20 files changed, 415 insertions, 167 deletions

diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
index d4e8983fba53..23f38cf2c5cd 100644
--- a/drivers/infiniband/hw/cxgb4/Kconfig
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -1,10 +1,10 @@
 config INFINIBAND_CXGB4
-        tristate "Chelsio T4 RDMA Driver"
+        tristate "Chelsio T4/T5 RDMA Driver"
         depends on CHELSIO_T4 && INET && (IPV6 || IPV6=n)
         select GENERIC_ALLOCATOR
         ---help---
-          This is an iWARP/RDMA driver for the Chelsio T4 1GbE and
-          10GbE adapters.
+          This is an iWARP/RDMA driver for the Chelsio T4 and T5
+          1GbE, 10GbE adapters and T5 40GbE adapter.
 
           For general information about Chelsio and our products, visit
           our website at <http://www.chelsio.com>.
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 02436d5d0dab..1f863a96a480 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -173,12 +173,15 @@ static void start_ep_timer(struct c4iw_ep *ep)
         add_timer(&ep->timer);
 }
 
-static void stop_ep_timer(struct c4iw_ep *ep)
+static int stop_ep_timer(struct c4iw_ep *ep)
 {
         PDBG("%s ep %p stopping\n", __func__, ep);
         del_timer_sync(&ep->timer);
-        if (!test_and_set_bit(TIMEOUT, &ep->com.flags))
+        if (!test_and_set_bit(TIMEOUT, &ep->com.flags)) {
                 c4iw_put_ep(&ep->com);
+                return 0;
+        }
+        return 1;
 }
 
 static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
@@ -584,6 +587,10 @@ static int send_connect(struct c4iw_ep *ep)
                 opt2 |= SACK_EN(1);
         if (wscale && enable_tcp_window_scaling)
                 opt2 |= WND_SCALE_EN(1);
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
         t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
 
         if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
@@ -993,7 +1000,7 @@ static void close_complete_upcall(struct c4iw_ep *ep, int status)
 static int abort_connection(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
 {
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        state_set(&ep->com, ABORTING);
+        __state_set(&ep->com, ABORTING);
         set_bit(ABORT_CONN, &ep->com.history);
         return send_abort(ep, skb, gfp);
 }
@@ -1151,7 +1158,7 @@ static int update_rx_credits(struct c4iw_ep *ep, u32 credits)
         return credits;
 }
 
-static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
+static int process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
 {
         struct mpa_message *mpa;
         struct mpa_v2_conn_params *mpa_v2_params;
@@ -1161,17 +1168,17 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         struct c4iw_qp_attributes attrs;
         enum c4iw_qp_attr_mask mask;
         int err;
+        int disconnect = 0;
 
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
 
         /*
-         * Stop mpa timer.  If it expired, then the state has
-         * changed and we bail since ep_timeout already aborted
-         * the connection.
+         * Stop mpa timer.  If it expired, then
+         * we ignore the MPA reply.  process_timeout()
+         * will abort the connection.
          */
-        stop_ep_timer(ep);
-        if (ep->com.state != MPA_REQ_SENT)
-                return;
+        if (stop_ep_timer(ep))
+                return 0;
 
         /*
          * If we get more than the supported amount of private data
@@ -1193,7 +1200,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
          * if we don't even have the mpa message, then bail.
          */
         if (ep->mpa_pkt_len < sizeof(*mpa))
-                return;
+                return 0;
         mpa = (struct mpa_message *) ep->mpa_pkt;
 
         /* Validate MPA header. */
@@ -1233,7 +1240,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
          * We'll continue process when more data arrives.
          */
         if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
-                return;
+                return 0;
 
         if (mpa->flags & MPA_REJECT) {
                 err = -ECONNREFUSED;
@@ -1335,9 +1342,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                 attrs.layer_etype = LAYER_MPA | DDP_LLP;
                 attrs.ecode = MPA_NOMATCH_RTR;
                 attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                 err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                 err = -ENOMEM;
+                disconnect = 1;
                 goto out;
         }
 
@@ -1353,9 +1362,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                 attrs.layer_etype = LAYER_MPA | DDP_LLP;
                 attrs.ecode = MPA_INSUFF_IRD;
                 attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                 err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                 err = -ENOMEM;
+                disconnect = 1;
                 goto out;
         }
         goto out;
@@ -1364,7 +1375,7 @@ err:
         send_abort(ep, skb, GFP_KERNEL);
 out:
         connect_reply_upcall(ep, err);
-        return;
+        return disconnect;
 }
 
 static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
@@ -1375,15 +1386,12 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
 
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
 
-        if (ep->com.state != MPA_REQ_WAIT)
-                return;
-
         /*
          * If we get more than the supported amount of private data
          * then we must fail this connection.
          */
         if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1413,13 +1421,13 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
         if (mpa->revision > mpa_rev) {
                 printk(KERN_ERR MOD "%s MPA version mismatch. Local = %d,"
                        " Received = %d\n", __func__, mpa_rev, mpa->revision);
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
 
         if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1430,7 +1438,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
          * Fail if there's too much private data.
          */
         if (plen > MPA_MAX_PRIVATE_DATA) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1439,7 +1447,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
          * If plen does not account for pkt size
          */
         if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 abort_connection(ep, skb, GFP_KERNEL);
                 return;
         }
@@ -1496,18 +1504,24 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
              ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version,
              ep->mpa_attr.p2p_type);
 
-        __state_set(&ep->com, MPA_REQ_RCVD);
-        stop_ep_timer(ep);
-
-        /* drive upcall */
-        mutex_lock(&ep->parent_ep->com.mutex);
-        if (ep->parent_ep->com.state != DEAD) {
-                if (connect_request_upcall(ep))
+        /*
+         * If the endpoint timer already expired, then we ignore
+         * the start request.  process_timeout() will abort
+         * the connection.
+         */
+        if (!stop_ep_timer(ep)) {
+                __state_set(&ep->com, MPA_REQ_RCVD);
+
+                /* drive upcall */
+                mutex_lock(&ep->parent_ep->com.mutex);
+                if (ep->parent_ep->com.state != DEAD) {
+                        if (connect_request_upcall(ep))
+                                abort_connection(ep, skb, GFP_KERNEL);
+                } else {
                         abort_connection(ep, skb, GFP_KERNEL);
-        } else {
-                abort_connection(ep, skb, GFP_KERNEL);
+                }
+                mutex_unlock(&ep->parent_ep->com.mutex);
         }
-        mutex_unlock(&ep->parent_ep->com.mutex);
         return;
 }
 
@@ -1519,6 +1533,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
         unsigned int tid = GET_TID(hdr);
         struct tid_info *t = dev->rdev.lldi.tids;
         __u8 status = hdr->status;
+        int disconnect = 0;
 
         ep = lookup_tid(t, tid);
         if (!ep)
@@ -1534,7 +1549,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
         switch (ep->com.state) {
         case MPA_REQ_SENT:
                 ep->rcv_seq += dlen;
-                process_mpa_reply(ep, skb);
+                disconnect = process_mpa_reply(ep, skb);
                 break;
         case MPA_REQ_WAIT:
                 ep->rcv_seq += dlen;
@@ -1550,13 +1565,16 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
                                ep->com.state, ep->hwtid, status);
                 attrs.next_state = C4IW_QP_STATE_TERMINATE;
                 c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                disconnect = 1;
                 break;
         }
         default:
                 break;
         }
         mutex_unlock(&ep->com.mutex);
+        if (disconnect)
+                c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
         return 0;
 }
 
@@ -2004,6 +2022,10 @@ static void accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
                 if (tcph->ece && tcph->cwr)
                         opt2 |= CCTRL_ECN(1);
         }
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
 
         rpl = cplhdr(skb);
         INIT_TP_WR(rpl, ep->hwtid);
@@ -2265,7 +2287,7 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
                 disconnect = 0;
                 break;
         case MORIBUND:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 if (ep->com.cm_id && ep->com.qp) {
                         attrs.next_state = C4IW_QP_STATE_IDLE;
                         c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
@@ -2325,10 +2347,10 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
         case CONNECTING:
                 break;
         case MPA_REQ_WAIT:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 break;
         case MPA_REQ_SENT:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
                         connect_reply_upcall(ep, -ECONNRESET);
                 else {
@@ -2433,7 +2455,7 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
                 __state_set(&ep->com, MORIBUND);
                 break;
         case MORIBUND:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                 if ((ep->com.cm_id) && (ep->com.qp)) {
                         attrs.next_state = C4IW_QP_STATE_IDLE;
                         c4iw_modify_qp(ep->com.qp->rhp,
@@ -3028,7 +3050,7 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
                 if (!test_and_set_bit(CLOSE_SENT, &ep->com.flags)) {
                         close = 1;
                         if (abrupt) {
-                                stop_ep_timer(ep);
+                                (void)stop_ep_timer(ep);
                                 ep->com.state = ABORTING;
                         } else
                                 ep->com.state = MORIBUND;
@@ -3462,14 +3484,24 @@ static void process_timeout(struct c4iw_ep *ep)
                 __state_set(&ep->com, ABORTING);
                 close_complete_upcall(ep, -ETIMEDOUT);
                 break;
+        case ABORTING:
+        case DEAD:
+
+                /*
+                 * These states are expected if the ep timed out at the same
+                 * time as another thread was calling stop_ep_timer().
+                 * So we silently do nothing for these states.
+                 */
+                abort = 0;
+                break;
         default:
                 WARN(1, "%s unexpected state ep %p tid %u state %u\n",
                         __func__, ep, ep->hwtid, ep->com.state);
                 abort = 0;
         }
-        mutex_unlock(&ep->com.mutex);
         if (abort)
                 abort_connection(ep, NULL, GFP_KERNEL);
+        mutex_unlock(&ep->com.mutex);
         c4iw_put_ep(&ep->com);
 }
 
@@ -3483,6 +3515,8 @@ static void process_timedout_eps(void)
 
                 tmp = timeout_list.next;
                 list_del(tmp);
+                tmp->next = NULL;
+                tmp->prev = NULL;
                 spin_unlock_irq(&timeout_lock);
                 ep = list_entry(tmp, struct c4iw_ep, entry);
                 process_timeout(ep);
@@ -3499,6 +3533,7 @@ static void process_work(struct work_struct *work)
         unsigned int opcode;
         int ret;
 
+        process_timedout_eps();
         while ((skb = skb_dequeue(&rxq))) {
                 rpl = cplhdr(skb);
                 dev = *((struct c4iw_dev **) (skb->cb + sizeof(void *)));
@@ -3508,8 +3543,8 @@ static void process_work(struct work_struct *work)
                 ret = work_handlers[opcode](dev, skb);
                 if (!ret)
                         kfree_skb(skb);
+                process_timedout_eps();
         }
-        process_timedout_eps();
 }
 
 static DECLARE_WORK(skb_work, process_work);
@@ -3521,8 +3556,13 @@ static void ep_timeout(unsigned long arg)
 
         spin_lock(&timeout_lock);
         if (!test_and_set_bit(TIMEOUT, &ep->com.flags)) {
-                list_add_tail(&ep->entry, &timeout_list);
-                kickit = 1;
+                /*
+                 * Only insert if it is not already on the list.
+                 */
+                if (!ep->entry.next) {
+                        list_add_tail(&ep->entry, &timeout_list);
+                        kickit = 1;
+                }
         }
         spin_unlock(&timeout_lock);
         if (kickit)
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index ce468e542428..cfaa56ada189 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -235,27 +235,21 @@ int c4iw_flush_sq(struct c4iw_qp *qhp)
         struct t4_cq *cq = &chp->cq;
         int idx;
         struct t4_swsqe *swsqe;
-        int error = (qhp->attr.state != C4IW_QP_STATE_CLOSING &&
-                        qhp->attr.state != C4IW_QP_STATE_IDLE);
 
         if (wq->sq.flush_cidx == -1)
                 wq->sq.flush_cidx = wq->sq.cidx;
         idx = wq->sq.flush_cidx;
         BUG_ON(idx >= wq->sq.size);
         while (idx != wq->sq.pidx) {
-                if (error) {
-                        swsqe = &wq->sq.sw_sq[idx];
-                        BUG_ON(swsqe->flushed);
-                        swsqe->flushed = 1;
-                        insert_sq_cqe(wq, cq, swsqe);
-                        if (wq->sq.oldest_read == swsqe) {
-                                BUG_ON(swsqe->opcode != FW_RI_READ_REQ);
-                                advance_oldest_read(wq);
-                        }
-                        flushed++;
-                } else {
-                        t4_sq_consume(wq);
+                swsqe = &wq->sq.sw_sq[idx];
+                BUG_ON(swsqe->flushed);
+                swsqe->flushed = 1;
+                insert_sq_cqe(wq, cq, swsqe);
+                if (wq->sq.oldest_read == swsqe) {
+                        BUG_ON(swsqe->opcode != FW_RI_READ_REQ);
+                        advance_oldest_read(wq);
                 }
+                flushed++;
                 if (++idx == wq->sq.size)
                         idx = 0;
         }
@@ -678,7 +672,7 @@ skip_cqe:
 static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
 {
         struct c4iw_qp *qhp = NULL;
-        struct t4_cqe cqe = {0, 0}, *rd_cqe;
+        struct t4_cqe uninitialized_var(cqe), *rd_cqe;
         struct t4_wq *wq;
         u32 credit = 0;
         u8 cqe_flushed;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 9489a388376c..f4fa50a609e2 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -682,7 +682,10 @@ static void c4iw_dealloc(struct uld_ctx *ctx)
         idr_destroy(&ctx->dev->hwtid_idr);
         idr_destroy(&ctx->dev->stid_idr);
         idr_destroy(&ctx->dev->atid_idr);
-        iounmap(ctx->dev->rdev.oc_mw_kva);
+        if (ctx->dev->rdev.bar2_kva)
+                iounmap(ctx->dev->rdev.bar2_kva);
+        if (ctx->dev->rdev.oc_mw_kva)
+                iounmap(ctx->dev->rdev.oc_mw_kva);
         ib_dealloc_device(&ctx->dev->ibdev);
         ctx->dev = NULL;
 }
@@ -722,11 +725,31 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
         }
         devp->rdev.lldi = *infop;
 
-        devp->rdev.oc_mw_pa = pci_resource_start(devp->rdev.lldi.pdev, 2) +
-                (pci_resource_len(devp->rdev.lldi.pdev, 2) -
-                 roundup_pow_of_two(devp->rdev.lldi.vr->ocq.size));
-        devp->rdev.oc_mw_kva = ioremap_wc(devp->rdev.oc_mw_pa,
-                                               devp->rdev.lldi.vr->ocq.size);
+        /*
+         * For T5 devices, we map all of BAR2 with WC.
+         * For T4 devices with onchip qp mem, we map only that part
+         * of BAR2 with WC.
+         */
+        devp->rdev.bar2_pa = pci_resource_start(devp->rdev.lldi.pdev, 2);
+        if (is_t5(devp->rdev.lldi.adapter_type)) {
+                devp->rdev.bar2_kva = ioremap_wc(devp->rdev.bar2_pa,
+                        pci_resource_len(devp->rdev.lldi.pdev, 2));
+                if (!devp->rdev.bar2_kva) {
+                        pr_err(MOD "Unable to ioremap BAR2\n");
+                        return ERR_PTR(-EINVAL);
+                }
+        } else if (ocqp_supported(infop)) {
+                devp->rdev.oc_mw_pa =
+                        pci_resource_start(devp->rdev.lldi.pdev, 2) +
+                        pci_resource_len(devp->rdev.lldi.pdev, 2) -
+                        roundup_pow_of_two(devp->rdev.lldi.vr->ocq.size);
+                devp->rdev.oc_mw_kva = ioremap_wc(devp->rdev.oc_mw_pa,
+                        devp->rdev.lldi.vr->ocq.size);
+                if (!devp->rdev.oc_mw_kva) {
+                        pr_err(MOD "Unable to ioremap onchip mem\n");
+                        return ERR_PTR(-EINVAL);
+                }
+        }
 
         PDBG(KERN_INFO MOD "ocq memory: "
                "hw_start 0x%x size %u mw_pa 0x%lx mw_kva %p\n",
@@ -1003,9 +1026,11 @@ static int enable_qp_db(int id, void *p, void *data)
 static void resume_rc_qp(struct c4iw_qp *qp)
 {
         spin_lock(&qp->lock);
-        t4_ring_sq_db(&qp->wq, qp->wq.sq.wq_pidx_inc);
+        t4_ring_sq_db(&qp->wq, qp->wq.sq.wq_pidx_inc,
+                      is_t5(qp->rhp->rdev.lldi.adapter_type), NULL);
         qp->wq.sq.wq_pidx_inc = 0;
-        t4_ring_rq_db(&qp->wq, qp->wq.rq.wq_pidx_inc);
+        t4_ring_rq_db(&qp->wq, qp->wq.rq.wq_pidx_inc,
+                      is_t5(qp->rhp->rdev.lldi.adapter_type), NULL);
         qp->wq.rq.wq_pidx_inc = 0;
         spin_unlock(&qp->lock);
 }
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index e872203c5424..7474b490760a 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -149,6 +149,8 @@ struct c4iw_rdev {
         struct gen_pool *ocqp_pool;
         u32 flags;
         struct cxgb4_lld_info lldi;
+        unsigned long bar2_pa;
+        void __iomem *bar2_kva;
         unsigned long oc_mw_pa;
         void __iomem *oc_mw_kva;
         struct c4iw_stats stats;
@@ -433,6 +435,7 @@ struct c4iw_qp_attributes {
         u8 ecode;
         u16 sq_db_inc;
         u16 rq_db_inc;
+        u8 send_term;
 };
 
 struct c4iw_qp {
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index f9ca072a99ed..ec7a2988a703 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -259,8 +259,12 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 
         if ((!reset_tpt_entry) && (*stag == T4_STAG_UNSET)) {
                 stag_idx = c4iw_get_resource(&rdev->resource.tpt_table);
-                if (!stag_idx)
+                if (!stag_idx) {
+                        mutex_lock(&rdev->stats.lock);
+                        rdev->stats.stag.fail++;
+                        mutex_unlock(&rdev->stats.lock);
                         return -ENOMEM;
+                }
                 mutex_lock(&rdev->stats.lock);
                 rdev->stats.stag.cur += 32;
                 if (rdev->stats.stag.cur > rdev->stats.stag.max)
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
index 79429256023a..a94a3e12c349 100644
--- a/drivers/infiniband/hw/cxgb4/provider.c
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -328,7 +328,7 @@ static int c4iw_query_device(struct ib_device *ibdev,
         props->max_mr = c4iw_num_stags(&dev->rdev);
         props->max_pd = T4_MAX_NUM_PD;
         props->local_ca_ack_delay = 0;
-        props->max_fast_reg_page_list_len = T4_MAX_FR_DEPTH;
+        props->max_fast_reg_page_list_len = t4_max_fr_depth(use_dsgl);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index cb76eb5eee1f..086f62f5dc9e 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -212,13 +212,23 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
 
         wq->db = rdev->lldi.db_reg;
         wq->gts = rdev->lldi.gts_reg;
-        if (user) {
-                wq->sq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
-                                        (wq->sq.qid << rdev->qpshift);
-                wq->sq.udb &= PAGE_MASK;
-                wq->rq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
-                                        (wq->rq.qid << rdev->qpshift);
-                wq->rq.udb &= PAGE_MASK;
+        if (user || is_t5(rdev->lldi.adapter_type)) {
+                u32 off;
+
+                off = (wq->sq.qid << rdev->qpshift) & PAGE_MASK;
+                if (user) {
+                        wq->sq.udb = (u64 __iomem *)(rdev->bar2_pa + off);
+                } else {
+                        off += 128 * (wq->sq.qid & rdev->qpmask) + 8;
+                        wq->sq.udb = (u64 __iomem *)(rdev->bar2_kva + off);
+                }
+                off = (wq->rq.qid << rdev->qpshift) & PAGE_MASK;
+                if (user) {
+                        wq->rq.udb = (u64 __iomem *)(rdev->bar2_pa + off);
+                } else {
+                        off += 128 * (wq->rq.qid & rdev->qpmask) + 8;
+                        wq->rq.udb = (u64 __iomem *)(rdev->bar2_kva + off);
+                }
         }
         wq->rdev = rdev;
         wq->rq.msn = 1;
@@ -299,9 +309,10 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         if (ret)
                 goto free_dma;
 
-        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%llx rqudb 0x%llx\n",
+        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%lx rqudb 0x%lx\n",
              __func__, wq->sq.qid, wq->rq.qid, wq->db,
-             (unsigned long long)wq->sq.udb, (unsigned long long)wq->rq.udb);
+             (__force unsigned long) wq->sq.udb,
+             (__force unsigned long) wq->rq.udb);
 
         return 0;
 free_dma:
@@ -425,6 +436,8 @@ static int build_rdma_send(struct t4_sq *sq, union t4_wr *wqe,
         default:
                 return -EINVAL;
         }
+        wqe->send.r3 = 0;
+        wqe->send.r4 = 0;
 
         plen = 0;
         if (wr->num_sge) {
@@ -555,7 +568,8 @@ static int build_fastreg(struct t4_sq *sq, union t4_wr *wqe,
         int pbllen = roundup(wr->wr.fast_reg.page_list_len * sizeof(u64), 32);
         int rem;
 
-        if (wr->wr.fast_reg.page_list_len > T4_MAX_FR_DEPTH)
+        if (wr->wr.fast_reg.page_list_len >
+            t4_max_fr_depth(use_dsgl))
                 return -EINVAL;
 
         wqe->fr.qpbinde_to_dcacpu = 0;
@@ -650,9 +664,10 @@ static int ring_kernel_sq_db(struct c4iw_qp *qhp, u16 inc)
 
         spin_lock_irqsave(&qhp->rhp->lock, flags);
         spin_lock(&qhp->lock);
-        if (qhp->rhp->db_state == NORMAL) {
-                t4_ring_sq_db(&qhp->wq, inc);
-        } else {
+        if (qhp->rhp->db_state == NORMAL)
+                t4_ring_sq_db(&qhp->wq, inc,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), NULL);
+        else {
                 add_to_fc_list(&qhp->rhp->db_fc_list, &qhp->db_fc_entry);
                 qhp->wq.sq.wq_pidx_inc += inc;
         }
@@ -667,9 +682,10 @@ static int ring_kernel_rq_db(struct c4iw_qp *qhp, u16 inc)
 
         spin_lock_irqsave(&qhp->rhp->lock, flags);
         spin_lock(&qhp->lock);
-        if (qhp->rhp->db_state == NORMAL) {
-                t4_ring_rq_db(&qhp->wq, inc);
-        } else {
+        if (qhp->rhp->db_state == NORMAL)
+                t4_ring_rq_db(&qhp->wq, inc,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), NULL);
+        else {
                 add_to_fc_list(&qhp->rhp->db_fc_list, &qhp->db_fc_entry);
                 qhp->wq.rq.wq_pidx_inc += inc;
         }
@@ -686,7 +702,7 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         enum fw_wr_opcodes fw_opcode = 0;
         enum fw_ri_wr_flags fw_flags;
         struct c4iw_qp *qhp;
-        union t4_wr *wqe;
+        union t4_wr *wqe = NULL;
         u32 num_wrs;
         struct t4_swsqe *swsqe;
         unsigned long flag;
@@ -792,7 +808,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 idx += DIV_ROUND_UP(len16*16, T4_EQ_ENTRY_SIZE);
         }
         if (!qhp->rhp->rdev.status_page->db_off) {
-                t4_ring_sq_db(&qhp->wq, idx);
+                t4_ring_sq_db(&qhp->wq, idx,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), wqe);
                 spin_unlock_irqrestore(&qhp->lock, flag);
         } else {
                 spin_unlock_irqrestore(&qhp->lock, flag);
@@ -806,7 +823,7 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 {
         int err = 0;
         struct c4iw_qp *qhp;
-        union t4_recv_wr *wqe;
+        union t4_recv_wr *wqe = NULL;
         u32 num_wrs;
         u8 len16 = 0;
         unsigned long flag;
@@ -858,7 +875,8 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 num_wrs--;
         }
         if (!qhp->rhp->rdev.status_page->db_off) {
-                t4_ring_rq_db(&qhp->wq, idx);
+                t4_ring_rq_db(&qhp->wq, idx,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), wqe);
                 spin_unlock_irqrestore(&qhp->lock, flag);
         } else {
                 spin_unlock_irqrestore(&qhp->lock, flag);
@@ -1352,6 +1370,7 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                 switch (attrs->next_state) {
                 case C4IW_QP_STATE_CLOSING:
                         BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
+                        t4_set_wq_in_error(&qhp->wq);
                         set_state(qhp, C4IW_QP_STATE_CLOSING);
                         ep = qhp->ep;
                         if (!internal) {
@@ -1359,30 +1378,30 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                                 disconnect = 1;
                                 c4iw_get_ep(&qhp->ep->com);
                         }
-                        t4_set_wq_in_error(&qhp->wq);
                         ret = rdma_fini(rhp, qhp, ep);
                         if (ret)
                                 goto err;
                         break;
                 case C4IW_QP_STATE_TERMINATE:
+                        t4_set_wq_in_error(&qhp->wq);
                         set_state(qhp, C4IW_QP_STATE_TERMINATE);
                         qhp->attr.layer_etype = attrs->layer_etype;
                         qhp->attr.ecode = attrs->ecode;
-                        t4_set_wq_in_error(&qhp->wq);
                         ep = qhp->ep;
-                        disconnect = 1;
-                        if (!internal)
+                        if (!internal) {
+                                c4iw_get_ep(&qhp->ep->com);
                                 terminate = 1;
-                        else {
+                                disconnect = 1;
+                        } else {
+                                terminate = qhp->attr.send_term;
                                 ret = rdma_fini(rhp, qhp, ep);
                                 if (ret)
                                         goto err;
                         }
-                        c4iw_get_ep(&qhp->ep->com);
                         break;
                 case C4IW_QP_STATE_ERROR:
-                        set_state(qhp, C4IW_QP_STATE_ERROR);
                         t4_set_wq_in_error(&qhp->wq);
+                        set_state(qhp, C4IW_QP_STATE_ERROR);
                         if (!internal) {
                                 abort = 1;
                                 disconnect = 1;
@@ -1677,11 +1696,11 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 mm2->len = PAGE_ALIGN(qhp->wq.rq.memsize);
                 insert_mmap(ucontext, mm2);
                 mm3->key = uresp.sq_db_gts_key;
-                mm3->addr = qhp->wq.sq.udb;
+                mm3->addr = (__force unsigned long) qhp->wq.sq.udb;
                 mm3->len = PAGE_SIZE;
                 insert_mmap(ucontext, mm3);
                 mm4->key = uresp.rq_db_gts_key;
-                mm4->addr = qhp->wq.rq.udb;
+                mm4->addr = (__force unsigned long) qhp->wq.rq.udb;
                 mm4->len = PAGE_SIZE;
                 insert_mmap(ucontext, mm4);
                 if (mm5) {
@@ -1758,11 +1777,15 @@ int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         /*
          * Use SQ_PSN and RQ_PSN to pass in IDX_INC values for
          * ringing the queue db when we're in DB_FULL mode.
+         * Only allow this on T4 devices.
          */
         attrs.sq_db_inc = attr->sq_psn;
         attrs.rq_db_inc = attr->rq_psn;
         mask |= (attr_mask & IB_QP_SQ_PSN) ? C4IW_QP_ATTR_SQ_DB : 0;
         mask |= (attr_mask & IB_QP_RQ_PSN) ? C4IW_QP_ATTR_RQ_DB : 0;
+        if (is_t5(to_c4iw_qp(ibqp)->rhp->rdev.lldi.adapter_type) &&
+            (mask & (C4IW_QP_ATTR_SQ_DB|C4IW_QP_ATTR_RQ_DB)))
+                return -EINVAL;
 
         return c4iw_modify_qp(rhp, qhp, mask, &attrs, 0);
 }
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index cdef4d7fb6d8..67df71a7012e 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -179,8 +179,12 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
                 kfree(entry);
         } else {
                 qid = c4iw_get_resource(&rdev->resource.qid_table);
-                if (!qid)
+                if (!qid) {
+                        mutex_lock(&rdev->stats.lock);
+                        rdev->stats.qid.fail++;
+                        mutex_unlock(&rdev->stats.lock);
                         goto out;
+                }
                 mutex_lock(&rdev->stats.lock);
                 rdev->stats.qid.cur += rdev->qpmask + 1;
                 mutex_unlock(&rdev->stats.lock);
@@ -322,8 +326,8 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
         unsigned long addr = gen_pool_alloc(rdev->rqt_pool, size << 6);
         PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size << 6);
         if (!addr)
-                printk_ratelimited(KERN_WARNING MOD "%s: Out of RQT memory\n",
-                       pci_name(rdev->lldi.pdev));
+                pr_warn_ratelimited(MOD "%s: Out of RQT memory\n",
+                                    pci_name(rdev->lldi.pdev));
         mutex_lock(&rdev->stats.lock);
         if (addr) {
                 rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT);
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index eeca8b1e6376..2178f3198410 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -84,7 +84,14 @@ struct t4_status_page {
                         sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
 #define T4_MAX_FR_IMMD ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_fr_nsmr_wr) - \
                         sizeof(struct fw_ri_immd)) & ~31UL)
-#define T4_MAX_FR_DEPTH (1024 / sizeof(u64))
+#define T4_MAX_FR_IMMD_DEPTH (T4_MAX_FR_IMMD / sizeof(u64))
+#define T4_MAX_FR_DSGL 1024
+#define T4_MAX_FR_DSGL_DEPTH (T4_MAX_FR_DSGL / sizeof(u64))
+
+static inline int t4_max_fr_depth(int use_dsgl)
+{
+        return use_dsgl ? T4_MAX_FR_DSGL_DEPTH : T4_MAX_FR_IMMD_DEPTH;
+}
 
 #define T4_RQ_NUM_SLOTS 2
 #define T4_RQ_NUM_BYTES (T4_EQ_ENTRY_SIZE * T4_RQ_NUM_SLOTS)
@@ -292,7 +299,7 @@ struct t4_sq {
         unsigned long phys_addr;
         struct t4_swsqe *sw_sq;
         struct t4_swsqe *oldest_read;
-        u64 udb;
+        u64 __iomem *udb;
         size_t memsize;
         u32 qid;
         u16 in_use;
@@ -314,7 +321,7 @@ struct t4_rq {
         dma_addr_t dma_addr;
         DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t4_swrqe *sw_rq;
-        u64 udb;
+        u64 __iomem *udb;
         size_t memsize;
         u32 qid;
         u32 msn;
@@ -435,15 +442,67 @@ static inline u16 t4_sq_wq_size(struct t4_wq *wq)
                 return wq->sq.size * T4_SQ_NUM_SLOTS;
 }
 
-static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc)
+/* This function copies 64 byte coalesced work request to memory
+ * mapped BAR2 space. For coalesced WRs, the SGE fetches data
+ * from the FIFO instead of from Host.
+ */
+static inline void pio_copy(u64 __iomem *dst, u64 *src)
+{
+        int count = 8;
+
+        while (count) {
+                writeq(*src, dst);
+                src++;
+                dst++;
+                count--;
+        }
+}
+
+static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc, u8 t5,
+                                 union t4_wr *wqe)
 {
+
+        /* Flush host queue memory writes. */
         wmb();
+        if (t5) {
+                if (inc == 1 && wqe) {
+                        PDBG("%s: WC wq->sq.pidx = %d\n",
+                             __func__, wq->sq.pidx);
+                        pio_copy(wq->sq.udb + 7, (void *)wqe);
+                } else {
+                        PDBG("%s: DB wq->sq.pidx = %d\n",
+                             __func__, wq->sq.pidx);
+                        writel(PIDX_T5(inc), wq->sq.udb);
+                }
+
+                /* Flush user doorbell area writes. */
+                wmb();
+                return;
+        }
         writel(QID(wq->sq.qid) | PIDX(inc), wq->db);
 }
 
-static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc)
+static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc, u8 t5,
+                                 union t4_recv_wr *wqe)
 {
+
+        /* Flush host queue memory writes. */
         wmb();
+        if (t5) {
+                if (inc == 1 && wqe) {
+                        PDBG("%s: WC wq->rq.pidx = %d\n",
+                             __func__, wq->rq.pidx);
+                        pio_copy(wq->rq.udb + 7, (void *)wqe);
+                } else {
+                        PDBG("%s: DB wq->rq.pidx = %d\n",
+                             __func__, wq->rq.pidx);
+                        writel(PIDX_T5(inc), wq->rq.udb);
+                }
+
+                /* Flush user doorbell area writes. */
+                wmb();
+                return;
+        }
         writel(QID(wq->rq.qid) | PIDX(inc), wq->db);
 }
 
@@ -568,6 +627,9 @@ static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
                 printk(KERN_ERR MOD "cq overflow cqid %u\n", cq->cqid);
                 BUG_ON(1);
         } else if (t4_valid_cqe(cq, &cq->queue[cq->cidx])) {
+
+                /* Ensure CQE is flushed to memory */
+                rmb();
                 *cqe = &cq->queue[cq->cidx];
                 ret = 0;
         } else
diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
index dc193c292671..6121ca08fe58 100644
--- a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
+++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
@@ -836,4 +836,18 @@ struct ulptx_idata {
 #define V_RX_DACK_CHANGE(x) ((x) << S_RX_DACK_CHANGE)
 #define F_RX_DACK_CHANGE    V_RX_DACK_CHANGE(1U)
 
+enum {                     /* TCP congestion control algorithms */
+        CONG_ALG_RENO,
+        CONG_ALG_TAHOE,
+        CONG_ALG_NEWRENO,
+        CONG_ALG_HIGHSPEED
+};
+
+#define S_CONG_CNTRL    14
+#define M_CONG_CNTRL    0x3
+#define V_CONG_CNTRL(x) ((x) << S_CONG_CNTRL)
+#define G_CONG_CNTRL(x) (((x) >> S_CONG_CNTRL) & M_CONG_CNTRL)
+
+#define T5_OPT_2_VALID       (1 << 31)
+
 #endif /* _T4FW_RI_API_H_ */
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 1b6dbe156a37..199c7896f081 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -48,6 +48,7 @@
 
 #include <linux/mlx4/driver.h>
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 
 #include "mlx4_ib.h"
 #include "user.h"
@@ -1614,6 +1615,53 @@ static int mlx4_ib_inet6_event(struct notifier_block *this, unsigned long event,
 }
 #endif
 
+#define MLX4_IB_INVALID_MAC     ((u64)-1)
+static void mlx4_ib_update_qps(struct mlx4_ib_dev *ibdev,
+                               struct net_device *dev,
+                               int port)
+{
+        u64 new_smac = 0;
+        u64 release_mac = MLX4_IB_INVALID_MAC;
+        struct mlx4_ib_qp *qp;
+
+        read_lock(&dev_base_lock);
+        new_smac = mlx4_mac_to_u64(dev->dev_addr);
+        read_unlock(&dev_base_lock);
+
+        mutex_lock(&ibdev->qp1_proxy_lock[port - 1]);
+        qp = ibdev->qp1_proxy[port - 1];
+        if (qp) {
+                int new_smac_index;
+                u64 old_smac = qp->pri.smac;
+                struct mlx4_update_qp_params update_params;
+
+                if (new_smac == old_smac)
+                        goto unlock;
+
+                new_smac_index = mlx4_register_mac(ibdev->dev, port, new_smac);
+
+                if (new_smac_index < 0)
+                        goto unlock;
+
+                update_params.smac_index = new_smac_index;
+                if (mlx4_update_qp(ibdev->dev, &qp->mqp, MLX4_UPDATE_QP_SMAC,
+                                   &update_params)) {
+                        release_mac = new_smac;
+                        goto unlock;
+                }
+
+                qp->pri.smac = new_smac;
+                qp->pri.smac_index = new_smac_index;
+
+                release_mac = old_smac;
+        }
+
+unlock:
+        mutex_unlock(&ibdev->qp1_proxy_lock[port - 1]);
+        if (release_mac != MLX4_IB_INVALID_MAC)
+                mlx4_unregister_mac(ibdev->dev, port, release_mac);
+}
+
 static void mlx4_ib_get_dev_addr(struct net_device *dev,
                                  struct mlx4_ib_dev *ibdev, u8 port)
 {
@@ -1689,9 +1737,13 @@ static int mlx4_ib_init_gid_table(struct mlx4_ib_dev *ibdev)
         return 0;
 }
 
-static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
+static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev,
+                                 struct net_device *dev,
+                                 unsigned long event)
+
 {
         struct mlx4_ib_iboe *iboe;
+        int update_qps_port = -1;
         int port;
 
         iboe = &ibdev->iboe;
@@ -1719,6 +1771,11 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
                 }
                 curr_master = iboe->masters[port - 1];
 
+                if (dev == iboe->netdevs[port - 1] &&
+                    (event == NETDEV_CHANGEADDR || event == NETDEV_REGISTER ||
+                     event == NETDEV_UP || event == NETDEV_CHANGE))
+                        update_qps_port = port;
+
                 if (curr_netdev) {
                         port_state = (netif_running(curr_netdev) && netif_carrier_ok(curr_netdev)) ?
                                                 IB_PORT_ACTIVE : IB_PORT_DOWN;
@@ -1752,6 +1809,9 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
         }
 
         spin_unlock(&iboe->lock);
+
+        if (update_qps_port > 0)
+                mlx4_ib_update_qps(ibdev, dev, update_qps_port);
 }
 
 static int mlx4_ib_netdev_event(struct notifier_block *this,
@@ -1764,7 +1824,7 @@ static int mlx4_ib_netdev_event(struct notifier_block *this,
                 return NOTIFY_DONE;
 
         ibdev = container_of(this, struct mlx4_ib_dev, iboe.nb);
-        mlx4_ib_scan_netdevs(ibdev);
+        mlx4_ib_scan_netdevs(ibdev, dev, event);
 
         return NOTIFY_DONE;
 }
@@ -2043,6 +2103,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                 goto err_map;
 
         for (i = 0; i < ibdev->num_ports; ++i) {
+                mutex_init(&ibdev->qp1_proxy_lock[i]);
                 if (mlx4_ib_port_link_layer(&ibdev->ib_dev, i + 1) ==
                                                 IB_LINK_LAYER_ETHERNET) {
                         err = mlx4_counter_alloc(ibdev->dev, &ibdev->counters[i]);
@@ -2126,7 +2187,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                 for (i = 1 ; i <= ibdev->num_ports ; ++i)
                         reset_gid_table(ibdev, i);
                 rtnl_lock();
-                mlx4_ib_scan_netdevs(ibdev);
+                mlx4_ib_scan_netdevs(ibdev, NULL, 0);
                 rtnl_unlock();
                 mlx4_ib_init_gid_table(ibdev);
         }
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index f589522fddfd..66b0b7dbd9f4 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -522,6 +522,9 @@ struct mlx4_ib_dev {
         int steer_qpn_count;
         int steer_qpn_base;
         int steering_support;
+        struct mlx4_ib_qp      *qp1_proxy[MLX4_MAX_PORTS];
+        /* lock when destroying qp1_proxy and getting netdev events */
+        struct mutex            qp1_proxy_lock[MLX4_MAX_PORTS];
 };
 
 struct ib_event_work {
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 41308af4163c..dc57482ae7af 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1132,6 +1132,12 @@ int mlx4_ib_destroy_qp(struct ib_qp *qp)
         if (is_qp0(dev, mqp))
                 mlx4_CLOSE_PORT(dev->dev, mqp->port);
 
+        if (dev->qp1_proxy[mqp->port - 1] == mqp) {
+                mutex_lock(&dev->qp1_proxy_lock[mqp->port - 1]);
+                dev->qp1_proxy[mqp->port - 1] = NULL;
+                mutex_unlock(&dev->qp1_proxy_lock[mqp->port - 1]);
+        }
+
         pd = get_pd(mqp);
         destroy_qp_common(dev, mqp, !!pd->ibpd.uobject);
 
@@ -1646,6 +1652,8 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                                 err = handle_eth_ud_smac_index(dev, qp, (u8 *)attr->smac, context);
                                 if (err)
                                         return -EINVAL;
+                                if (qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI)
+                                        dev->qp1_proxy[qp->port - 1] = qp;
                         }
                 }
         }
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index fa6dc870adae..364d4b6937f5 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -282,6 +282,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
                 props->sig_guard_cap = IB_GUARD_T10DIF_CRC |
                                        IB_GUARD_T10DIF_CSUM;
         }
+        if (flags & MLX5_DEV_CAP_FLAG_BLOCK_MCAST)
+                props->device_cap_flags |= IB_DEVICE_BLOCK_MULTICAST_LOOPBACK;
 
         props->vendor_id           = be32_to_cpup((__be32 *)(out_mad->data + 36)) &
                 0xffffff;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index ae788d27b93f..dc930ed21eca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -807,6 +807,15 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
         spin_lock_init(&qp->sq.lock);
         spin_lock_init(&qp->rq.lock);
 
+        if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK) {
+                if (!(dev->mdev.caps.flags & MLX5_DEV_CAP_FLAG_BLOCK_MCAST)) {
+                        mlx5_ib_dbg(dev, "block multicast loopback isn't supported\n");
+                        return -EINVAL;
+                } else {
+                        qp->flags |= MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK;
+                }
+        }
+
         if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
                 qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE;
 
@@ -878,6 +887,9 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
         if (qp->wq_sig)
                 in->ctx.flags_pd |= cpu_to_be32(MLX5_QP_ENABLE_SIG);
 
+        if (qp->flags & MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK)
+                in->ctx.flags_pd |= cpu_to_be32(MLX5_QP_BLOCK_MCAST);
+
         if (qp->scat_cqe && is_connected(init_attr->qp_type)) {
                 int rcqe_sz;
                 int scqe_sz;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 87897b95666d..ded76c101dde 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -858,13 +858,9 @@ static int mthca_enable_msi_x(struct mthca_dev *mdev)
         entries[1].entry = 1;
         entries[2].entry = 2;
 
-        err = pci_enable_msix(mdev->pdev, entries, ARRAY_SIZE(entries));
-        if (err) {
-                if (err > 0)
-                        mthca_info(mdev, "Only %d MSI-X vectors available, "
-                                   "not using MSI-X\n", err);
+        err = pci_enable_msix_exact(mdev->pdev, entries, ARRAY_SIZE(entries));
+        if (err)
                 return err;
-        }
 
         mdev->eq_table.eq[MTHCA_EQ_COMP ].msi_x_vector = entries[0].vector;
         mdev->eq_table.eq[MTHCA_EQ_ASYNC].msi_x_vector = entries[1].vector;
diff --git a/drivers/infiniband/hw/qib/qib_pcie.c b/drivers/infiniband/hw/qib/qib_pcie.c
index c8d9c4ab142b..61a0046efb76 100644
--- a/drivers/infiniband/hw/qib/qib_pcie.c
+++ b/drivers/infiniband/hw/qib/qib_pcie.c
@@ -197,46 +197,47 @@ static void qib_msix_setup(struct qib_devdata *dd, int pos, u32 *msixcnt,
                            struct qib_msix_entry *qib_msix_entry)
 {
         int ret;
-        u32 tabsize = 0;
-        u16 msix_flags;
+        int nvec = *msixcnt;
         struct msix_entry *msix_entry;
         int i;
 
+        ret = pci_msix_vec_count(dd->pcidev);
+        if (ret < 0)
+                goto do_intx;
+
+        nvec = min(nvec, ret);
+
         /* We can't pass qib_msix_entry array to qib_msix_setup
          * so use a dummy msix_entry array and copy the allocated
          * irq back to the qib_msix_entry array. */
-        msix_entry = kmalloc(*msixcnt * sizeof(*msix_entry), GFP_KERNEL);
-        if (!msix_entry) {
-                ret = -ENOMEM;
+        msix_entry = kmalloc(nvec * sizeof(*msix_entry), GFP_KERNEL);
+        if (!msix_entry)
                 goto do_intx;
-        }
-        for (i = 0; i < *msixcnt; i++)
+
+        for (i = 0; i < nvec; i++)
                 msix_entry[i] = qib_msix_entry[i].msix;
 
-        pci_read_config_word(dd->pcidev, pos + PCI_MSIX_FLAGS, &msix_flags);
-        tabsize = 1 + (msix_flags & PCI_MSIX_FLAGS_QSIZE);
-        if (tabsize > *msixcnt)
-                tabsize = *msixcnt;
-        ret = pci_enable_msix(dd->pcidev, msix_entry, tabsize);
-        if (ret > 0) {
-                tabsize = ret;
-                ret = pci_enable_msix(dd->pcidev, msix_entry, tabsize);
-        }
-do_intx:
-        if (ret) {
-                qib_dev_err(dd,
-                        "pci_enable_msix %d vectors failed: %d, falling back to INTx\n",
-                        tabsize, ret);
-                tabsize = 0;
-        }
-        for (i = 0; i < tabsize; i++)
+        ret = pci_enable_msix_range(dd->pcidev, msix_entry, 1, nvec);
+        if (ret < 0)
+                goto free_msix_entry;
+        else
+                nvec = ret;
+
+        for (i = 0; i < nvec; i++)
                 qib_msix_entry[i].msix = msix_entry[i];
+
         kfree(msix_entry);
-        *msixcnt = tabsize;
+        *msixcnt = nvec;
+        return;
 
-        if (ret)
-                qib_enable_intx(dd->pcidev);
+free_msix_entry:
+        kfree(msix_entry);
 
+do_intx:
+        qib_dev_err(dd, "pci_enable_msix_range %d vectors failed: %d, "
+                        "falling back to INTx\n", nvec, ret);
+        *msixcnt = 0;
+        qib_enable_intx(dd->pcidev);
 }
 
 /**
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index c98fdb185931..a1710465faaf 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -28,6 +28,7 @@
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_transport.h>
+#include <linux/semaphore.h>
 
 #include "isert_proto.h"
 #include "ib_isert.h"
@@ -561,7 +562,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         struct isert_device *device;
         struct ib_device *ib_dev = cma_id->device;
         int ret = 0;
-        u8 pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+        u8 pi_support;
+
+        spin_lock_bh(&np->np_thread_lock);
+        if (!np->enabled) {
+                spin_unlock_bh(&np->np_thread_lock);
+                pr_debug("iscsi_np is not enabled, reject connect request\n");
+                return rdma_reject(cma_id, NULL, 0);
+        }
+        spin_unlock_bh(&np->np_thread_lock);
 
         pr_debug("Entering isert_connect_request cma_id: %p, context: %p\n",
                  cma_id, cma_id->context);
@@ -652,6 +661,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 goto out_mr;
         }
 
+        pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
         if (pi_support && !device->pi_capable) {
                 pr_err("Protection information requested but not supported\n");
                 ret = -EINVAL;
@@ -663,11 +673,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 goto out_conn_dev;
 
         mutex_lock(&isert_np->np_accept_mutex);
-        list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
+        list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
         mutex_unlock(&isert_np->np_accept_mutex);
 
-        pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
-        wake_up(&isert_np->np_accept_wq);
+        pr_debug("isert_connect_request() up np_sem np: %p\n", np);
+        up(&isert_np->np_sem);
         return 0;
 
 out_conn_dev:
@@ -2999,7 +3009,7 @@ isert_setup_np(struct iscsi_np *np,
                 pr_err("Unable to allocate struct isert_np\n");
                 return -ENOMEM;
         }
-        init_waitqueue_head(&isert_np->np_accept_wq);
+        sema_init(&isert_np->np_sem, 0);
         mutex_init(&isert_np->np_accept_mutex);
         INIT_LIST_HEAD(&isert_np->np_accept_list);
         init_completion(&isert_np->np_login_comp);
@@ -3048,18 +3058,6 @@ out:
 }
 
 static int
-isert_check_accept_queue(struct isert_np *isert_np)
-{
-        int empty;
-
-        mutex_lock(&isert_np->np_accept_mutex);
-        empty = list_empty(&isert_np->np_accept_list);
-        mutex_unlock(&isert_np->np_accept_mutex);
-
-        return empty;
-}
-
-static int
 isert_rdma_accept(struct isert_conn *isert_conn)
 {
         struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
@@ -3151,16 +3149,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
         int max_accept = 0, ret;
 
 accept_wait:
-        ret = wait_event_interruptible(isert_np->np_accept_wq,
-                        !isert_check_accept_queue(isert_np) ||
-                        np->np_thread_state == ISCSI_NP_THREAD_RESET);
+        ret = down_interruptible(&isert_np->np_sem);
         if (max_accept > 5)
                 return -ENODEV;
 
         spin_lock_bh(&np->np_thread_lock);
         if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                 spin_unlock_bh(&np->np_thread_lock);
-                pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
+                pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
                 return -ENODEV;
         }
         spin_unlock_bh(&np->np_thread_lock);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 4c072ae34c01..da6612e68000 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -182,7 +182,7 @@ struct isert_device {
 };
 
 struct isert_np {
-        wait_queue_head_t       np_accept_wq;
+        struct semaphore        np_sem;
         struct rdma_cm_id       *np_cm_id;
         struct mutex            np_accept_mutex;
         struct list_head        np_accept_list;