IB/ehca: Remove unnecessary memory operations for userspace queue pairs
[safe/jmp/linux-2.6] / drivers / infiniband / hw / ehca / ehca_qp.c
index a3146e6..ead4e71 100644 (file)
@@ -43,9 +43,6 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-
-#include <asm/current.h>
-
 #include "ehca_classes.h"
 #include "ehca_tools.h"
 #include "ehca_qes.h"
@@ -273,38 +270,44 @@ static inline void queue2resp(struct ipzu_queue_resp *resp,
        resp->queue_length = queue->queue_length;
        resp->pagesize = queue->pagesize;
        resp->toggle_state = queue->toggle_state;
-}
-
-static inline int ll_qp_msg_size(int nr_sge)
-{
-       return 128 << nr_sge;
+       resp->offset = queue->offset;
 }
 
 /*
  * init_qp_queue initializes/constructs r/squeue and registers queue pages.
  */
 static inline int init_qp_queue(struct ehca_shca *shca,
+                               struct ehca_pd *pd,
                                struct ehca_qp *my_qp,
                                struct ipz_queue *queue,
                                int q_type,
                                u64 expected_hret,
-                               int nr_q_pages,
-                               int wqe_size,
-                               int nr_sges)
+                               struct ehca_alloc_queue_parms *parms,
+                               int wqe_size)
 {
-       int ret, cnt, ipz_rc;
+       int ret, cnt, ipz_rc, nr_q_pages;
        void *vpage;
        u64 rpage, h_ret;
        struct ib_device *ib_dev = &shca->ib_device;
        struct ipz_adapter_handle ipz_hca_handle = shca->ipz_hca_handle;
 
-       if (!nr_q_pages)
+       if (!parms->queue_size)
                return 0;
 
-       ipz_rc = ipz_queue_ctor(queue, nr_q_pages, EHCA_PAGESIZE,
-                               wqe_size, nr_sges);
+       if (parms->is_small) {
+               nr_q_pages = 1;
+               ipz_rc = ipz_queue_ctor(pd, queue, nr_q_pages,
+                                       128 << parms->page_size,
+                                       wqe_size, parms->act_nr_sges, 1);
+       } else {
+               nr_q_pages = parms->queue_size;
+               ipz_rc = ipz_queue_ctor(pd, queue, nr_q_pages,
+                                       EHCA_PAGESIZE, wqe_size,
+                                       parms->act_nr_sges, 0);
+       }
+
        if (!ipz_rc) {
-               ehca_err(ib_dev, "Cannot allocate page for queue. ipz_rc=%x",
+               ehca_err(ib_dev, "Cannot allocate page for queue. ipz_rc=%i",
                         ipz_rc);
                return -EBUSY;
        }
@@ -323,12 +326,12 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                h_ret = hipz_h_register_rpage_qp(ipz_hca_handle,
                                                 my_qp->ipz_qp_handle,
                                                 NULL, 0, q_type,
-                                                rpage, 1,
+                                                rpage, parms->is_small ? 0 : 1,
                                                 my_qp->galpas.kernel);
                if (cnt == (nr_q_pages - 1)) {  /* last page! */
                        if (h_ret != expected_hret) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                        "h_ret= %lx ", h_ret);
+                                        "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -342,7 +345,7 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                } else {
                        if (h_ret != H_PAGE_REGISTERED) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                        "h_ret= %lx ", h_ret);
+                                        "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -354,27 +357,111 @@ static inline int init_qp_queue(struct ehca_shca *shca,
        return 0;
 
 init_qp_queue1:
-       ipz_queue_dtor(queue);
+       ipz_queue_dtor(pd, queue);
        return ret;
 }
 
+static inline int ehca_calc_wqe_size(int act_nr_sge, int is_llqp)
+{
+       if (is_llqp)
+               return 128 << act_nr_sge;
+       else
+               return offsetof(struct ehca_wqe,
+                               u.nud.sg_list[act_nr_sge]);
+}
+
+static void ehca_determine_small_queue(struct ehca_alloc_queue_parms *queue,
+                                      int req_nr_sge, int is_llqp)
+{
+       u32 wqe_size, q_size;
+       int act_nr_sge = req_nr_sge;
+
+       if (!is_llqp)
+               /* round up #SGEs so WQE size is a power of 2 */
+               for (act_nr_sge = 4; act_nr_sge <= 252;
+                    act_nr_sge = 4 + 2 * act_nr_sge)
+                       if (act_nr_sge >= req_nr_sge)
+                               break;
+
+       wqe_size = ehca_calc_wqe_size(act_nr_sge, is_llqp);
+       q_size = wqe_size * (queue->max_wr + 1);
+
+       if (q_size <= 512)
+               queue->page_size = 2;
+       else if (q_size <= 1024)
+               queue->page_size = 3;
+       else
+               queue->page_size = 0;
+
+       queue->is_small = (queue->page_size != 0);
+}
+
+/* needs to be called with cq->spinlock held */
+void ehca_add_to_err_list(struct ehca_qp *qp, int on_sq)
+{
+       struct list_head *list, *node;
+
+       /* TODO: support low latency QPs */
+       if (qp->ext_type == EQPT_LLQP)
+               return;
+
+       if (on_sq) {
+               list = &qp->send_cq->sqp_err_list;
+               node = &qp->sq_err_node;
+       } else {
+               list = &qp->recv_cq->rqp_err_list;
+               node = &qp->rq_err_node;
+       }
+
+       if (list_empty(node))
+               list_add_tail(node, list);
+
+       return;
+}
+
+static void del_from_err_list(struct ehca_cq *cq, struct list_head *node)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&cq->spinlock, flags);
+
+       if (!list_empty(node))
+               list_del_init(node);
+
+       spin_unlock_irqrestore(&cq->spinlock, flags);
+}
+
+static void reset_queue_map(struct ehca_queue_map *qmap)
+{
+       int i;
+
+       qmap->tail = qmap->entries - 1;
+       qmap->left_to_poll = 0;
+       qmap->next_wqe_idx = 0;
+       for (i = 0; i < qmap->entries; i++) {
+               qmap->map[i].reported = 1;
+               qmap->map[i].cqe_req = 0;
+       }
+}
+
 /*
  * Create an ib_qp struct that is either a QP or an SRQ, depending on
  * the value of the is_srq parameter. If init_attr and srq_init_attr share
  * fields, the field out of init_attr is used.
  */
-struct ehca_qp *internal_create_qp(struct ib_pd *pd,
-                                  struct ib_qp_init_attr *init_attr,
-                                  struct ib_srq_init_attr *srq_init_attr,
-                                  struct ib_udata *udata, int is_srq)
+static struct ehca_qp *internal_create_qp(
+       struct ib_pd *pd,
+       struct ib_qp_init_attr *init_attr,
+       struct ib_srq_init_attr *srq_init_attr,
+       struct ib_udata *udata, int is_srq)
 {
-       struct ehca_qp *my_qp;
+       struct ehca_qp *my_qp, *my_srq = NULL;
        struct ehca_pd *my_pd = container_of(pd, struct ehca_pd, ib_pd);
        struct ehca_shca *shca = container_of(pd->device, struct ehca_shca,
                                              ib_device);
        struct ib_ucontext *context = NULL;
        u64 h_ret;
-       int is_llqp = 0, has_srq = 0;
+       int is_llqp = 0, has_srq = 0, is_user = 0;
        int qp_type, max_send_sge, max_recv_sge, ret;
 
        /* h_call's out parameters */
@@ -382,6 +469,19 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
        u32 swqe_size = 0, rwqe_size = 0, ib_qp_num;
        unsigned long flags;
 
+       if (!atomic_add_unless(&shca->num_qps, 1, shca->max_num_qps)) {
+               ehca_err(pd->device, "Unable to create QP, max number of %i "
+                        "QPs reached.", shca->max_num_qps);
+               ehca_err(pd->device, "To increase the maximum number of QPs "
+                        "use the number_of_qps module parameter.\n");
+               return ERR_PTR(-ENOSPC);
+       }
+
+       if (init_attr->create_flags) {
+               atomic_dec(&shca->num_qps);
+               return ERR_PTR(-EINVAL);
+       }
+
        memset(&parms, 0, sizeof(parms));
        qp_type = init_attr->qp_type;
 
@@ -389,6 +489,7 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                init_attr->sq_sig_type != IB_SIGNAL_ALL_WR) {
                ehca_err(pd->device, "init_attr->sg_sig_type=%x not allowed",
                         init_attr->sq_sig_type);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -403,17 +504,22 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
 
        /* handle SRQ base QPs */
        if (init_attr->srq) {
-               struct ehca_qp *my_srq =
-                       container_of(init_attr->srq, struct ehca_qp, ib_srq);
+               my_srq = container_of(init_attr->srq, struct ehca_qp, ib_srq);
+
+               if (qp_type == IB_QPT_UC) {
+                       ehca_err(pd->device, "UC with SRQ not supported");
+                       atomic_dec(&shca->num_qps);
+                       return ERR_PTR(-EINVAL);
+               }
 
                has_srq = 1;
                parms.ext_type = EQPT_SRQBASE;
                parms.srq_qpn = my_srq->real_qp_num;
-               parms.srq_token = my_srq->token;
        }
 
        if (is_llqp && has_srq) {
                ehca_err(pd->device, "LLQPs can't have an SRQ");
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -425,6 +531,7 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                        ehca_err(pd->device, "no more than three SGEs "
                                 "supported for SRQ  pd=%p  max_sge=%x",
                                 pd, init_attr->cap.max_recv_sge);
+                       atomic_dec(&shca->num_qps);
                        return ERR_PTR(-EINVAL);
                }
        }
@@ -436,6 +543,7 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
            qp_type != IB_QPT_SMI &&
            qp_type != IB_QPT_GSI) {
                ehca_err(pd->device, "wrong QP Type=%x", qp_type);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-EINVAL);
        }
 
@@ -449,6 +557,7 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                                         "or max_rq_wr=%x for RC LLQP",
                                         init_attr->cap.max_send_wr,
                                         init_attr->cap.max_recv_wr);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        }
                        break;
@@ -456,6 +565,7 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                        if (!EHCA_BMASK_GET(HCA_CAP_UD_LL_QP, shca->hca_cap)) {
                                ehca_err(pd->device, "UD LLQP not supported "
                                         "by this adapter");
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-ENOSYS);
                        }
                        if (!(init_attr->cap.max_send_sge <= 5
@@ -467,36 +577,57 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                                         "or max_recv_sge=%x for UD LLQP",
                                         init_attr->cap.max_send_sge,
                                         init_attr->cap.max_recv_sge);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        } else if (init_attr->cap.max_send_wr > 255) {
                                ehca_err(pd->device,
                                         "Invalid Number of "
-                                        "ax_send_wr=%x for UD QP_TYPE=%x",
+                                        "max_send_wr=%x for UD QP_TYPE=%x",
                                         init_attr->cap.max_send_wr, qp_type);
+                               atomic_dec(&shca->num_qps);
                                return ERR_PTR(-EINVAL);
                        }
                        break;
                default:
                        ehca_err(pd->device, "unsupported LL QP Type=%x",
                                 qp_type);
+                       atomic_dec(&shca->num_qps);
+                       return ERR_PTR(-EINVAL);
+               }
+       } else {
+               int max_sge = (qp_type == IB_QPT_UD || qp_type == IB_QPT_SMI
+                              || qp_type == IB_QPT_GSI) ? 250 : 252;
+
+               if (init_attr->cap.max_send_sge > max_sge
+                   || init_attr->cap.max_recv_sge > max_sge) {
+                       ehca_err(pd->device, "Invalid number of SGEs requested "
+                                "send_sge=%x recv_sge=%x max_sge=%x",
+                                init_attr->cap.max_send_sge,
+                                init_attr->cap.max_recv_sge, max_sge);
+                       atomic_dec(&shca->num_qps);
                        return ERR_PTR(-EINVAL);
-                       break;
                }
        }
 
-       if (pd->uobject && udata)
-               context = pd->uobject->context;
-
        my_qp = kmem_cache_zalloc(qp_cache, GFP_KERNEL);
        if (!my_qp) {
                ehca_err(pd->device, "pd=%p not enough memory to alloc qp", pd);
+               atomic_dec(&shca->num_qps);
                return ERR_PTR(-ENOMEM);
        }
 
+       if (pd->uobject && udata) {
+               is_user = 1;
+               context = pd->uobject->context;
+       }
+
+       atomic_set(&my_qp->nr_events, 0);
+       init_waitqueue_head(&my_qp->wait_completion);
        spin_lock_init(&my_qp->spinlock_s);
        spin_lock_init(&my_qp->spinlock_r);
        my_qp->qp_type = qp_type;
        my_qp->ext_type = parms.ext_type;
+       my_qp->state = IB_QPS_RESET;
 
        if (init_attr->recv_cq)
                my_qp->recv_cq =
@@ -515,7 +646,6 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                write_lock_irqsave(&ehca_qp_idr_lock, flags);
                ret = idr_get_new(&ehca_qp_idr, my_qp, &my_qp->token);
                write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
-
        } while (ret == -EAGAIN);
 
        if (ret) {
@@ -524,17 +654,24 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                goto create_qp_exit0;
        }
 
+       if (my_qp->token > 0x1FFFFFF) {
+               ret = -EINVAL;
+               ehca_err(pd->device, "Invalid number of qp");
+               goto create_qp_exit1;
+       }
+
+       if (has_srq)
+               parms.srq_token = my_qp->token;
+
        parms.servicetype = ibqptype2servicetype(qp_type);
        if (parms.servicetype < 0) {
                ret = -EINVAL;
                ehca_err(pd->device, "Invalid qp_type=%x", qp_type);
-               goto create_qp_exit0;
+               goto create_qp_exit1;
        }
 
-       if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
-               parms.sigtype = HCALL_SIGT_EVERY;
-       else
-               parms.sigtype = HCALL_SIGT_BY_WQE;
+       /* Always signal by WQE so we can hide circ. WQEs */
+       parms.sigtype = HCALL_SIGT_BY_WQE;
 
        /* UD_AV CIRCUMVENTION */
        max_send_sge = init_attr->cap.max_send_sge;
@@ -552,14 +689,29 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
        if (my_qp->recv_cq)
                parms.recv_cq_handle = my_qp->recv_cq->ipz_cq_handle;
 
-       parms.max_send_wr = init_attr->cap.max_send_wr;
-       parms.max_recv_wr = init_attr->cap.max_recv_wr;
-       parms.max_send_sge = max_send_sge;
-       parms.max_recv_sge = max_recv_sge;
+       parms.squeue.max_wr = init_attr->cap.max_send_wr;
+       parms.rqueue.max_wr = init_attr->cap.max_recv_wr;
+       parms.squeue.max_sge = max_send_sge;
+       parms.rqueue.max_sge = max_recv_sge;
+
+       /* RC QPs need one more SWQE for unsolicited ack circumvention */
+       if (qp_type == IB_QPT_RC)
+               parms.squeue.max_wr++;
 
-       h_ret = hipz_h_alloc_resource_qp(shca->ipz_hca_handle, &parms);
+       if (EHCA_BMASK_GET(HCA_CAP_MINI_QP, shca->hca_cap)) {
+               if (HAS_SQ(my_qp))
+                       ehca_determine_small_queue(
+                               &parms.squeue, max_send_sge, is_llqp);
+               if (HAS_RQ(my_qp))
+                       ehca_determine_small_queue(
+                               &parms.rqueue, max_recv_sge, is_llqp);
+               parms.qp_storage =
+                       (parms.squeue.is_small || parms.rqueue.is_small);
+       }
+
+       h_ret = hipz_h_alloc_resource_qp(shca->ipz_hca_handle, &parms, is_user);
        if (h_ret != H_SUCCESS) {
-               ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%lx",
+               ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%lli",
                         h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto create_qp_exit1;
@@ -569,50 +721,35 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
        my_qp->ipz_qp_handle = parms.qp_handle;
        my_qp->galpas = parms.galpas;
 
+       swqe_size = ehca_calc_wqe_size(parms.squeue.act_nr_sges, is_llqp);
+       rwqe_size = ehca_calc_wqe_size(parms.rqueue.act_nr_sges, is_llqp);
+
        switch (qp_type) {
        case IB_QPT_RC:
-               if (!is_llqp) {
-                       swqe_size = offsetof(struct ehca_wqe, u.nud.sg_list[
-                                            (parms.act_nr_send_sges)]);
-                       rwqe_size = offsetof(struct ehca_wqe, u.nud.sg_list[
-                                            (parms.act_nr_recv_sges)]);
-               } else { /* for LLQP we need to use msg size, not wqe size */
-                       swqe_size = ll_qp_msg_size(max_send_sge);
-                       rwqe_size = ll_qp_msg_size(max_recv_sge);
-                       parms.act_nr_send_sges = 1;
-                       parms.act_nr_recv_sges = 1;
+               if (is_llqp) {
+                       parms.squeue.act_nr_sges = 1;
+                       parms.rqueue.act_nr_sges = 1;
                }
+               /* hide the extra WQE */
+               parms.squeue.act_nr_wqes--;
                break;
-       case IB_QPT_UC:
-               swqe_size = offsetof(struct ehca_wqe,
-                                    u.nud.sg_list[parms.act_nr_send_sges]);
-               rwqe_size = offsetof(struct ehca_wqe,
-                                    u.nud.sg_list[parms.act_nr_recv_sges]);
-               break;
-
        case IB_QPT_UD:
        case IB_QPT_GSI:
        case IB_QPT_SMI:
+               /* UD circumvention */
                if (is_llqp) {
-                       swqe_size = ll_qp_msg_size(parms.act_nr_send_sges);
-                       rwqe_size = ll_qp_msg_size(parms.act_nr_recv_sges);
-                       parms.act_nr_send_sges = 1;
-                       parms.act_nr_recv_sges = 1;
+                       parms.squeue.act_nr_sges = 1;
+                       parms.rqueue.act_nr_sges = 1;
                } else {
-                       /* UD circumvention */
-                       parms.act_nr_send_sges -= 2;
-                       parms.act_nr_recv_sges -= 2;
-                       swqe_size = offsetof(struct ehca_wqe, u.ud_av.sg_list[
-                                                    parms.act_nr_send_sges]);
-                       rwqe_size = offsetof(struct ehca_wqe, u.ud_av.sg_list[
-                                                    parms.act_nr_recv_sges]);
+                       parms.squeue.act_nr_sges -= 2;
+                       parms.rqueue.act_nr_sges -= 2;
                }
 
                if (IB_QPT_GSI == qp_type || IB_QPT_SMI == qp_type) {
-                       parms.act_nr_send_wqes = init_attr->cap.max_send_wr;
-                       parms.act_nr_recv_wqes = init_attr->cap.max_recv_wr;
-                       parms.act_nr_send_sges = init_attr->cap.max_send_sge;
-                       parms.act_nr_recv_sges = init_attr->cap.max_recv_sge;
+                       parms.squeue.act_nr_wqes = init_attr->cap.max_send_wr;
+                       parms.rqueue.act_nr_wqes = init_attr->cap.max_recv_wr;
+                       parms.squeue.act_nr_sges = init_attr->cap.max_send_sge;
+                       parms.rqueue.act_nr_sges = init_attr->cap.max_recv_sge;
                        ib_qp_num = (qp_type == IB_QPT_SMI) ? 0 : 1;
                }
 
@@ -625,27 +762,60 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
        /* initialize r/squeue and register queue pages */
        if (HAS_SQ(my_qp)) {
                ret = init_qp_queue(
-                       shca, my_qp, &my_qp->ipz_squeue, 0,
+                       shca, my_pd, my_qp, &my_qp->ipz_squeue, 0,
                        HAS_RQ(my_qp) ? H_PAGE_REGISTERED : H_SUCCESS,
-                       parms.nr_sq_pages, swqe_size,
-                       parms.act_nr_send_sges);
+                       &parms.squeue, swqe_size);
                if (ret) {
                        ehca_err(pd->device, "Couldn't initialize squeue "
-                                "and pages  ret=%x", ret);
+                                "and pages ret=%i", ret);
                        goto create_qp_exit2;
                }
+
+               if (!is_user) {
+                       my_qp->sq_map.entries = my_qp->ipz_squeue.queue_length /
+                               my_qp->ipz_squeue.qe_size;
+                       my_qp->sq_map.map = vmalloc(my_qp->sq_map.entries *
+                                                   sizeof(struct ehca_qmap_entry));
+                       if (!my_qp->sq_map.map) {
+                               ehca_err(pd->device, "Couldn't allocate squeue "
+                                        "map ret=%i", ret);
+                               goto create_qp_exit3;
+                       }
+                       INIT_LIST_HEAD(&my_qp->sq_err_node);
+                       /* to avoid the generation of bogus flush CQEs */
+                       reset_queue_map(&my_qp->sq_map);
+               }
        }
 
        if (HAS_RQ(my_qp)) {
                ret = init_qp_queue(
-                       shca, my_qp, &my_qp->ipz_rqueue, 1,
-                       H_SUCCESS, parms.nr_rq_pages, rwqe_size,
-                       parms.act_nr_recv_sges);
+                       shca, my_pd, my_qp, &my_qp->ipz_rqueue, 1,
+                       H_SUCCESS, &parms.rqueue, rwqe_size);
                if (ret) {
                        ehca_err(pd->device, "Couldn't initialize rqueue "
-                                "and pages ret=%x", ret);
-                       goto create_qp_exit3;
+                                "and pages ret=%i", ret);
+                       goto create_qp_exit4;
+               }
+               if (!is_user) {
+                       my_qp->rq_map.entries = my_qp->ipz_rqueue.queue_length /
+                               my_qp->ipz_rqueue.qe_size;
+                       my_qp->rq_map.map = vmalloc(my_qp->rq_map.entries *
+                                                   sizeof(struct ehca_qmap_entry));
+                       if (!my_qp->rq_map.map) {
+                               ehca_err(pd->device, "Couldn't allocate squeue "
+                                        "map ret=%i", ret);
+                               goto create_qp_exit5;
+                       }
+                       INIT_LIST_HEAD(&my_qp->rq_err_node);
+                       /* to avoid the generation of bogus flush CQEs */
+                       reset_queue_map(&my_qp->rq_map);
                }
+       } else if (init_attr->srq && !is_user) {
+               /* this is a base QP, use the queue map of the SRQ */
+               my_qp->rq_map = my_srq->rq_map;
+               INIT_LIST_HEAD(&my_qp->rq_err_node);
+
+               my_qp->ipz_rqueue = my_srq->ipz_rqueue;
        }
 
        if (is_srq) {
@@ -670,20 +840,42 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
        }
 
        init_attr->cap.max_inline_data = 0; /* not supported yet */
-       init_attr->cap.max_recv_sge = parms.act_nr_recv_sges;
-       init_attr->cap.max_recv_wr = parms.act_nr_recv_wqes;
-       init_attr->cap.max_send_sge = parms.act_nr_send_sges;
-       init_attr->cap.max_send_wr = parms.act_nr_send_wqes;
+       init_attr->cap.max_recv_sge = parms.rqueue.act_nr_sges;
+       init_attr->cap.max_recv_wr = parms.rqueue.act_nr_wqes;
+       init_attr->cap.max_send_sge = parms.squeue.act_nr_sges;
+       init_attr->cap.max_send_wr = parms.squeue.act_nr_wqes;
        my_qp->init_attr = *init_attr;
 
+       if (qp_type == IB_QPT_SMI || qp_type == IB_QPT_GSI) {
+               shca->sport[init_attr->port_num - 1].ibqp_sqp[qp_type] =
+                       &my_qp->ib_qp;
+               if (ehca_nr_ports < 0) {
+                       /* alloc array to cache subsequent modify qp parms
+                        * for autodetect mode
+                        */
+                       my_qp->mod_qp_parm =
+                               kzalloc(EHCA_MOD_QP_PARM_MAX *
+                                       sizeof(*my_qp->mod_qp_parm),
+                                       GFP_KERNEL);
+                       if (!my_qp->mod_qp_parm) {
+                               ehca_err(pd->device,
+                                        "Could not alloc mod_qp_parm");
+                               goto create_qp_exit5;
+                       }
+               }
+       }
+
        /* NOTE: define_apq0() not supported yet */
        if (qp_type == IB_QPT_GSI) {
                h_ret = ehca_define_sqp(shca, my_qp, init_attr);
                if (h_ret != H_SUCCESS) {
-                       ehca_err(pd->device, "ehca_define_sqp() failed rc=%lx",
-                                h_ret);
+                       kfree(my_qp->mod_qp_parm);
+                       my_qp->mod_qp_parm = NULL;
+                       /* the QP pointer is no longer valid */
+                       shca->sport[init_attr->port_num - 1].ibqp_sqp[qp_type] =
+                               NULL;
                        ret = ehca2ib_return_code(h_ret);
-                       goto create_qp_exit4;
+                       goto create_qp_exit6;
                }
        }
 
@@ -691,8 +883,8 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                ret = ehca_cq_assign_qp(my_qp->send_cq, my_qp);
                if (ret) {
                        ehca_err(pd->device,
-                                "Couldn't assign qp to send_cq ret=%x", ret);
-                       goto create_qp_exit4;
+                                "Couldn't assign qp to send_cq ret=%i", ret);
+                       goto create_qp_exit7;
                }
        }
 
@@ -707,27 +899,44 @@ struct ehca_qp *internal_create_qp(struct ib_pd *pd,
                resp.ext_type = my_qp->ext_type;
                resp.qkey = my_qp->qkey;
                resp.real_qp_num = my_qp->real_qp_num;
+
                if (HAS_SQ(my_qp))
                        queue2resp(&resp.ipz_squeue, &my_qp->ipz_squeue);
                if (HAS_RQ(my_qp))
                        queue2resp(&resp.ipz_rqueue, &my_qp->ipz_rqueue);
+               resp.fw_handle_ofs = (u32)
+                       (my_qp->galpas.user.fw_handle & (PAGE_SIZE - 1));
 
                if (ib_copy_to_udata(udata, &resp, sizeof resp)) {
                        ehca_err(pd->device, "Copy to udata failed");
                        ret = -EINVAL;
-                       goto create_qp_exit4;
+                       goto create_qp_exit8;
                }
        }
 
        return my_qp;
 
-create_qp_exit4:
+create_qp_exit8:
+       ehca_cq_unassign_qp(my_qp->send_cq, my_qp->real_qp_num);
+
+create_qp_exit7:
+       kfree(my_qp->mod_qp_parm);
+
+create_qp_exit6:
+       if (HAS_RQ(my_qp) && !is_user)
+               vfree(my_qp->rq_map.map);
+
+create_qp_exit5:
        if (HAS_RQ(my_qp))
-               ipz_queue_dtor(&my_qp->ipz_rqueue);
+               ipz_queue_dtor(my_pd, &my_qp->ipz_rqueue);
+
+create_qp_exit4:
+       if (HAS_SQ(my_qp) && !is_user)
+               vfree(my_qp->sq_map.map);
 
 create_qp_exit3:
        if (HAS_SQ(my_qp))
-               ipz_queue_dtor(&my_qp->ipz_squeue);
+               ipz_queue_dtor(my_pd, &my_qp->ipz_squeue);
 
 create_qp_exit2:
        hipz_h_destroy_qp(shca->ipz_hca_handle, my_qp);
@@ -739,6 +948,7 @@ create_qp_exit1:
 
 create_qp_exit0:
        kmem_cache_free(qp_cache, my_qp);
+       atomic_dec(&shca->num_qps);
        return ERR_PTR(ret);
 }
 
@@ -752,8 +962,8 @@ struct ib_qp *ehca_create_qp(struct ib_pd *pd,
        return IS_ERR(ret) ? (struct ib_qp *)ret : &ret->ib_qp;
 }
 
-int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
-                       struct ib_uobject *uobject);
+static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
+                              struct ib_uobject *uobject);
 
 struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                               struct ib_srq_init_attr *srq_init_attr,
@@ -784,7 +994,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
 
        /* copy back return values */
        srq_init_attr->attr.max_wr = qp_init_attr.cap.max_recv_wr;
-       srq_init_attr->attr.max_sge = qp_init_attr.cap.max_recv_sge;
+       srq_init_attr->attr.max_sge = 3;
 
        /* drive SRQ into RTR state */
        mqpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
@@ -804,8 +1014,8 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                update_mask,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
-               ehca_err(pd->device, "Could not modify SRQ to INIT"
-                        "ehca_qp=%p qp_num=%x hret=%lx",
+               ehca_err(pd->device, "Could not modify SRQ to INIT "
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -818,8 +1028,8 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                update_mask,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
-               ehca_err(pd->device, "Could not enable SRQ"
-                        "ehca_qp=%p qp_num=%x hret=%lx",
+               ehca_err(pd->device, "Could not enable SRQ "
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -832,12 +1042,14 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                update_mask,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
-               ehca_err(pd->device, "Could not modify SRQ to RTR"
-                        "ehca_qp=%p qp_num=%x hret=%lx",
+               ehca_err(pd->device, "Could not modify SRQ to RTR "
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
 
+       ehca_free_fw_ctrlblock(mqpcb);
+
        return &my_qp->ib_srq;
 
 create_srq2:
@@ -871,7 +1083,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
                                           &bad_send_wqe_p, NULL, 2);
        if (h_ret != H_SUCCESS) {
                ehca_err(&shca->ib_device, "hipz_h_disable_and_get_wqe() failed"
-                        " ehca_qp=%p qp_num=%x h_ret=%lx",
+                        " ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp_num, h_ret);
                return ehca2ib_return_code(h_ret);
        }
@@ -880,7 +1092,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
                 qp_num, bad_send_wqe_p);
        /* convert wqe pointer to vadr */
        bad_send_wqe_v = abs_to_virt((u64)bad_send_wqe_p);
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(bad_send_wqe_v, 32, "qp_num=%x bad_wqe", qp_num);
        squeue = &my_qp->ipz_squeue;
        if (ipz_queue_abs_to_offset(squeue, (u64)bad_send_wqe_p, &q_ofs)) {
@@ -893,7 +1105,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
        wqe = (struct ehca_wqe *)ipz_qeit_calc(squeue, q_ofs);
        *bad_wqe_cnt = 0;
        while (wqe->optype != 0xff && wqe->wqef != 0xff) {
-               if (ehca_debug_level)
+               if (ehca_debug_level >= 2)
                        ehca_dmp(wqe, 32, "qp_num=%x wqe", qp_num);
                wqe->nr_of_data_seg = 0; /* suppress data access */
                wqe->wqef = WQEF_PURGE; /* WQE to be purged */
@@ -912,6 +1124,111 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
        return 0;
 }
 
+static int calc_left_cqes(u64 wqe_p, struct ipz_queue *ipz_queue,
+                         struct ehca_queue_map *qmap)
+{
+       void *wqe_v;
+       u64 q_ofs;
+       u32 wqe_idx;
+       unsigned int tail_idx;
+
+       /* convert real to abs address */
+       wqe_p = wqe_p & (~(1UL << 63));
+
+       wqe_v = abs_to_virt(wqe_p);
+
+       if (ipz_queue_abs_to_offset(ipz_queue, wqe_p, &q_ofs)) {
+               ehca_gen_err("Invalid offset for calculating left cqes "
+                               "wqe_p=%#llx wqe_v=%p\n", wqe_p, wqe_v);
+               return -EFAULT;
+       }
+
+       tail_idx = next_index(qmap->tail, qmap->entries);
+       wqe_idx = q_ofs / ipz_queue->qe_size;
+
+       /* check all processed wqes, whether a cqe is requested or not */
+       while (tail_idx != wqe_idx) {
+               if (qmap->map[tail_idx].cqe_req)
+                       qmap->left_to_poll++;
+               tail_idx = next_index(tail_idx, qmap->entries);
+       }
+       /* save index in queue, where we have to start flushing */
+       qmap->next_wqe_idx = wqe_idx;
+       return 0;
+}
+
+static int check_for_left_cqes(struct ehca_qp *my_qp, struct ehca_shca *shca)
+{
+       u64 h_ret;
+       void *send_wqe_p, *recv_wqe_p;
+       int ret;
+       unsigned long flags;
+       int qp_num = my_qp->ib_qp.qp_num;
+
+       /* this hcall is not supported on base QPs */
+       if (my_qp->ext_type != EQPT_SRQBASE) {
+               /* get send and receive wqe pointer */
+               h_ret = hipz_h_disable_and_get_wqe(shca->ipz_hca_handle,
+                               my_qp->ipz_qp_handle, &my_qp->pf,
+                               &send_wqe_p, &recv_wqe_p, 4);
+               if (h_ret != H_SUCCESS) {
+                       ehca_err(&shca->ib_device, "disable_and_get_wqe() "
+                                "failed ehca_qp=%p qp_num=%x h_ret=%lli",
+                                my_qp, qp_num, h_ret);
+                       return ehca2ib_return_code(h_ret);
+               }
+
+               /*
+                * acquire lock to ensure that nobody is polling the cq which
+                * could mean that the qmap->tail pointer is in an
+                * inconsistent state.
+                */
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               ret = calc_left_cqes((u64)send_wqe_p, &my_qp->ipz_squeue,
+                               &my_qp->sq_map);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+               if (ret)
+                       return ret;
+
+
+               spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+               ret = calc_left_cqes((u64)recv_wqe_p, &my_qp->ipz_rqueue,
+                               &my_qp->rq_map);
+               spin_unlock_irqrestore(&my_qp->recv_cq->spinlock, flags);
+               if (ret)
+                       return ret;
+       } else {
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               my_qp->sq_map.left_to_poll = 0;
+               my_qp->sq_map.next_wqe_idx = next_index(my_qp->sq_map.tail,
+                                                       my_qp->sq_map.entries);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+
+               spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+               my_qp->rq_map.left_to_poll = 0;
+               my_qp->rq_map.next_wqe_idx = next_index(my_qp->rq_map.tail,
+                                                       my_qp->rq_map.entries);
+               spin_unlock_irqrestore(&my_qp->recv_cq->spinlock, flags);
+       }
+
+       /* this assures flush cqes being generated only for pending wqes */
+       if ((my_qp->sq_map.left_to_poll == 0) &&
+                               (my_qp->rq_map.left_to_poll == 0)) {
+               spin_lock_irqsave(&my_qp->send_cq->spinlock, flags);
+               ehca_add_to_err_list(my_qp, 1);
+               spin_unlock_irqrestore(&my_qp->send_cq->spinlock, flags);
+
+               if (HAS_RQ(my_qp)) {
+                       spin_lock_irqsave(&my_qp->recv_cq->spinlock, flags);
+                       ehca_add_to_err_list(my_qp, 0);
+                       spin_unlock_irqrestore(&my_qp->recv_cq->spinlock,
+                                       flags);
+               }
+       }
+
+       return 0;
+}
+
 /*
  * internal_modify_qp with circumvention to handle aqp0 properly
  * smi_reset2init indicates if this is an internal reset-to-init-call for
@@ -932,11 +1249,12 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        u64 update_mask;
        u64 h_ret;
        int bad_wqe_cnt = 0;
+       int is_user = 0;
        int squeue_locked = 0;
        unsigned long flags = 0;
 
        /* do query_qp to obtain current attr values */
-       mqpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
+       mqpcb = ehca_alloc_fw_ctrlblock(GFP_ATOMIC);
        if (!mqpcb) {
                ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                         "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
@@ -949,11 +1267,13 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                                mqpcb, my_qp->galpas.kernel);
        if (h_ret != H_SUCCESS) {
                ehca_err(ibqp->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%lx",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, ibqp->qp_num, h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto modify_qp_exit1;
        }
+       if (ibqp->uobject)
+               is_user = 1;
 
        qp_cur_state = ehca2ib_qp_state(mqpcb->qp_state);
 
@@ -985,7 +1305,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        ibqp, &smiqp_attr, smiqp_attr_mask, 1);
                if (smirc) {
                        ehca_err(ibqp->device, "SMI RESET -> INIT failed. "
-                                "ehca_modify_qp() rc=%x", smirc);
+                                "ehca_modify_qp() rc=%i", smirc);
                        ret = H_PARAMETER;
                        goto modify_qp_exit1;
                }
@@ -1087,7 +1407,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                ret = prepare_sqe_rts(my_qp, shca, &bad_wqe_cnt);
                if (ret) {
                        ehca_err(ibqp->device, "prepare_sqe_rts() failed "
-                                "ehca_qp=%p qp_num=%x ret=%x",
+                                "ehca_qp=%p qp_num=%x ret=%i",
                                 my_qp, ibqp->qp_num, ret);
                        goto modify_qp_exit2;
                }
@@ -1113,10 +1433,19 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        }
 
        if (attr_mask & IB_QP_PKEY_INDEX) {
+               if (attr->pkey_index >= 16) {
+                       ret = -EINVAL;
+                       ehca_err(ibqp->device, "Invalid pkey_index=%x. "
+                                "ehca_qp=%p qp_num=%x max_pkey_index=f",
+                                attr->pkey_index, my_qp, ibqp->qp_num);
+                       goto modify_qp_exit2;
+               }
                mqpcb->prim_p_key_idx = attr->pkey_index;
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_PRIM_P_KEY_IDX, 1);
        }
        if (attr_mask & IB_QP_PORT) {
+               struct ehca_sport *sport;
+               struct ehca_qp *aqp1;
                if (attr->port_num < 1 || attr->port_num > shca->num_ports) {
                        ret = -EINVAL;
                        ehca_err(ibqp->device, "Invalid port=%x. "
@@ -1125,6 +1454,29 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                                 shca->num_ports);
                        goto modify_qp_exit2;
                }
+               sport = &shca->sport[attr->port_num - 1];
+               if (!sport->ibqp_sqp[IB_QPT_GSI]) {
+                       /* should not occur */
+                       ret = -EFAULT;
+                       ehca_err(ibqp->device, "AQP1 was not created for "
+                                "port=%x", attr->port_num);
+                       goto modify_qp_exit2;
+               }
+               aqp1 = container_of(sport->ibqp_sqp[IB_QPT_GSI],
+                                   struct ehca_qp, ib_qp);
+               if (ibqp->qp_type != IB_QPT_GSI &&
+                   ibqp->qp_type != IB_QPT_SMI &&
+                   aqp1->mod_qp_parm) {
+                       /*
+                        * firmware will reject this modify_qp() because
+                        * port is not activated/initialized fully
+                        */
+                       ret = -EFAULT;
+                       ehca_warn(ibqp->device, "Couldn't modify qp port=%x: "
+                                 "either port is being activated (try again) "
+                                 "or cabling issue", attr->port_num);
+                       goto modify_qp_exit2;
+               }
                mqpcb->prim_phys_port = attr->port_num;
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_PRIM_PHYS_PORT, 1);
        }
@@ -1133,10 +1485,6 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_QKEY, 1);
        }
        if (attr_mask & IB_QP_AV) {
-               int ah_mult = ib_rate_to_mult(attr->ah_attr.static_rate);
-               int ehca_mult = ib_rate_to_mult(shca->sport[my_qp->
-                                               init_attr.port_num].rate);
-
                mqpcb->dlid = attr->ah_attr.dlid;
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_DLID, 1);
                mqpcb->source_path_bits = attr->ah_attr.src_path_bits;
@@ -1144,11 +1492,12 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                mqpcb->service_level = attr->ah_attr.sl;
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_SERVICE_LEVEL, 1);
 
-               if (ah_mult < ehca_mult)
-                       mqpcb->max_static_rate = (ah_mult > 0) ?
-                       ((ehca_mult - 1) / ah_mult) : 0;
-               else
-                       mqpcb->max_static_rate = 0;
+               if (ehca_calc_ipd(shca, mqpcb->prim_phys_port,
+                                 attr->ah_attr.static_rate,
+                                 &mqpcb->max_static_rate)) {
+                       ret = -EINVAL;
+                       goto modify_qp_exit2;
+               }
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_MAX_STATIC_RATE, 1);
 
                /*
@@ -1184,6 +1533,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        }
 
        if (attr_mask & IB_QP_PATH_MTU) {
+               /* store ld(MTU) */
+               my_qp->mtu_shift = attr->path_mtu + 7;
                mqpcb->path_mtu = attr->path_mtu;
                update_mask |= EHCA_BMASK_SET(MQPCB_MASK_PATH_MTU, 1);
        }
@@ -1217,54 +1568,80 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        (MQPCB_MASK_RDMA_ATOMIC_OUTST_DEST_QP, 1);
        }
        if (attr_mask & IB_QP_ALT_PATH) {
-               int ah_mult = ib_rate_to_mult(attr->alt_ah_attr.static_rate);
-               int ehca_mult = ib_rate_to_mult(
-                       shca->sport[my_qp->init_attr.port_num].rate);
+               if (attr->alt_port_num < 1
+                   || attr->alt_port_num > shca->num_ports) {
+                       ret = -EINVAL;
+                       ehca_err(ibqp->device, "Invalid alt_port=%x. "
+                                "ehca_qp=%p qp_num=%x num_ports=%x",
+                                attr->alt_port_num, my_qp, ibqp->qp_num,
+                                shca->num_ports);
+                       goto modify_qp_exit2;
+               }
+               mqpcb->alt_phys_port = attr->alt_port_num;
 
+               if (attr->alt_pkey_index >= 16) {
+                       ret = -EINVAL;
+                       ehca_err(ibqp->device, "Invalid alt_pkey_index=%x. "
+                                "ehca_qp=%p qp_num=%x max_pkey_index=f",
+                                attr->pkey_index, my_qp, ibqp->qp_num);
+                       goto modify_qp_exit2;
+               }
+               mqpcb->alt_p_key_idx = attr->alt_pkey_index;
+
+               mqpcb->timeout_al = attr->alt_timeout;
                mqpcb->dlid_al = attr->alt_ah_attr.dlid;
-               update_mask |= EHCA_BMASK_SET(MQPCB_MASK_DLID_AL, 1);
                mqpcb->source_path_bits_al = attr->alt_ah_attr.src_path_bits;
-               update_mask |=
-                       EHCA_BMASK_SET(MQPCB_MASK_SOURCE_PATH_BITS_AL, 1);
                mqpcb->service_level_al = attr->alt_ah_attr.sl;
-               update_mask |= EHCA_BMASK_SET(MQPCB_MASK_SERVICE_LEVEL_AL, 1);
 
-               if (ah_mult < ehca_mult)
-                       mqpcb->max_static_rate = (ah_mult > 0) ?
-                       ((ehca_mult - 1) / ah_mult) : 0;
-               else
-                       mqpcb->max_static_rate_al = 0;
+               if (ehca_calc_ipd(shca, mqpcb->alt_phys_port,
+                                 attr->alt_ah_attr.static_rate,
+                                 &mqpcb->max_static_rate_al)) {
+                       ret = -EINVAL;
+                       goto modify_qp_exit2;
+               }
+
+               /* OpenIB doesn't support alternate retry counts - copy them */
+               mqpcb->retry_count_al = mqpcb->retry_count;
+               mqpcb->rnr_retry_count_al = mqpcb->rnr_retry_count;
 
-               update_mask |= EHCA_BMASK_SET(MQPCB_MASK_MAX_STATIC_RATE_AL, 1);
+               update_mask |= EHCA_BMASK_SET(MQPCB_MASK_ALT_PHYS_PORT, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_ALT_P_KEY_IDX, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_TIMEOUT_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_DLID_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_SOURCE_PATH_BITS_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_SERVICE_LEVEL_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_MAX_STATIC_RATE_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_RETRY_COUNT_AL, 1)
+                       | EHCA_BMASK_SET(MQPCB_MASK_RNR_RETRY_COUNT_AL, 1);
+
+               /*
+                * Always supply the GRH flag, even if it's zero, to give the
+                * hypervisor a clear "yes" or "no" instead of a "perhaps"
+                */
+               update_mask |= EHCA_BMASK_SET(MQPCB_MASK_SEND_GRH_FLAG_AL, 1);
 
                /*
                 * only if GRH is TRUE we might consider SOURCE_GID_IDX
                 * and DEST_GID otherwise phype will return H_ATTR_PARM!!!
                 */
                if (attr->alt_ah_attr.ah_flags == IB_AH_GRH) {
-                       mqpcb->send_grh_flag_al = 1 << 31;
-                       update_mask |=
-                               EHCA_BMASK_SET(MQPCB_MASK_SEND_GRH_FLAG_AL, 1);
-                       mqpcb->source_gid_idx_al =
-                               attr->alt_ah_attr.grh.sgid_index;
-                       update_mask |=
-                               EHCA_BMASK_SET(MQPCB_MASK_SOURCE_GID_IDX_AL, 1);
+                       mqpcb->send_grh_flag_al = 1;
 
                        for (cnt = 0; cnt < 16; cnt++)
                                mqpcb->dest_gid_al.byte[cnt] =
                                        attr->alt_ah_attr.grh.dgid.raw[cnt];
-
-                       update_mask |=
-                               EHCA_BMASK_SET(MQPCB_MASK_DEST_GID_AL, 1);
+                       mqpcb->source_gid_idx_al =
+                               attr->alt_ah_attr.grh.sgid_index;
                        mqpcb->flow_label_al = attr->alt_ah_attr.grh.flow_label;
-                       update_mask |=
-                               EHCA_BMASK_SET(MQPCB_MASK_FLOW_LABEL_AL, 1);
                        mqpcb->hop_limit_al = attr->alt_ah_attr.grh.hop_limit;
-                       update_mask |=
-                               EHCA_BMASK_SET(MQPCB_MASK_HOP_LIMIT_AL, 1);
                        mqpcb->traffic_class_al =
                                attr->alt_ah_attr.grh.traffic_class;
+
                        update_mask |=
+                               EHCA_BMASK_SET(MQPCB_MASK_SOURCE_GID_IDX_AL, 1)
+                               | EHCA_BMASK_SET(MQPCB_MASK_DEST_GID_AL, 1)
+                               | EHCA_BMASK_SET(MQPCB_MASK_FLOW_LABEL_AL, 1)
+                               | EHCA_BMASK_SET(MQPCB_MASK_HOP_LIMIT_AL, 1) |
                                EHCA_BMASK_SET(MQPCB_MASK_TRAFFIC_CLASS_AL, 1);
                }
        }
@@ -1286,7 +1663,16 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        }
 
        if (attr_mask & IB_QP_PATH_MIG_STATE) {
-               mqpcb->path_migration_state = attr->path_mig_state;
+               if (attr->path_mig_state != IB_MIG_REARM
+                   && attr->path_mig_state != IB_MIG_MIGRATED) {
+                       ret = -EINVAL;
+                       ehca_err(ibqp->device, "Invalid mig_state=%x",
+                                attr->path_mig_state);
+                       goto modify_qp_exit2;
+               }
+               mqpcb->path_migration_state = attr->path_mig_state + 1;
+               if (attr->path_mig_state == IB_MIG_REARM)
+                       my_qp->mig_armed = 1;
                update_mask |=
                        EHCA_BMASK_SET(MQPCB_MASK_PATH_MIGRATION_STATE, 1);
        }
@@ -1301,7 +1687,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                /* no support for max_send/recv_sge yet */
        }
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(mqpcb, 4*70, "qp_num=%x", ibqp->qp_num);
 
        h_ret = hipz_h_modify_qp(shca->ipz_hca_handle,
@@ -1312,7 +1698,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
 
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-               ehca_err(ibqp->device, "hipz_h_modify_qp() failed rc=%lx "
+               ehca_err(ibqp->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, ibqp->qp_num);
                goto modify_qp_exit2;
        }
@@ -1345,15 +1731,34 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        ret = ehca2ib_return_code(h_ret);
                        ehca_err(ibqp->device, "ENABLE in context of "
                                 "RESET_2_INIT failed! Maybe you didn't get "
-                                "a LID h_ret=%lx ehca_qp=%p qp_num=%x",
+                                "a LID h_ret=%lli ehca_qp=%p qp_num=%x",
                                 h_ret, my_qp, ibqp->qp_num);
                        goto modify_qp_exit2;
                }
        }
+       if ((qp_new_state == IB_QPS_ERR) && (qp_cur_state != IB_QPS_ERR)
+           && !is_user) {
+               ret = check_for_left_cqes(my_qp, shca);
+               if (ret)
+                       goto modify_qp_exit2;
+       }
 
        if (statetrans == IB_QPST_ANY2RESET) {
                ipz_qeit_reset(&my_qp->ipz_rqueue);
                ipz_qeit_reset(&my_qp->ipz_squeue);
+
+               if (qp_cur_state == IB_QPS_ERR && !is_user) {
+                       del_from_err_list(my_qp->send_cq, &my_qp->sq_err_node);
+
+                       if (HAS_RQ(my_qp))
+                               del_from_err_list(my_qp->recv_cq,
+                                                 &my_qp->rq_err_node);
+               }
+               if (!is_user)
+                       reset_queue_map(&my_qp->sq_map);
+
+               if (HAS_RQ(my_qp) && !is_user)
+                       reset_queue_map(&my_qp->rq_map);
        }
 
        if (attr_mask & IB_QP_QKEY)
@@ -1374,19 +1779,110 @@ modify_qp_exit1:
 int ehca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
                   struct ib_udata *udata)
 {
+       int ret = 0;
+
+       struct ehca_shca *shca = container_of(ibqp->device, struct ehca_shca,
+                                             ib_device);
        struct ehca_qp *my_qp = container_of(ibqp, struct ehca_qp, ib_qp);
-       struct ehca_pd *my_pd = container_of(my_qp->ib_qp.pd, struct ehca_pd,
-                                            ib_pd);
-       u32 cur_pid = current->tgid;
 
-       if (my_pd->ib_pd.uobject && my_pd->ib_pd.uobject->context &&
-           my_pd->ownpid != cur_pid) {
-               ehca_err(ibqp->pd->device, "Invalid caller pid=%x ownpid=%x",
-                        cur_pid, my_pd->ownpid);
-               return -EINVAL;
+       /* The if-block below caches qp_attr to be modified for GSI and SMI
+        * qps during the initialization by ib_mad. When the respective port
+        * is activated, ie we got an event PORT_ACTIVE, we'll replay the
+        * cached modify calls sequence, see ehca_recover_sqs() below.
+        * Why that is required:
+        * 1) If one port is connected, older code requires that port one
+        *    to be connected and module option nr_ports=1 to be given by
+        *    user, which is very inconvenient for end user.
+        * 2) Firmware accepts modify_qp() only if respective port has become
+        *    active. Older code had a wait loop of 30sec create_qp()/
+        *    define_aqp1(), which is not appropriate in practice. This
+        *    code now removes that wait loop, see define_aqp1(), and always
+        *    reports all ports to ib_mad resp. users. Only activated ports
+        *    will then usable for the users.
+        */
+       if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_SMI) {
+               int port = my_qp->init_attr.port_num;
+               struct ehca_sport *sport = &shca->sport[port - 1];
+               unsigned long flags;
+               spin_lock_irqsave(&sport->mod_sqp_lock, flags);
+               /* cache qp_attr only during init */
+               if (my_qp->mod_qp_parm) {
+                       struct ehca_mod_qp_parm *p;
+                       if (my_qp->mod_qp_parm_idx >= EHCA_MOD_QP_PARM_MAX) {
+                               ehca_err(&shca->ib_device,
+                                        "mod_qp_parm overflow state=%x port=%x"
+                                        " type=%x", attr->qp_state,
+                                        my_qp->init_attr.port_num,
+                                        ibqp->qp_type);
+                               spin_unlock_irqrestore(&sport->mod_sqp_lock,
+                                                      flags);
+                               return -EINVAL;
+                       }
+                       p = &my_qp->mod_qp_parm[my_qp->mod_qp_parm_idx];
+                       p->mask = attr_mask;
+                       p->attr = *attr;
+                       my_qp->mod_qp_parm_idx++;
+                       ehca_dbg(&shca->ib_device,
+                                "Saved qp_attr for state=%x port=%x type=%x",
+                                attr->qp_state, my_qp->init_attr.port_num,
+                                ibqp->qp_type);
+                       spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
+                       goto out;
+               }
+               spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
+       }
+
+       ret = internal_modify_qp(ibqp, attr, attr_mask, 0);
+
+out:
+       if ((ret == 0) && (attr_mask & IB_QP_STATE))
+               my_qp->state = attr->qp_state;
+
+       return ret;
+}
+
+void ehca_recover_sqp(struct ib_qp *sqp)
+{
+       struct ehca_qp *my_sqp = container_of(sqp, struct ehca_qp, ib_qp);
+       int port = my_sqp->init_attr.port_num;
+       struct ib_qp_attr attr;
+       struct ehca_mod_qp_parm *qp_parm;
+       int i, qp_parm_idx, ret;
+       unsigned long flags, wr_cnt;
+
+       if (!my_sqp->mod_qp_parm)
+               return;
+       ehca_dbg(sqp->device, "SQP port=%x qp_num=%x", port, sqp->qp_num);
+
+       qp_parm = my_sqp->mod_qp_parm;
+       qp_parm_idx = my_sqp->mod_qp_parm_idx;
+       for (i = 0; i < qp_parm_idx; i++) {
+               attr = qp_parm[i].attr;
+               ret = internal_modify_qp(sqp, &attr, qp_parm[i].mask, 0);
+               if (ret) {
+                       ehca_err(sqp->device, "Could not modify SQP port=%x "
+                                "qp_num=%x ret=%x", port, sqp->qp_num, ret);
+                       goto free_qp_parm;
+               }
+               ehca_dbg(sqp->device, "SQP port=%x qp_num=%x in state=%x",
+                        port, sqp->qp_num, attr.qp_state);
+       }
+
+       /* re-trigger posted recv wrs */
+       wr_cnt =  my_sqp->ipz_rqueue.current_q_offset /
+               my_sqp->ipz_rqueue.qe_size;
+       if (wr_cnt) {
+               spin_lock_irqsave(&my_sqp->spinlock_r, flags);
+               hipz_update_rqa(my_sqp, wr_cnt);
+               spin_unlock_irqrestore(&my_sqp->spinlock_r, flags);
+               ehca_dbg(sqp->device, "doorbell port=%x qp_num=%x wr_cnt=%lx",
+                        port, sqp->qp_num, wr_cnt);
        }
 
-       return internal_modify_qp(ibqp, attr, attr_mask, 0);
+free_qp_parm:
+       kfree(qp_parm);
+       /* this prevents subsequent calls to modify_qp() to cache qp_attr */
+       my_sqp->mod_qp_parm = NULL;
 }
 
 int ehca_query_qp(struct ib_qp *qp,
@@ -1394,23 +1890,13 @@ int ehca_query_qp(struct ib_qp *qp,
                  int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
 {
        struct ehca_qp *my_qp = container_of(qp, struct ehca_qp, ib_qp);
-       struct ehca_pd *my_pd = container_of(my_qp->ib_qp.pd, struct ehca_pd,
-                                            ib_pd);
        struct ehca_shca *shca = container_of(qp->device, struct ehca_shca,
                                              ib_device);
        struct ipz_adapter_handle adapter_handle = shca->ipz_hca_handle;
        struct hcp_modify_qp_control_block *qpcb;
-       u32 cur_pid = current->tgid;
        int cnt, ret = 0;
        u64 h_ret;
 
-       if (my_pd->ib_pd.uobject  && my_pd->ib_pd.uobject->context  &&
-           my_pd->ownpid != cur_pid) {
-               ehca_err(qp->device, "Invalid caller pid=%x ownpid=%x",
-                        cur_pid, my_pd->ownpid);
-               return -EINVAL;
-       }
-
        if (qp_attr_mask & QP_ATTR_QUERY_NOT_SUPPORTED) {
                ehca_err(qp->device, "Invalid attribute mask "
                         "ehca_qp=%p qp_num=%x qp_attr_mask=%x ",
@@ -1433,7 +1919,7 @@ int ehca_query_qp(struct ib_qp *qp,
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(qp->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%lx",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp->qp_num, h_ret);
                goto query_qp_exit1;
        }
@@ -1454,7 +1940,7 @@ int ehca_query_qp(struct ib_qp *qp,
 
        qp_attr->qkey = qpcb->qkey;
        qp_attr->path_mtu = qpcb->path_mtu;
-       qp_attr->path_mig_state = qpcb->path_migration_state;
+       qp_attr->path_mig_state = qpcb->path_migration_state - 1;
        qp_attr->rq_psn = qpcb->receive_psn;
        qp_attr->sq_psn = qpcb->send_psn;
        qp_attr->min_rnr_timer = qpcb->min_rnr_nak_timer_field;
@@ -1541,7 +2027,7 @@ int ehca_query_qp(struct ib_qp *qp,
        if (qp_init_attr)
                *qp_init_attr = my_qp->init_attr;
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 
 query_qp_exit1:
@@ -1555,8 +2041,6 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
 {
        struct ehca_qp *my_qp =
                container_of(ibsrq, struct ehca_qp, ib_srq);
-       struct ehca_pd *my_pd =
-               container_of(ibsrq->pd, struct ehca_pd, ib_pd);
        struct ehca_shca *shca =
                container_of(ibsrq->pd->device, struct ehca_shca, ib_device);
        struct hcp_modify_qp_control_block *mqpcb;
@@ -1564,14 +2048,6 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
        u64 h_ret;
        int ret = 0;
 
-       u32 cur_pid = current->tgid;
-       if (my_pd->ib_pd.uobject && my_pd->ib_pd.uobject->context &&
-           my_pd->ownpid != cur_pid) {
-               ehca_err(ibsrq->pd->device, "Invalid caller pid=%x ownpid=%x",
-                        cur_pid, my_pd->ownpid);
-               return -EINVAL;
-       }
-
        mqpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
        if (!mqpcb) {
                ehca_err(ibsrq->device, "Could not get zeroed page for mqpcb "
@@ -1599,7 +2075,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                goto modify_srq_exit0;
        }
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(mqpcb, 4*70, "qp_num=%x", my_qp->real_qp_num);
 
        h_ret = hipz_h_modify_qp(shca->ipz_hca_handle, my_qp->ipz_qp_handle,
@@ -1608,7 +2084,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
 
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-               ehca_err(ibsrq->device, "hipz_h_modify_qp() failed rc=%lx "
+               ehca_err(ibsrq->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x",
                         h_ret, my_qp, my_qp->real_qp_num);
        }
@@ -1622,22 +2098,13 @@ modify_srq_exit0:
 int ehca_query_srq(struct ib_srq *srq, struct ib_srq_attr *srq_attr)
 {
        struct ehca_qp *my_qp = container_of(srq, struct ehca_qp, ib_srq);
-       struct ehca_pd *my_pd = container_of(srq->pd, struct ehca_pd, ib_pd);
        struct ehca_shca *shca = container_of(srq->device, struct ehca_shca,
                                              ib_device);
        struct ipz_adapter_handle adapter_handle = shca->ipz_hca_handle;
        struct hcp_modify_qp_control_block *qpcb;
-       u32 cur_pid = current->tgid;
        int ret = 0;
        u64 h_ret;
 
-       if (my_pd->ib_pd.uobject  && my_pd->ib_pd.uobject->context  &&
-           my_pd->ownpid != cur_pid) {
-               ehca_err(srq->device, "Invalid caller pid=%x ownpid=%x",
-                        cur_pid, my_pd->ownpid);
-               return -EINVAL;
-       }
-
        qpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
        if (!qpcb) {
                ehca_err(srq->device, "Out of memory for qpcb "
@@ -1651,16 +2118,17 @@ int ehca_query_srq(struct ib_srq *srq, struct ib_srq_attr *srq_attr)
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(srq->device, "hipz_h_query_qp() failed "
-                        "ehca_qp=%p qp_num=%x h_ret=%lx",
+                        "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, h_ret);
                goto query_srq_exit1;
        }
 
        srq_attr->max_wr = qpcb->max_nr_outst_recv_wr - 1;
+       srq_attr->max_sge = 3;
        srq_attr->srq_limit = EHCA_BMASK_GET(
                MQPCB_CURR_SRQ_LIMIT, qpcb->curr_srq_limit);
 
-       if (ehca_debug_level)
+       if (ehca_debug_level >= 2)
                ehca_dmp(qpcb, 4*70, "qp_num=%x", my_qp->real_qp_num);
 
 query_srq_exit1:
@@ -1669,39 +2137,36 @@ query_srq_exit1:
        return ret;
 }
 
-int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
-                       struct ib_uobject *uobject)
+static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
+                              struct ib_uobject *uobject)
 {
        struct ehca_shca *shca = container_of(dev, struct ehca_shca, ib_device);
        struct ehca_pd *my_pd = container_of(my_qp->ib_qp.pd, struct ehca_pd,
                                             ib_pd);
-       u32 cur_pid = current->tgid;
+       struct ehca_sport *sport = &shca->sport[my_qp->init_attr.port_num - 1];
        u32 qp_num = my_qp->real_qp_num;
        int ret;
        u64 h_ret;
        u8 port_num;
+       int is_user = 0;
        enum ib_qp_type qp_type;
        unsigned long flags;
 
        if (uobject) {
+               is_user = 1;
                if (my_qp->mm_count_galpa ||
                    my_qp->mm_count_rqueue || my_qp->mm_count_squeue) {
                        ehca_err(dev, "Resources still referenced in "
                                 "user space qp_num=%x", qp_num);
                        return -EINVAL;
                }
-               if (my_pd->ownpid != cur_pid) {
-                       ehca_err(dev, "Invalid caller pid=%x ownpid=%x",
-                                cur_pid, my_pd->ownpid);
-                       return -EINVAL;
-               }
        }
 
        if (my_qp->send_cq) {
                ret = ehca_cq_unassign_qp(my_qp->send_cq, qp_num);
                if (ret) {
                        ehca_err(dev, "Couldn't unassign qp from "
-                                "send_cq ret=%x qp_num=%x cq_num=%x", ret,
+                                "send_cq ret=%i qp_num=%x cq_num=%x", ret,
                                 qp_num, my_qp->send_cq->cq_number);
                        return ret;
                }
@@ -1711,9 +2176,22 @@ int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        idr_remove(&ehca_qp_idr, my_qp->token);
        write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
 
+       /*
+        * SRQs will never get into an error list and do not have a recv_cq,
+        * so we need to skip them here.
+        */
+       if (HAS_RQ(my_qp) && !IS_SRQ(my_qp) && !is_user)
+               del_from_err_list(my_qp->recv_cq, &my_qp->rq_err_node);
+
+       if (HAS_SQ(my_qp) && !is_user)
+               del_from_err_list(my_qp->send_cq, &my_qp->sq_err_node);
+
+       /* now wait until all pending events have completed */
+       wait_event(my_qp->wait_completion, !atomic_read(&my_qp->nr_events));
+
        h_ret = hipz_h_destroy_qp(shca->ipz_hca_handle, my_qp);
        if (h_ret != H_SUCCESS) {
-               ehca_err(dev, "hipz_h_destroy_qp() failed rc=%lx "
+               ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, qp_num);
                return ehca2ib_return_code(h_ret);
        }
@@ -1721,11 +2199,19 @@ int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        port_num = my_qp->init_attr.port_num;
        qp_type  = my_qp->init_attr.qp_type;
 
+       if (qp_type == IB_QPT_SMI || qp_type == IB_QPT_GSI) {
+               spin_lock_irqsave(&sport->mod_sqp_lock, flags);
+               kfree(my_qp->mod_qp_parm);
+               my_qp->mod_qp_parm = NULL;
+               shca->sport[port_num - 1].ibqp_sqp[qp_type] = NULL;
+               spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
+       }
+
        /* no support for IB_QPT_SMI yet */
        if (qp_type == IB_QPT_GSI) {
                struct ib_event event;
                ehca_info(dev, "device %s: port %x is inactive.",
-                         shca->ib_device.name, port_num);
+                               shca->ib_device.name, port_num);
                event.device = &shca->ib_device;
                event.event = IB_EVENT_PORT_ERR;
                event.element.port_num = port_num;
@@ -1733,11 +2219,18 @@ int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
                ib_dispatch_event(&event);
        }
 
-       if (HAS_RQ(my_qp))
-               ipz_queue_dtor(&my_qp->ipz_rqueue);
-       if (HAS_SQ(my_qp))
-               ipz_queue_dtor(&my_qp->ipz_squeue);
+       if (HAS_RQ(my_qp)) {
+               ipz_queue_dtor(my_pd, &my_qp->ipz_rqueue);
+               if (!is_user)
+                       vfree(my_qp->rq_map.map);
+       }
+       if (HAS_SQ(my_qp)) {
+               ipz_queue_dtor(my_pd, &my_qp->ipz_squeue);
+               if (!is_user)
+                       vfree(my_qp->sq_map.map);
+       }
        kmem_cache_free(qp_cache, my_qp);
+       atomic_dec(&shca->num_qps);
        return 0;
 }