9 files changed, 124 insertions, 88 deletions

diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index fef3f1ae7225..52d7bb0c2a12 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -1830,6 +1830,10 @@ int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         ep->com.rpl_err = 0;
         ep->ird = conn_param->ird;
         ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ird == 0)
+                ep->ird = 1;
+
         PDBG("%s %d ird %d ord %d\n", __func__, __LINE__, ep->ird, ep->ord);
 
         get_ep(&ep->com);
@@ -1915,6 +1919,10 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                        conn_param->private_data, ep->plen);
         ep->ird = conn_param->ird;
         ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ord == 0)
+                ep->ord = 1;
+
         ep->com.tdev = h->rdev.t3cdev_p;
 
         cm_id->add_ref(cm_id);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 2f546a625330..27bbdc8e773a 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -1069,7 +1069,6 @@ int iwch_modify_qp(struct iwch_dev *rhp, struct iwch_qp *qhp,
                         goto out;
                 }
                 qhp->attr.state = IWCH_QP_STATE_IDLE;
-                memset(&qhp->attr, 0, sizeof(qhp->attr));
                 break;
         case IWCH_QP_STATE_TERMINATE:
                 if (!internal) {
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index c33e1c53c799..6d55f9d748f6 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -157,13 +157,15 @@ enum {
 enum {
         CMD_TIME_CLASS_A = (HZ + 999) / 1000 + 1,
         CMD_TIME_CLASS_B = (HZ +  99) /  100 + 1,
-        CMD_TIME_CLASS_C = (HZ +   9) /   10 + 1
+        CMD_TIME_CLASS_C = (HZ +   9) /   10 + 1,
+        CMD_TIME_CLASS_D = 60 * HZ
 };
 #else
 enum {
         CMD_TIME_CLASS_A = 60 * HZ,
         CMD_TIME_CLASS_B = 60 * HZ,
-        CMD_TIME_CLASS_C = 60 * HZ
+        CMD_TIME_CLASS_C = 60 * HZ,
+        CMD_TIME_CLASS_D = 60 * HZ
 };
 #endif
 
@@ -598,7 +600,7 @@ int mthca_SYS_EN(struct mthca_dev *dev, u8 *status)
         u64 out;
         int ret;
 
-        ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, HZ, status);
+        ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D, status);
 
         if (*status == MTHCA_CMD_STAT_DDR_MEM_ERR)
                 mthca_warn(dev, "SYS_EN DDR error: syn=%x, sock=%d, "
@@ -611,7 +613,7 @@ int mthca_SYS_EN(struct mthca_dev *dev, u8 *status)
 
 int mthca_SYS_DIS(struct mthca_dev *dev, u8 *status)
 {
-        return mthca_cmd(dev, 0, 0, 0, CMD_SYS_DIS, HZ, status);
+        return mthca_cmd(dev, 0, 0, 0, CMD_SYS_DIS, CMD_TIME_CLASS_C, status);
 }
 
 static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
@@ -1390,7 +1392,7 @@ int mthca_INIT_HCA(struct mthca_dev *dev,
                 MTHCA_PUT(inbox, param->uarc_base,   INIT_HCA_UAR_CTX_BASE_OFFSET);
         }
 
-        err = mthca_cmd(dev, mailbox->dma, 0, 0, CMD_INIT_HCA, HZ, status);
+        err = mthca_cmd(dev, mailbox->dma, 0, 0, CMD_INIT_HCA, CMD_TIME_CLASS_D, status);
 
         mthca_free_mailbox(dev, mailbox);
         return err;
@@ -1450,12 +1452,12 @@ int mthca_INIT_IB(struct mthca_dev *dev,
 
 int mthca_CLOSE_IB(struct mthca_dev *dev, int port, u8 *status)
 {
-        return mthca_cmd(dev, 0, port, 0, CMD_CLOSE_IB, HZ, status);
+        return mthca_cmd(dev, 0, port, 0, CMD_CLOSE_IB, CMD_TIME_CLASS_A, status);
 }
 
 int mthca_CLOSE_HCA(struct mthca_dev *dev, int panic, u8 *status)
 {
-        return mthca_cmd(dev, 0, 0, panic, CMD_CLOSE_HCA, HZ, status);
+        return mthca_cmd(dev, 0, 0, panic, CMD_CLOSE_HCA, CMD_TIME_CLASS_C, status);
 }
 
 int mthca_SET_IB(struct mthca_dev *dev, struct mthca_set_ib_param *param,
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index 17621de54a9f..bf1720f7f35f 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -56,10 +56,8 @@
 
 #define QUEUE_DISCONNECTS
 
-#define DRV_BUILD   "1"
-
 #define DRV_NAME    "iw_nes"
-#define DRV_VERSION "1.0 KO Build " DRV_BUILD
+#define DRV_VERSION "1.5.0.0"
 #define PFX         DRV_NAME ": "
 
 /*
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index dbd9a75474e3..11c7d6642014 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -56,6 +56,7 @@
 #include <net/neighbour.h>
 #include <net/route.h>
 #include <net/ip_fib.h>
+#include <net/tcp.h>
 
 #include "nes.h"
 
@@ -540,6 +541,7 @@ static void nes_cm_timer_tick(unsigned long pass)
         struct list_head *list_node;
         struct nes_cm_core *cm_core = g_cm_core;
         u32 settimer = 0;
+        unsigned long timetosend;
         int ret = NETDEV_TX_OK;
 
         struct list_head timer_list;
@@ -644,8 +646,11 @@ static void nes_cm_timer_tick(unsigned long pass)
                                 send_entry->retrycount);
                         if (send_entry->send_retrans) {
                                 send_entry->retranscount--;
+                                timetosend = (NES_RETRY_TIMEOUT <<
+                                        (NES_DEFAULT_RETRANS - send_entry->retranscount));
+
                                 send_entry->timetosend = jiffies +
-                                        NES_RETRY_TIMEOUT;
+                                        min(timetosend, NES_MAX_TIMEOUT);
                                 if (nexttimeout > send_entry->timetosend ||
                                         !settimer) {
                                         nexttimeout = send_entry->timetosend;
@@ -854,7 +859,6 @@ static struct nes_cm_listener *find_listener(struct nes_cm_core *cm_core,
 {
         unsigned long flags;
         struct nes_cm_listener *listen_node;
-        __be32 tmp_addr = cpu_to_be32(dst_addr);
 
         /* walk list and find cm_node associated with this session ID */
         spin_lock_irqsave(&cm_core->listen_list_lock, flags);
@@ -871,9 +875,6 @@ static struct nes_cm_listener *find_listener(struct nes_cm_core *cm_core,
         }
         spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
 
-        nes_debug(NES_DBG_CM, "Unable to find listener for %pI4:%x\n",
-                  &tmp_addr, dst_port);
-
         /* no listener */
         return NULL;
 }
@@ -1325,18 +1326,20 @@ static void handle_fin_pkt(struct nes_cm_node *cm_node)
         nes_debug(NES_DBG_CM, "Received FIN, cm_node = %p, state = %u. "
                 "refcnt=%d\n", cm_node, cm_node->state,
                 atomic_read(&cm_node->ref_count));
-        cm_node->tcp_cntxt.rcv_nxt++;
-        cleanup_retrans_entry(cm_node);
         switch (cm_node->state) {
         case NES_CM_STATE_SYN_RCVD:
         case NES_CM_STATE_SYN_SENT:
         case NES_CM_STATE_ESTABLISHED:
         case NES_CM_STATE_MPAREQ_SENT:
         case NES_CM_STATE_MPAREJ_RCVD:
+                cm_node->tcp_cntxt.rcv_nxt++;
+                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_LAST_ACK;
                 send_fin(cm_node, NULL);
                 break;
         case NES_CM_STATE_FIN_WAIT1:
+                cm_node->tcp_cntxt.rcv_nxt++;
+                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSING;
                 send_ack(cm_node, NULL);
                 /* Wait for ACK as this is simultanous close..
@@ -1344,11 +1347,15 @@ static void handle_fin_pkt(struct nes_cm_node *cm_node)
                 * Just rm the node.. Done.. */
                 break;
         case NES_CM_STATE_FIN_WAIT2:
+                cm_node->tcp_cntxt.rcv_nxt++;
+                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_TIME_WAIT;
                 send_ack(cm_node, NULL);
                 schedule_nes_timer(cm_node, NULL,  NES_TIMER_TYPE_CLOSE, 1, 0);
                 break;
         case NES_CM_STATE_TIME_WAIT:
+                cm_node->tcp_cntxt.rcv_nxt++;
+                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSED;
                 rem_ref_cm_node(cm_node->cm_core, cm_node);
                 break;
@@ -1384,7 +1391,6 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 passive_state = atomic_add_return(1, &cm_node->passive_state);
                 if (passive_state ==  NES_SEND_RESET_EVENT)
                         create_event(cm_node, NES_CM_EVENT_RESET);
-                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSED;
                 dev_kfree_skb_any(skb);
                 break;
@@ -1398,17 +1404,16 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 active_open_err(cm_node, skb, reset);
                 break;
         case NES_CM_STATE_CLOSED:
-                cleanup_retrans_entry(cm_node);
                 drop_packet(skb);
                 break;
+        case NES_CM_STATE_LAST_ACK:
+                cm_node->cm_id->rem_ref(cm_node->cm_id);
         case NES_CM_STATE_TIME_WAIT:
-                cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSED;
                 rem_ref_cm_node(cm_node->cm_core, cm_node);
                 drop_packet(skb);
                 break;
         case NES_CM_STATE_FIN_WAIT1:
-                cleanup_retrans_entry(cm_node);
                 nes_debug(NES_DBG_CM, "Bad state %s[%u]\n", __func__, __LINE__);
         default:
                 drop_packet(skb);
@@ -1455,6 +1460,7 @@ static void handle_rcv_mpa(struct nes_cm_node *cm_node, struct sk_buff *skb)
                                 NES_PASSIVE_STATE_INDICATED);
                 break;
         case NES_CM_STATE_MPAREQ_SENT:
+                cleanup_retrans_entry(cm_node);
                 if (res_type == NES_MPA_REQUEST_REJECT) {
                         type = NES_CM_EVENT_MPA_REJECT;
                         cm_node->state = NES_CM_STATE_MPAREJ_RCVD;
@@ -1518,7 +1524,7 @@ static int check_seq(struct nes_cm_node *cm_node, struct tcphdr *tcph,
         rcv_wnd = cm_node->tcp_cntxt.rcv_wnd;
         if (ack_seq != loc_seq_num)
                 err = 1;
-        else if ((seq + rcv_wnd) < rcv_nxt)
+        else if (!between(seq, rcv_nxt, (rcv_nxt+rcv_wnd)))
                 err = 1;
         if (err) {
                 nes_debug(NES_DBG_CM, "%s[%u] create abort for cm_node=%p "
@@ -1652,49 +1658,39 @@ static void handle_synack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
         }
 }
 
-static void handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
+static int handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
         struct tcphdr *tcph)
 {
         int datasize = 0;
         u32 inc_sequence;
         u32 rem_seq_ack;
         u32 rem_seq;
-        int ret;
+        int ret = 0;
         int optionsize;
         optionsize = (tcph->doff << 2) - sizeof(struct tcphdr);
 
         if (check_seq(cm_node, tcph, skb))
-                return;
+                return -EINVAL;
 
         skb_pull(skb, tcph->doff << 2);
         inc_sequence = ntohl(tcph->seq);
         rem_seq = ntohl(tcph->seq);
         rem_seq_ack =  ntohl(tcph->ack_seq);
         datasize = skb->len;
-        cleanup_retrans_entry(cm_node);
         switch (cm_node->state) {
         case NES_CM_STATE_SYN_RCVD:
                 /* Passive OPEN */
+                cleanup_retrans_entry(cm_node);
                 ret = handle_tcp_options(cm_node, tcph, skb, optionsize, 1);
                 if (ret)
                         break;
                 cm_node->tcp_cntxt.rem_ack_num = ntohl(tcph->ack_seq);
-                if (cm_node->tcp_cntxt.rem_ack_num !=
-                    cm_node->tcp_cntxt.loc_seq_num) {
-                        nes_debug(NES_DBG_CM, "rem_ack_num != loc_seq_num\n");
-                        cleanup_retrans_entry(cm_node);
-                        send_reset(cm_node, skb);
-                        return;
-                }
                 cm_node->state = NES_CM_STATE_ESTABLISHED;
-                cleanup_retrans_entry(cm_node);
                 if (datasize) {
                         cm_node->tcp_cntxt.rcv_nxt = inc_sequence + datasize;
                         handle_rcv_mpa(cm_node, skb);
-                } else { /* rcvd ACK only */
+                } else  /* rcvd ACK only */
                         dev_kfree_skb_any(skb);
-                        cleanup_retrans_entry(cm_node);
-                 }
                 break;
         case NES_CM_STATE_ESTABLISHED:
                 /* Passive OPEN */
@@ -1706,15 +1702,12 @@ static void handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                         drop_packet(skb);
                 break;
         case NES_CM_STATE_MPAREQ_SENT:
-                cleanup_retrans_entry(cm_node);
                 cm_node->tcp_cntxt.rem_ack_num = ntohl(tcph->ack_seq);
                 if (datasize) {
                         cm_node->tcp_cntxt.rcv_nxt = inc_sequence + datasize;
                         handle_rcv_mpa(cm_node, skb);
-                } else { /* Could be just an ack pkt.. */
-                        cleanup_retrans_entry(cm_node);
+                } else  /* Could be just an ack pkt.. */
                         dev_kfree_skb_any(skb);
-                }
                 break;
         case NES_CM_STATE_LISTENING:
         case NES_CM_STATE_CLOSED:
@@ -1722,11 +1715,10 @@ static void handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 send_reset(cm_node, skb);
                 break;
         case NES_CM_STATE_LAST_ACK:
+        case NES_CM_STATE_CLOSING:
                 cleanup_retrans_entry(cm_node);
                 cm_node->state = NES_CM_STATE_CLOSED;
                 cm_node->cm_id->rem_ref(cm_node->cm_id);
-        case NES_CM_STATE_CLOSING:
-                cleanup_retrans_entry(cm_node);
                 rem_ref_cm_node(cm_node->cm_core, cm_node);
                 drop_packet(skb);
                 break;
@@ -1741,9 +1733,11 @@ static void handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
         case NES_CM_STATE_MPAREQ_RCVD:
         case NES_CM_STATE_UNKNOWN:
         default:
+                cleanup_retrans_entry(cm_node);
                 drop_packet(skb);
                 break;
         }
+        return ret;
 }
 
 
@@ -1849,6 +1843,7 @@ static void process_packet(struct nes_cm_node *cm_node, struct sk_buff *skb,
         enum nes_tcpip_pkt_type pkt_type = NES_PKT_TYPE_UNKNOWN;
         struct tcphdr *tcph = tcp_hdr(skb);
         u32     fin_set = 0;
+        int ret = 0;
         skb_pull(skb, ip_hdr(skb)->ihl << 2);
 
         nes_debug(NES_DBG_CM, "process_packet: cm_node=%p state =%d syn=%d "
@@ -1874,17 +1869,17 @@ static void process_packet(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 handle_synack_pkt(cm_node, skb, tcph);
                 break;
         case NES_PKT_TYPE_ACK:
-                handle_ack_pkt(cm_node, skb, tcph);
-                if (fin_set)
+                ret = handle_ack_pkt(cm_node, skb, tcph);
+                if (fin_set && !ret)
                         handle_fin_pkt(cm_node);
                 break;
         case NES_PKT_TYPE_RST:
                 handle_rst_pkt(cm_node, skb, tcph);
                 break;
         default:
-                drop_packet(skb);
-                if (fin_set)
+                if ((fin_set) && (!check_seq(cm_node, tcph, skb)))
                         handle_fin_pkt(cm_node);
+                drop_packet(skb);
                 break;
         }
 }
@@ -2710,7 +2705,6 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         /* associate the node with the QP */
         nesqp->cm_node = (void *)cm_node;
         cm_node->nesqp = nesqp;
-        nes_add_ref(&nesqp->ibqp);
 
         nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
                 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
@@ -2763,6 +2757,9 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                         nes_debug(NES_DBG_CM, "Unable to register memory region"
                                         "for lSMM for cm_node = %p \n",
                                         cm_node);
+                        pci_free_consistent(nesdev->pcidev,
+                                nesqp->private_data_len+sizeof(struct ietf_mpa_frame),
+                                nesqp->ietf_frame, nesqp->ietf_frame_pbase);
                         return -ENOMEM;
                 }
 
@@ -2879,6 +2876,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 
         /* notify OF layer that accept event was successful */
         cm_id->add_ref(cm_id);
+        nes_add_ref(&nesqp->ibqp);
 
         cm_event.event = IW_CM_EVENT_ESTABLISHED;
         cm_event.status = IW_CM_EVENT_STATUS_ACCEPTED;
@@ -2959,6 +2957,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct nes_device *nesdev;
         struct nes_cm_node *cm_node;
         struct nes_cm_info cm_info;
+        int apbvt_set = 0;
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
         if (!ibqp)
@@ -2996,9 +2995,11 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 conn_param->private_data_len);
 
         if (cm_id->local_addr.sin_addr.s_addr !=
-                cm_id->remote_addr.sin_addr.s_addr)
+                cm_id->remote_addr.sin_addr.s_addr) {
                 nes_manage_apbvt(nesvnic, ntohs(cm_id->local_addr.sin_port),
                         PCI_FUNC(nesdev->pcidev->devfn), NES_MANAGE_APBVT_ADD);
+                apbvt_set = 1;
+        }
 
         /* set up the connection params for the node */
         cm_info.loc_addr = htonl(cm_id->local_addr.sin_addr.s_addr);
@@ -3015,8 +3016,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 conn_param->private_data_len, (void *)conn_param->private_data,
                 &cm_info);
         if (!cm_node) {
-                if (cm_id->local_addr.sin_addr.s_addr !=
-                                cm_id->remote_addr.sin_addr.s_addr)
+                if (apbvt_set)
                         nes_manage_apbvt(nesvnic, ntohs(cm_id->local_addr.sin_port),
                                 PCI_FUNC(nesdev->pcidev->devfn),
                                 NES_MANAGE_APBVT_DEL);
@@ -3025,7 +3025,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 return -ENOMEM;
         }
 
-        cm_node->apbvt_set = 1;
+        cm_node->apbvt_set = apbvt_set;
         nesqp->cm_node = cm_node;
         cm_node->nesqp = nesqp;
         nes_add_ref(&nesqp->ibqp);
diff --git a/drivers/infiniband/hw/nes/nes_cm.h b/drivers/infiniband/hw/nes/nes_cm.h
index 80bba1892571..8b7e7c0e496e 100644
--- a/drivers/infiniband/hw/nes/nes_cm.h
+++ b/drivers/infiniband/hw/nes/nes_cm.h
@@ -149,6 +149,7 @@ struct nes_timer_entry {
 #endif
 #define NES_SHORT_TIME      (10)
 #define NES_LONG_TIME       (2000*HZ/1000)
+#define NES_MAX_TIMEOUT     ((unsigned long) (12*HZ))
 
 #define NES_CM_HASHTABLE_SIZE         1024
 #define NES_CM_TCP_TIMER_INTERVAL     3000
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index d6fc9ae44062..b832a7b814a2 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -550,11 +550,8 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
                         msleep(1);
                 }
                 if (int_cnt > 1) {
-                        u32 sds;
                         spin_lock_irqsave(&nesadapter->phy_lock, flags);
-                        sds = nes_read_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1);
-                        sds |= 0x00000040;
-                        nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1, sds);
+                        nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1, 0x0000F0C8);
                         mh_detected++;
                         reset_value = nes_read32(nesdev->regs+NES_SOFTWARE_RESET);
                         reset_value |= 0x0000003d;
@@ -579,7 +576,7 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
                                         if (++ext_cnt > int_cnt) {
                                                 spin_lock_irqsave(&nesadapter->phy_lock, flags);
                                                 nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1,
-                                                                0x0000F0C8);
+                                                                0x0000F088);
                                                 mh_detected++;
                                                 reset_value = nes_read32(nesdev->regs+NES_SOFTWARE_RESET);
                                                 reset_value |= 0x0000003d;
@@ -764,6 +761,9 @@ static int nes_init_serdes(struct nes_device *nesdev, u8 hw_rev, u8 port_count,
                         return 0;
 
                 /* init serdes 1 */
+                if (!(OneG_Mode && (nesadapter->phy_type[1] != NES_PHY_TYPE_PUMA_1G)))
+                        nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_CDR_CONTROL1, 0x000000FF);
+
                 switch (nesadapter->phy_type[1]) {
                 case NES_PHY_TYPE_ARGUS:
                 case NES_PHY_TYPE_SFP_D:
@@ -771,21 +771,20 @@ static int nes_init_serdes(struct nes_device *nesdev, u8 hw_rev, u8 port_count,
                         nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_TX_EMP1, 0x00000000);
                         break;
                 case NES_PHY_TYPE_CX4:
-                        sds = nes_read_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1);
-                        sds &= 0xFFFFFFBF;
-                        nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1, sds);
                         if (wide_ppm_offset)
                                 nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_CDR_CONTROL1, 0x000FFFAA);
-                        else
-                                nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_CDR_CONTROL1, 0x000000FF);
                         break;
                 case NES_PHY_TYPE_PUMA_1G:
                         sds = nes_read_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1);
                         sds |= 0x000000100;
                         nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1, sds);
                 }
-                if (!OneG_Mode)
+                if (!OneG_Mode) {
                         nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_TX_HIGHZ_LANE_MODE1, 0x11110000);
+                        sds = nes_read_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1);
+                        sds &= 0xFFFFFFBF;
+                        nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL1, sds);
+                }
         } else {
                 /* init serdes 0 */
                 nes_write_indexed(nesdev, NES_IDX_ETH_SERDES_COMMON_CONTROL0, 0x00000008);
@@ -913,6 +912,12 @@ static void nes_init_csr_ne020(struct nes_device *nesdev, u8 hw_rev, u8 port_cou
                 u32temp &= 0x7fffffff;
                 u32temp |= 0x7fff0010;
                 nes_write_indexed(nesdev, 0x000021f8, u32temp);
+                if (port_count > 1) {
+                        u32temp = nes_read_indexed(nesdev, 0x000023f8);
+                        u32temp &= 0x7fffffff;
+                        u32temp |= 0x7fff0010;
+                        nes_write_indexed(nesdev, 0x000023f8, u32temp);
+                }
         }
 }
 
@@ -1366,13 +1371,14 @@ int nes_init_phy(struct nes_device *nesdev)
                 if (phy_type == NES_PHY_TYPE_ARGUS) {
                         nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xc302, 0x000C);
                         nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xc319, 0x0008);
+                        nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0x0027, 0x0001);
                 } else {
                         nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xc302, 0x0004);
                         nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xc319, 0x0038);
+                        nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0x0027, 0x0013);
                 }
                 nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xc31a, 0x0098);
                 nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0x0026, 0x0E00);
-                nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0x0027, 0x0001);
 
                 /* setup LEDs */
                 nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xd006, 0x0007);
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 7e5b5ba13a74..64d5cfd8f380 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1627,6 +1627,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 nescq->hw_cq.cq_number = nes_ucontext->mcrqf & 0xffff;
                         else
                                 nescq->hw_cq.cq_number = nesvnic->mcrq_qp_id + nes_ucontext->mcrqf-1;
+                        nescq->mcrqf = nes_ucontext->mcrqf;
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                 }
                 nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
@@ -1682,6 +1683,12 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
+                else {
+                        pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,
+                                            nespbl->pbl_vbase, nespbl->pbl_pbase);
+                        kfree(nespbl);
+                }
+
                 nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                 kfree(nescq);
                 return ERR_PTR(-ENOMEM);
@@ -1705,6 +1712,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 if (!context)
                                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                                         nescq->hw_cq.cq_pbase);
+                                else {
+                                        pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,
+                                                            nespbl->pbl_vbase, nespbl->pbl_pbase);
+                                        kfree(nespbl);
+                                }
                                 nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                                 kfree(nescq);
                                 return ERR_PTR(-ENOMEM);
@@ -1722,6 +1734,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 if (!context)
                                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                                         nescq->hw_cq.cq_pbase);
+                                else {
+                                        pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,
+                                                            nespbl->pbl_vbase, nespbl->pbl_pbase);
+                                        kfree(nespbl);
+                                }
                                 nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                                 kfree(nescq);
                                 return ERR_PTR(-ENOMEM);
@@ -1774,6 +1791,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
+                else {
+                        pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,
+                                            nespbl->pbl_vbase, nespbl->pbl_pbase);
+                        kfree(nespbl);
+                }
                 nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                 kfree(nescq);
                 return ERR_PTR(-EIO);
@@ -1855,7 +1877,9 @@ static int nes_destroy_cq(struct ib_cq *ib_cq)
         set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_OPCODE_IDX, opcode);
         set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_ID_IDX,
                 (nescq->hw_cq.cq_number | ((u32)PCI_FUNC(nesdev->pcidev->devfn) << 16)));
-        nes_free_resource(nesadapter, nesadapter->allocated_cqs, nescq->hw_cq.cq_number);
+        if (!nescq->mcrqf)
+                nes_free_resource(nesadapter, nesadapter->allocated_cqs, nescq->hw_cq.cq_number);
+
         atomic_set(&cqp_request->refcount, 2);
         nes_post_cqp_request(nesdev, cqp_request);
 
@@ -1895,8 +1919,7 @@ static int nes_destroy_cq(struct ib_cq *ib_cq)
 static u32 root_256(struct nes_device *nesdev,
                     struct nes_root_vpbl *root_vpbl,
                     struct nes_root_vpbl *new_root,
-                    u16 pbl_count_4k,
-                    u16 pbl_count_256)
+                    u16 pbl_count_4k)
 {
         u64 leaf_pbl;
         int i, j, k;
@@ -1952,7 +1975,7 @@ static int nes_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
         int ret;
         struct nes_adapter *nesadapter = nesdev->nesadapter;
         uint pg_cnt = 0;
-        u16 pbl_count_256;
+        u16 pbl_count_256 = 0;
         u16 pbl_count = 0;
         u8  use_256_pbls = 0;
         u8  use_4k_pbls = 0;
@@ -2012,7 +2035,7 @@ static int nes_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
         }
 
         if (use_256_pbls && use_two_level) {
-                if (root_256(nesdev, root_vpbl, &new_root, pbl_count_4k, pbl_count_256) == 1) {
+                if (root_256(nesdev, root_vpbl, &new_root, pbl_count_4k) == 1) {
                         if (new_root.pbl_pbase != 0)
                                 root_vpbl = &new_root;
                 } else {
@@ -2122,6 +2145,7 @@ static struct ib_mr *nes_reg_phys_mr(struct ib_pd *ib_pd,
         struct nes_root_vpbl root_vpbl;
         u32 stag;
         u32 i;
+        unsigned long mask;
         u32 stag_index = 0;
         u32 next_stag_index = 0;
         u32 driver_key = 0;
@@ -2150,6 +2174,9 @@ static struct ib_mr *nes_reg_phys_mr(struct ib_pd *ib_pd,
                 return ERR_PTR(-E2BIG);
         }
 
+        if ((buffer_list[0].addr ^ *iova_start) & ~PAGE_MASK)
+                return ERR_PTR(-EINVAL);
+
         err = nes_alloc_resource(nesadapter, nesadapter->allocated_mrs, nesadapter->max_mr,
                         &stag_index, &next_stag_index);
         if (err) {
@@ -2215,19 +2242,16 @@ static struct ib_mr *nes_reg_phys_mr(struct ib_pd *ib_pd,
                         root_pbl_index++;
                         cur_pbl_index = 0;
                 }
-                if (buffer_list[i].addr & ~PAGE_MASK) {
-                        /* TODO: Unwind allocated buffers */
-                        nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
-                        nes_debug(NES_DBG_MR, "Unaligned Memory Buffer: 0x%x\n",
-                                        (unsigned int) buffer_list[i].addr);
-                        ibmr = ERR_PTR(-EINVAL);
-                        kfree(nesmr);
-                        goto reg_phys_err;
-                }
 
-                if (!buffer_list[i].size) {
+                mask = !buffer_list[i].size;
+                if (i != 0)
+                        mask |= buffer_list[i].addr;
+                if (i != num_phys_buf - 1)
+                        mask |= buffer_list[i].addr + buffer_list[i].size;
+
+                if (mask & ~PAGE_MASK) {
                         nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
-                        nes_debug(NES_DBG_MR, "Invalid Buffer Size\n");
+                        nes_debug(NES_DBG_MR, "Invalid buffer addr or size\n");
                         ibmr = ERR_PTR(-EINVAL);
                         kfree(nesmr);
                         goto reg_phys_err;
@@ -2238,7 +2262,7 @@ static struct ib_mr *nes_reg_phys_mr(struct ib_pd *ib_pd,
                         if ((buffer_list[i-1].addr+PAGE_SIZE) != buffer_list[i].addr)
                                 single_page = 0;
                 }
-                vpbl.pbl_vbase[cur_pbl_index].pa_low = cpu_to_le32((u32)buffer_list[i].addr);
+                vpbl.pbl_vbase[cur_pbl_index].pa_low = cpu_to_le32((u32)buffer_list[i].addr & PAGE_MASK);
                 vpbl.pbl_vbase[cur_pbl_index++].pa_high =
                                 cpu_to_le32((u32)((((u64)buffer_list[i].addr) >> 32)));
         }
@@ -2251,8 +2275,6 @@ static struct ib_mr *nes_reg_phys_mr(struct ib_pd *ib_pd,
                         " length = 0x%016lX, index = 0x%08X\n",
                         stag, (unsigned long)*iova_start, (unsigned long)region_length, stag_index);
 
-        region_length -= (*iova_start)&PAGE_MASK;
-
         /* Make the leaf PBL the root if only one PBL */
         if (root_pbl_index == 1) {
                 root_vpbl.pbl_pbase = vpbl.pbl_pbase;
@@ -2786,10 +2808,9 @@ static ssize_t show_fw_ver(struct device *dev, struct device_attribute *attr,
         struct nes_vnic *nesvnic = nesibdev->nesvnic;
 
         nes_debug(NES_DBG_INIT, "\n");
-        return sprintf(buf, "%x.%x.%x\n",
-                        (int)(nesvnic->nesdev->nesadapter->fw_ver >> 32),
-                        (int)(nesvnic->nesdev->nesadapter->fw_ver >> 16) & 0xffff,
-                        (int)(nesvnic->nesdev->nesadapter->fw_ver & 0xffff));
+        return sprintf(buf, "%u.%u\n",
+                (nesvnic->nesdev->nesadapter->firmware_version >> 16),
+                (nesvnic->nesdev->nesadapter->firmware_version & 0x000000ff));
 }
 
 
diff --git a/drivers/infiniband/hw/nes/nes_verbs.h b/drivers/infiniband/hw/nes/nes_verbs.h
index 5e48f67fbe8d..41c07f29f7c9 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.h
+++ b/drivers/infiniband/hw/nes/nes_verbs.h
@@ -112,6 +112,7 @@ struct nes_cq {
         spinlock_t       lock;
         u8               virtual_cq;
         u8               pad[3];
+        u32              mcrqf;
 };
 
 struct nes_wq {