#include "iwch.h"
 #include "iwch_cm.h"
 #include "cxio_hal.h"
+#include "cxio_resource.h"
 
 #define NO_SUPPORT -1
 
-static int iwch_build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
                                u8 * flit_cnt)
 {
        int i;
        return 0;
 }
 
-static int iwch_build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
                                 u8 *flit_cnt)
 {
        int i;
        return 0;
 }
 
-static int iwch_build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
                                u8 *flit_cnt)
 {
        if (wr->num_sge > 1)
        return 0;
 }
 
-static int iwch_build_fastreg(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_fastreg(union t3_wr *wqe, struct ib_send_wr *wr,
                                u8 *flit_cnt, int *wr_cnt, struct t3_wq *wq)
 {
        int i;
        return 0;
 }
 
-static int iwch_build_inv_stag(union t3_wr *wqe, struct ib_send_wr *wr,
+static int build_inv_stag(union t3_wr *wqe, struct ib_send_wr *wr,
                                u8 *flit_cnt)
 {
        wqe->local_inv.stag = cpu_to_be32(wr->ex.invalidate_rkey);
        return 0;
 }
 
-static int iwch_build_rdma_recv(struct iwch_dev *rhp, union t3_wr *wqe,
+static int build_rdma_recv(struct iwch_qp *qhp, union t3_wr *wqe,
                                struct ib_recv_wr *wr)
 {
-       int i;
-       if (wr->num_sge > T3_MAX_SGE)
-               return -EINVAL;
+       int i, err = 0;
+       u32 pbl_addr[T3_MAX_SGE];
+       u8 page_size[T3_MAX_SGE];
+
+       err = iwch_sgl2pbl_map(qhp->rhp, wr->sg_list, wr->num_sge, pbl_addr,
+                              page_size);
+       if (err)
+               return err;
+       wqe->recv.pagesz[0] = page_size[0];
+       wqe->recv.pagesz[1] = page_size[1];
+       wqe->recv.pagesz[2] = page_size[2];
+       wqe->recv.pagesz[3] = page_size[3];
        wqe->recv.num_sgle = cpu_to_be32(wr->num_sge);
        for (i = 0; i < wr->num_sge; i++) {
                wqe->recv.sgl[i].stag = cpu_to_be32(wr->sg_list[i].lkey);
                wqe->recv.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
+
+               /* to in the WQE == the offset into the page */
+               wqe->recv.sgl[i].to = cpu_to_be64(((u32) wr->sg_list[i].addr) %
+                               (1UL << (12 + page_size[i])));
+
+               /* pbl_addr is the adapters address in the PBL */
+               wqe->recv.pbl_addr[i] = cpu_to_be32(pbl_addr[i]);
+       }
+       for (; i < T3_MAX_SGE; i++) {
+               wqe->recv.sgl[i].stag = 0;
+               wqe->recv.sgl[i].len = 0;
+               wqe->recv.sgl[i].to = 0;
+               wqe->recv.pbl_addr[i] = 0;
+       }
+       qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                            qhp->wq.rq_size_log2)].wr_id = wr->wr_id;
+       qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                            qhp->wq.rq_size_log2)].pbl_addr = 0;
+       return 0;
+}
+
+static int build_zero_stag_recv(struct iwch_qp *qhp, union t3_wr *wqe,
+                               struct ib_recv_wr *wr)
+{
+       int i;
+       u32 pbl_addr;
+       u32 pbl_offset;
+
+
+       /*
+        * The T3 HW requires the PBL in the HW recv descriptor to reference
+        * a PBL entry.  So we allocate the max needed PBL memory here and pass
+        * it to the uP in the recv WR.  The uP will build the PBL and setup
+        * the HW recv descriptor.
+        */
+       pbl_addr = cxio_hal_pblpool_alloc(&qhp->rhp->rdev, T3_STAG0_PBL_SIZE);
+       if (!pbl_addr)
+               return -ENOMEM;
+
+       /*
+        * Compute the 8B aligned offset.
+        */
+       pbl_offset = (pbl_addr - qhp->rhp->rdev.rnic_info.pbl_base) >> 3;
+
+       wqe->recv.num_sgle = cpu_to_be32(wr->num_sge);
+
+       for (i = 0; i < wr->num_sge; i++) {
+
+               /*
+                * Use a 128MB page size. This and an imposed 128MB
+                * sge length limit allows us to require only a 2-entry HW
+                * PBL for each SGE.  This restriction is acceptable since
+                * since it is not possible to allocate 128MB of contiguous
+                * DMA coherent memory!
+                */
+               if (wr->sg_list[i].length > T3_STAG0_MAX_PBE_LEN)
+                       return -EINVAL;
+               wqe->recv.pagesz[i] = T3_STAG0_PAGE_SHIFT;
+
+               /*
+                * T3 restricts a recv to all zero-stag or all non-zero-stag.
+                */
+               if (wr->sg_list[i].lkey != 0)
+                       return -EINVAL;
+               wqe->recv.sgl[i].stag = 0;
+               wqe->recv.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
                wqe->recv.sgl[i].to = cpu_to_be64(wr->sg_list[i].addr);
+               wqe->recv.pbl_addr[i] = cpu_to_be32(pbl_offset);
+               pbl_offset += 2;
        }
        for (; i < T3_MAX_SGE; i++) {
+               wqe->recv.pagesz[i] = 0;
                wqe->recv.sgl[i].stag = 0;
                wqe->recv.sgl[i].len = 0;
                wqe->recv.sgl[i].to = 0;
+               wqe->recv.pbl_addr[i] = 0;
        }
+       qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                            qhp->wq.rq_size_log2)].wr_id = wr->wr_id;
+       qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr,
+                            qhp->wq.rq_size_log2)].pbl_addr = pbl_addr;
        return 0;
 }
 
                        if (wr->send_flags & IB_SEND_FENCE)
                                t3_wr_flags |= T3_READ_FENCE_FLAG;
                        t3_wr_opcode = T3_WR_SEND;
-                       err = iwch_build_rdma_send(wqe, wr, &t3_wr_flit_cnt);
+                       err = build_rdma_send(wqe, wr, &t3_wr_flit_cnt);
                        break;
                case IB_WR_RDMA_WRITE:
                case IB_WR_RDMA_WRITE_WITH_IMM:
                        t3_wr_opcode = T3_WR_WRITE;
-                       err = iwch_build_rdma_write(wqe, wr, &t3_wr_flit_cnt);
+                       err = build_rdma_write(wqe, wr, &t3_wr_flit_cnt);
                        break;
                case IB_WR_RDMA_READ:
                case IB_WR_RDMA_READ_WITH_INV:
                        t3_wr_opcode = T3_WR_READ;
                        t3_wr_flags = 0; /* T3 reads are always signaled */
-                       err = iwch_build_rdma_read(wqe, wr, &t3_wr_flit_cnt);
+                       err = build_rdma_read(wqe, wr, &t3_wr_flit_cnt);
                        if (err)
                                break;
                        sqp->read_len = wqe->read.local_len;
                        break;
                case IB_WR_FAST_REG_MR:
                        t3_wr_opcode = T3_WR_FASTREG;
-                       err = iwch_build_fastreg(wqe, wr, &t3_wr_flit_cnt,
+                       err = build_fastreg(wqe, wr, &t3_wr_flit_cnt,
                                                 &wr_cnt, &qhp->wq);
                        break;
                case IB_WR_LOCAL_INV:
                        if (wr->send_flags & IB_SEND_FENCE)
                                t3_wr_flags |= T3_LOCAL_FENCE_FLAG;
                        t3_wr_opcode = T3_WR_INV_STAG;
-                       err = iwch_build_inv_stag(wqe, wr, &t3_wr_flit_cnt);
+                       err = build_inv_stag(wqe, wr, &t3_wr_flit_cnt);
                        break;
                default:
                        PDBG("%s post of type=%d TBD!\n", __func__,
                return -EINVAL;
        }
        while (wr) {
+               if (wr->num_sge > T3_MAX_SGE) {
+                       err = -EINVAL;
+                       *bad_wr = wr;
+                       break;
+               }
                idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
                wqe = (union t3_wr *) (qhp->wq.queue + idx);
                if (num_wrs)
-                       err = iwch_build_rdma_recv(qhp->rhp, wqe, wr);
+                       if (wr->sg_list[0].lkey)
+                               err = build_rdma_recv(qhp, wqe, wr);
+                       else
+                               err = build_zero_stag_recv(qhp, wqe, wr);
                else
                        err = -ENOMEM;
                if (err) {
                        *bad_wr = wr;
                        break;
                }
-               qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr, qhp->wq.rq_size_log2)] =
-                       wr->wr_id;
                build_fw_riwrh((void *) wqe, T3_WR_RCV, T3_COMPLETION_FLAG,
                               Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
                               0, sizeof(struct t3_receive_wr) >> 3, T3_SOPEOP);
        init_attr.qp_dma_size = (1UL << qhp->wq.size_log2);
        init_attr.rqe_count = iwch_rqes_posted(qhp);
        init_attr.flags = qhp->attr.mpa_attr.initiator ? MPA_INITIATOR : 0;
-       init_attr.flags |= capable(CAP_NET_BIND_SERVICE) ? PRIV_QP : 0;
+       if (!qhp->ibqp.uobject)
+               init_attr.flags |= PRIV_QP;
        if (peer2peer) {
                init_attr.rtr_type = RTR_READ;
                if (init_attr.ord == 0 && qhp->attr.mpa_attr.initiator)