84 files changed, 936 insertions, 443 deletions
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index ad1f59c1b3fc..b4a8d6030e48 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -132,7 +132,7 @@ config SATA_SIS
        depends on PCI
        select PATA_SIS
        help
-          This option enables support for SiS Serial ATA on 
+          This option enables support for SiS Serial ATA on
          SiS 964/965/966/180 and Parallel ATA on SiS 180.
          The PATA support for SiS 180 requires additionally to
          enable the PATA_SIS driver in the config.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index e00e1b913d28..7baeaffefe7a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -46,7 +46,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "ahci"
-#define DRV_VERSION     "2.1"
+#define DRV_VERSION     "2.2"
 enum {
@@ -170,6 +170,7 @@ enum {
        AHCI_FLAG_IGN_IRQ_IF_ERR        = (1 << 25), /* ignore IRQ_IF_ERR */
        AHCI_FLAG_HONOR_PI              = (1 << 26), /* honor PORTS_IMPL */
        AHCI_FLAG_IGN_SERR_INTERNAL     = (1 << 27), /* ignore SERR_INTERNAL */
+        AHCI_FLAG_32BIT_ONLY            = (1 << 28), /* force 32bit */
        AHCI_FLAG_COMMON                = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
                                          ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
@@ -354,7 +355,8 @@ static const struct ata_port_info ahci_port_info[] = {
        /* board_ahci_sb600 */
        {
                .flags          = AHCI_FLAG_COMMON |
-                                  AHCI_FLAG_IGN_SERR_INTERNAL,
+                                  AHCI_FLAG_IGN_SERR_INTERNAL |
+                                  AHCI_FLAG_32BIT_ONLY,
                .pio_mask       = 0x1f, /* pio0-4 */
                .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
                .port_ops       = &ahci_ops,
@@ -492,6 +494,13 @@ static void ahci_save_initial_config(struct pci_dev *pdev,
        hpriv->saved_cap = cap = readl(mmio + HOST_CAP);
        hpriv->saved_port_map = port_map = readl(mmio + HOST_PORTS_IMPL);
+        /* some chips lie about 64bit support */
+        if ((cap & HOST_CAP_64) && (pi->flags & AHCI_FLAG_32BIT_ONLY)) {
+                dev_printk(KERN_INFO, &pdev->dev,
+                           "controller can't do 64bit DMA, forcing 32bit\n");
+                cap &= ~HOST_CAP_64;
+        }
        /* fixup zero port_map */
        if (!port_map) {
                port_map = (1 << ahci_nr_ports(hpriv->cap)) - 1;
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index c3d753296bc6..7565f022bd69 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -26,7 +26,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "ata_generic"
-#define DRV_VERSION "0.2.11"
+#define DRV_VERSION "0.2.12"
 /*
 *      A generic parallel ATA driver using libata
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 13b6b1df2ac4..0458811010fd 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -155,7 +155,6 @@ struct piix_host_priv {
 static int piix_init_one (struct pci_dev *pdev,
                                    const struct pci_device_id *ent);
 static void piix_pata_error_handler(struct ata_port *ap);
-static void piix_sata_error_handler(struct ata_port *ap);
 static void piix_set_piomode (struct ata_port *ap, struct ata_device *adev);
 static void piix_set_dmamode (struct ata_port *ap, struct ata_device *adev);
 static void ich_set_dmamode (struct ata_port *ap, struct ata_device *adev);
@@ -364,7 +363,7 @@ static const struct ata_port_operations piix_sata_ops = {
        .freeze                 = ata_bmdma_freeze,
        .thaw                   = ata_bmdma_thaw,
-        .error_handler          = piix_sata_error_handler,
+        .error_handler          = ata_bmdma_error_handler,
        .post_internal_cmd      = ata_bmdma_post_internal_cmd,
        .irq_handler            = ata_interrupt,
@@ -641,12 +640,6 @@ static void piix_pata_error_handler(struct ata_port *ap)
                           ata_std_postreset);
 }
-static void piix_sata_error_handler(struct ata_port *ap)
-{
-        ata_bmdma_drive_eh(ap, ata_std_prereset, ata_std_softreset, NULL,
-                           ata_std_postreset);
-}
 /**
 *      piix_set_piomode - Initialize host controller PATA PIO timings
 *      @ap: Port whose timings we are configuring
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index d3ea7f55283c..a6de57e02047 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -59,7 +59,7 @@
 #include "libata.h"
-#define DRV_VERSION     "2.20"  /* must be exactly four chars */
+#define DRV_VERSION     "2.21"  /* must be exactly four chars */
 /* debounce timing parameters in msecs { interval, duration, timeout } */
@@ -977,7 +977,7 @@ static u64 ata_hpa_resize(struct ata_device *dev)
 {
        u64 sectors = dev->n_sectors;
        u64 hpa_sectors;
-        
        if (ata_id_has_lba48(dev->id))
                hpa_sectors = ata_read_native_max_address_ext(dev);
        else
@@ -1588,7 +1588,7 @@ unsigned int ata_do_simple_cmd(struct ata_device *dev, u8 cmd)
 *      Check if the current speed of the device requires IORDY. Used
 *      by various controllers for chip configuration.
 */
- 
 unsigned int ata_pio_need_iordy(const struct ata_device *adev)
 {
        /* Controller doesn't support  IORDY. Probably a pointless check
@@ -1611,7 +1611,7 @@ unsigned int ata_pio_need_iordy(const struct ata_device *adev)
 *      Compute the highest mode possible if we are not using iordy. Return
 *      -1 if no iordy mode is available.
 */
- 
 static u32 ata_pio_mask_no_iordy(const struct ata_device *adev)
 {
        /* If we have no drive specific rule, then PIO 2 is non IORDY */
@@ -2663,7 +2663,7 @@ int ata_timing_compute(struct ata_device *adev, unsigned short speed,
                t->active += (t->cycle - (t->active + t->recover)) / 2;
                t->recover = t->cycle - t->active;
        }
-        
        /* In a few cases quantisation may produce enough errors to
           leave t->cycle too low for the sum of active and recovery
           if so we must correct this */
@@ -2893,9 +2893,6 @@ int ata_do_set_mode(struct ata_port *ap, struct ata_device **r_failed_dev)
        if (used_dma && (ap->host->flags & ATA_HOST_SIMPLEX))
                ap->host->simplex_claimed = ap;
-        /* step5: chip specific finalisation */
-        if (ap->ops->post_set_mode)
-                ap->ops->post_set_mode(ap);
 out:
        if (rc)
                *r_failed_dev = dev;
@@ -3771,6 +3768,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "ATAPI CD-ROM DRIVE 40X MAXIMUM",NULL,ATA_HORKAGE_NODMA },
        { "_NEC DV5800A",       NULL,           ATA_HORKAGE_NODMA },
        { "SAMSUNG CD-ROM SN-124","N001",       ATA_HORKAGE_NODMA },
+        { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
        /* Weird ATAPI devices */
        { "TORiSAN DVD-ROM DRD-N216", NULL,     ATA_HORKAGE_MAX_SEC_128 |
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 5309c312f517..d8070989a39f 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1009,7 +1009,7 @@ static unsigned int atapi_eh_request_sense(struct ata_queued_cmd *qc)
        sense_buf[0] = 0x70;
        sense_buf[2] = qc->result_tf.feature >> 4;
-        /* some devices time out if garbage left in tf */ 
+        /* some devices time out if garbage left in tf */
        ata_tf_init(dev, &tf);
        memset(cdb, 0, ATAPI_CDB_LEN);
diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
index 9861059dd673..7b4810c171b7 100644
--- a/drivers/ata/pata_artop.c
+++ b/drivers/ata/pata_artop.c
@@ -28,7 +28,7 @@
 #include <linux/ata.h>
 #define DRV_NAME        "pata_artop"
-#define DRV_VERSION     "0.4.2"
+#define DRV_VERSION     "0.4.3"
 /*
 *      The ARTOP has 33 Mhz and "over clocked" timing tables. Until we
@@ -99,7 +99,7 @@ static int artop6260_pre_reset(struct ata_port *ap, unsigned long deadline)
 *
 *      Identify the cable type for the ARTOp interface in question
 */
- 
 static int artop6260_cable_detect(struct ata_port *ap)
 {
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
diff --git a/drivers/ata/pata_cmd640.c b/drivers/ata/pata_cmd640.c
index ed00fa9d53be..31cbf8daa299 100644
--- a/drivers/ata/pata_cmd640.c
+++ b/drivers/ata/pata_cmd640.c
@@ -107,7 +107,7 @@ static void cmd640_set_piomode(struct ata_port *ap, struct ata_device *adev)
                pci_write_config_byte(pdev, arttim + 1, (t.active << 4) | t.recover);
        } else {
                /* Save the shared timings for channel, they will be loaded
-                   by qc_issue_prot. Reloading the setup time is expensive 
+                   by qc_issue_prot. Reloading the setup time is expensive
                   so we keep a merged one loaded */
                pci_read_config_byte(pdev, ARTIM23, &reg);
                reg &= 0x3F;
@@ -231,7 +231,7 @@ static void cmd640_hardware_init(struct pci_dev *pdev)
        pci_write_config_byte(pdev, CMDTIM, 0);
        /* 512 byte bursts (sector) */
        pci_write_config_byte(pdev, BRST, 0x40);
-        /* 
+        /*
         * A reporter a long time ago
         * Had problems with the data fifo
         * So don't run the risk
diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
index 2a79b335cfcc..320a5b10aa98 100644
--- a/drivers/ata/pata_cmd64x.c
+++ b/drivers/ata/pata_cmd64x.c
@@ -31,7 +31,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_cmd64x"
-#define DRV_VERSION "0.2.2"
+#define DRV_VERSION "0.2.3"
 /*
 * CMD64x specific registers definition.
diff --git a/drivers/ata/pata_cs5520.c b/drivers/ata/pata_cs5520.c
index 83bcc5b32597..1aabe15ad9d3 100644
--- a/drivers/ata/pata_cs5520.c
+++ b/drivers/ata/pata_cs5520.c
@@ -41,7 +41,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pata_cs5520"
-#define DRV_VERSION     "0.6.4"
+#define DRV_VERSION     "0.6.5"
 struct pio_clocks
 {
diff --git a/drivers/ata/pata_cs5530.c b/drivers/ata/pata_cs5530.c
index 1b67923d7a4e..848f0309bf03 100644
--- a/drivers/ata/pata_cs5530.c
+++ b/drivers/ata/pata_cs5530.c
@@ -35,7 +35,7 @@
 #include <linux/dmi.h>
 #define DRV_NAME        "pata_cs5530"
-#define DRV_VERSION     "0.7.2"
+#define DRV_VERSION     "0.7.3"
 static void __iomem *cs5530_port_base(struct ata_port *ap)
 {
diff --git a/drivers/ata/pata_cs5535.c b/drivers/ata/pata_cs5535.c
index f37d4cd812a1..aa3256fb9f7a 100644
--- a/drivers/ata/pata_cs5535.c
+++ b/drivers/ata/pata_cs5535.c
@@ -39,7 +39,7 @@
 #include <asm/msr.h>
 #define DRV_NAME        "cs5535"
-#define DRV_VERSION     "0.2.11"
+#define DRV_VERSION     "0.2.12"
 /*
 *      The Geode (Aka Athlon GX now) uses an internal MSR based
diff --git a/drivers/ata/pata_cypress.c b/drivers/ata/pata_cypress.c
index 27b9f29c01e3..d41a7691dd8e 100644
--- a/drivers/ata/pata_cypress.c
+++ b/drivers/ata/pata_cypress.c
@@ -18,7 +18,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_cypress"
-#define DRV_VERSION "0.1.4"
+#define DRV_VERSION "0.1.5"
 /* here are the offset definitions for the registers */
diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
index c6c8a8bb06d0..0c9cb6090711 100644
--- a/drivers/ata/pata_hpt366.c
+++ b/drivers/ata/pata_hpt366.c
@@ -220,32 +220,6 @@ static int hpt36x_cable_detect(struct ata_port *ap)
        return ATA_CBL_PATA80;
 }
-static int hpt36x_pre_reset(struct ata_port *ap, unsigned long deadline)
-{
-        static const struct pci_bits hpt36x_enable_bits[] = {
-                { 0x50, 1, 0x04, 0x04 },
-                { 0x54, 1, 0x04, 0x04 }
-        };
-        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
-        if (!pci_test_config_bits(pdev, &hpt36x_enable_bits[ap->port_no]))
-                return -ENOENT;
-        return ata_std_prereset(ap, deadline);
-}
-/**
- *      hpt36x_error_handler    -       reset the hpt36x bus
- *      @ap: ATA port to reset
- *
- *      Perform the reset handling for the 366/368
- */
-static void hpt36x_error_handler(struct ata_port *ap)
-{
-        ata_bmdma_drive_eh(ap, hpt36x_pre_reset, ata_std_softreset, NULL, ata_std_postreset);
-}
 /**
 *      hpt366_set_piomode              -       PIO setup
 *      @ap: ATA interface
@@ -351,7 +325,7 @@ static struct ata_port_operations hpt366_port_ops = {
        .freeze         = ata_bmdma_freeze,
        .thaw           = ata_bmdma_thaw,
-        .error_handler  = hpt36x_error_handler,
+        .error_handler  = ata_bmdma_error_handler,
        .post_internal_cmd = ata_bmdma_post_internal_cmd,
        .cable_detect   = hpt36x_cable_detect,
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index 5a0a410654e2..a54c17433eef 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -961,7 +961,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
        u8 mcr1;
        u32 freq;
        int prefer_dpll = 1;
-        
        unsigned long iobase = pci_resource_start(dev, 4);
        const struct hpt_chip *chip_table;
@@ -1055,7 +1055,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         */
        pci_write_config_byte(dev, 0x5b, 0x23);
-        
        /*
         * HighPoint does this for HPT372A.
         * NOTE: This register is only writeable via I/O space.
@@ -1088,7 +1088,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         *      Turn the frequency check into a band and then find a timing
         *      table to match it.
         */
-         
        clock_slot = hpt37x_clock_slot(freq, chip_table->base);
        if (chip_table->clocks[clock_slot] == NULL || prefer_dpll) {
                /*
@@ -1099,11 +1099,11 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 */
                unsigned int f_low, f_high;
                int adjust;
-                
                clock_slot = 2;
                if (port->udma_mask & 0xE0)
                        clock_slot = 3;
-                
                f_low = (MHz[clock_slot] * chip_table->base) / 192;
                f_high = f_low + 2;
diff --git a/drivers/ata/pata_hpt3x3.c b/drivers/ata/pata_hpt3x3.c
index bbabe7902fbb..8ce5e23a5f75 100644
--- a/drivers/ata/pata_hpt3x3.c
+++ b/drivers/ata/pata_hpt3x3.c
@@ -23,7 +23,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pata_hpt3x3"
-#define DRV_VERSION     "0.4.2"
+#define DRV_VERSION     "0.4.3"
 /**
 *      hpt3x3_set_piomode              -       PIO setup
diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index d042efdfbac4..1f647b648204 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -17,7 +17,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_isapnp"
-#define DRV_VERSION "0.2.0"
+#define DRV_VERSION "0.2.1"
 static struct scsi_host_template isapnp_sht = {
        .module                 = THIS_MODULE,
diff --git a/drivers/ata/pata_it8213.c b/drivers/ata/pata_it8213.c
index a769952646e1..95b0bb61788b 100644
--- a/drivers/ata/pata_it8213.c
+++ b/drivers/ata/pata_it8213.c
@@ -19,7 +19,7 @@
 #include <linux/ata.h>
 #define DRV_NAME        "pata_it8213"
-#define DRV_VERSION     "0.0.2"
+#define DRV_VERSION     "0.0.3"
 /**
 *      it8213_pre_reset        -       check for 40/80 pin
diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index b994351fbcd0..8d2bc1e9e871 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -23,7 +23,7 @@
 #include <scsi/scsi_host.h>
 #define DRV_NAME        "pata_ixp4xx_cf"
-#define DRV_VERSION     "0.1.2"
+#define DRV_VERSION     "0.1.3"
 static int ixp4xx_set_mode(struct ata_port *ap, struct ata_device **error)
 {
diff --git a/drivers/ata/pata_jmicron.c b/drivers/ata/pata_jmicron.c
index 8d799e87f752..2af7ff8256ca 100644
--- a/drivers/ata/pata_jmicron.c
+++ b/drivers/ata/pata_jmicron.c
@@ -19,7 +19,7 @@
 #include <linux/ata.h>
 #define DRV_NAME        "pata_jmicron"
-#define DRV_VERSION     "0.1.4"
+#define DRV_VERSION     "0.1.5"
 typedef enum {
        PORT_PATA0 = 0,
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index 707099291e01..edffc25d2d3f 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -64,7 +64,7 @@
 #include <linux/platform_device.h>
 #define DRV_NAME "pata_legacy"
-#define DRV_VERSION "0.5.4"
+#define DRV_VERSION "0.5.5"
 #define NR_HOST 6
diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
index 1f6384895a4f..cbb7866940d6 100644
--- a/drivers/ata/pata_platform.c
+++ b/drivers/ata/pata_platform.c
@@ -22,7 +22,7 @@
 #include <linux/pata_platform.h>
 #define DRV_NAME "pata_platform"
-#define DRV_VERSION "0.1.2"
+#define DRV_VERSION "1.0"
 static int pio_mask = 1;
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index fb8c9e14b8d4..1998c19e8743 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -26,7 +26,7 @@
 #include <linux/platform_device.h>
 #define DRV_NAME "pata_qdi"
-#define DRV_VERSION "0.3.0"
+#define DRV_VERSION "0.3.1"
 #define NR_HOST 4       /* Two 6580s */
diff --git a/drivers/ata/pata_rz1000.c b/drivers/ata/pata_rz1000.c
index 2bfd7ef42af5..a3488b41ad26 100644
--- a/drivers/ata/pata_rz1000.c
+++ b/drivers/ata/pata_rz1000.c
@@ -21,7 +21,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pata_rz1000"
-#define DRV_VERSION     "0.2.3"
+#define DRV_VERSION     "0.2.4"
 /**
diff --git a/drivers/ata/pata_sc1200.c b/drivers/ata/pata_sc1200.c
index 225013ecf4b6..1233063ab9a8 100644
--- a/drivers/ata/pata_sc1200.c
+++ b/drivers/ata/pata_sc1200.c
@@ -40,7 +40,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sc1200"
-#define DRV_VERSION     "0.2.4"
+#define DRV_VERSION     "0.2.5"
 #define SC1200_REV_A    0x00
 #define SC1200_REV_B1   0x01
diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
index 844e53b280c7..aa138d211b09 100644
--- a/drivers/ata/pata_scc.c
+++ b/drivers/ata/pata_scc.c
@@ -43,7 +43,7 @@
 #include <linux/libata.h>
 #define DRV_NAME                "pata_scc"
-#define DRV_VERSION             "0.1"
+#define DRV_VERSION             "0.2"
 #define PCI_DEVICE_ID_TOSHIBA_SCC_ATA           0x01b4
diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
index dee6e211949d..1e8f421963c7 100644
--- a/drivers/ata/pata_serverworks.c
+++ b/drivers/ata/pata_serverworks.c
@@ -41,7 +41,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_serverworks"
-#define DRV_VERSION "0.4.0"
+#define DRV_VERSION "0.4.1"
 #define SVWKS_CSB5_REVISION_NEW 0x92 /* min PCI_REVISION_ID for UDMA5 (A2.0) */
 #define SVWKS_CSB6_REVISION     0xa0 /* min PCI_REVISION_ID for UDMA4 (A1.0) */
diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
index f48491ad5f3a..e5aaec43694d 100644
--- a/drivers/ata/pata_sl82c105.c
+++ b/drivers/ata/pata_sl82c105.c
@@ -26,7 +26,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_sl82c105"
-#define DRV_VERSION "0.3.0"
+#define DRV_VERSION "0.3.1"
 enum {
        /*
diff --git a/drivers/ata/pata_winbond.c b/drivers/ata/pata_winbond.c
index cc4ad271afb5..83abfeca4057 100644
--- a/drivers/ata/pata_winbond.c
+++ b/drivers/ata/pata_winbond.c
@@ -16,7 +16,7 @@
 #include <linux/platform_device.h>
 #define DRV_NAME "pata_winbond"
-#define DRV_VERSION "0.0.2"
+#define DRV_VERSION "0.0.3"
 #define NR_HOST 4       /* Two winbond controllers, two channels each */
diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
index 52b69530ab29..f12c2b6ac08e 100644
--- a/drivers/ata/pdc_adma.c
+++ b/drivers/ata/pdc_adma.c
@@ -44,7 +44,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pdc_adma"
-#define DRV_VERSION     "0.05"
+#define DRV_VERSION     "0.06"
 /* macro to calculate base address for ATA regs */
 #define ADMA_ATA_REGS(base,port_no)     ((base) + ((port_no) * 0x40))
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index bda5e7747c21..2d80c9d95e95 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -28,7 +28,7 @@
 #include <scsi/scsi_device.h>
 #define DRV_NAME        "sata_inic162x"
-#define DRV_VERSION     "0.1"
+#define DRV_VERSION     "0.2"
 enum {
        MMIO_BAR                = 5,
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index cb9b9ac12b4c..705a020e1597 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -35,7 +35,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_mv"
-#define DRV_VERSION     "0.8"
+#define DRV_VERSION     "0.81"
 enum {
        /* BAR's are enumerated in terms of pci_resource_start() terms */
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 1a49c777fa6a..adfa693db53d 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -49,7 +49,7 @@
 #include <linux/libata.h>
 #define DRV_NAME                        "sata_nv"
-#define DRV_VERSION                     "3.3"
+#define DRV_VERSION                     "3.4"
 #define NV_ADMA_DMA_BOUNDARY            0xffffffffUL
@@ -802,7 +802,7 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                        u16 status;
                        u32 gen_ctl;
                        u32 notifier, notifier_error;
-                        
                        /* if ADMA is disabled, use standard ata interrupt handler */
                        if (pp->flags & NV_ADMA_ATAPI_SETUP_COMPLETE) {
                                u8 irq_stat = readb(host->iomap[NV_MMIO_BAR] + NV_INT_STATUS_CK804)
@@ -963,7 +963,7 @@ static void nv_adma_irq_clear(struct ata_port *ap)
        /* clear ADMA status */
        writew(0xffff, mmio + NV_ADMA_STAT);
-        
        /* clear notifiers - note both ports need to be written with
           something even though we are only clearing on one */
        if (ap->port_no == 0) {
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index f5a05de0093d..6688ccb66320 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -39,7 +39,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_qstor"
-#define DRV_VERSION     "0.07"
+#define DRV_VERSION     "0.08"
 enum {
        QS_MMIO_BAR             = 4,
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index e8483aadd11b..a3b339bcf3cf 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -305,7 +305,7 @@ static int sil_set_mode (struct ata_port *ap, struct ata_device **r_failed)
        u32 tmp, dev_mode[2];
        unsigned int i;
        int rc;
-        
        rc = ata_do_set_mode(ap, r_failed);
        if (rc)
                return rc;
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 0cb6618935b1..0ddfae9911cd 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -30,7 +30,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_sil24"
-#define DRV_VERSION     "0.8"
+#define DRV_VERSION     "0.9"
 /*
 * Port request block (PRB) 32 bytes
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index ee66c5fa7ac8..51d9251b0898 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -43,7 +43,7 @@
 #include "sis.h"
 #define DRV_NAME        "sata_sis"
-#define DRV_VERSION     "0.7"
+#define DRV_VERSION     "0.8"
 enum {
        sis_180                 = 0,
diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
index 17246734fe76..bcb2cd8b063d 100644
--- a/drivers/ata/sata_svw.c
+++ b/drivers/ata/sata_svw.c
@@ -53,7 +53,7 @@
 #endif /* CONFIG_PPC_OF */
 #define DRV_NAME        "sata_svw"
-#define DRV_VERSION     "2.1"
+#define DRV_VERSION     "2.2"
 enum {
        /* ap->flags bits */
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index 3a4f44559d0a..2d14f3d56d92 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -44,7 +44,7 @@
 #include "sata_promise.h"
 #define DRV_NAME        "sata_sx4"
-#define DRV_VERSION     "0.10"
+#define DRV_VERSION     "0.11"
 enum {
diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
index 006f5e352658..6815de7cca79 100644
--- a/drivers/ata/sata_uli.c
+++ b/drivers/ata/sata_uli.c
@@ -36,7 +36,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_uli"
-#define DRV_VERSION     "1.1"
+#define DRV_VERSION     "1.2"
 enum {
        uli_5289                = 0,
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index ac4f43c4993f..01bba26d8d1a 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -46,7 +46,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_via"
-#define DRV_VERSION     "2.1"
+#define DRV_VERSION     "2.2"
 enum board_ids_enum {
        vt6420,
diff --git a/drivers/ata/sata_vsc.c b/drivers/ata/sata_vsc.c
index 80126f835d32..81330175fc89 100644
--- a/drivers/ata/sata_vsc.c
+++ b/drivers/ata/sata_vsc.c
@@ -47,7 +47,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_vsc"
-#define DRV_VERSION     "2.1"
+#define DRV_VERSION     "2.2"
 enum {
        VSC_MMIO_BAR                    = 0,
diff --git a/drivers/base/dmapool.c b/drivers/base/dmapool.c
index 9406259754ad..91970e9bb05e 100644
--- a/drivers/base/dmapool.c
+++ b/drivers/base/dmapool.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/poison.h>
+#include <linux/sched.h>
 /*
 * Pool allocator ... wraps the dma_alloc_coherent page allocator, so
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 679d7f972439..c7ed617aa7ff 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -37,6 +37,7 @@
 #include <linux/agpgart.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include "agp.h"
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 45aeb917ec63..d535c406b319 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -37,6 +37,7 @@
 #include <linux/vmalloc.h>
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/cacheflush.h>
 #include <asm/pgtable.h>
diff --git a/drivers/char/hangcheck-timer.c b/drivers/char/hangcheck-timer.c
index f0e7263dfcde..0e8ceea5ea78 100644
--- a/drivers/char/hangcheck-timer.c
+++ b/drivers/char/hangcheck-timer.c
@@ -48,7 +48,7 @@
 #include <linux/delay.h>
 #include <asm/uaccess.h>
 #include <linux/sysrq.h>
+#include <linux/timer.h>
 #define VERSION_STR "0.9.0"
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 558c9a0fc8b9..e85f7013de57 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -38,6 +38,7 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include <rdma/ib_cache.h>
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index eff591deeb46..e840434a96d8 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -306,7 +306,9 @@ static int cm_alloc_id(struct cm_id_private *cm_id_priv)
        do {
                spin_lock_irqsave(&cm.lock, flags);
                ret = idr_get_new_above(&cm.local_id_table, cm_id_priv,
-                                        next_id++, &id);
+                                        next_id, &id);
+                if (!ret)
+                        next_id = ((unsigned) id + 1) & MAX_ID_MASK;
                spin_unlock_irqrestore(&cm.lock, flags);
        } while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 592c90aa3183..3ada17c0f239 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -40,6 +40,7 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/workqueue.h>
 #include "core_priv.h"
@@ -149,6 +150,18 @@ static int alloc_name(char *name)
        return 0;
 }
+static int start_port(struct ib_device *device)
+{
+        return (device->node_type == RDMA_NODE_IB_SWITCH) ? 0 : 1;
+}
+static int end_port(struct ib_device *device)
+{
+        return (device->node_type == RDMA_NODE_IB_SWITCH) ?
+                0 : device->phys_port_cnt;
+}
 /**
 * ib_alloc_device - allocate an IB device struct
 * @size:size of structure to allocate
@@ -208,6 +221,45 @@ static int add_client_context(struct ib_device *device, struct ib_client *client
        return 0;
 }
+static int read_port_table_lengths(struct ib_device *device)
+{
+        struct ib_port_attr *tprops = NULL;
+        int num_ports, ret = -ENOMEM;
+        u8 port_index;
+        tprops = kmalloc(sizeof *tprops, GFP_KERNEL);
+        if (!tprops)
+                goto out;
+        num_ports = end_port(device) - start_port(device) + 1;
+        device->pkey_tbl_len = kmalloc(sizeof *device->pkey_tbl_len * num_ports,
+                                       GFP_KERNEL);
+        device->gid_tbl_len = kmalloc(sizeof *device->gid_tbl_len * num_ports,
+                                      GFP_KERNEL);
+        if (!device->pkey_tbl_len || !device->gid_tbl_len)
+                goto err;
+        for (port_index = 0; port_index < num_ports; ++port_index) {
+                ret = ib_query_port(device, port_index + start_port(device),
+                                        tprops);
+                if (ret)
+                        goto err;
+                device->pkey_tbl_len[port_index] = tprops->pkey_tbl_len;
+                device->gid_tbl_len[port_index]  = tprops->gid_tbl_len;
+        }
+        ret = 0;
+        goto out;
+err:
+        kfree(device->gid_tbl_len);
+        kfree(device->pkey_tbl_len);
+out:
+        kfree(tprops);
+        return ret;
+}
 /**
 * ib_register_device - Register an IB device with IB core
 * @device:Device to register
@@ -239,10 +291,19 @@ int ib_register_device(struct ib_device *device)
        spin_lock_init(&device->event_handler_lock);
        spin_lock_init(&device->client_data_lock);
+        ret = read_port_table_lengths(device);
+        if (ret) {
+                printk(KERN_WARNING "Couldn't create table lengths cache for device %s\n",
+                       device->name);
+                goto out;
+        }
        ret = ib_device_register_sysfs(device);
        if (ret) {
                printk(KERN_WARNING "Couldn't register device %s with driver model\n",
                       device->name);
+                kfree(device->gid_tbl_len);
+                kfree(device->pkey_tbl_len);
                goto out;
        }
@@ -284,6 +345,9 @@ void ib_unregister_device(struct ib_device *device)
        list_del(&device->core_list);
+        kfree(device->gid_tbl_len);
+        kfree(device->pkey_tbl_len);
        mutex_unlock(&device_mutex);
        spin_lock_irqsave(&device->client_data_lock, flags);
@@ -506,10 +570,7 @@ int ib_query_port(struct ib_device *device,
                  u8 port_num,
                  struct ib_port_attr *port_attr)
 {
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (port_num < start_port(device) || port_num > end_port(device))
-                if (port_num)
-                        return -EINVAL;
-        } else if (port_num < 1 || port_num > device->phys_port_cnt)
                return -EINVAL;
        return device->query_port(device, port_num, port_attr);
@@ -581,10 +642,7 @@ int ib_modify_port(struct ib_device *device,
                   u8 port_num, int port_modify_mask,
                   struct ib_port_modify *port_modify)
 {
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (port_num < start_port(device) || port_num > end_port(device))
-                if (port_num)
-                        return -EINVAL;
-        } else if (port_num < 1 || port_num > device->phys_port_cnt)
                return -EINVAL;
        return device->modify_port(device, port_num, port_modify_mask,
@@ -592,6 +650,68 @@ int ib_modify_port(struct ib_device *device,
 }
 EXPORT_SYMBOL(ib_modify_port);
+/**
+ * ib_find_gid - Returns the port number and GID table index where
+ *   a specified GID value occurs.
+ * @device: The device to query.
+ * @gid: The GID value to search for.
+ * @port_num: The port number of the device where the GID value was found.
+ * @index: The index into the GID table where the GID was found.  This
+ *   parameter may be NULL.
+ */
+int ib_find_gid(struct ib_device *device, union ib_gid *gid,
+                u8 *port_num, u16 *index)
+{
+        union ib_gid tmp_gid;
+        int ret, port, i;
+        for (port = start_port(device); port <= end_port(device); ++port) {
+                for (i = 0; i < device->gid_tbl_len[port - start_port(device)]; ++i) {
+                        ret = ib_query_gid(device, port, i, &tmp_gid);
+                        if (ret)
+                                return ret;
+                        if (!memcmp(&tmp_gid, gid, sizeof *gid)) {
+                                *port_num = port;
+                                if (index)
+                                        *index = i;
+                                return 0;
+                        }
+                }
+        }
+        return -ENOENT;
+}
+EXPORT_SYMBOL(ib_find_gid);
+/**
+ * ib_find_pkey - Returns the PKey table index where a specified
+ *   PKey value occurs.
+ * @device: The device to query.
+ * @port_num: The port number of the device to search for the PKey.
+ * @pkey: The PKey value to search for.
+ * @index: The index into the PKey table where the PKey was found.
+ */
+int ib_find_pkey(struct ib_device *device,
+                 u8 port_num, u16 pkey, u16 *index)
+{
+        int ret, i;
+        u16 tmp_pkey;
+        for (i = 0; i < device->pkey_tbl_len[port_num - start_port(device)]; ++i) {
+                ret = ib_query_pkey(device, port_num, i, &tmp_pkey);
+                if (ret)
+                        return ret;
+                if (pkey == tmp_pkey) {
+                        *index = i;
+                        return 0;
+                }
+        }
+        return -ENOENT;
+}
+EXPORT_SYMBOL(ib_find_pkey);
 static int __init ib_core_init(void)
 {
        int ret;
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index f32ca5fbb26b..b4aec5103c99 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -36,6 +36,7 @@
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched.h>
 #include "uverbs.h"
@@ -209,8 +210,10 @@ void ib_umem_release(struct ib_umem *umem)
        __ib_umem_release(umem->context->device, umem, 1);
        mm = get_task_mm(current);
-        if (!mm)
+        if (!mm) {
+                kfree(umem);
                return;
+        }
        diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 84c5bb498563..add79bd44e39 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -2050,13 +2050,10 @@ int ehca_mrmw_map_hrc_alloc(const u64 hipz_rc)
        switch (hipz_rc) {
        case H_SUCCESS:              /* successful completion */
                return 0;
-        case H_ADAPTER_PARM:         /* invalid adapter handle */
-        case H_RT_PARM:              /* invalid resource type */
        case H_NOT_ENOUGH_RESOURCES: /* insufficient resources */
-        case H_MLENGTH_PARM:         /* invalid memory length */
-        case H_MEM_ACCESS_PARM:      /* invalid access controls */
        case H_CONSTRAINED:          /* resource constraint */
-                return -EINVAL;
+        case H_NO_MEM:
+                return -ENOMEM;
        case H_BUSY:                 /* long busy */
                return -EBUSY;
        default:
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
index 085e28b939ec..dd691cfa5079 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
@@ -165,10 +165,9 @@ static int ipath_mcast_add(struct ipath_ibdev *dev,
 {
        struct rb_node **n = &mcast_tree.rb_node;
        struct rb_node *pn = NULL;
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&mcast_lock, flags);
+        spin_lock_irq(&mcast_lock);
        while (*n) {
                struct ipath_mcast *tmcast;
@@ -228,7 +227,7 @@ static int ipath_mcast_add(struct ipath_ibdev *dev,
        ret = 0;
 bail:
-        spin_unlock_irqrestore(&mcast_lock, flags);
+        spin_unlock_irq(&mcast_lock);
        return ret;
 }
@@ -289,17 +288,16 @@ int ipath_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
        struct ipath_mcast *mcast = NULL;
        struct ipath_mcast_qp *p, *tmp;
        struct rb_node *n;
-        unsigned long flags;
        int last = 0;
        int ret;
-        spin_lock_irqsave(&mcast_lock, flags);
+        spin_lock_irq(&mcast_lock);
        /* Find the GID in the mcast table. */
        n = mcast_tree.rb_node;
        while (1) {
                if (n == NULL) {
-                        spin_unlock_irqrestore(&mcast_lock, flags);
+                        spin_unlock_irq(&mcast_lock);
                        ret = -EINVAL;
                        goto bail;
                }
@@ -334,7 +332,7 @@ int ipath_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                break;
        }
-        spin_unlock_irqrestore(&mcast_lock, flags);
+        spin_unlock_irq(&mcast_lock);
        if (p) {
                /*
@@ -348,9 +346,9 @@ int ipath_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                atomic_dec(&mcast->refcount);
                wait_event(mcast->wait, !atomic_read(&mcast->refcount));
                ipath_mcast_free(mcast);
-                spin_lock(&dev->n_mcast_grps_lock);
+                spin_lock_irq(&dev->n_mcast_grps_lock);
                dev->n_mcast_grps_allocated--;
-                spin_unlock(&dev->n_mcast_grps_lock);
+                spin_unlock_irq(&dev->n_mcast_grps_lock);
        }
        ret = 0;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 5cd706908450..a824bc5f79fd 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -188,14 +188,32 @@ static int send_wqe_overhead(enum ib_qp_type type)
        }
 }
-static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
+static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
-                       enum ib_qp_type type, struct mlx4_ib_qp *qp)
+                       struct mlx4_ib_qp *qp)
 {
-        /* Sanity check QP size before proceeding */
+        /* Sanity check RQ size before proceeding */
+        if (cap->max_recv_wr  > dev->dev->caps.max_wqes  ||
+            cap->max_recv_sge > dev->dev->caps.max_rq_sg)
+                return -EINVAL;
+        qp->rq.max = cap->max_recv_wr ? roundup_pow_of_two(cap->max_recv_wr) : 0;
+        qp->rq.wqe_shift = ilog2(roundup_pow_of_two(cap->max_recv_sge *
+                                                    sizeof (struct mlx4_wqe_data_seg)));
+        qp->rq.max_gs    = (1 << qp->rq.wqe_shift) / sizeof (struct mlx4_wqe_data_seg);
+        cap->max_recv_wr  = qp->rq.max;
+        cap->max_recv_sge = qp->rq.max_gs;
+        return 0;
+}
+static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
+                              enum ib_qp_type type, struct mlx4_ib_qp *qp)
+{
+        /* Sanity check SQ size before proceeding */
        if (cap->max_send_wr     > dev->dev->caps.max_wqes  ||
-            cap->max_recv_wr     > dev->dev->caps.max_wqes  ||
            cap->max_send_sge    > dev->dev->caps.max_sq_sg ||
-            cap->max_recv_sge    > dev->dev->caps.max_rq_sg ||
            cap->max_inline_data + send_wqe_overhead(type) +
            sizeof (struct mlx4_wqe_inline_seg) > dev->dev->caps.max_sq_desc_sz)
                return -EINVAL;
@@ -208,12 +226,7 @@ static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
            cap->max_send_sge + 2 > dev->dev->caps.max_sq_sg)
                return -EINVAL;
-        qp->rq.max = cap->max_recv_wr ? roundup_pow_of_two(cap->max_recv_wr) : 0;
+        qp->sq.max = cap->max_send_wr ? roundup_pow_of_two(cap->max_send_wr) : 1;
-        qp->sq.max = cap->max_send_wr ? roundup_pow_of_two(cap->max_send_wr) : 0;
-        qp->rq.wqe_shift = ilog2(roundup_pow_of_two(cap->max_recv_sge *
-                                                    sizeof (struct mlx4_wqe_data_seg)));
-        qp->rq.max_gs    = (1 << qp->rq.wqe_shift) / sizeof (struct mlx4_wqe_data_seg);
        qp->sq.wqe_shift = ilog2(roundup_pow_of_two(max(cap->max_send_sge *
                                                        sizeof (struct mlx4_wqe_data_seg),
@@ -233,16 +246,26 @@ static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                qp->sq.offset = 0;
        }
-        cap->max_send_wr  = qp->sq.max;
+        cap->max_send_wr     = qp->sq.max;
-        cap->max_recv_wr  = qp->rq.max;
+        cap->max_send_sge    = qp->sq.max_gs;
-        cap->max_send_sge = qp->sq.max_gs;
-        cap->max_recv_sge = qp->rq.max_gs;
        cap->max_inline_data = (1 << qp->sq.wqe_shift) - send_wqe_overhead(type) -
                sizeof (struct mlx4_wqe_inline_seg);
        return 0;
 }
+static int set_user_sq_size(struct mlx4_ib_qp *qp,
+                            struct mlx4_ib_create_qp *ucmd)
+{
+        qp->sq.max       = 1 << ucmd->log_sq_bb_count;
+        qp->sq.wqe_shift = ucmd->log_sq_stride;
+        qp->buf_size = (qp->rq.max << qp->rq.wqe_shift) +
+                (qp->sq.max << qp->sq.wqe_shift);
+        return 0;
+}
 static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                            struct ib_qp_init_attr *init_attr,
                            struct ib_udata *udata, int sqpn, struct mlx4_ib_qp *qp)
@@ -264,7 +287,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
        qp->sq.head         = 0;
        qp->sq.tail         = 0;
-        err = set_qp_size(dev, &init_attr->cap, init_attr->qp_type, qp);
+        err = set_rq_size(dev, &init_attr->cap, qp);
        if (err)
                goto err;
@@ -276,6 +299,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                        goto err;
                }
+                err = set_user_sq_size(qp, &ucmd);
+                if (err)
+                        goto err;
                qp->umem = ib_umem_get(pd->uobject->context, ucmd.buf_addr,
                                       qp->buf_size, 0);
                if (IS_ERR(qp->umem)) {
@@ -297,6 +324,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                if (err)
                        goto err_mtt;
        } else {
+                err = set_kernel_sq_size(dev, &init_attr->cap, init_attr->qp_type, qp);
+                if (err)
+                        goto err;
                err = mlx4_ib_db_alloc(dev, &qp->db, 0);
                if (err)
                        goto err;
@@ -573,7 +604,7 @@ static int to_mlx4_st(enum ib_qp_type type)
        }
 }
-static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, struct ib_qp_attr *attr,
+static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, const struct ib_qp_attr *attr,
                                   int attr_mask)
 {
        u8 dest_rd_atomic;
@@ -603,7 +634,7 @@ static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, struct ib_qp_attr *att
        return cpu_to_be32(hw_access_flags);
 }
-static void store_sqp_attrs(struct mlx4_ib_sqp *sqp, struct ib_qp_attr *attr,
+static void store_sqp_attrs(struct mlx4_ib_sqp *sqp, const struct ib_qp_attr *attr,
                            int attr_mask)
 {
        if (attr_mask & IB_QP_PKEY_INDEX)
@@ -619,7 +650,7 @@ static void mlx4_set_sched(struct mlx4_qp_path *path, u8 port)
        path->sched_queue = (path->sched_queue & 0xbf) | ((port - 1) << 6);
 }
-static int mlx4_set_path(struct mlx4_ib_dev *dev, struct ib_ah_attr *ah,
+static int mlx4_set_path(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah,
                         struct mlx4_qp_path *path, u8 port)
 {
        path->grh_mylmc     = ah->src_path_bits & 0x7f;
@@ -655,14 +686,14 @@ static int mlx4_set_path(struct mlx4_ib_dev *dev, struct ib_ah_attr *ah,
        return 0;
 }
-int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
-                      int attr_mask, struct ib_udata *udata)
+                               const struct ib_qp_attr *attr, int attr_mask,
+                               enum ib_qp_state cur_state, enum ib_qp_state new_state)
 {
        struct mlx4_ib_dev *dev = to_mdev(ibqp->device);
        struct mlx4_ib_qp *qp = to_mqp(ibqp);
        struct mlx4_qp_context *context;
        enum mlx4_qp_optpar optpar = 0;
-        enum ib_qp_state cur_state, new_state;
        int sqd_event;
        int err = -EINVAL;
@@ -670,34 +701,6 @@ int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        if (!context)
                return -ENOMEM;
-        mutex_lock(&qp->mutex);
-        cur_state = attr_mask & IB_QP_CUR_STATE ? attr->cur_qp_state : qp->state;
-        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
-        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask))
-                goto out;
-        if ((attr_mask & IB_QP_PKEY_INDEX) &&
-             attr->pkey_index >= dev->dev->caps.pkey_table_len) {
-                goto out;
-        }
-        if ((attr_mask & IB_QP_PORT) &&
-            (attr->port_num == 0 || attr->port_num > dev->dev->caps.num_ports)) {
-                goto out;
-        }
-        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
-            attr->max_rd_atomic > dev->dev->caps.max_qp_init_rdma) {
-                goto out;
-        }
-        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
-            attr->max_dest_rd_atomic > 1 << dev->dev->caps.max_qp_dest_rdma) {
-                goto out;
-        }
        context->flags = cpu_to_be32((to_mlx4_state(new_state) << 28) |
                                     (to_mlx4_st(ibqp->qp_type) << 16));
        context->flags     |= cpu_to_be32(1 << 8); /* DE? */
@@ -920,11 +923,84 @@ int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        }
 out:
-        mutex_unlock(&qp->mutex);
        kfree(context);
        return err;
 }
+static const struct ib_qp_attr mlx4_ib_qp_attr = { .port_num = 1 };
+static const int mlx4_ib_qp_attr_mask_table[IB_QPT_UD + 1] = {
+                [IB_QPT_UD]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_QKEY),
+                [IB_QPT_UC]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_ACCESS_FLAGS),
+                [IB_QPT_RC]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_ACCESS_FLAGS),
+                [IB_QPT_SMI] = (IB_QP_PKEY_INDEX                |
+                                IB_QP_QKEY),
+                [IB_QPT_GSI] = (IB_QP_PKEY_INDEX                |
+                                IB_QP_QKEY),
+};
+int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                      int attr_mask, struct ib_udata *udata)
+{
+        struct mlx4_ib_dev *dev = to_mdev(ibqp->device);
+        struct mlx4_ib_qp *qp = to_mqp(ibqp);
+        enum ib_qp_state cur_state, new_state;
+        int err = -EINVAL;
+        mutex_lock(&qp->mutex);
+        cur_state = attr_mask & IB_QP_CUR_STATE ? attr->cur_qp_state : qp->state;
+        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
+        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask))
+                goto out;
+        if ((attr_mask & IB_QP_PKEY_INDEX) &&
+             attr->pkey_index >= dev->dev->caps.pkey_table_len) {
+                goto out;
+        }
+        if ((attr_mask & IB_QP_PORT) &&
+            (attr->port_num == 0 || attr->port_num > dev->dev->caps.num_ports)) {
+                goto out;
+        }
+        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
+            attr->max_rd_atomic > dev->dev->caps.max_qp_init_rdma) {
+                goto out;
+        }
+        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
+            attr->max_dest_rd_atomic > dev->dev->caps.max_qp_dest_rdma) {
+                goto out;
+        }
+        if (cur_state == new_state && cur_state == IB_QPS_RESET) {
+                err = 0;
+                goto out;
+        }
+        if (cur_state == IB_QPS_RESET && new_state == IB_QPS_ERR) {
+                err = __mlx4_ib_modify_qp(ibqp, &mlx4_ib_qp_attr,
+                                          mlx4_ib_qp_attr_mask_table[ibqp->qp_type],
+                                          IB_QPS_RESET, IB_QPS_INIT);
+                if (err)
+                        goto out;
+                cur_state = IB_QPS_INIT;
+        }
+        err = __mlx4_ib_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
+out:
+        mutex_unlock(&qp->mutex);
+        return err;
+}
 static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                            void *wqe)
 {
@@ -952,6 +1028,7 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                        (be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 20) & 0xff;
                sqp->ud_header.grh.flow_label    =
                        ah->av.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+                sqp->ud_header.grh.hop_limit     = ah->av.hop_limit;
                ib_get_cached_gid(ib_dev, be32_to_cpu(ah->av.port_pd) >> 24,
                                  ah->av.gid_index, &sqp->ud_header.grh.source_gid);
                memcpy(sqp->ud_header.grh.destination_gid.raw,
@@ -1192,7 +1269,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 */
                wmb();
-                if (wr->opcode < 0 || wr->opcode > ARRAY_SIZE(mlx4_ib_opcode)) {
+                if (wr->opcode < 0 || wr->opcode >= ARRAY_SIZE(mlx4_ib_opcode)) {
                        err = -EINVAL;
                        goto out;
                }
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index 42ab4a801d6a..12fac1c8989d 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -297,6 +297,12 @@ int mlx4_ib_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                        break;
                }
+                if (unlikely(srq->head == srq->tail)) {
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        break;
+                }
                srq->wrid[srq->head] = wr->wr_id;
                next      = get_wqe(srq, srq->head);
diff --git a/drivers/infiniband/hw/mlx4/user.h b/drivers/infiniband/hw/mlx4/user.h
index 5b8eddc9fa83..88c72d56368b 100644
--- a/drivers/infiniband/hw/mlx4/user.h
+++ b/drivers/infiniband/hw/mlx4/user.h
@@ -39,7 +39,7 @@
 * Increment this value if any changes that break userspace ABI
 * compatibility are made.
 */
-#define MLX4_IB_UVERBS_ABI_VERSION      1
+#define MLX4_IB_UVERBS_ABI_VERSION      2
 /*
 * Make sure that all structs defined in this file remain laid out so
@@ -87,6 +87,9 @@ struct mlx4_ib_create_srq_resp {
 struct mlx4_ib_create_qp {
        __u64   buf_addr;
        __u64   db_addr;
+        __u8    log_sq_bb_count;
+        __u8    log_sq_stride;
+        __u8    reserved[6];
 };
 #endif /* MLX4_IB_USER_H */
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index 27caf3b0648a..4b111a852ff6 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -279,6 +279,7 @@ int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
                        (be32_to_cpu(ah->av->sl_tclass_flowlabel) >> 20) & 0xff;
                header->grh.flow_label    =
                        ah->av->sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+                header->grh.hop_limit     = ah->av->hop_limit;
                ib_get_cached_gid(&dev->ib_dev,
                                  be32_to_cpu(ah->av->port_pd) >> 24,
                                  ah->av->gid_index % dev->limits.gid_table_len,
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 71314460b11e..38102520ffb3 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -37,6 +37,7 @@
 #include <linux/completion.h>
 #include <linux/pci.h>
 #include <linux/errno.h>
+#include <linux/sched.h>
 #include <asm/io.h>
 #include <rdma/ib_mad.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index ca224d018af2..be6e1e03bdab 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -37,6 +37,7 @@
 */
 #include <linux/hardirq.h>
+#include <linux/sched.h>
 #include <asm/io.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 773145e29947..aa563e61de65 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -1250,12 +1250,14 @@ static void __mthca_remove_one(struct pci_dev *pdev)
 int __mthca_restart_one(struct pci_dev *pdev)
 {
        struct mthca_dev *mdev;
+        int hca_type;
        mdev = pci_get_drvdata(pdev);
        if (!mdev)
                return -ENODEV;
+        hca_type = mdev->hca_type;
        __mthca_remove_one(pdev);
-        return __mthca_init_one(pdev, mdev->hca_type);
+        return __mthca_init_one(pdev, hca_type);
 }
 static int __devinit mthca_init_one(struct pci_dev *pdev,
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 48f7c65e9aed..e61f3e626980 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -36,6 +36,7 @@
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
+#include <linux/sched.h>
 #include <asm/page.h>
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 72fabb822f1c..027664979fe2 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -37,6 +37,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
 #include <asm/io.h>
@@ -295,7 +296,7 @@ static int to_mthca_st(int transport)
        }
 }
-static void store_attrs(struct mthca_sqp *sqp, struct ib_qp_attr *attr,
+static void store_attrs(struct mthca_sqp *sqp, const struct ib_qp_attr *attr,
                        int attr_mask)
 {
        if (attr_mask & IB_QP_PKEY_INDEX)
@@ -327,7 +328,7 @@ static void init_port(struct mthca_dev *dev, int port)
                mthca_warn(dev, "INIT_IB returned status %02x.\n", status);
 }
-static __be32 get_hw_access_flags(struct mthca_qp *qp, struct ib_qp_attr *attr,
+static __be32 get_hw_access_flags(struct mthca_qp *qp, const struct ib_qp_attr *attr,
                                  int attr_mask)
 {
        u8 dest_rd_atomic;
@@ -510,7 +511,7 @@ out:
        return err;
 }
-static int mthca_path_set(struct mthca_dev *dev, struct ib_ah_attr *ah,
+static int mthca_path_set(struct mthca_dev *dev, const struct ib_ah_attr *ah,
                          struct mthca_qp_path *path, u8 port)
 {
        path->g_mylmc     = ah->src_path_bits & 0x7f;
@@ -538,12 +539,12 @@ static int mthca_path_set(struct mthca_dev *dev, struct ib_ah_attr *ah,
        return 0;
 }
-int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
+static int __mthca_modify_qp(struct ib_qp *ibqp,
-                    struct ib_udata *udata)
+                             const struct ib_qp_attr *attr, int attr_mask,
+                             enum ib_qp_state cur_state, enum ib_qp_state new_state)
 {
        struct mthca_dev *dev = to_mdev(ibqp->device);
        struct mthca_qp *qp = to_mqp(ibqp);
-        enum ib_qp_state cur_state, new_state;
        struct mthca_mailbox *mailbox;
        struct mthca_qp_param *qp_param;
        struct mthca_qp_context *qp_context;
@@ -551,60 +552,6 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
        u8 status;
        int err = -EINVAL;
-        mutex_lock(&qp->mutex);
-        if (attr_mask & IB_QP_CUR_STATE) {
-                cur_state = attr->cur_qp_state;
-        } else {
-                spin_lock_irq(&qp->sq.lock);
-                spin_lock(&qp->rq.lock);
-                cur_state = qp->state;
-                spin_unlock(&qp->rq.lock);
-                spin_unlock_irq(&qp->sq.lock);
-        }
-        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
-        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask)) {
-                mthca_dbg(dev, "Bad QP transition (transport %d) "
-                          "%d->%d with attr 0x%08x\n",
-                          qp->transport, cur_state, new_state,
-                          attr_mask);
-                goto out;
-        }
-        if (cur_state == new_state && cur_state == IB_QPS_RESET) {
-                err = 0;
-                goto out;
-        }
-        if ((attr_mask & IB_QP_PKEY_INDEX) &&
-             attr->pkey_index >= dev->limits.pkey_table_len) {
-                mthca_dbg(dev, "P_Key index (%u) too large. max is %d\n",
-                          attr->pkey_index, dev->limits.pkey_table_len-1);
-                goto out;
-        }
-        if ((attr_mask & IB_QP_PORT) &&
-            (attr->port_num == 0 || attr->port_num > dev->limits.num_ports)) {
-                mthca_dbg(dev, "Port number (%u) is invalid\n", attr->port_num);
-                goto out;
-        }
-        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
-            attr->max_rd_atomic > dev->limits.max_qp_init_rdma) {
-                mthca_dbg(dev, "Max rdma_atomic as initiator %u too large (max is %d)\n",
-                          attr->max_rd_atomic, dev->limits.max_qp_init_rdma);
-                goto out;
-        }
-        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
-            attr->max_dest_rd_atomic > 1 << dev->qp_table.rdb_shift) {
-                mthca_dbg(dev, "Max rdma_atomic as responder %u too large (max %d)\n",
-                          attr->max_dest_rd_atomic, 1 << dev->qp_table.rdb_shift);
-                goto out;
-        }
        mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
        if (IS_ERR(mailbox)) {
                err = PTR_ERR(mailbox);
@@ -891,6 +838,98 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
 out_mailbox:
        mthca_free_mailbox(dev, mailbox);
+out:
+        return err;
+}
+static const struct ib_qp_attr dummy_init_attr = { .port_num = 1 };
+static const int dummy_init_attr_mask[] = {
+        [IB_QPT_UD]  = (IB_QP_PKEY_INDEX                |
+                        IB_QP_PORT                      |
+                        IB_QP_QKEY),
+        [IB_QPT_UC]  = (IB_QP_PKEY_INDEX                |
+                        IB_QP_PORT                      |
+                        IB_QP_ACCESS_FLAGS),
+        [IB_QPT_RC]  = (IB_QP_PKEY_INDEX                |
+                        IB_QP_PORT                      |
+                        IB_QP_ACCESS_FLAGS),
+        [IB_QPT_SMI] = (IB_QP_PKEY_INDEX                |
+                        IB_QP_QKEY),
+        [IB_QPT_GSI] = (IB_QP_PKEY_INDEX                |
+                        IB_QP_QKEY),
+};
+int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
+                    struct ib_udata *udata)
+{
+        struct mthca_dev *dev = to_mdev(ibqp->device);
+        struct mthca_qp *qp = to_mqp(ibqp);
+        enum ib_qp_state cur_state, new_state;
+        int err = -EINVAL;
+        mutex_lock(&qp->mutex);
+        if (attr_mask & IB_QP_CUR_STATE) {
+                cur_state = attr->cur_qp_state;
+        } else {
+                spin_lock_irq(&qp->sq.lock);
+                spin_lock(&qp->rq.lock);
+                cur_state = qp->state;
+                spin_unlock(&qp->rq.lock);
+                spin_unlock_irq(&qp->sq.lock);
+        }
+        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
+        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask)) {
+                mthca_dbg(dev, "Bad QP transition (transport %d) "
+                          "%d->%d with attr 0x%08x\n",
+                          qp->transport, cur_state, new_state,
+                          attr_mask);
+                goto out;
+        }
+        if ((attr_mask & IB_QP_PKEY_INDEX) &&
+             attr->pkey_index >= dev->limits.pkey_table_len) {
+                mthca_dbg(dev, "P_Key index (%u) too large. max is %d\n",
+                          attr->pkey_index, dev->limits.pkey_table_len-1);
+                goto out;
+        }
+        if ((attr_mask & IB_QP_PORT) &&
+            (attr->port_num == 0 || attr->port_num > dev->limits.num_ports)) {
+                mthca_dbg(dev, "Port number (%u) is invalid\n", attr->port_num);
+                goto out;
+        }
+        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
+            attr->max_rd_atomic > dev->limits.max_qp_init_rdma) {
+                mthca_dbg(dev, "Max rdma_atomic as initiator %u too large (max is %d)\n",
+                          attr->max_rd_atomic, dev->limits.max_qp_init_rdma);
+                goto out;
+        }
+        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
+            attr->max_dest_rd_atomic > 1 << dev->qp_table.rdb_shift) {
+                mthca_dbg(dev, "Max rdma_atomic as responder %u too large (max %d)\n",
+                          attr->max_dest_rd_atomic, 1 << dev->qp_table.rdb_shift);
+                goto out;
+        }
+        if (cur_state == new_state && cur_state == IB_QPS_RESET) {
+                err = 0;
+                goto out;
+        }
+        if (cur_state == IB_QPS_RESET && new_state == IB_QPS_ERR) {
+                err = __mthca_modify_qp(ibqp, &dummy_init_attr,
+                                        dummy_init_attr_mask[ibqp->qp_type],
+                                        IB_QPS_RESET, IB_QPS_INIT);
+                if (err)
+                        goto out;
+                cur_state = IB_QPS_INIT;
+        }
+        err = __mthca_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
 out:
        mutex_unlock(&qp->mutex);
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 61974b0296ca..b8f05a526673 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/sched.h>
 #include <asm/io.h>
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 87310eeb6df0..a0b3782c7625 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -132,12 +132,46 @@ struct ipoib_cm_data {
        __be32 mtu;
 };
+/*
+ * Quoting 10.3.1 Queue Pair and EE Context States:
+ *
+ * Note, for QPs that are associated with an SRQ, the Consumer should take the
+ * QP through the Error State before invoking a Destroy QP or a Modify QP to the
+ * Reset State.  The Consumer may invoke the Destroy QP without first performing
+ * a Modify QP to the Error State and waiting for the Affiliated Asynchronous
+ * Last WQE Reached Event. However, if the Consumer does not wait for the
+ * Affiliated Asynchronous Last WQE Reached Event, then WQE and Data Segment
+ * leakage may occur. Therefore, it is good programming practice to tear down a
+ * QP that is associated with an SRQ by using the following process:
+ *
+ * - Put the QP in the Error State
+ * - Wait for the Affiliated Asynchronous Last WQE Reached Event;
+ * - either:
+ *       drain the CQ by invoking the Poll CQ verb and either wait for CQ
+ *       to be empty or the number of Poll CQ operations has exceeded
+ *       CQ capacity size;
+ * - or
+ *       post another WR that completes on the same CQ and wait for this
+ *       WR to return as a WC;
+ * - and then invoke a Destroy QP or Reset QP.
+ *
+ * We use the second option and wait for a completion on the
+ * rx_drain_qp before destroying QPs attached to our SRQ.
+ */
+enum ipoib_cm_state {
+        IPOIB_CM_RX_LIVE,
+        IPOIB_CM_RX_ERROR, /* Ignored by stale task */
+        IPOIB_CM_RX_FLUSH  /* Last WQE Reached event observed */
+};
 struct ipoib_cm_rx {
        struct ib_cm_id     *id;
        struct ib_qp        *qp;
        struct list_head     list;
        struct net_device   *dev;
        unsigned long        jiffies;
+        enum ipoib_cm_state  state;
 };
 struct ipoib_cm_tx {
@@ -165,10 +199,16 @@ struct ipoib_cm_dev_priv {
        struct ib_srq          *srq;
        struct ipoib_cm_rx_buf *srq_ring;
        struct ib_cm_id        *id;
-        struct list_head        passive_ids;
+        struct ib_qp           *rx_drain_qp;   /* generates WR described in 10.3.1 */
+        struct list_head        passive_ids;   /* state: LIVE */
+        struct list_head        rx_error_list; /* state: ERROR */
+        struct list_head        rx_flush_list; /* state: FLUSH, drain not started */
+        struct list_head        rx_drain_list; /* state: FLUSH, drain started */
+        struct list_head        rx_reap_list;  /* state: FLUSH, drain done */
        struct work_struct      start_task;
        struct work_struct      reap_task;
        struct work_struct      skb_task;
+        struct work_struct      rx_reap_task;
        struct delayed_work     stale_task;
        struct sk_buff_head     skb_queue;
        struct list_head        start_list;
@@ -201,15 +241,17 @@ struct ipoib_dev_priv {
        struct list_head multicast_list;
        struct rb_root multicast_tree;
-        struct delayed_work pkey_task;
+        struct delayed_work pkey_poll_task;
        struct delayed_work mcast_task;
        struct work_struct flush_task;
        struct work_struct restart_task;
        struct delayed_work ah_reap_task;
+        struct work_struct pkey_event_task;
        struct ib_device *ca;
        u8                port;
        u16               pkey;
+        u16               pkey_index;
        struct ib_pd     *pd;
        struct ib_mr     *mr;
        struct ib_cq     *cq;
@@ -333,12 +375,13 @@ struct ipoib_dev_priv *ipoib_intf_alloc(const char *format);
 int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_ib_dev_flush(struct work_struct *work);
+void ipoib_pkey_event(struct work_struct *work);
 void ipoib_ib_dev_cleanup(struct net_device *dev);
 int ipoib_ib_dev_open(struct net_device *dev);
 int ipoib_ib_dev_up(struct net_device *dev);
 int ipoib_ib_dev_down(struct net_device *dev, int flush);
-int ipoib_ib_dev_stop(struct net_device *dev);
+int ipoib_ib_dev_stop(struct net_device *dev, int flush);
 int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_dev_cleanup(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index eec833b81e9b..ffec794b7913 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -37,6 +37,7 @@
 #include <net/dst.h>
 #include <net/icmp.h>
 #include <linux/icmpv6.h>
+#include <linux/delay.h>
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG_DATA
 static int data_debug_level;
@@ -62,6 +63,16 @@ struct ipoib_cm_id {
        u32 remote_mtu;
 };
+static struct ib_qp_attr ipoib_cm_err_attr = {
+        .qp_state = IB_QPS_ERR
+};
+#define IPOIB_CM_RX_DRAIN_WRID 0x7fffffff
+static struct ib_recv_wr ipoib_cm_rx_drain_wr = {
+        .wr_id = IPOIB_CM_RX_DRAIN_WRID
+};
 static int ipoib_cm_tx_handler(struct ib_cm_id *cm_id,
                               struct ib_cm_event *event);
@@ -150,11 +161,44 @@ partial_error:
        return NULL;
 }
+static void ipoib_cm_start_rx_drain(struct ipoib_dev_priv* priv)
+{
+        struct ib_recv_wr *bad_wr;
+        /* rx_drain_qp send queue depth is 1, so
+         * make sure we have at most 1 outstanding WR. */
+        if (list_empty(&priv->cm.rx_flush_list) ||
+            !list_empty(&priv->cm.rx_drain_list))
+                return;
+        if (ib_post_recv(priv->cm.rx_drain_qp, &ipoib_cm_rx_drain_wr, &bad_wr))
+                ipoib_warn(priv, "failed to post rx_drain wr\n");
+        list_splice_init(&priv->cm.rx_flush_list, &priv->cm.rx_drain_list);
+}
+static void ipoib_cm_rx_event_handler(struct ib_event *event, void *ctx)
+{
+        struct ipoib_cm_rx *p = ctx;
+        struct ipoib_dev_priv *priv = netdev_priv(p->dev);
+        unsigned long flags;
+        if (event->event != IB_EVENT_QP_LAST_WQE_REACHED)
+                return;
+        spin_lock_irqsave(&priv->lock, flags);
+        list_move(&p->list, &priv->cm.rx_flush_list);
+        p->state = IPOIB_CM_RX_FLUSH;
+        ipoib_cm_start_rx_drain(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
 static struct ib_qp *ipoib_cm_create_rx_qp(struct net_device *dev,
                                           struct ipoib_cm_rx *p)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ib_qp_init_attr attr = {
+                .event_handler = ipoib_cm_rx_event_handler,
                .send_cq = priv->cq, /* does not matter, we never send anything */
                .recv_cq = priv->cq,
                .srq = priv->cm.srq,
@@ -256,6 +300,7 @@ static int ipoib_cm_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even
        cm_id->context = p;
        p->jiffies = jiffies;
+        p->state = IPOIB_CM_RX_LIVE;
        spin_lock_irq(&priv->lock);
        if (list_empty(&priv->cm.passive_ids))
                queue_delayed_work(ipoib_workqueue,
@@ -277,7 +322,6 @@ static int ipoib_cm_rx_handler(struct ib_cm_id *cm_id,
 {
        struct ipoib_cm_rx *p;
        struct ipoib_dev_priv *priv;
-        int ret;
        switch (event->event) {
        case IB_CM_REQ_RECEIVED:
@@ -289,20 +333,9 @@ static int ipoib_cm_rx_handler(struct ib_cm_id *cm_id,
        case IB_CM_REJ_RECEIVED:
                p = cm_id->context;
                priv = netdev_priv(p->dev);
-                spin_lock_irq(&priv->lock);
+                if (ib_modify_qp(p->qp, &ipoib_cm_err_attr, IB_QP_STATE))
-                if (list_empty(&p->list))
+                        ipoib_warn(priv, "unable to move qp to error state\n");
-                        ret = 0; /* Connection is going away already. */
+                /* Fall through */
-                else {
-                        list_del_init(&p->list);
-                        ret = -ECONNRESET;
-                }
-                spin_unlock_irq(&priv->lock);
-                if (ret) {
-                        ib_destroy_qp(p->qp);
-                        kfree(p);
-                        return ret;
-                }
-                return 0;
        default:
                return 0;
        }
@@ -354,8 +387,15 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
                       wr_id, wc->status);
        if (unlikely(wr_id >= ipoib_recvq_size)) {
-                ipoib_warn(priv, "cm recv completion event with wrid %d (> %d)\n",
+                if (wr_id == (IPOIB_CM_RX_DRAIN_WRID & ~IPOIB_CM_OP_SRQ)) {
-                           wr_id, ipoib_recvq_size);
+                        spin_lock_irqsave(&priv->lock, flags);
+                        list_splice_init(&priv->cm.rx_drain_list, &priv->cm.rx_reap_list);
+                        ipoib_cm_start_rx_drain(priv);
+                        queue_work(ipoib_workqueue, &priv->cm.rx_reap_task);
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                } else
+                        ipoib_warn(priv, "cm recv completion event with wrid %d (> %d)\n",
+                                   wr_id, ipoib_recvq_size);
                return;
        }
@@ -374,9 +414,9 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
                if (p && time_after_eq(jiffies, p->jiffies + IPOIB_CM_RX_UPDATE_TIME)) {
                        spin_lock_irqsave(&priv->lock, flags);
                        p->jiffies = jiffies;
-                        /* Move this entry to list head, but do
+                        /* Move this entry to list head, but do not re-add it
-                         * not re-add it if it has been removed. */
+                         * if it has been moved out of list. */
-                        if (!list_empty(&p->list))
+                        if (p->state == IPOIB_CM_RX_LIVE)
                                list_move(&p->list, &priv->cm.passive_ids);
                        spin_unlock_irqrestore(&priv->lock, flags);
                }
@@ -583,17 +623,43 @@ static void ipoib_cm_tx_completion(struct ib_cq *cq, void *tx_ptr)
 int ipoib_cm_dev_open(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_qp_init_attr qp_init_attr = {
+                .send_cq = priv->cq,   /* does not matter, we never send anything */
+                .recv_cq = priv->cq,
+                .cap.max_send_wr = 1,  /* FIXME: 0 Seems not to work */
+                .cap.max_send_sge = 1, /* FIXME: 0 Seems not to work */
+                .cap.max_recv_wr = 1,
+                .cap.max_recv_sge = 1, /* FIXME: 0 Seems not to work */
+                .sq_sig_type = IB_SIGNAL_ALL_WR,
+                .qp_type = IB_QPT_UC,
+        };
        int ret;
        if (!IPOIB_CM_SUPPORTED(dev->dev_addr))
                return 0;
+        priv->cm.rx_drain_qp = ib_create_qp(priv->pd, &qp_init_attr);
+        if (IS_ERR(priv->cm.rx_drain_qp)) {
+                printk(KERN_WARNING "%s: failed to create CM ID\n", priv->ca->name);
+                ret = PTR_ERR(priv->cm.rx_drain_qp);
+                return ret;
+        }
+        /*
+         * We put the QP in error state directly.  This way, a "flush
+         * error" WC will be immediately generated for each WR we post.
+         */
+        ret = ib_modify_qp(priv->cm.rx_drain_qp, &ipoib_cm_err_attr, IB_QP_STATE);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify drain QP to error: %d\n", ret);
+                goto err_qp;
+        }
        priv->cm.id = ib_create_cm_id(priv->ca, ipoib_cm_rx_handler, dev);
        if (IS_ERR(priv->cm.id)) {
                printk(KERN_WARNING "%s: failed to create CM ID\n", priv->ca->name);
                ret = PTR_ERR(priv->cm.id);
-                priv->cm.id = NULL;
+                goto err_cm;
-                return ret;
        }
        ret = ib_cm_listen(priv->cm.id, cpu_to_be64(IPOIB_CM_IETF_ID | priv->qp->qp_num),
@@ -601,35 +667,79 @@ int ipoib_cm_dev_open(struct net_device *dev)
        if (ret) {
                printk(KERN_WARNING "%s: failed to listen on ID 0x%llx\n", priv->ca->name,
                       IPOIB_CM_IETF_ID | priv->qp->qp_num);
-                ib_destroy_cm_id(priv->cm.id);
+                goto err_listen;
-                priv->cm.id = NULL;
-                return ret;
        }
        return 0;
+err_listen:
+        ib_destroy_cm_id(priv->cm.id);
+err_cm:
+        priv->cm.id = NULL;
+err_qp:
+        ib_destroy_qp(priv->cm.rx_drain_qp);
+        return ret;
 }
 void ipoib_cm_dev_stop(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        struct ipoib_cm_rx *p;
+        struct ipoib_cm_rx *p, *n;
+        unsigned long begin;
+        LIST_HEAD(list);
+        int ret;
        if (!IPOIB_CM_SUPPORTED(dev->dev_addr) || !priv->cm.id)
                return;
        ib_destroy_cm_id(priv->cm.id);
        priv->cm.id = NULL;
        spin_lock_irq(&priv->lock);
        while (!list_empty(&priv->cm.passive_ids)) {
                p = list_entry(priv->cm.passive_ids.next, typeof(*p), list);
-                list_del_init(&p->list);
+                list_move(&p->list, &priv->cm.rx_error_list);
+                p->state = IPOIB_CM_RX_ERROR;
                spin_unlock_irq(&priv->lock);
+                ret = ib_modify_qp(p->qp, &ipoib_cm_err_attr, IB_QP_STATE);
+                if (ret)
+                        ipoib_warn(priv, "unable to move qp to error state: %d\n", ret);
+                spin_lock_irq(&priv->lock);
+        }
+        /* Wait for all RX to be drained */
+        begin = jiffies;
+        while (!list_empty(&priv->cm.rx_error_list) ||
+               !list_empty(&priv->cm.rx_flush_list) ||
+               !list_empty(&priv->cm.rx_drain_list)) {
+                if (!time_after(jiffies, begin + 5 * HZ)) {
+                        ipoib_warn(priv, "RX drain timing out\n");
+                        /*
+                         * assume the HW is wedged and just free up everything.
+                         */
+                        list_splice_init(&priv->cm.rx_flush_list, &list);
+                        list_splice_init(&priv->cm.rx_error_list, &list);
+                        list_splice_init(&priv->cm.rx_drain_list, &list);
+                        break;
+                }
+                spin_unlock_irq(&priv->lock);
+                msleep(1);
+                spin_lock_irq(&priv->lock);
+        }
+        list_splice_init(&priv->cm.rx_reap_list, &list);
+        spin_unlock_irq(&priv->lock);
+        list_for_each_entry_safe(p, n, &list, list) {
                ib_destroy_cm_id(p->id);
                ib_destroy_qp(p->qp);
                kfree(p);
-                spin_lock_irq(&priv->lock);
        }
-        spin_unlock_irq(&priv->lock);
+        ib_destroy_qp(priv->cm.rx_drain_qp);
        cancel_delayed_work(&priv->cm.stale_task);
 }
@@ -1079,24 +1189,44 @@ void ipoib_cm_skb_too_long(struct net_device* dev, struct sk_buff *skb,
                queue_work(ipoib_workqueue, &priv->cm.skb_task);
 }
+static void ipoib_cm_rx_reap(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   cm.rx_reap_task);
+        struct ipoib_cm_rx *p, *n;
+        LIST_HEAD(list);
+        spin_lock_irq(&priv->lock);
+        list_splice_init(&priv->cm.rx_reap_list, &list);
+        spin_unlock_irq(&priv->lock);
+        list_for_each_entry_safe(p, n, &list, list) {
+                ib_destroy_cm_id(p->id);
+                ib_destroy_qp(p->qp);
+                kfree(p);
+        }
+}
 static void ipoib_cm_stale_task(struct work_struct *work)
 {
        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
                                                   cm.stale_task.work);
        struct ipoib_cm_rx *p;
+        int ret;
        spin_lock_irq(&priv->lock);
        while (!list_empty(&priv->cm.passive_ids)) {
-                /* List if sorted by LRU, start from tail,
+                /* List is sorted by LRU, start from tail,
                 * stop when we see a recently used entry */
                p = list_entry(priv->cm.passive_ids.prev, typeof(*p), list);
                if (time_before_eq(jiffies, p->jiffies + IPOIB_CM_RX_TIMEOUT))
                        break;
-                list_del_init(&p->list);
+                list_move(&p->list, &priv->cm.rx_error_list);
+                p->state = IPOIB_CM_RX_ERROR;
                spin_unlock_irq(&priv->lock);
-                ib_destroy_cm_id(p->id);
+                ret = ib_modify_qp(p->qp, &ipoib_cm_err_attr, IB_QP_STATE);
-                ib_destroy_qp(p->qp);
+                if (ret)
-                kfree(p);
+                        ipoib_warn(priv, "unable to move qp to error state: %d\n", ret);
                spin_lock_irq(&priv->lock);
        }
@@ -1164,9 +1294,14 @@ int ipoib_cm_dev_init(struct net_device *dev)
        INIT_LIST_HEAD(&priv->cm.passive_ids);
        INIT_LIST_HEAD(&priv->cm.reap_list);
        INIT_LIST_HEAD(&priv->cm.start_list);
+        INIT_LIST_HEAD(&priv->cm.rx_error_list);
+        INIT_LIST_HEAD(&priv->cm.rx_flush_list);
+        INIT_LIST_HEAD(&priv->cm.rx_drain_list);
+        INIT_LIST_HEAD(&priv->cm.rx_reap_list);
        INIT_WORK(&priv->cm.start_task, ipoib_cm_tx_start);
        INIT_WORK(&priv->cm.reap_task, ipoib_cm_tx_reap);
        INIT_WORK(&priv->cm.skb_task, ipoib_cm_skb_reap);
+        INIT_WORK(&priv->cm.rx_reap_task, ipoib_cm_rx_reap);
        INIT_DELAYED_WORK(&priv->cm.stale_task, ipoib_cm_stale_task);
        skb_queue_head_init(&priv->cm.skb_queue);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 68d72c6f7ffb..c1aad06eb4e9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -448,6 +448,13 @@ int ipoib_ib_dev_open(struct net_device *dev)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        int ret;
+        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &priv->pkey_index)) {
+                ipoib_warn(priv, "P_Key 0x%04x not found\n", priv->pkey);
+                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                return -1;
+        }
+        set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
        ret = ipoib_init_qp(dev);
        if (ret) {
                ipoib_warn(priv, "ipoib_init_qp returned %d\n", ret);
@@ -457,14 +464,14 @@ int ipoib_ib_dev_open(struct net_device *dev)
        ret = ipoib_ib_post_receives(dev);
        if (ret) {
                ipoib_warn(priv, "ipoib_ib_post_receives returned %d\n", ret);
-                ipoib_ib_dev_stop(dev);
+                ipoib_ib_dev_stop(dev, 1);
                return -1;
        }
        ret = ipoib_cm_dev_open(dev);
        if (ret) {
-                ipoib_warn(priv, "ipoib_ib_post_receives returned %d\n", ret);
+                ipoib_warn(priv, "ipoib_cm_dev_open returned %d\n", ret);
-                ipoib_ib_dev_stop(dev);
+                ipoib_ib_dev_stop(dev, 1);
                return -1;
        }
@@ -516,7 +523,7 @@ int ipoib_ib_dev_down(struct net_device *dev, int flush)
        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
                mutex_lock(&pkey_mutex);
                set_bit(IPOIB_PKEY_STOP, &priv->flags);
-                cancel_delayed_work(&priv->pkey_task);
+                cancel_delayed_work(&priv->pkey_poll_task);
                mutex_unlock(&pkey_mutex);
                if (flush)
                        flush_workqueue(ipoib_workqueue);
@@ -543,7 +550,7 @@ static int recvs_pending(struct net_device *dev)
        return pending;
 }
-int ipoib_ib_dev_stop(struct net_device *dev)
+int ipoib_ib_dev_stop(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ib_qp_attr qp_attr;
@@ -629,7 +636,8 @@ timeout:
        /* Wait for all AHs to be reaped */
        set_bit(IPOIB_STOP_REAPER, &priv->flags);
        cancel_delayed_work(&priv->ah_reap_task);
-        flush_workqueue(ipoib_workqueue);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
        begin = jiffies;
@@ -673,13 +681,24 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
        return 0;
 }
-void ipoib_ib_dev_flush(struct work_struct *work)
+static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, int pkey_event)
 {
-        struct ipoib_dev_priv *cpriv, *priv =
+        struct ipoib_dev_priv *cpriv;
-                container_of(work, struct ipoib_dev_priv, flush_task);
        struct net_device *dev = priv->dev;
+        u16 new_index;
+        mutex_lock(&priv->vlan_mutex);
-        if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags) ) {
+        /*
+         * Flush any child interfaces too -- they might be up even if
+         * the parent is down.
+         */
+        list_for_each_entry(cpriv, &priv->child_intfs, list)
+                __ipoib_ib_dev_flush(cpriv, pkey_event);
+        mutex_unlock(&priv->vlan_mutex);
+        if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) {
                ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_INITIALIZED not set.\n");
                return;
        }
@@ -689,10 +708,32 @@ void ipoib_ib_dev_flush(struct work_struct *work)
                return;
        }
+        if (pkey_event) {
+                if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
+                        clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                        ipoib_ib_dev_down(dev, 0);
+                        ipoib_pkey_dev_delay_open(dev);
+                        return;
+                }
+                set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                /* restart QP only if P_Key index is changed */
+                if (new_index == priv->pkey_index) {
+                        ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
+                        return;
+                }
+                priv->pkey_index = new_index;
+        }
        ipoib_dbg(priv, "flushing\n");
        ipoib_ib_dev_down(dev, 0);
+        if (pkey_event) {
+                ipoib_ib_dev_stop(dev, 0);
+                ipoib_ib_dev_open(dev);
+        }
        /*
         * The device could have been brought down between the start and when
         * we get here, don't bring it back up if it's not configured up
@@ -701,14 +742,24 @@ void ipoib_ib_dev_flush(struct work_struct *work)
                ipoib_ib_dev_up(dev);
                ipoib_mcast_restart_task(&priv->restart_task);
        }
+}
-        mutex_lock(&priv->vlan_mutex);
+void ipoib_ib_dev_flush(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, flush_task);
-        /* Flush any child interfaces too */
+        ipoib_dbg(priv, "Flushing %s\n", priv->dev->name);
-        list_for_each_entry(cpriv, &priv->child_intfs, list)
+        __ipoib_ib_dev_flush(priv, 0);
-                ipoib_ib_dev_flush(&cpriv->flush_task);
+}
-        mutex_unlock(&priv->vlan_mutex);
+void ipoib_pkey_event(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv =
+                container_of(work, struct ipoib_dev_priv, pkey_event_task);
+        ipoib_dbg(priv, "Flushing %s and restarting its QP\n", priv->dev->name);
+        __ipoib_ib_dev_flush(priv, 1);
 }
 void ipoib_ib_dev_cleanup(struct net_device *dev)
@@ -736,7 +787,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
 void ipoib_pkey_poll(struct work_struct *work)
 {
        struct ipoib_dev_priv *priv =
-                container_of(work, struct ipoib_dev_priv, pkey_task.work);
+                container_of(work, struct ipoib_dev_priv, pkey_poll_task.work);
        struct net_device *dev = priv->dev;
        ipoib_pkey_dev_check_presence(dev);
@@ -747,7 +798,7 @@ void ipoib_pkey_poll(struct work_struct *work)
                mutex_lock(&pkey_mutex);
                if (!test_bit(IPOIB_PKEY_STOP, &priv->flags))
                        queue_delayed_work(ipoib_workqueue,
-                                           &priv->pkey_task,
+                                           &priv->pkey_poll_task,
                                           HZ);
                mutex_unlock(&pkey_mutex);
        }
@@ -766,7 +817,7 @@ int ipoib_pkey_dev_delay_open(struct net_device *dev)
                mutex_lock(&pkey_mutex);
                clear_bit(IPOIB_PKEY_STOP, &priv->flags);
                queue_delayed_work(ipoib_workqueue,
-                                   &priv->pkey_task,
+                                   &priv->pkey_poll_task,
                                   HZ);
                mutex_unlock(&pkey_mutex);
                return 1;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 0a428f2b05c7..894b1dcdf3eb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -107,7 +107,7 @@ int ipoib_open(struct net_device *dev)
                return -EINVAL;
        if (ipoib_ib_dev_up(dev)) {
-                ipoib_ib_dev_stop(dev);
+                ipoib_ib_dev_stop(dev, 1);
                return -EINVAL;
        }
@@ -152,7 +152,7 @@ static int ipoib_stop(struct net_device *dev)
        flush_workqueue(ipoib_workqueue);
        ipoib_ib_dev_down(dev, 1);
-        ipoib_ib_dev_stop(dev);
+        ipoib_ib_dev_stop(dev, 1);
        if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
                struct ipoib_dev_priv *cpriv;
@@ -988,7 +988,8 @@ static void ipoib_setup(struct net_device *dev)
        INIT_LIST_HEAD(&priv->dead_ahs);
        INIT_LIST_HEAD(&priv->multicast_list);
-        INIT_DELAYED_WORK(&priv->pkey_task,    ipoib_pkey_poll);
+        INIT_DELAYED_WORK(&priv->pkey_poll_task, ipoib_pkey_poll);
+        INIT_WORK(&priv->pkey_event_task, ipoib_pkey_event);
        INIT_DELAYED_WORK(&priv->mcast_task,   ipoib_mcast_join_task);
        INIT_WORK(&priv->flush_task,   ipoib_ib_dev_flush);
        INIT_WORK(&priv->restart_task, ipoib_mcast_restart_task);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 54fbead4de01..aae367057a56 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -524,7 +524,7 @@ void ipoib_mcast_join_task(struct work_struct *work)
                return;
        if (ib_query_gid(priv->ca, priv->port, 0, &priv->local_gid))
-                ipoib_warn(priv, "ib_gid_entry_get() failed\n");
+                ipoib_warn(priv, "ib_query_gid() failed\n");
        else
                memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw, sizeof (union ib_gid));
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 5c3c6a43a52b..982eb88e27ec 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -33,8 +33,6 @@
 * $Id: ipoib_verbs.c 1349 2004-12-16 21:09:43Z roland $
 */
-#include <rdma/ib_cache.h>
 #include "ipoib.h"
 int ipoib_mcast_attach(struct net_device *dev, u16 mlid, union ib_gid *mgid)
@@ -49,7 +47,7 @@ int ipoib_mcast_attach(struct net_device *dev, u16 mlid, union ib_gid *mgid)
        if (!qp_attr)
                goto out;
-        if (ib_find_cached_pkey(priv->ca, priv->port, priv->pkey, &pkey_index)) {
+        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &pkey_index)) {
                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
                ret = -ENXIO;
                goto out;
@@ -94,26 +92,16 @@ int ipoib_init_qp(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        int ret;
-        u16 pkey_index;
        struct ib_qp_attr qp_attr;
        int attr_mask;
-        /*
+        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags))
-         * Search through the port P_Key table for the requested pkey value.
+                return -1;
-         * The port has to be assigned to the respective IB partition in
-         * advance.
-         */
-        ret = ib_find_cached_pkey(priv->ca, priv->port, priv->pkey, &pkey_index);
-        if (ret) {
-                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
-                return ret;
-        }
-        set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
        qp_attr.qp_state = IB_QPS_INIT;
        qp_attr.qkey = 0;
        qp_attr.port_num = priv->port;
-        qp_attr.pkey_index = pkey_index;
+        qp_attr.pkey_index = priv->pkey_index;
        attr_mask =
            IB_QP_QKEY |
            IB_QP_PORT |
@@ -185,7 +173,7 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
        size = ipoib_sendq_size + ipoib_recvq_size + 1;
        ret = ipoib_cm_dev_init(dev);
        if (!ret)
-                size += ipoib_recvq_size;
+                size += ipoib_recvq_size + 1 /* 1 extra for rx_drain_qp */;
        priv->cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev, size, 0);
        if (IS_ERR(priv->cq)) {
@@ -259,14 +247,18 @@ void ipoib_event(struct ib_event_handler *handler,
        struct ipoib_dev_priv *priv =
                container_of(handler, struct ipoib_dev_priv, event_handler);
-        if ((record->event == IB_EVENT_PORT_ERR    ||
+        if (record->element.port_num != priv->port)
-             record->event == IB_EVENT_PKEY_CHANGE ||
+                return;
-             record->event == IB_EVENT_PORT_ACTIVE ||
-             record->event == IB_EVENT_LID_CHANGE  ||
+        if (record->event == IB_EVENT_PORT_ERR    ||
-             record->event == IB_EVENT_SM_CHANGE   ||
+            record->event == IB_EVENT_PORT_ACTIVE ||
-             record->event == IB_EVENT_CLIENT_REREGISTER) &&
+            record->event == IB_EVENT_LID_CHANGE  ||
-            record->element.port_num == priv->port) {
+            record->event == IB_EVENT_SM_CHANGE   ||
+            record->event == IB_EVENT_CLIENT_REREGISTER) {
                ipoib_dbg(priv, "Port state change event\n");
                queue_work(ipoib_workqueue, &priv->flush_task);
+        } else if (record->event == IB_EVENT_PKEY_CHANGE) {
+                ipoib_dbg(priv, "P_Key change event on port:%d\n", priv->port);
+                queue_work(ipoib_workqueue, &priv->pkey_event_task);
        }
 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 1e699bcaba0f..82d957bde299 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -12,6 +12,7 @@
 #include "icn.h"
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/sched.h>
 static int portbase = ICN_BASEADDR;
 static unsigned long membase = ICN_MEMADDR;
diff --git a/drivers/isdn/sc/message.c b/drivers/isdn/sc/message.c
index c5a307e3c496..0b4c4f15abdd 100644
--- a/drivers/isdn/sc/message.c
+++ b/drivers/isdn/sc/message.c
@@ -16,7 +16,7 @@
 *     +1 (416) 297-8565
 *     +1 (416) 297-6433 Facsimile
 */
+#include <linux/sched.h>
 #include "includes.h"
 #include "hardware.h"
 #include "message.h"
diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 41634fde8e13..1c040d80c641 100644
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -11,6 +11,7 @@
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
 #include <linux/mm.h>
+#include <asm/signal.h>
 #include "vmx.h"
 #include <linux/kvm.h>
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index 0d892600ff00..da985b31b17e 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -40,6 +40,7 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/sched.h>
 #include "x86_emulate.h"
 #include "segment_descriptor.h"
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index 9c15f32eea18..fa17d6d4f0cb 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -19,6 +19,7 @@
 #include <linux/vmalloc.h>
 #include <linux/highmem.h>
 #include <linux/profile.h>
+#include <linux/sched.h>
 #include <asm/desc.h>
 #include "kvm_svm.h"
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 724db0027f00..e6e4d240b2a6 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -22,6 +22,7 @@
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/profile.h>
+#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/desc.h>
diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index 95d854e2295c..b2577f40124e 100644
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -932,8 +932,6 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Kick the lance: transmit now */
        writereg(&ll->rdp, LE_C0_INEA | LE_C0_TDMD);
-        spin_unlock_irq(&lp->lock);
        dev->trans_start = jiffies;
        dev_kfree_skb(skb);
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 49be393e1c1d..cbc7febe9cdc 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1431,10 +1431,6 @@ e1000_open(struct net_device *netdev)
        /* From here on the code is the same as e1000_up() */
        clear_bit(__E1000_DOWN, &adapter->flags);
-#ifdef CONFIG_E1000_NAPI
-        netif_poll_enable(netdev);
-#endif
        e1000_irq_enable(adapter);
        /* fire a link status change interrupt to start the watchdog */
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index c42717313663..cfa5cc072339 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -90,7 +90,7 @@ static void dump_dev_cap_flags(struct mlx4_dev *dev, u32 flags)
        int i;
        mlx4_dbg(dev, "DEV_CAP flags:\n");
-        for (i = 0; i < 32; ++i)
+        for (i = 0; i < ARRAY_SIZE(fname); ++i)
                if (fname[i] && (flags & (1 << i)))
                        mlx4_dbg(dev, "    %s\n", fname[i]);
 }
diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
index 78c2e6e4b42e..edd6de995726 100644
--- a/drivers/oprofile/buffer_sync.c
+++ b/drivers/oprofile/buffer_sync.c
@@ -26,6 +26,7 @@
 #include <linux/profile.h>
 #include <linux/module.h>
 #include <linux/fs.h>
+#include <linux/sched.h>
 
 #include "oprofile_stats.h"
 #include "event_buffer.h"
diff --git a/drivers/pci/hotplug/ibmphp_hpc.c b/drivers/pci/hotplug/ibmphp_hpc.c
index 46abaa8c41f1..d06ccb69e411 100644
--- a/drivers/pci/hotplug/ibmphp_hpc.c
+++ b/drivers/pci/hotplug/ibmphp_hpc.c
@@ -34,6 +34,7 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/sched.h>
 #include "ibmphp.h"
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index bf655dbaf8e2..5cca394d5999 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -8,6 +8,7 @@
 #ifndef _AERDRV_H_
 #define _AERDRV_H_
+#include <linux/workqueue.h>
 #include <linux/pcieport_if.h>
 #include <linux/aer.h>
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index e075a52ac104..84d9c27133d4 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -14,7 +14,7 @@
 *
 * Common management module
 */
+#include <linux/sched.h>
 #include "megaraid_mm.h"
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 408390f93db9..787dc7168f3e 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -6,8 +6,6 @@
 * Created:
 * Description:  Driver for blackfin 5xx serial ports
 *
- * Rev:          $Id: bfin_5xx.c,v 1.19 2006/09/24 02:33:53 aubrey Exp $
- *
 * Modified:
 *               Copyright 2006 Analog Devices Inc.
 *
@@ -152,7 +150,7 @@ static void local_put_char(struct bfin_serial_port *uart, char ch)
 static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
 {
-        struct tty_struct *tty = uart->port.info?uart->port.info->tty:0;
+        struct tty_struct *tty = uart->port.info->tty;
        unsigned int status, ch, flg;
 #ifdef BF533_FAMILY
        static int in_break = 0;
@@ -173,8 +171,10 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
                if (ch != 0) {
                        in_break = 0;
                        ch = UART_GET_CHAR(uart);
-                }
+                        if (bfin_revid() < 5)
-                return;
+                                return;
+                } else
+                        return;
        }
 #endif
@@ -185,27 +185,32 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
                uart->port.icount.brk++;
                if (uart_handle_break(&uart->port))
                        goto ignore_char;
-                flg = TTY_BREAK;
+        }
-        } else if (status & PE) {
+        if (status & PE)
-                flg = TTY_PARITY;
                uart->port.icount.parity++;
-        } else if (status & OE) {
+        if (status & OE)
-                flg = TTY_OVERRUN;
                uart->port.icount.overrun++;
-        } else if (status & FE) {
+        if (status & FE)
-                flg = TTY_FRAME;
                uart->port.icount.frame++;
-        } else
+        status &= uart->port.read_status_mask;
+        if (status & BI)
+                flg = TTY_BREAK;
+        else if (status & PE)
+                flg = TTY_PARITY;
+        else if (status & FE)
+                flg = TTY_FRAME;
+        else
                flg = TTY_NORMAL;
        if (uart_handle_sysrq_char(&uart->port, ch))
                goto ignore_char;
-        if (tty)
-                uart_insert_char(&uart->port, status, 2, ch, flg);
-ignore_char:
+        uart_insert_char(&uart->port, status, OE, ch, flg);
-        if (tty)
-                tty_flip_buffer_push(tty);
+ ignore_char:
+        tty_flip_buffer_push(tty);
 }
 static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
@@ -240,24 +245,29 @@ static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
                bfin_serial_stop_tx(&uart->port);
 }
-static irqreturn_t bfin_serial_int(int irq, void *dev_id)
+static irqreturn_t bfin_serial_rx_int(int irq, void *dev_id)
 {
        struct bfin_serial_port *uart = dev_id;
-        unsigned short status;
        spin_lock(&uart->port.lock);
-        status = UART_GET_IIR(uart);
+        while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_RX_READY)
-        do {
+                bfin_serial_rx_chars(uart);
-                if ((status & IIR_STATUS) == IIR_TX_READY)
-                        bfin_serial_tx_chars(uart);
-                if ((status & IIR_STATUS) == IIR_RX_READY)
-                        bfin_serial_rx_chars(uart);
-                status = UART_GET_IIR(uart);
-        } while (status & (IIR_TX_READY | IIR_RX_READY));
        spin_unlock(&uart->port.lock);
        return IRQ_HANDLED;
 }
+static irqreturn_t bfin_serial_tx_int(int irq, void *dev_id)
+{
+        struct bfin_serial_port *uart = dev_id;
+        spin_lock(&uart->port.lock);
+        while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_TX_READY)
+                bfin_serial_tx_chars(uart);
+        spin_unlock(&uart->port.lock);
+        return IRQ_HANDLED;
+}
 static void bfin_serial_do_work(struct work_struct *work)
 {
        struct bfin_serial_port *uart = container_of(work, struct bfin_serial_port, cts_workqueue);
@@ -319,7 +329,7 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
        spin_unlock_irqrestore(&uart->port.lock, flags);
 }
-static void bfin_serial_dma_rx_chars(struct bfin_serial_port * uart)
+static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
 {
        struct tty_struct *tty = uart->port.info->tty;
        int i, flg, status;
@@ -331,25 +341,32 @@ static void bfin_serial_dma_rx_chars(struct bfin_serial_port * uart)
                uart->port.icount.brk++;
                if (uart_handle_break(&uart->port))
                        goto dma_ignore_char;
-                flg = TTY_BREAK;
+        }
-        } else if (status & PE) {
+        if (status & PE)
-                flg = TTY_PARITY;
                uart->port.icount.parity++;
-        } else if (status & OE) {
+        if (status & OE)
-                flg = TTY_OVERRUN;
                uart->port.icount.overrun++;
-        } else if (status & FE) {
+        if (status & FE)
-                flg = TTY_FRAME;
                uart->port.icount.frame++;
-        } else
+        status &= uart->port.read_status_mask;
+        if (status & BI)
+                flg = TTY_BREAK;
+        else if (status & PE)
+                flg = TTY_PARITY;
+        else if (status & FE)
+                flg = TTY_FRAME;
+        else
                flg = TTY_NORMAL;
        for (i = uart->rx_dma_buf.head; i < uart->rx_dma_buf.tail; i++) {
                if (uart_handle_sysrq_char(&uart->port, uart->rx_dma_buf.buf[i]))
                        goto dma_ignore_char;
-                uart_insert_char(&uart->port, status, 2, uart->rx_dma_buf.buf[i], flg);
+                uart_insert_char(&uart->port, status, OE, uart->rx_dma_buf.buf[i], flg);
        }
-dma_ignore_char:
+ dma_ignore_char:
        tty_flip_buffer_push(tty);
 }
@@ -545,14 +562,14 @@ static int bfin_serial_startup(struct uart_port *port)
        add_timer(&(uart->rx_dma_timer));
 #else
        if (request_irq
-            (uart->port.irq, bfin_serial_int, IRQF_DISABLED,
+            (uart->port.irq, bfin_serial_rx_int, IRQF_DISABLED,
             "BFIN_UART_RX", uart)) {
                printk(KERN_NOTICE "Unable to attach BlackFin UART RX interrupt\n");
                return -EBUSY;
        }
        if (request_irq
-            (uart->port.irq+1, bfin_serial_int, IRQF_DISABLED,
+            (uart->port.irq+1, bfin_serial_tx_int, IRQF_DISABLED,
             "BFIN_UART_TX", uart)) {
                printk(KERN_NOTICE "Unable to attach BlackFin UART TX interrupt\n");
                free_irq(uart->port.irq, uart);
@@ -614,13 +631,27 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
                        lcr |= EPS;
        }
-        /* These controls are not implemented for this port */
+        port->read_status_mask = OE;
-        termios->c_iflag |= INPCK | BRKINT | PARMRK;
+        if (termios->c_iflag & INPCK)
-        termios->c_iflag &= ~(IGNPAR | IGNBRK);
+                port->read_status_mask |= (FE | PE);
+        if (termios->c_iflag & (BRKINT | PARMRK))
+                port->read_status_mask |= BI;
-        /* These controls are not implemented for this port */
+        /*
-        termios->c_iflag |= INPCK | BRKINT | PARMRK;
+         * Characters to ignore
-        termios->c_iflag &= ~(IGNPAR | IGNBRK);
+         */
+        port->ignore_status_mask = 0;
+        if (termios->c_iflag & IGNPAR)
+                port->ignore_status_mask |= FE | PE;
+        if (termios->c_iflag & IGNBRK) {
+                port->ignore_status_mask |= BI;
+                /*
+                 * If we're ignoring parity and break indicators,
+                 * ignore overruns too (for real raw support).
+                 */
+                if (termios->c_iflag & IGNPAR)
+                        port->ignore_status_mask |= OE;
+        }
        baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
        quot = uart_get_divisor(port, baud);
diff --git a/drivers/serial/serial_ks8695.c b/drivers/serial/serial_ks8695.c
index c5346d677315..698763b28ddd 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/serial/serial_ks8695.c
@@ -301,11 +301,11 @@ static int ks8695uart_startup(struct uart_port *port)
        retval = request_irq(KS8695_IRQ_UART_LINE_STATUS, ks8695uart_rx_chars, IRQF_DISABLED, "UART LineStatus", port);
        if (retval)
-                return err_ls;
+                goto err_ls;
        retval = request_irq(KS8695_IRQ_UART_MODEM_STATUS, ks8695uart_modem_status, IRQF_DISABLED, "UART ModemStatus", port);
        if (retval)
-                return err_ms;
+                goto err_ms;
        return 0;
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index ce3c0ce2316e..7d2d9ec6cac3 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -126,7 +126,7 @@ struct chip_data {
        u8 chip_select_num;
        u8 n_bytes;
-        u32 width;              /* 0 or 1 */
+        u8 width;               /* 0 or 1 */
        u8 enable_dma;
        u8 bits_per_word;       /* 8 or 16 */
        u8 cs_change_per_word;
@@ -136,7 +136,7 @@ struct chip_data {
        void (*duplex) (struct driver_data *);
 };
-void bfin_spi_enable(struct driver_data *drv_data)
+static void bfin_spi_enable(struct driver_data *drv_data)
 {
        u16 cr;
@@ -145,7 +145,7 @@ void bfin_spi_enable(struct driver_data *drv_data)
        SSYNC();
 }
-void bfin_spi_disable(struct driver_data *drv_data)
+static void bfin_spi_disable(struct driver_data *drv_data)
 {
        u16 cr;
@@ -163,9 +163,6 @@ static u16 hz_to_spi_baud(u32 speed_hz)
        if ((sclk % (2 * speed_hz)) > 0)
                spi_baud++;
-        pr_debug("sclk = %ld, speed_hz = %d, spi_baud = %d\n", sclk, speed_hz,
-                 spi_baud);
        return spi_baud;
 }
@@ -190,11 +187,12 @@ static void restore_state(struct driver_data *drv_data)
        /* Clear status and disable clock */
        write_STAT(BIT_STAT_CLR);
        bfin_spi_disable(drv_data);
-        pr_debug("restoring spi ctl state\n");
+        dev_dbg(&drv_data->pdev->dev, "restoring spi ctl state\n");
 #if defined(CONFIG_BF534) || defined(CONFIG_BF536) || defined(CONFIG_BF537)
-        pr_debug("chip select number is %d\n", chip->chip_select_num);
+        dev_dbg(&drv_data->pdev->dev, 
+                "chip select number is %d\n", chip->chip_select_num);
+        
        switch (chip->chip_select_num) {
        case 1:
                bfin_write_PORTF_FER(bfin_read_PORTF_FER() | 0x3c00);
@@ -280,7 +278,8 @@ static void null_reader(struct driver_data *drv_data)
 static void u8_writer(struct driver_data *drv_data)
 {
-        pr_debug("cr8-s is 0x%x\n", read_STAT());
+        dev_dbg(&drv_data->pdev->dev, 
+                "cr8-s is 0x%x\n", read_STAT());
        while (drv_data->tx < drv_data->tx_end) {
                write_TDBR(*(u8 *) (drv_data->tx));
                while (read_STAT() & BIT_STAT_TXS)
@@ -318,7 +317,8 @@ static void u8_cs_chg_writer(struct driver_data *drv_data)
 static void u8_reader(struct driver_data *drv_data)
 {
-        pr_debug("cr-8 is 0x%x\n", read_STAT());
+        dev_dbg(&drv_data->pdev->dev, 
+                "cr-8 is 0x%x\n", read_STAT());
        /* clear TDBR buffer before read(else it will be shifted out) */
        write_TDBR(0xFFFF);
@@ -404,7 +404,9 @@ static void u8_cs_chg_duplex(struct driver_data *drv_data)
 static void u16_writer(struct driver_data *drv_data)
 {
-        pr_debug("cr16 is 0x%x\n", read_STAT());
+        dev_dbg(&drv_data->pdev->dev, 
+                "cr16 is 0x%x\n", read_STAT());
        while (drv_data->tx < drv_data->tx_end) {
                write_TDBR(*(u16 *) (drv_data->tx));
                while ((read_STAT() & BIT_STAT_TXS))
@@ -442,7 +444,8 @@ static void u16_cs_chg_writer(struct driver_data *drv_data)
 static void u16_reader(struct driver_data *drv_data)
 {
-        pr_debug("cr-16 is 0x%x\n", read_STAT());
+        dev_dbg(&drv_data->pdev->dev,
+                "cr-16 is 0x%x\n", read_STAT());
        dummy_read();
        while (drv_data->rx < (drv_data->rx_end - 2)) {
@@ -571,12 +574,12 @@ static void giveback(struct driver_data *drv_data)
                msg->complete(msg->context);
 }
-static irqreturn_t dma_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t dma_irq_handler(int irq, void *dev_id)
 {
        struct driver_data *drv_data = (struct driver_data *)dev_id;
        struct spi_message *msg = drv_data->cur_msg;
-        pr_debug("in dma_irq_handler\n");
+        dev_dbg(&drv_data->pdev->dev, "in dma_irq_handler\n");
        clear_dma_irqstat(CH_SPI);
        /*
@@ -604,7 +607,9 @@ static irqreturn_t dma_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
        tasklet_schedule(&drv_data->pump_transfers);
        /* free the irq handler before next transfer */
-        pr_debug("disable dma channel irq%d\n", CH_SPI);
+        dev_dbg(&drv_data->pdev->dev,
+                "disable dma channel irq%d\n",
+                CH_SPI);
        dma_disable_irq(CH_SPI);
        return IRQ_HANDLED;
@@ -617,7 +622,8 @@ static void pump_transfers(unsigned long data)
        struct spi_transfer *transfer = NULL;
        struct spi_transfer *previous = NULL;
        struct chip_data *chip = NULL;
-        u16 cr, width, dma_width, dma_config;
+        u8 width;
+        u16 cr, dma_width, dma_config;
        u32 tranf_success = 1;
        /* Get current state information */
@@ -662,8 +668,8 @@ static void pump_transfers(unsigned long data)
        if (transfer->tx_buf != NULL) {
                drv_data->tx = (void *)transfer->tx_buf;
                drv_data->tx_end = drv_data->tx + transfer->len;
-                pr_debug("tx_buf is %p, tx_end is %p\n", transfer->tx_buf,
+                dev_dbg(&drv_data->pdev->dev, "tx_buf is %p, tx_end is %p\n",
-                         drv_data->tx_end);
+                        transfer->tx_buf, drv_data->tx_end);
        } else {
                drv_data->tx = NULL;
        }
@@ -671,8 +677,8 @@ static void pump_transfers(unsigned long data)
        if (transfer->rx_buf != NULL) {
                drv_data->rx = transfer->rx_buf;
                drv_data->rx_end = drv_data->rx + transfer->len;
-                pr_debug("rx_buf is %p, rx_end is %p\n", transfer->rx_buf,
+                dev_dbg(&drv_data->pdev->dev, "rx_buf is %p, rx_end is %p\n",
-                         drv_data->rx_end);
+                        transfer->rx_buf, drv_data->rx_end);
        } else {
                drv_data->rx = NULL;
        }
@@ -690,9 +696,9 @@ static void pump_transfers(unsigned long data)
        drv_data->write = drv_data->tx ? chip->write : null_writer;
        drv_data->read = drv_data->rx ? chip->read : null_reader;
        drv_data->duplex = chip->duplex ? chip->duplex : null_writer;
-        pr_debug
+        dev_dbg(&drv_data->pdev->dev,
-            ("transfer: drv_data->write is %p, chip->write is %p, null_wr is %p\n",
+                "transfer: drv_data->write is %p, chip->write is %p, null_wr is %p\n",
-             drv_data->write, chip->write, null_writer);
+                drv_data->write, chip->write, null_writer);
        /* speed and width has been set on per message */
        message->state = RUNNING_STATE;
@@ -706,8 +712,9 @@ static void pump_transfers(unsigned long data)
        }
        write_FLAG(chip->flag);
-        pr_debug("now pumping a transfer: width is %d, len is %d\n", width,
+        dev_dbg(&drv_data->pdev->dev,
-                 transfer->len);
+                "now pumping a transfer: width is %d, len is %d\n",
+                width, transfer->len);
        /*
         * Try to map dma buffer and do a dma transfer if
@@ -722,7 +729,7 @@ static void pump_transfers(unsigned long data)
                bfin_spi_disable(drv_data);
                /* config dma channel */
-                pr_debug("doing dma transfer\n");
+                dev_dbg(&drv_data->pdev->dev, "doing dma transfer\n");
                if (width == CFG_SPI_WORDSIZE16) {
                        set_dma_x_count(CH_SPI, drv_data->len);
                        set_dma_x_modify(CH_SPI, 2);
@@ -738,7 +745,8 @@ static void pump_transfers(unsigned long data)
                /* dirty hack for autobuffer DMA mode */
                if (drv_data->tx_dma == 0xFFFF) {
-                        pr_debug("doing autobuffer DMA out.\n");
+                        dev_dbg(&drv_data->pdev->dev,
+                                "doing autobuffer DMA out.\n");
                        /* no irq in autobuffer mode */
                        dma_config =
@@ -758,7 +766,7 @@ static void pump_transfers(unsigned long data)
                /* In dma mode, rx or tx must be NULL in one transfer */
                if (drv_data->rx != NULL) {
                        /* set transfer mode, and enable SPI */
-                        pr_debug("doing DMA in.\n");
+                        dev_dbg(&drv_data->pdev->dev, "doing DMA in.\n");
                        /* disable SPI before write to TDBR */
                        write_CTRL(cr & ~BIT_CTL_ENABLE);
@@ -781,7 +789,7 @@ static void pump_transfers(unsigned long data)
                        /* set transfer mode, and enable SPI */
                        write_CTRL(cr);
                } else if (drv_data->tx != NULL) {
-                        pr_debug("doing DMA out.\n");
+                        dev_dbg(&drv_data->pdev->dev, "doing DMA out.\n");
                        /* start dma */
                        dma_enable_irq(CH_SPI);
@@ -796,7 +804,7 @@ static void pump_transfers(unsigned long data)
                }
        } else {
                /* IO mode write then read */
-                pr_debug("doing IO transfer\n");
+                dev_dbg(&drv_data->pdev->dev, "doing IO transfer\n");
                write_STAT(BIT_STAT_CLR);
@@ -804,11 +812,11 @@ static void pump_transfers(unsigned long data)
                        /* full duplex mode */
                        BUG_ON((drv_data->tx_end - drv_data->tx) !=
                               (drv_data->rx_end - drv_data->rx));
-                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));  /* clear the TIMOD bits */
+                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));  
-                        cr |=
+                        cr |= CFG_SPI_WRITE | (width << 8) |
-                            CFG_SPI_WRITE | (width << 8) | (CFG_SPI_ENABLE <<
+                                (CFG_SPI_ENABLE << 14);
-                                                            14);
+                        dev_dbg(&drv_data->pdev->dev,
-                        pr_debug("IO duplex: cr is 0x%x\n", cr);
+                                "IO duplex: cr is 0x%x\n", cr);
                        write_CTRL(cr);
                        SSYNC();
@@ -819,11 +827,11 @@ static void pump_transfers(unsigned long data)
                                tranf_success = 0;
                } else if (drv_data->tx != NULL) {
                        /* write only half duplex */
-                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));  /* clear the TIMOD bits */
+                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));
-                        cr |=
+                        cr |= CFG_SPI_WRITE | (width << 8) |
-                            CFG_SPI_WRITE | (width << 8) | (CFG_SPI_ENABLE <<
+                                (CFG_SPI_ENABLE << 14);
-                                                            14);
+                        dev_dbg(&drv_data->pdev->dev, 
-                        pr_debug("IO write: cr is 0x%x\n", cr);
+                                "IO write: cr is 0x%x\n", cr);
                        write_CTRL(cr);
                        SSYNC();
@@ -834,11 +842,11 @@ static void pump_transfers(unsigned long data)
                                tranf_success = 0;
                } else if (drv_data->rx != NULL) {
                        /* read only half duplex */
-                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));  /* cleare the TIMOD bits */
+                        cr = (read_CTRL() & (~BIT_CTL_TIMOD));
-                        cr |=
+                        cr |= CFG_SPI_READ | (width << 8) |
-                            CFG_SPI_READ | (width << 8) | (CFG_SPI_ENABLE <<
+                                (CFG_SPI_ENABLE << 14);
-                                                           14);
+                        dev_dbg(&drv_data->pdev->dev, 
-                        pr_debug("IO read: cr is 0x%x\n", cr);
+                                "IO read: cr is 0x%x\n", cr);
                        write_CTRL(cr);
                        SSYNC();
@@ -849,7 +857,8 @@ static void pump_transfers(unsigned long data)
                }
                if (!tranf_success) {
-                        pr_debug("IO write error!\n");
+                        dev_dbg(&drv_data->pdev->dev, 
+                                "IO write error!\n");
                        message->state = ERROR_STATE;
                } else {
                        /* Update total byte transfered */
@@ -899,11 +908,14 @@ static void pump_messages(struct work_struct *work)
        /* Setup the SSP using the per chip configuration */
        drv_data->cur_chip = spi_get_ctldata(drv_data->cur_msg->spi);
        restore_state(drv_data);
-        pr_debug
+        dev_dbg(&drv_data->pdev->dev,
-            ("got a message to pump, state is set to: baud %d, flag 0x%x, ctl 0x%x\n",
+                "got a message to pump, state is set to: baud %d, flag 0x%x, ctl 0x%x\n",
-             drv_data->cur_chip->baud, drv_data->cur_chip->flag,
+                drv_data->cur_chip->baud, drv_data->cur_chip->flag,
-             drv_data->cur_chip->ctl_reg);
+                drv_data->cur_chip->ctl_reg);
-        pr_debug("the first transfer len is %d\n", drv_data->cur_transfer->len);
+        
+        dev_dbg(&drv_data->pdev->dev, 
+                "the first transfer len is %d\n",
+                drv_data->cur_transfer->len);
        /* Mark as busy and launch transfers */
        tasklet_schedule(&drv_data->pump_transfers);
@@ -932,7 +944,7 @@ static int transfer(struct spi_device *spi, struct spi_message *msg)
        msg->status = -EINPROGRESS;
        msg->state = START_STATE;
-        pr_debug("adding an msg in transfer() \n");
+        dev_dbg(&spi->dev, "adding an msg in transfer() \n");
        list_add_tail(&msg->queue, &drv_data->queue);
        if (drv_data->run == QUEUE_RUNNING && !drv_data->busy)
@@ -1002,13 +1014,13 @@ static int setup(struct spi_device *spi)
        if (chip->enable_dma && !dma_requested) {
                /* register dma irq handler */
                if (request_dma(CH_SPI, "BF53x_SPI_DMA") < 0) {
-                        pr_debug
+                        dev_dbg(&spi->dev,
-                            ("Unable to request BlackFin SPI DMA channel\n");
+                                "Unable to request BlackFin SPI DMA channel\n");
                        return -ENODEV;
                }
                if (set_dma_callback(CH_SPI, (void *)dma_irq_handler, drv_data)
                    < 0) {
-                        pr_debug("Unable to set dma callback\n");
+                        dev_dbg(&spi->dev, "Unable to set dma callback\n");
                        return -EPERM;
                }
                dma_disable_irq(CH_SPI);
@@ -1054,9 +1066,9 @@ static int setup(struct spi_device *spi)
                return -ENODEV;
        }
-        pr_debug("setup spi chip %s, width is %d, dma is %d,",
+        dev_dbg(&spi->dev, "setup spi chip %s, width is %d, dma is %d,",
                        spi->modalias, chip->width, chip->enable_dma);
-        pr_debug("ctl_reg is 0x%x, flag_reg is 0x%x\n",
+        dev_dbg(&spi->dev, "ctl_reg is 0x%x, flag_reg is 0x%x\n",
                        chip->ctl_reg, chip->flag);
        spi_set_ctldata(spi, chip);
@@ -1068,7 +1080,7 @@ static int setup(struct spi_device *spi)
 * callback for spi framework.
 * clean driver specific data
 */
-static void cleanup(const struct spi_device *spi)
+static void cleanup(struct spi_device *spi)
 {
        struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
@@ -1207,7 +1219,7 @@ static int __init bfin5xx_spi_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "problem registering spi master\n");
                goto out_error_queue_alloc;
        }
-        pr_debug("controller probe successfully\n");
+        dev_dbg(&pdev->dev, "controller probe successfully\n");
        return status;
      out_error_queue_alloc:
@@ -1287,27 +1299,23 @@ static int bfin5xx_spi_resume(struct platform_device *pdev)
 #endif                          /* CONFIG_PM */
 static struct platform_driver bfin5xx_spi_driver = {
-        .driver = {
+        .driver         = {
-                   .name = "bfin-spi-master",
+                .name   = "bfin-spi-master",
-                   .bus = &platform_bus_type,
+                .owner  = THIS_MODULE,
-                   .owner = THIS_MODULE,
+        },
-                   },
+        .suspend        = bfin5xx_spi_suspend,
-        .probe = bfin5xx_spi_probe,
+        .resume         = bfin5xx_spi_resume,
-        .remove = __devexit_p(bfin5xx_spi_remove),
+        .remove         = __devexit_p(bfin5xx_spi_remove),
-        .suspend = bfin5xx_spi_suspend,
-        .resume = bfin5xx_spi_resume,
 };
 static int __init bfin5xx_spi_init(void)
 {
-        return platform_driver_register(&bfin5xx_spi_driver);
+        return platform_driver_probe(&bfin5xx_spi_driver, bfin5xx_spi_probe);
 }
 module_init(bfin5xx_spi_init);
 static void __exit bfin5xx_spi_exit(void)
 {
        platform_driver_unregister(&bfin5xx_spi_driver);
 }
 module_exit(bfin5xx_spi_exit);