src_qp, qp->ibqp.qp_num,
                                               hdr->lrh[3], hdr->lrh[1]);
-                                goto bail;
+                                return;
                         }
                 }
                 if (unlikely(qkey != qp->qkey)) {
@@ -484,30 +483,24 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
                                       (be16_to_cpu(hdr->lrh[0]) >> 4) & 0xF,
                                       src_qp, qp->ibqp.qp_num,
                                       hdr->lrh[3], hdr->lrh[1]);
-                        goto bail;
+                        return;
                 }
                 /* Drop invalid MAD packets (see 13.5.3.1). */
                 if (unlikely(qp->ibqp.qp_num == 1 &&
                              (tlen != 256 ||
-                              (be16_to_cpu(hdr->lrh[0]) >> 12) == 15))) {
-                        ibp->n_pkt_drops++;
-                        goto bail;
-                }
+                              (be16_to_cpu(hdr->lrh[0]) >> 12) == 15)))
+                        goto drop;
         } else {
                 struct ib_smp *smp;
 
                 /* Drop invalid MAD packets (see 13.5.3.1). */
-                if (tlen != 256 || (be16_to_cpu(hdr->lrh[0]) >> 12) != 15) {
-                        ibp->n_pkt_drops++;
-                        goto bail;
-                }
+                if (tlen != 256 || (be16_to_cpu(hdr->lrh[0]) >> 12) != 15)
+                        goto drop;
                 smp = (struct ib_smp *) data;
                 if ((hdr->lrh[1] == IB_LID_PERMISSIVE ||
                      hdr->lrh[3] == IB_LID_PERMISSIVE) &&
-                    smp->mgmt_class != IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
-                        ibp->n_pkt_drops++;
-                        goto bail;
-                }
+                    smp->mgmt_class != IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
+                        goto drop;
         }
 
         /*
@@ -519,17 +512,15 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                hdrsize += sizeof(u32);
+                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
-        } else {
-                ibp->n_pkt_drops++;
-                goto bail;
-        }
+        } else
+                goto drop;
 
         /*
-         * A GRH is expected to preceed the data even if not
+         * A GRH is expected to precede the data even if not
          * present on the wire.
          */
         wc.byte_len = tlen + sizeof(struct ib_grh);
@@ -556,8 +547,7 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
         /* Silently drop packets which are too big. */
         if (unlikely(wc.byte_len > qp->r_len)) {
                 qp->r_flags |= QIB_R_REUSE_SGE;
-                ibp->n_pkt_drops++;
-                return;
+                goto drop;
         }
         if (has_grh) {
                 qib_copy_sge(&qp->r_sge, &hdr->u.l.grh,
@@ -594,5 +584,8 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr,
         qib_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
                      (ohdr->bth[0] &
                         cpu_to_be32(IB_BTH_SOLICITED)) != 0);
-bail:;
+        return;
+
+drop:
+        ibp->n_pkt_drops++;
 }
diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c
index d7a26c1d4f37..7689e49c13c9 100644
--- a/drivers/infiniband/hw/qib/qib_user_pages.c
+++ b/drivers/infiniband/hw/qib/qib_user_pages.c
@@ -51,8 +51,8 @@ static void __qib_release_user_pages(struct page **p, size_t num_pages,
 /*
  * Call with current->mm->mmap_sem held.
  */
-static int __get_user_pages(unsigned long start_page, size_t num_pages,
-                            struct page **p, struct vm_area_struct **vma)
+static int __qib_get_user_pages(unsigned long start_page, size_t num_pages,
+                                struct page **p, struct vm_area_struct **vma)
 {
         unsigned long lock_limit;
         size_t got;
@@ -136,7 +136,7 @@ int qib_get_user_pages(unsigned long start_page, size_t num_pages,
 
         down_write(&current->mm->mmap_sem);
 
-        ret = __get_user_pages(start_page, num_pages, p, NULL);
+        ret = __qib_get_user_pages(start_page, num_pages, p, NULL);
 
         up_write(&current->mm->mmap_sem);
 
diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
index 4c19e06b5e85..82442085cbe6 100644
--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
+++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
@@ -239,7 +239,7 @@ static int qib_user_sdma_num_pages(const struct iovec *iov)
 }
 
 /*
- * Truncate length to page boundry.
+ * Truncate length to page boundary.
  */
 static int qib_user_sdma_page_length(unsigned long addr, unsigned long len)
 {
@@ -382,6 +382,7 @@ static void qib_user_sdma_free_pkt_list(struct device *dev,
 
                 kmem_cache_free(pq->pkt_slab, pkt);
         }
+        INIT_LIST_HEAD(list);
 }
 
 /*
diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
index bd57c1273225..95e5b47223b3 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.h
+++ b/drivers/infiniband/hw/qib/qib_verbs.h
@@ -301,6 +301,7 @@ struct qib_mregion {
         int access_flags;
         u32 max_segs;           /* number of qib_segs in all the arrays */
         u32 mapsz;              /* size of the map array */
+        u8  page_shift;         /* 0 - non unform/non powerof2 sizes */
         atomic_t refcount;
         struct qib_segarray *map[0];    /* the segments */
 };
@@ -435,7 +436,6 @@ struct qib_qp {
         spinlock_t r_lock;      /* used for APM */
         spinlock_t s_lock;
         atomic_t s_dma_busy;
-        unsigned processor_id;  /* Processor ID QP is bound to */
         u32 s_flags;
         u32 s_cur_size;         /* size of send packet in bytes */
         u32 s_len;              /* total length of s_sge */
@@ -805,7 +805,6 @@ static inline int qib_send_ok(struct qib_qp *qp)
                  !(qp->s_flags & QIB_S_ANY_WAIT_SEND));
 }
 
-extern struct workqueue_struct *qib_wq;
 extern struct workqueue_struct *qib_cq_wq;
 
 /*
@@ -813,13 +812,8 @@ extern struct workqueue_struct *qib_cq_wq;
  */
 static inline void qib_schedule_send(struct qib_qp *qp)
 {
-        if (qib_send_ok(qp)) {
-                if (qp->processor_id == smp_processor_id())
-                        queue_work(qib_wq, &qp->s_work);
-                else
-                        queue_work_on(qp->processor_id,
-                                      qib_wq, &qp->s_work);
-        }
+        if (qib_send_ok(qp))
+                queue_work(ib_wq, &qp->s_work);
 }
 
 static inline int qib_pkey_ok(u16 pkey1, u16 pkey2)