8 files changed, 116 insertions, 89 deletions

diff --git a/drivers/infiniband/ulp/ipoib/Kconfig b/drivers/infiniband/ulp/ipoib/Kconfig
index 8d2e04cac68e..13d6d01c72c0 100644
--- a/drivers/infiniband/ulp/ipoib/Kconfig
+++ b/drivers/infiniband/ulp/ipoib/Kconfig
@@ -10,8 +10,9 @@ config INFINIBAND_IPOIB
           group: <http://www.ietf.org/html.charters/ipoib-charter.html>.
 
 config INFINIBAND_IPOIB_DEBUG
-        bool "IP-over-InfiniBand debugging"
+        bool "IP-over-InfiniBand debugging" if EMBEDDED
         depends on INFINIBAND_IPOIB
+        default y
         ---help---
           This option causes debugging code to be compiled into the
           IPoIB driver.  The output can be turned on via the
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index b640107fb732..12a1e0572ef2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -65,6 +65,8 @@ enum {
 
         IPOIB_RX_RING_SIZE        = 128,
         IPOIB_TX_RING_SIZE        = 64,
+        IPOIB_MAX_QUEUE_SIZE      = 8192,
+        IPOIB_MIN_QUEUE_SIZE      = 2,
 
         IPOIB_NUM_WC              = 4,
 
@@ -230,6 +232,9 @@ static inline struct ipoib_neigh **to_ipoib_neigh(struct neighbour *neigh)
                                      INFINIBAND_ALEN, sizeof(void *));
 }
 
+struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neigh);
+void ipoib_neigh_free(struct ipoib_neigh *neigh);
+
 extern struct workqueue_struct *ipoib_workqueue;
 
 /* functions */
@@ -329,6 +334,8 @@ static inline void ipoib_unregister_debugfs(void) { }
 #define ipoib_warn(priv, format, arg...)                \
         ipoib_printk(KERN_WARNING, priv, format , ## arg)
 
+extern int ipoib_sendq_size;
+extern int ipoib_recvq_size;
 
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
 extern int ipoib_debug_level;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 685258e34034..5dde380e8dbe 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -213,7 +213,7 @@ static int ipoib_path_seq_show(struct seq_file *file, void *iter_ptr)
                    gid_buf, path.pathrec.dlid ? "yes" : "no");
 
         if (path.pathrec.dlid) {
-                rate = ib_sa_rate_enum_to_int(path.pathrec.rate) * 25;
+                rate = ib_rate_to_mult(path.pathrec.rate) * 25;
 
                 seq_printf(file,
                            "  DLID:     0x%04x\n"
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index ed65202878d8..a54da42849ae 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -161,7 +161,7 @@ static int ipoib_ib_post_receives(struct net_device *dev)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         int i;
 
-        for (i = 0; i < IPOIB_RX_RING_SIZE; ++i) {
+        for (i = 0; i < ipoib_recvq_size; ++i) {
                 if (ipoib_alloc_rx_skb(dev, i)) {
                         ipoib_warn(priv, "failed to allocate receive buffer %d\n", i);
                         return -ENOMEM;
@@ -187,7 +187,7 @@ static void ipoib_ib_handle_wc(struct net_device *dev,
         if (wr_id & IPOIB_OP_RECV) {
                 wr_id &= ~IPOIB_OP_RECV;
 
-                if (wr_id < IPOIB_RX_RING_SIZE) {
+                if (wr_id < ipoib_recvq_size) {
                         struct sk_buff *skb  = priv->rx_ring[wr_id].skb;
                         dma_addr_t      addr = priv->rx_ring[wr_id].mapping;
 
@@ -252,9 +252,9 @@ static void ipoib_ib_handle_wc(struct net_device *dev,
                 struct ipoib_tx_buf *tx_req;
                 unsigned long flags;
 
-                if (wr_id >= IPOIB_TX_RING_SIZE) {
+                if (wr_id >= ipoib_sendq_size) {
                         ipoib_warn(priv, "completion event with wrid %d (> %d)\n",
-                                   wr_id, IPOIB_TX_RING_SIZE);
+                                   wr_id, ipoib_sendq_size);
                         return;
                 }
 
@@ -275,7 +275,7 @@ static void ipoib_ib_handle_wc(struct net_device *dev,
                 spin_lock_irqsave(&priv->tx_lock, flags);
                 ++priv->tx_tail;
                 if (netif_queue_stopped(dev) &&
-                    priv->tx_head - priv->tx_tail <= IPOIB_TX_RING_SIZE / 2)
+                    priv->tx_head - priv->tx_tail <= ipoib_sendq_size >> 1)
                         netif_wake_queue(dev);
                 spin_unlock_irqrestore(&priv->tx_lock, flags);
 
@@ -344,13 +344,13 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
          * means we have to make sure everything is properly recorded and
          * our state is consistent before we call post_send().
          */
-        tx_req = &priv->tx_ring[priv->tx_head & (IPOIB_TX_RING_SIZE - 1)];
+        tx_req = &priv->tx_ring[priv->tx_head & (ipoib_sendq_size - 1)];
         tx_req->skb = skb;
         addr = dma_map_single(priv->ca->dma_device, skb->data, skb->len,
                               DMA_TO_DEVICE);
         pci_unmap_addr_set(tx_req, mapping, addr);
 
-        if (unlikely(post_send(priv, priv->tx_head & (IPOIB_TX_RING_SIZE - 1),
+        if (unlikely(post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
                                address->ah, qpn, addr, skb->len))) {
                 ipoib_warn(priv, "post_send failed\n");
                 ++priv->stats.tx_errors;
@@ -363,7 +363,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 address->last_send = priv->tx_head;
                 ++priv->tx_head;
 
-                if (priv->tx_head - priv->tx_tail == IPOIB_TX_RING_SIZE) {
+                if (priv->tx_head - priv->tx_tail == ipoib_sendq_size) {
                         ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
                         netif_stop_queue(dev);
                 }
@@ -488,7 +488,7 @@ static int recvs_pending(struct net_device *dev)
         int pending = 0;
         int i;
 
-        for (i = 0; i < IPOIB_RX_RING_SIZE; ++i)
+        for (i = 0; i < ipoib_recvq_size; ++i)
                 if (priv->rx_ring[i].skb)
                         ++pending;
 
@@ -527,7 +527,7 @@ int ipoib_ib_dev_stop(struct net_device *dev)
                          */
                         while ((int) priv->tx_tail - (int) priv->tx_head < 0) {
                                 tx_req = &priv->tx_ring[priv->tx_tail &
-                                                        (IPOIB_TX_RING_SIZE - 1)];
+                                                        (ipoib_sendq_size - 1)];
                                 dma_unmap_single(priv->ca->dma_device,
                                                  pci_unmap_addr(tx_req, mapping),
                                                  tx_req->skb->len,
@@ -536,7 +536,7 @@ int ipoib_ib_dev_stop(struct net_device *dev)
                                 ++priv->tx_tail;
                         }
 
-                        for (i = 0; i < IPOIB_RX_RING_SIZE; ++i)
+                        for (i = 0; i < ipoib_recvq_size; ++i)
                                 if (priv->rx_ring[i].skb) {
                                         dma_unmap_single(priv->ca->dma_device,
                                                          pci_unmap_addr(&priv->rx_ring[i],
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 9b0bd7c746ca..cb078a7d0bf5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -41,6 +41,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <linux/kernel.h>
 
 #include <linux/if_arp.h>       /* For ARPHRD_xxx */
 
@@ -53,6 +54,14 @@ MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("IP-over-InfiniBand net driver");
 MODULE_LICENSE("Dual BSD/GPL");
 
+int ipoib_sendq_size __read_mostly = IPOIB_TX_RING_SIZE;
+int ipoib_recvq_size __read_mostly = IPOIB_RX_RING_SIZE;
+
+module_param_named(send_queue_size, ipoib_sendq_size, int, 0444);
+MODULE_PARM_DESC(send_queue_size, "Number of descriptors in send queue");
+module_param_named(recv_queue_size, ipoib_recvq_size, int, 0444);
+MODULE_PARM_DESC(recv_queue_size, "Number of descriptors in receive queue");
+
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
 int ipoib_debug_level;
 
@@ -252,8 +261,8 @@ static void path_free(struct net_device *dev, struct ipoib_path *path)
                  */
                 if (neigh->ah)
                         ipoib_put_ah(neigh->ah);
-                *to_ipoib_neigh(neigh->neighbour) = NULL;
-                kfree(neigh);
+
+                ipoib_neigh_free(neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -327,9 +336,8 @@ void ipoib_flush_paths(struct net_device *dev)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_path *path, *tp;
         LIST_HEAD(remove_list);
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irq(&priv->lock);
 
         list_splice(&priv->path_list, &remove_list);
         INIT_LIST_HEAD(&priv->path_list);
@@ -337,14 +345,15 @@ void ipoib_flush_paths(struct net_device *dev)
         list_for_each_entry(path, &remove_list, list)
                 rb_erase(&path->rb_node, &priv->path_tree);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         list_for_each_entry_safe(path, tp, &remove_list, list) {
                 if (path->query)
                         ib_sa_cancel_query(path->query_id, path->query);
+                spin_unlock_irq(&priv->lock);
                 wait_for_completion(&path->done);
                 path_free(dev, path);
+                spin_lock_irq(&priv->lock);
         }
+        spin_unlock_irq(&priv->lock);
 }
 
 static void path_rec_completion(int status,
@@ -373,16 +382,9 @@ static void path_rec_completion(int status,
                 struct ib_ah_attr av = {
                         .dlid          = be16_to_cpu(pathrec->dlid),
                         .sl            = pathrec->sl,
-                        .port_num      = priv->port
+                        .port_num      = priv->port,
+                        .static_rate   = pathrec->rate
                 };
-                int path_rate = ib_sa_rate_enum_to_int(pathrec->rate);
-
-                if (path_rate > 0 && priv->local_rate > path_rate)
-                        av.static_rate = (priv->local_rate - 1) / path_rate;
-
-                ipoib_dbg(priv, "static_rate %d for local port %dX, path %dX\n",
-                          av.static_rate, priv->local_rate,
-                          ib_sa_rate_enum_to_int(pathrec->rate));
 
                 ah = ipoib_create_ah(dev, priv->pd, &av);
         }
@@ -481,7 +483,7 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
         struct ipoib_path *path;
         struct ipoib_neigh *neigh;
 
-        neigh = kmalloc(sizeof *neigh, GFP_ATOMIC);
+        neigh = ipoib_neigh_alloc(skb->dst->neighbour);
         if (!neigh) {
                 ++priv->stats.tx_dropped;
                 dev_kfree_skb_any(skb);
@@ -489,8 +491,6 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb_queue_head_init(&neigh->queue);
-        neigh->neighbour = skb->dst->neighbour;
-        *to_ipoib_neigh(skb->dst->neighbour) = neigh;
 
         /*
          * We can only be called from ipoib_start_xmit, so we're
@@ -503,7 +503,7 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                 path = path_rec_create(dev,
                                        (union ib_gid *) (skb->dst->neighbour->ha + 4));
                 if (!path)
-                        goto err;
+                        goto err_path;
 
                 __path_add(dev, path);
         }
@@ -521,17 +521,17 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                 __skb_queue_tail(&neigh->queue, skb);
 
                 if (!path->query && path_rec_start(dev, path))
-                        goto err;
+                        goto err_list;
         }
 
         spin_unlock(&priv->lock);
         return;
 
-err:
-        *to_ipoib_neigh(skb->dst->neighbour) = NULL;
+err_list:
         list_del(&neigh->list);
-        kfree(neigh);
 
+err_path:
+        ipoib_neigh_free(neigh);
         ++priv->stats.tx_dropped;
         dev_kfree_skb_any(skb);
 
@@ -763,8 +763,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
                 if (neigh->ah)
                         ah = neigh->ah;
                 list_del(&neigh->list);
-                *to_ipoib_neigh(n) = NULL;
-                kfree(neigh);
+                ipoib_neigh_free(neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -773,6 +772,26 @@ static void ipoib_neigh_destructor(struct neighbour *n)
                 ipoib_put_ah(ah);
 }
 
+struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neighbour)
+{
+        struct ipoib_neigh *neigh;
+
+        neigh = kmalloc(sizeof *neigh, GFP_ATOMIC);
+        if (!neigh)
+                return NULL;
+
+        neigh->neighbour = neighbour;
+        *to_ipoib_neigh(neighbour) = neigh;
+
+        return neigh;
+}
+
+void ipoib_neigh_free(struct ipoib_neigh *neigh)
+{
+        *to_ipoib_neigh(neigh->neighbour) = NULL;
+        kfree(neigh);
+}
+
 static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms)
 {
         parms->neigh_destructor = ipoib_neigh_destructor;
@@ -785,20 +804,19 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
 
         /* Allocate RX/TX "rings" to hold queued skbs */
-
-        priv->rx_ring = kzalloc(IPOIB_RX_RING_SIZE * sizeof (struct ipoib_rx_buf),
+        priv->rx_ring = kzalloc(ipoib_recvq_size * sizeof *priv->rx_ring,
                                 GFP_KERNEL);
         if (!priv->rx_ring) {
                 printk(KERN_WARNING "%s: failed to allocate RX ring (%d entries)\n",
-                       ca->name, IPOIB_RX_RING_SIZE);
+                       ca->name, ipoib_recvq_size);
                 goto out;
         }
 
-        priv->tx_ring = kzalloc(IPOIB_TX_RING_SIZE * sizeof (struct ipoib_tx_buf),
+        priv->tx_ring = kzalloc(ipoib_sendq_size * sizeof *priv->tx_ring,
                                 GFP_KERNEL);
         if (!priv->tx_ring) {
                 printk(KERN_WARNING "%s: failed to allocate TX ring (%d entries)\n",
-                       ca->name, IPOIB_TX_RING_SIZE);
+                       ca->name, ipoib_sendq_size);
                 goto out_rx_ring_cleanup;
         }
 
@@ -866,7 +884,7 @@ static void ipoib_setup(struct net_device *dev)
         dev->hard_header_len     = IPOIB_ENCAP_LEN + INFINIBAND_ALEN;
         dev->addr_len            = INFINIBAND_ALEN;
         dev->type                = ARPHRD_INFINIBAND;
-        dev->tx_queue_len        = IPOIB_TX_RING_SIZE * 2;
+        dev->tx_queue_len        = ipoib_sendq_size * 2;
         dev->features            = NETIF_F_VLAN_CHALLENGED | NETIF_F_LLTX;
 
         /* MTU will be reset when mcast join happens */
@@ -1118,6 +1136,14 @@ static int __init ipoib_init_module(void)
 {
         int ret;
 
+        ipoib_recvq_size = roundup_pow_of_two(ipoib_recvq_size);
+        ipoib_recvq_size = min(ipoib_recvq_size, IPOIB_MAX_QUEUE_SIZE);
+        ipoib_recvq_size = max(ipoib_recvq_size, IPOIB_MIN_QUEUE_SIZE);
+
+        ipoib_sendq_size = roundup_pow_of_two(ipoib_sendq_size);
+        ipoib_sendq_size = min(ipoib_sendq_size, IPOIB_MAX_QUEUE_SIZE);
+        ipoib_sendq_size = max(ipoib_sendq_size, IPOIB_MIN_QUEUE_SIZE);
+
         ret = ipoib_register_debugfs();
         if (ret)
                 return ret;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 93c462eaf4fd..1dae4b238252 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -114,8 +114,7 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
                  */
                 if (neigh->ah)
                         ipoib_put_ah(neigh->ah);
-                *to_ipoib_neigh(neigh->neighbour) = NULL;
-                kfree(neigh);
+                ipoib_neigh_free(neigh);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -251,6 +250,7 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                         .port_num      = priv->port,
                         .sl            = mcast->mcmember.sl,
                         .ah_flags      = IB_AH_GRH,
+                        .static_rate   = mcast->mcmember.rate,
                         .grh           = {
                                 .flow_label    = be32_to_cpu(mcast->mcmember.flow_label),
                                 .hop_limit     = mcast->mcmember.hop_limit,
@@ -258,17 +258,8 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                                 .traffic_class = mcast->mcmember.traffic_class
                         }
                 };
-                int path_rate = ib_sa_rate_enum_to_int(mcast->mcmember.rate);
-
                 av.grh.dgid = mcast->mcmember.mgid;
 
-                if (path_rate > 0 && priv->local_rate > path_rate)
-                        av.static_rate = (priv->local_rate - 1) / path_rate;
-
-                ipoib_dbg_mcast(priv, "static_rate %d for local port %dX, mcmember %dX\n",
-                                av.static_rate, priv->local_rate,
-                                ib_sa_rate_enum_to_int(mcast->mcmember.rate));
-
                 ah = ipoib_create_ah(dev, priv->pd, &av);
                 if (!ah) {
                         ipoib_warn(priv, "ib_address_create failed\n");
@@ -618,6 +609,22 @@ int ipoib_mcast_start_thread(struct net_device *dev)
         return 0;
 }
 
+static void wait_for_mcast_join(struct ipoib_dev_priv *priv,
+                                struct ipoib_mcast *mcast)
+{
+        spin_lock_irq(&priv->lock);
+        if (mcast && mcast->query) {
+                ib_sa_cancel_query(mcast->query_id, mcast->query);
+                mcast->query = NULL;
+                spin_unlock_irq(&priv->lock);
+                ipoib_dbg_mcast(priv, "waiting for MGID " IPOIB_GID_FMT "\n",
+                                IPOIB_GID_ARG(mcast->mcmember.mgid));
+                wait_for_completion(&mcast->done);
+        }
+        else
+                spin_unlock_irq(&priv->lock);
+}
+
 int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -637,28 +644,10 @@ int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
         if (flush)
                 flush_workqueue(ipoib_workqueue);
 
-        spin_lock_irq(&priv->lock);
-        if (priv->broadcast && priv->broadcast->query) {
-                ib_sa_cancel_query(priv->broadcast->query_id, priv->broadcast->query);
-                priv->broadcast->query = NULL;
-                spin_unlock_irq(&priv->lock);
-                ipoib_dbg_mcast(priv, "waiting for bcast\n");
-                wait_for_completion(&priv->broadcast->done);
-        } else
-                spin_unlock_irq(&priv->lock);
+        wait_for_mcast_join(priv, priv->broadcast);
 
-        list_for_each_entry(mcast, &priv->multicast_list, list) {
-                spin_lock_irq(&priv->lock);
-                if (mcast->query) {
-                        ib_sa_cancel_query(mcast->query_id, mcast->query);
-                        mcast->query = NULL;
-                        spin_unlock_irq(&priv->lock);
-                        ipoib_dbg_mcast(priv, "waiting for MGID " IPOIB_GID_FMT "\n",
-                                        IPOIB_GID_ARG(mcast->mcmember.mgid));
-                        wait_for_completion(&mcast->done);
-                } else
-                        spin_unlock_irq(&priv->lock);
-        }
+        list_for_each_entry(mcast, &priv->multicast_list, list)
+                wait_for_mcast_join(priv, mcast);
 
         return 0;
 }
@@ -772,13 +761,11 @@ out:
                 if (skb->dst            &&
                     skb->dst->neighbour &&
                     !*to_ipoib_neigh(skb->dst->neighbour)) {
-                        struct ipoib_neigh *neigh = kmalloc(sizeof *neigh, GFP_ATOMIC);
+                        struct ipoib_neigh *neigh = ipoib_neigh_alloc(skb->dst->neighbour);
 
                         if (neigh) {
                                 kref_get(&mcast->ah->ref);
                                 neigh->ah       = mcast->ah;
-                                neigh->neighbour = skb->dst->neighbour;
-                                *to_ipoib_neigh(skb->dst->neighbour) = neigh;
                                 list_add_tail(&neigh->list, &mcast->neigh_list);
                         }
                 }
@@ -913,6 +900,7 @@ void ipoib_mcast_restart_task(void *dev_ptr)
 
         /* We have to cancel outside of the spinlock */
         list_for_each_entry_safe(mcast, tmcast, &remove_list, list) {
+                wait_for_mcast_join(priv, mcast);
                 ipoib_mcast_leave(mcast->dev, mcast);
                 ipoib_mcast_free(mcast);
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 5f0388027b25..1d49d1643c59 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -159,8 +159,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ib_qp_init_attr init_attr = {
                 .cap = {
-                        .max_send_wr  = IPOIB_TX_RING_SIZE,
-                        .max_recv_wr  = IPOIB_RX_RING_SIZE,
+                        .max_send_wr  = ipoib_sendq_size,
+                        .max_recv_wr  = ipoib_recvq_size,
                         .max_send_sge = 1,
                         .max_recv_sge = 1
                 },
@@ -175,7 +175,7 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
         }
 
         priv->cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev,
-                                IPOIB_TX_RING_SIZE + IPOIB_RX_RING_SIZE + 1);
+                                ipoib_sendq_size + ipoib_recvq_size + 1);
         if (IS_ERR(priv->cq)) {
                 printk(KERN_WARNING "%s: failed to create CQ\n", ca->name);
                 goto out_free_pd;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index fd8a95a9c5d3..5bb55742ada6 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -617,6 +617,14 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
                      scmnd->sc_data_direction);
 }
 
+static void srp_remove_req(struct srp_target_port *target, struct srp_request *req,
+                           int index)
+{
+        list_del(&req->list);
+        req->next = target->req_head;
+        target->req_head = index;
+}
+
 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
 {
         struct srp_request *req;
@@ -664,9 +672,7 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                         scmnd->host_scribble = (void *) -1L;
                         scmnd->scsi_done(scmnd);
 
-                        list_del(&req->list);
-                        req->next = target->req_head;
-                        target->req_head = rsp->tag & ~SRP_TAG_TSK_MGMT;
+                        srp_remove_req(target, req, rsp->tag & ~SRP_TAG_TSK_MGMT);
                 } else
                         req->cmd_done = 1;
         }
@@ -1188,12 +1194,10 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
         spin_lock_irq(target->scsi_host->host_lock);
 
         if (req->cmd_done) {
-                list_del(&req->list);
-                req->next = target->req_head;
-                target->req_head = req_index;
-
+                srp_remove_req(target, req, req_index);
                 scmnd->scsi_done(scmnd);
         } else if (!req->tsk_status) {
+                srp_remove_req(target, req, req_index);
                 scmnd->result = DID_ABORT << 16;
                 ret = SUCCESS;
         }
@@ -1434,6 +1438,7 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                         p = match_strdup(args);
                         if (strlen(p) != 32) {
                                 printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
+                                kfree(p);
                                 goto out;
                         }