IB/ehca: Ensure that guid_entry index is not negative
[safe/jmp/linux-2.6] / drivers / infiniband / hw / ehca / ehca_qp.c
index a9fd419..0338f1f 100644 (file)
@@ -331,7 +331,7 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                if (cnt == (nr_q_pages - 1)) {  /* last page! */
                        if (h_ret != expected_hret) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                        "h_ret=%li", h_ret);
+                                        "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -345,7 +345,7 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                } else {
                        if (h_ret != H_PAGE_REGISTERED) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                        "h_ret=%li", h_ret);
+                                        "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -396,6 +396,54 @@ static void ehca_determine_small_queue(struct ehca_alloc_queue_parms *queue,
        queue->is_small = (queue->page_size != 0);
 }
 
+/* needs to be called with cq->spinlock held */
+void ehca_add_to_err_list(struct ehca_qp *qp, int on_sq)
+{
+       struct list_head *list, *node;
+
+       /* TODO: support low latency QPs */
+       if (qp->ext_type == EQPT_LLQP)
+               return;
+
+       if (on_sq) {
+               list = &qp->send_cq->sqp_err_list;
+               node = &qp->sq_err_node;
+       } else {
+               list = &qp->recv_cq->rqp_err_list;
+               node = &qp->rq_err_node;
+       }
+
+       if (list_empty(node))
+               list_add_tail(node, list);
+
+       return;
+}
+
+static void del_from_err_list(struct ehca_cq *cq, struct list_head *node)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&cq->spinlock, flags);
+
+       if (!list_empty(node))
+               list_del_init(node);
+
+       spin_unlock_irqrestore(&cq->spinlock, flags);
+}
+
+static void reset_queue_map(struct ehca_queue_map *qmap)
+{
+       int i;
+
+       qmap->tail = qmap->entries - 1;
+       qmap->left_to_poll = 0;
+       qmap->next_wqe_idx = 0;
+       for (i = 0; i < qmap->entries; i++) {
+               qmap->map[i].reported = 1;
+               qmap->map[i].cqe_req = 0;
+       }
+}
+
 /*
  * Create an ib_qp struct that is either a QP or an SRQ, depending on
  * the value of the is_srq parameter. If init_attr and srq_init_attr share
@@ -407,13 +455,13 @@ static struct ehca_qp *internal_create_qp(
        struct ib_srq_init_attr *srq_init_attr,
        struct ib_udata *udata, int is_srq)
 {
-       struct ehca_qp *my_qp;
+       struct ehca_qp *my_qp, *my_srq = NULL;
        struct ehca_pd *my_pd = container_of(pd, struct ehca_pd, ib_pd);
        struct ehca_shca *shca = container_of(pd->device, struct ehca_shca,
                                              ib_device);
        struct ib_ucontext *context = NULL;
        u64 h_ret;
-       int is_llqp = 0, has_srq = 0;
+       int is_llqp = 0, has_srq = 0, is_user = 0;
        int qp_type, max_send_sge, max_recv_sge, ret;
 
        /* h_call's out parameters */
@@ -421,6 +469,19 @@ static struct ehca_qp *internal_create_qp(
        u32 swqe_size = 0, rwqe_size = 0, ib_qp_num;
        unsigned long flags;
 
+       if (!atomic_add_unless(&shca->num_qps, 1, shca->max_num_qps)) {
+               ehca_err(pd->device, "Unable to create QP, max number of %i "
+                        "QPs reached.", shca->max_num_qps);
+               ehca_err(pd->device, "To increase the maximum number of QPs "
+                        "use the number_of_qps module parameter.\n");
+               return ERR_PTR(-ENOSPC);
+       }
+
+       if (init_attr->create_flags) {
+               atomic_dec(&shca->num_qps);
+               return ERR_PTR(-EINVAL);
+       }
+
        memset(&parms, 0, sizeof(parms));
        qp_type = init_attr->qp_type;
 
@@ -428,6 +489,7 @@ static struct ehca_qp *internal_create_qp(
                init_attr->sq_sig_type != IB_SIGNAL_ALL_WR) {
                ehca_err(pd->device, "init_attr->sg_sig_type=%x not allowed",
                         init_attr->sq_sig_type);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -442,8 +504,13 @@ static struct ehca_qp *internal_create_qp(
 
        /* handle SRQ base QPs */
        if (init_attr->srq) {
-               struct ehca_qp *my_srq =
-                       container_of(init_attr->srq, struct ehca_qp, ib_srq);
+               my_srq = container_of(init_attr->srq, struct ehca_qp, ib_srq);
+
+               if (qp_type == IB_QPT_UC) {
+                       ehca_err(pd->device, "UC with SRQ not supported");
+                       atomic_dec(&shca->num_qps);
+                       return ERR_PTR(-EINVAL);
+               }
 
                has_srq = 1;
                parms.ext_type = EQPT_SRQBASE;
@@ -452,6 +519,7 @@ static struct ehca_qp *internal_create_qp(
 
        if (is_llqp && has_srq) {
                ehca_err(pd->device, "LLQPs can't have an SRQ");
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -463,6 +531,7 @@ static struct ehca_qp *internal_create_qp(
                        ehca_err(pd->device, "no more than three SGEs "
                                 "supported for SRQ  pd=%p  max_sge=%x",
                                 pd, init_attr->cap.max_recv_sge);
+                       atomic_dec(&shca->num_qps);
                        return ERR_PTR(-EINVAL);
                }
        }
@@ -474,6 +543,7 @@ static struct ehca_qp *internal_create_qp(
            qp_type != IB_QPT_SMI &&
            qp_type != IB_QPT_GSI) {
                ehca_err(pd->device, "wrong QP Type=%x", qp_type);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -487,6 +557,7 @@ static struct ehca_qp *internal_create_qp(
                                         "or max_rq_wr=%x for RC LLQP",
                                         init_attr->cap.max_send_wr,
                                         init_attr->cap.max_recv_wr);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        }
                        break;
@@ -494,6 +565,7 @@ static struct ehca_qp *internal_create_qp(
                        if (!EHCA_BMASK_GET(HCA_CAP_UD_LL_QP, shca->hca_cap)) {
                                ehca_err(pd->device, "UD LLQP not supported "
                                         "by this adapter");
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-ENOSYS);
                        }
                        if (!(init_attr->cap.max_send_sge <= 5
@@ -505,20 +577,22 @@ static struct ehca_qp *internal_create_qp(
                                         "or max_recv_sge=%x for UD LLQP",
                                         init_attr->cap.max_send_sge,
                                         init_attr->cap.max_recv_sge);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        } else if (init_attr->cap.max_send_wr > 255) {
                                ehca_err(pd->device,
                                         "Invalid Number of "
                                         "max_send_wr=%x for UD QP_TYPE=%x",
                                         init_attr->cap.max_send_wr, qp_type);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        }
                        break;
                default:
                        ehca_err(pd->device, "unsupported LL QP Type=%x",
                                 qp_type);
+                       atomic_dec(&shca->num_qps);
                        return ERR_PTR(-EINVAL);
-                       break;
                }
        } else {
                int max_sge = (qp_type == IB_QPT_UD || qp_type == IB_QPT_SMI
@@ -530,23 +604,30 @@ static struct ehca_qp *internal_create_qp(
                                 "send_sge=%x recv_sge=%x max_sge=%x",
                                 init_attr->cap.max_send_sge,
                                 init_attr->cap.max_recv_sge, max_sge);
+                       atomic_dec(&shca->num_qps);
                        return ERR_PTR(-EINVAL);
                }
        }
 
-       if (pd->uobject && udata)
-               context = pd->uobject->context;
-
        my_qp = kmem_cache_zalloc(qp_cache, GFP_KERNEL);
        if (!my_qp) {
                ehca_err(pd->device, "pd=%p not enough memory to alloc qp", pd);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-ENOMEM);
        }
 
+       if (pd->uobject && udata) {
+               is_user = 1;
+               context = pd->uobject->context;
+       }
+
+       atomic_set(&my_qp->nr_events, 0);
+       init_waitqueue_head(&my_qp->wait_completion);
        spin_lock_init(&my_qp->spinlock_s);
        spin_lock_init(&my_qp->spinlock_r);
        my_qp->qp_type = qp_type;
        my_qp->ext_type = parms.ext_type;
+       my_qp->state = IB_QPS_RESET;
 
        if (init_attr->recv_cq)
                my_qp->recv_cq =
@@ -628,9 +709,9 @@ static struct ehca_qp *internal_create_qp(
                        (parms.squeue.is_small || parms.rqueue.is_small);
        }
 
-       h_ret = hipz_h_alloc_resource_qp(shca->ipz_hca_handle, &parms);
+       h_ret = hipz_h_alloc_resource_qp(shca->ipz_hca_handle, &parms, is_user);
        if (h_ret != H_SUCCESS) {
-               ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%li",
+               ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%lli",
                         h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto create_qp_exit1;
@@ -689,6 +770,21 @@ static struct ehca_qp *internal_create_qp(
                                 "and pages ret=%i", ret);
                        goto create_qp_exit2;
                }
+
+               if (!is_user) {
+                       my_qp->sq_map.entries = my_qp->ipz_squeue.queue_length /
+                               my_qp->ipz_squeue.qe_size;
+                       my_qp->sq_map.map = vmalloc(my_qp->sq_map.entries *
+                                                   sizeof(struct ehca_qmap_entry));
+                       if (!my_qp->sq_map.map) {
+                               ehca_err(pd->device, "Couldn't allocate squeue "
+                                        "map ret=%i", ret);
+                               goto create_qp_exit3;
+                       }
+                       INIT_LIST_HEAD(&my_qp->sq_err_node);
+                       /* to avoid the generation of bogus flush CQEs */
+                       reset_queue_map(&my_qp->sq_map);
+               }
        }
 
        if (HAS_RQ(my_qp)) {
@@ -698,8 +794,28 @@ static struct ehca_qp *internal_create_qp(
                if (ret) {
                        ehca_err(pd->device, "Couldn't initialize rqueue "
                                 "and pages ret=%i", ret);
-                       goto create_qp_exit3;
+                       goto create_qp_exit4;
                }
+               if (!is_user) {
+                       my_qp->rq_map.entries = my_qp->ipz_rqueue.queue_length /
+                               my_qp->ipz_rqueue.qe_size;
+                       my_qp->rq_map.map = vmalloc(my_qp->rq_map.entries *
+                                                   sizeof(struct ehca_qmap_entry));
+                       if (!my_qp->rq_map.map) {
+                               ehca_err(pd->device, "Couldn't allocate squeue "
+                                        "map ret=%i", ret);
+                               goto create_qp_exit5;
+                       }
+                       INIT_LIST_HEAD(&my_qp->rq_err_node);
+                       /* to avoid the generation of bogus flush CQEs */
+                       reset_queue_map(&my_qp->rq_map);
+               }
+       } else if (init_attr->srq && !is_user) {
+               /* this is a base QP, use the queue map of the SRQ */
+               my_qp->rq_map = my_srq->rq_map;
+               INIT_LIST_HEAD(&my_qp->rq_err_node);
+
+               my_qp->ipz_rqueue = my_srq->ipz_rqueue;
        }
 
        if (is_srq) {
@@ -744,7 +860,7 @@ static struct ehca_qp *internal_create_qp(
                        if (!my_qp->mod_qp_parm) {
                                ehca_err(pd->device,
                                         "Could not alloc mod_qp_parm");
-                               goto create_qp_exit4;
+                               goto create_qp_exit5;
                        }
                }
        }
@@ -753,8 +869,13 @@ static struct ehca_qp *internal_create_qp(
        if (qp_type == IB_QPT_GSI) {
                h_ret = ehca_define_sqp(shca, my_qp, init_attr);
                if (h_ret != H_SUCCESS) {
+                       kfree(my_qp->mod_qp_parm);
+                       my_qp->mod_qp_parm = NULL;
+                       /* the QP pointer is no longer valid */
+                       shca->sport[init_attr->port_num - 1].ibqp_sqp[qp_type] =
+                               NULL;
                        ret = ehca2ib_return_code(h_ret);
-                       goto create_qp_exit5;
+                       goto create_qp_exit6;
                }
        }
 
@@ -763,7 +884,7 @@ static struct ehca_qp *internal_create_qp(
                if (ret) {
                        ehca_err(pd->device,
                                 "Couldn't assign qp to send_cq ret=%i", ret);
-                       goto create_qp_exit5;
+                       goto create_qp_exit7;
                }
        }
 
@@ -789,22 +910,30 @@ static struct ehca_qp *internal_create_qp(
                if (ib_copy_to_udata(udata, &resp, sizeof resp)) {
                        ehca_err(pd->device, "Copy to udata failed");
                        ret = -EINVAL;
-                       goto create_qp_exit6;
+                       goto create_qp_exit8;
                }
        }
 
        return my_qp;
 
-create_qp_exit6:
+create_qp_exit8:
        ehca_cq_unassign_qp(my_qp->send_cq, my_qp->real_qp_num);
 
-create_qp_exit5:
+create_qp_exit7:
        kfree(my_qp->mod_qp_parm);
 
-create_qp_exit4:
+create_qp_exit6:
+       if (HAS_RQ(my_qp) && !is_user)
+               vfree(my_qp->rq_map.map);
+
+create_qp_exit5:
        if (HAS_RQ(my_qp))
                ipz_queue_dtor(my_pd, &my_qp->ipz_rqueue);
 
+create_qp_exit4:
+       if (HAS_SQ(my_qp) && !is_user)
+               vfree(my_qp->sq_map.map);
+
 create_qp_exit3:
        if (HAS_SQ(my_qp))
                ipz_queue_dtor(my_pd, &my_qp->ipz_squeue);
@@ -819,6 +948,7 @@ create_qp_exit1:
 
 create_qp_exit0:
        kmem_cache_free(qp_cache, my_qp);
+       atomic_dec(&shca->num_qps);
        return ERR_PTR(ret);
 }
 
@@ -885,7 +1015,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not modify SRQ to INIT "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -899,7 +1029,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not enable SRQ "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -913,7 +1043,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not modify SRQ to RTR "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -953,7 +1083,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
                                           &bad_send_wqe_p, NULL, 2);
        if (h_ret != H_SUCCESS) {
                ehca_err(&shca->ib_device, "hipz_h_disable_and_get_wqe() failed"
-                        " ehca_qp=%p qp_num=%x h_ret=%li",
+                        " ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp_num, h_ret);
                return ehca2ib_return_code(h_ret);
        }
@@ -962,7 +1092,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
                 qp_num, bad_send_wqe_p);
        /* convert wqe pointer to vadr */
        bad_send_wqe_v = abs_to_virt((u64)bad_send_wqe_p);
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(bad_send_wqe_v, 32, "qp_num=%x bad_wqe", qp_num);
        squeue = &my_qp->ipz_squeue;
        if (ipz_queue_abs_to_offset(squeue, (u64)bad_send_wqe_p, &q_ofs)) {
@@ -975,7 +1105,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
        wqe = (struct ehca_wqe *)ipz_qeit_calc(squeue, q_ofs);
        *bad_wqe_cnt = 0;
        while (wqe->optype != 0xff && wqe->wqef != 0xff) {
-               if (ehca_debug_level)
+               if (ehca_debug_level >= 2)
                        ehca_dmp(wqe, 32, "qp_num=%x wqe", qp_num);
                wqe->nr_of_data_seg = 0; /* suppress data access */
                wqe->wqef = WQEF_PURGE; /* WQE to be purged */
@@ -994,6 +1124,111 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
        return 0;
 }
 
+static int calc_left_cqes(u64 wqe_p, struct ipz_queue *ipz_queue,
+                         struct ehca_queue_map *qmap)
+{
+       void *wqe_v;
+       u64 q_ofs;
+       u32 wqe_idx;
+       unsigned int tail_idx;
+
+       /* convert real to abs address */
+       wqe_p = wqe_p & (~(1UL << 63));
+
+       wqe_v = abs_to_virt(wqe_p);
+
+       if (ipz_queue_abs_to_offset(ipz_queue, wqe_p, &q_ofs)) {
+               ehca_gen_err("Invalid offset for calculating left cqes "
+                               "wqe_p=%#llx wqe_v=%p\n", wqe_p, wqe_v);
+               return -EFAULT;
+       }
+
+       tail_idx = next_index(qmap->tail, qmap->entries);
+       wqe_idx = q_ofs / ipz_queue->qe_size;
+
+       /* check all processed wqes, whether a cqe is requested or not */
+       while (tail_idx != wqe_idx) {
+               if (qmap->map[tail_idx].cqe_req)
+                       qmap->left_to_poll++;
+               tail_idx = next_index(tail_idx, qmap->entries);
+       }
+       /* save index in queue, where we have to start flushing */
+       qmap->next_wqe_idx = wqe_idx;
+       return 0;
+}
+
+static int check_for_left_cqes(struct ehca_qp *my_qp, struct ehca_shca *shca)
+{
+       u64 h_ret;
+       void *send_wqe_p, *recv_wqe_p;
+       int ret;
+       unsigned long flags;
+       int qp_num = my_qp->ib_qp.qp_num;
+
+       /* this hcall is not supported on base QPs */
+       if (my_qp->ext_type != EQPT_SRQBASE) {
+               /* get send and receive wqe pointer */
+               h_ret = hipz_h_disable_and_get_wqe(shca->ipz_hca_handle,
+                               my_qp->ipz_qp_handle, &my_qp->pf,
+                               &send_wqe_p, &recv_wqe_p, 4);
+               if (h_ret != H_SUCCESS) {
+                       ehca_err(&shca->ib_device, "disable_and_get_wqe() "
+                                "failed ehca_qp=%p qp_num=%x h_ret=%lli",
+                                my_qp, qp_num, h_ret);
+                       return ehca2ib_return_code(h_ret);
+               }
+
+               /*
+                * acquire lock to ensure that nobody is polling the cq which
+                * could mean that the qmap->tail pointer is in an
+                * inconsistent state.
+                */
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               ret = calc_left_cqes((u64)send_wqe_p, &my_qp->ipz_squeue,
+                               &my_qp->sq_map);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+               if (ret)
+                       return ret;
+
+
+               spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+               ret = calc_left_cqes((u64)recv_wqe_p, &my_qp->ipz_rqueue,
+                               &my_qp->rq_map);
+               spin_unlock_irqrestore(&my_qp->recv_cq->spinlock, flags);
+               if (ret)
+                       return ret;
+       } else {
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               my_qp->sq_map.left_to_poll = 0;
+               my_qp->sq_map.next_wqe_idx = next_index(my_qp->sq_map.tail,
+                                                       my_qp->sq_map.entries);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+
+               spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+               my_qp->rq_map.left_to_poll = 0;
+               my_qp->rq_map.next_wqe_idx = next_index(my_qp->rq_map.tail,
+                                                       my_qp->rq_map.entries);
+               spin_unlock_irqrestore(&my_qp->recv_cq->spinlock, flags);
+       }
+
+       /* this assures flush cqes being generated only for pending wqes */
+       if ((my_qp->sq_map.left_to_poll == 0) &&
+                               (my_qp->rq_map.left_to_poll == 0)) {
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               ehca_add_to_err_list(my_qp, 1);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+
+               if (HAS_RQ(my_qp)) {
+                       spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+                       ehca_add_to_err_list(my_qp, 0);
+                       spin_unlock_irqrestore(&my_qp->recv_cq->spinlock,
+                                       flags);
+               }
+       }
+
+       return 0;
+}
+
 /*
  * internal_modify_qp with circumvention to handle aqp0 properly
  * smi_reset2init indicates if this is an internal reset-to-init-call for
@@ -1014,6 +1249,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        u64 update_mask;
        u64 h_ret;
        int bad_wqe_cnt = 0;
+       int is_user = 0;
        int squeue_locked = 0;
        unsigned long flags = 0;
 
@@ -1031,11 +1267,13 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                                mqpcb, my_qp->galpas.kernel);
        if (h_ret != H_SUCCESS) {
                ehca_err(ibqp->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, ibqp->qp_num, h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto modify_qp_exit1;
        }
+       if (ibqp->uobject)
+               is_user = 1;
 
        qp_cur_state = ehca2ib_qp_state(mqpcb->qp_state);
 
@@ -1433,6 +1671,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        goto modify_qp_exit2;
                }
                mqpcb->path_migration_state = attr->path_mig_state + 1;
+               if (attr->path_mig_state == IB_MIG_REARM)
+                       my_qp->mig_armed = 1;
                update_mask |=
                        EHCA_BMASK_SET(MQPCB_MASK_PATH_MIGRATION_STATE, 1);
        }
@@ -1447,7 +1687,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                /* no support for max_send/recv_sge yet */
        }
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(mqpcb, 4*70, "qp_num=%x", ibqp->qp_num);
 
        h_ret = hipz_h_modify_qp(shca->ipz_hca_handle,
@@ -1458,7 +1698,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
 
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-               ehca_err(ibqp->device, "hipz_h_modify_qp() failed h_ret=%li "
+               ehca_err(ibqp->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, ibqp->qp_num);
                goto modify_qp_exit2;
        }
@@ -1491,15 +1731,34 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        ret = ehca2ib_return_code(h_ret);
                        ehca_err(ibqp->device, "ENABLE in context of "
                                 "RESET_2_INIT failed! Maybe you didn't get "
-                                "a LID h_ret=%li ehca_qp=%p qp_num=%x",
+                                "a LID h_ret=%lli ehca_qp=%p qp_num=%x",
                                 h_ret, my_qp, ibqp->qp_num);
                        goto modify_qp_exit2;
                }
        }
+       if ((qp_new_state == IB_QPS_ERR) && (qp_cur_state != IB_QPS_ERR)
+           && !is_user) {
+               ret = check_for_left_cqes(my_qp, shca);
+               if (ret)
+                       goto modify_qp_exit2;
+       }
 
        if (statetrans == IB_QPST_ANY2RESET) {
                ipz_qeit_reset(&my_qp->ipz_rqueue);
                ipz_qeit_reset(&my_qp->ipz_squeue);
+
+               if (qp_cur_state == IB_QPS_ERR && !is_user) {
+                       del_from_err_list(my_qp->send_cq, &my_qp->sq_err_node);
+
+                       if (HAS_RQ(my_qp))
+                               del_from_err_list(my_qp->recv_cq,
+                                                 &my_qp->rq_err_node);
+               }
+               if (!is_user)
+                       reset_queue_map(&my_qp->sq_map);
+
+               if (HAS_RQ(my_qp) && !is_user)
+                       reset_queue_map(&my_qp->rq_map);
        }
 
        if (attr_mask & IB_QP_QKEY)
@@ -1520,6 +1779,8 @@ modify_qp_exit1:
 int ehca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
                   struct ib_udata *udata)
 {
+       int ret = 0;
+
        struct ehca_shca *shca = container_of(ibqp->device, struct ehca_shca,
                                              ib_device);
        struct ehca_qp *my_qp = container_of(ibqp, struct ehca_qp, ib_qp);
@@ -1566,12 +1827,18 @@ int ehca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
                                 attr->qp_state, my_qp->init_attr.port_num,
                                 ibqp->qp_type);
                        spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
-                       return 0;
+                       goto out;
                }
                spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
        }
 
-       return internal_modify_qp(ibqp, attr, attr_mask, 0);
+       ret = internal_modify_qp(ibqp, attr, attr_mask, 0);
+
+out:
+       if ((ret == 0) && (attr_mask & IB_QP_STATE))
+               my_qp->state = attr->qp_state;
+
+       return ret;
 }
 
 void ehca_recover_sqp(struct ib_qp *sqp)
@@ -1652,7 +1919,7 @@ int ehca_query_qp(struct ib_qp *qp,
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(qp->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp->qp_num, h_ret);
                goto query_qp_exit1;
        }
@@ -1695,19 +1962,13 @@ int ehca_query_qp(struct ib_qp *qp,
        qp_attr->cap.max_inline_data = my_qp->sq_max_inline_data_size;
        qp_attr->dest_qp_num = qpcb->dest_qp_nr;
 
-       qp_attr->pkey_index =
-               EHCA_BMASK_GET(MQPCB_PRIM_P_KEY_IDX, qpcb->prim_p_key_idx);
-
-       qp_attr->port_num =
-               EHCA_BMASK_GET(MQPCB_PRIM_PHYS_PORT, qpcb->prim_phys_port);
-
+       qp_attr->pkey_index = qpcb->prim_p_key_idx;
+       qp_attr->port_num = qpcb->prim_phys_port;
        qp_attr->timeout = qpcb->timeout;
        qp_attr->retry_cnt = qpcb->retry_count;
        qp_attr->rnr_retry = qpcb->rnr_retry_count;
 
-       qp_attr->alt_pkey_index =
-               EHCA_BMASK_GET(MQPCB_PRIM_P_KEY_IDX, qpcb->alt_p_key_idx);
-
+       qp_attr->alt_pkey_index = qpcb->alt_p_key_idx;
        qp_attr->alt_port_num = qpcb->alt_phys_port;
        qp_attr->alt_timeout = qpcb->timeout_al;
 
@@ -1760,7 +2021,7 @@ int ehca_query_qp(struct ib_qp *qp,
        if (qp_init_attr)
                *qp_init_attr = my_qp->init_attr;
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 
 query_qp_exit1:
@@ -1794,8 +2055,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                update_mask |=
                        EHCA_BMASK_SET(MQPCB_MASK_CURR_SRQ_LIMIT, 1)
                        | EHCA_BMASK_SET(MQPCB_MASK_QP_AFF_ASYN_EV_LOG_REG, 1);
-               mqpcb->curr_srq_limit =
-                       EHCA_BMASK_SET(MQPCB_CURR_SRQ_LIMIT, attr->srq_limit);
+               mqpcb->curr_srq_limit = attr->srq_limit;
                mqpcb->qp_aff_asyn_ev_log_reg =
                        EHCA_BMASK_SET(QPX_AAELOG_RESET_SRQ_LIMIT, 1);
        }
@@ -1808,7 +2068,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                goto modify_srq_exit0;
        }
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(mqpcb, 4*70, "qp_num=%x", my_qp->real_qp_num);
 
        h_ret = hipz_h_modify_qp(shca->ipz_hca_handle, my_qp->ipz_qp_handle,
@@ -1817,7 +2077,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
 
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-               ehca_err(ibsrq->device, "hipz_h_modify_qp() failed h_ret=%li "
+               ehca_err(ibsrq->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x",
                         h_ret, my_qp, my_qp->real_qp_num);
        }
@@ -1851,17 +2111,16 @@ int ehca_query_srq(struct ib_srq *srq, struct ib_srq_attr *srq_attr)
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(srq->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%li",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, h_ret);
                goto query_srq_exit1;
        }
 
        srq_attr->max_wr = qpcb->max_nr_outst_recv_wr - 1;
        srq_attr->max_sge = 3;
-       srq_attr->srq_limit = EHCA_BMASK_GET(
-               MQPCB_CURR_SRQ_LIMIT, qpcb->curr_srq_limit);
+       srq_attr->srq_limit = qpcb->curr_srq_limit;
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(qpcb, 4*70, "qp_num=%x", my_qp->real_qp_num);
 
 query_srq_exit1:
@@ -1881,10 +2140,12 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        int ret;
        u64 h_ret;
        u8 port_num;
+       int is_user = 0;
        enum ib_qp_type qp_type;
        unsigned long flags;
 
        if (uobject) {
+               is_user = 1;
                if (my_qp->mm_count_galpa ||
                    my_qp->mm_count_rqueue || my_qp->mm_count_squeue) {
                        ehca_err(dev, "Resources still referenced in "
@@ -1907,9 +2168,22 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        idr_remove(&ehca_qp_idr, my_qp->token);
        write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
 
+       /*
+        * SRQs will never get into an error list and do not have a recv_cq,
+        * so we need to skip them here.
+        */
+       if (HAS_RQ(my_qp) && !IS_SRQ(my_qp) && !is_user)
+               del_from_err_list(my_qp->recv_cq, &my_qp->rq_err_node);
+
+       if (HAS_SQ(my_qp) && !is_user)
+               del_from_err_list(my_qp->send_cq, &my_qp->sq_err_node);
+
+       /* now wait until all pending events have completed */
+       wait_event(my_qp->wait_completion, !atomic_read(&my_qp->nr_events));
+
        h_ret = hipz_h_destroy_qp(shca->ipz_hca_handle, my_qp);
        if (h_ret != H_SUCCESS) {
-               ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%li "
+               ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, qp_num);
                return ehca2ib_return_code(h_ret);
        }
@@ -1929,7 +2203,7 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        if (qp_type == IB_QPT_GSI) {
                struct ib_event event;
                ehca_info(dev, "device %s: port %x is inactive.",
-                         shca->ib_device.name, port_num);
+                               shca->ib_device.name, port_num);
                event.device = &shca->ib_device;
                event.event = IB_EVENT_PORT_ERR;
                event.element.port_num = port_num;
@@ -1937,11 +2211,18 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
                ib_dispatch_event(&event);
        }
 
-       if (HAS_RQ(my_qp))
+       if (HAS_RQ(my_qp)) {
                ipz_queue_dtor(my_pd, &my_qp->ipz_rqueue);
-       if (HAS_SQ(my_qp))
+               if (!is_user)
+                       vfree(my_qp->rq_map.map);
+       }
+       if (HAS_SQ(my_qp)) {
                ipz_queue_dtor(my_pd, &my_qp->ipz_squeue);
+               if (!is_user)
+                       vfree(my_qp->sq_map.map);
+       }
        kmem_cache_free(qp_cache, my_qp);
+       atomic_dec(&shca->num_qps);
        return 0;
 }