diff --git a/drivers/infiniband/hw/erdma/erdma_cq.c b/drivers/infiniband/hw/erdma/erdma_cq.c
index e51faa2b8993e2f5197851b95f4be3c6a2d41644..075568645fb82780231e88c28c3ad55c1d28d4fa 100644
--- a/drivers/infiniband/hw/erdma/erdma_cq.c
+++ b/drivers/infiniband/hw/erdma/erdma_cq.c
@@ -160,10 +160,6 @@ static int erdma_poll_one_cqe(struct erdma_cq *cq, struct ib_wc *wc)
 	} else {
 		id_table = kern_qp->rwr_tbl;
 		depth = qp->attrs.rq_size;
-		/* Prevent rqe out of range from HW */
-		if (kern_qp->rq_pi - wqe_idx == 0 ||
-		    (u16)(kern_qp->rq_pi - wqe_idx) > depth)
-			syndrome = ERDMA_WC_GENERAL_ERR;
 	}
 	wc->wr_id = id_table[wqe_idx & (depth - 1)];
 	wc->byte_len = be32_to_cpu(cqe->size);
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 9981774672c514393ab663c73f1efc7fbf346339..35cc99608d74f8c04d2fb9913ef5920e62ddb6b3 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -153,6 +153,9 @@ enum CMDQ_COMMON_OPCODE {
 	CMDQ_OPCODE_GET_STATS = 4,
 	CMDQ_OPCODE_QUERY_EQC = 6,
 	CMDQ_OPCODE_SET_RETRANS_NUM = 7,
+
+	CMDQ_OPCODE_SET_EXT_ATTR = 10,
+	CMDQ_OPCODE_GET_EXT_ATTR = 11,
 };
 
 /* cmdq-SQE HDR */
@@ -200,6 +203,13 @@ struct erdma_cmdq_set_retrans_num_req {
 	u32 retrans_num;
 };
 
+#define ERDMA_CMDQ_SET_EXT_ATTR_DACK_COUNT_MASK BIT(0)
+struct erdma_cmdq_set_ext_attr_req {
+	u64 hdr;
+	u32 attr_mask;
+	u8 dack_count;
+};
+
 /* create_cq cfg0 */
 #define ERDMA_CMD_CREATE_CQ_DEPTH_MASK GENMASK(31, 24)
 #define ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK GENMASK(23, 20)
@@ -691,6 +701,15 @@ struct erdma_cmdq_query_eqc_resp {
 	u64 eq_db_record;
 };
 
+struct erdma_cmdq_query_ext_attr_resp {
+	struct erdma_cmdq_query_resp_hdr hdr;
+
+	u32 cap_mask;
+	u32 attr_mask;
+
+	u8 dack_count;
+};
+
 struct erdma_cmdq_dump_addr_req {
 	u64 hdr;
 	u64 dump_addr;
diff --git a/drivers/infiniband/hw/erdma/erdma_ioctl.c b/drivers/infiniband/hw/erdma/erdma_ioctl.c
index af4d8e5df99b027088b65c7e1b008282e15d23d0..4491fcc659c2815b63a8e24f4df2f253d428fd28 100644
--- a/drivers/infiniband/hw/erdma/erdma_ioctl.c
+++ b/drivers/infiniband/hw/erdma/erdma_ioctl.c
@@ -21,6 +21,37 @@ static dev_t erdma_char_dev;
 
 #define ERDMA_CHRDEV_NAME "erdma"
 
+int erdma_set_ext_attr(struct erdma_dev *dev, struct erdma_ext_attr *attr)
+{
+	struct erdma_cmdq_set_ext_attr_req req;
+	int ret;
+
+	erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_COMMON,
+				CMDQ_OPCODE_SET_EXT_ATTR);
+
+	if (attr->attr_mask & ERDMA_EXT_ATTR_DACK_COUNT_MASK)
+		req.dack_count = attr->dack_count;
+
+	req.attr_mask = attr->attr_mask;
+
+	ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+
+	return ret;
+}
+
+int erdma_set_dack_count(struct erdma_dev *dev, u32 value)
+{
+	struct erdma_ext_attr attr;
+
+	if (value > 0xff)
+		return -EINVAL;
+
+	attr.attr_mask = ERDMA_EXT_ATTR_DACK_COUNT_MASK;
+	attr.dack_count = (u8)value;
+
+	return erdma_set_ext_attr(dev, &attr);
+}
+
 static int erdma_query_resource(struct erdma_dev *dev, u32 mod, u32 op,
 				u32 index, void *out, u32 len)
 {
@@ -82,6 +113,16 @@ static int erdma_query_eqc(struct erdma_dev *dev, u32 eqn, void *out)
 				    sizeof(struct erdma_cmdq_query_eqc_resp));
 }
 
+static int erdma_query_ext_attr(struct erdma_dev *dev, void *out)
+{
+	BUILD_BUG_ON(sizeof(struct erdma_cmdq_query_ext_attr_resp) >
+		     ERDMA_HW_RESP_SIZE);
+
+	return erdma_query_resource(dev, CMDQ_SUBMOD_COMMON,
+				    CMDQ_OPCODE_GET_EXT_ATTR, 0, out,
+				    sizeof(struct erdma_cmdq_query_ext_attr_resp));
+}
+
 static int erdma_ioctl_conf_cmd(struct erdma_dev *edev,
 				struct erdma_ioctl_msg *msg)
 {
@@ -97,6 +138,11 @@ static int erdma_ioctl_conf_cmd(struct erdma_dev *edev,
 			ret = erdma_set_retrans_num(edev, msg->in.config_req.value);
 		else
 			msg->out.config_resp.value = edev->attrs.retrans_num;
+	} else if (msg->in.opcode == ERDMA_CONFIG_TYPE_DACK_COUNT) {
+		if (msg->in.config_req.is_set)
+			ret = erdma_set_dack_count(edev, msg->in.config_req.value);
+		else
+			ret = -EINVAL;
 	}
 
 	msg->out.length = 4;
@@ -167,7 +213,6 @@ static int fill_cq_info(struct erdma_dev *dev, u32 cqn,
 	struct erdma_cmdq_query_cqc_resp resp;
 	struct rdma_restrack_entry *res;
 	struct erdma_cq *cq;
-	struct erdma_mem *mtt;
 	int ret;
 
 	if (cqn == 0) {
@@ -192,17 +237,16 @@ static int fill_cq_info(struct erdma_dev *dev, u32 cqn,
 
 	res = &cq->ibcq.res;
 	info->is_user = !rdma_is_kernel_res(res);
-	mtt = info->is_user ? &cq->user_cq.qbuf_mtt :
-			      &cq->kern_cq.qbuf_mtt;
-
-	info->mtt.page_size = mtt->page_size;
-	info->mtt.page_offset = mtt->page_offset;
-	info->mtt.page_cnt = mtt->page_cnt;
-	info->mtt.mtt_nents = mtt->mtt_nents;
-	info->mtt.va = mtt->va;
-	info->mtt.len = mtt->len;
 
-	if (!info->is_user) {
+	if (info->is_user) {
+		info->mtt.page_size = cq->user_cq.qbuf_mtt.page_size;
+		info->mtt.page_offset = cq->user_cq.qbuf_mtt.page_offset;
+		info->mtt.page_cnt = cq->user_cq.qbuf_mtt.page_cnt;
+		info->mtt.mtt_nents = cq->user_cq.qbuf_mtt.mtt_nents;
+		info->mtt.va = cq->user_cq.qbuf_mtt.va;
+		info->mtt.len = cq->user_cq.qbuf_mtt.len;
+	} else {
+		info->qbuf_dma_addr = cq->kern_cq.qbuf_dma_addr;
 		info->ci = cq->kern_cq.ci;
 		info->cmdsn = cq->kern_cq.cmdsn;
 		info->notify_cnt = cq->kern_cq.notify_cnt;
@@ -230,6 +274,23 @@ static int fill_cq_info(struct erdma_dev *dev, u32 cqn,
 	return 0;
 }
 
+static int fill_ext_attr_info(struct erdma_dev *dev,
+			struct erdma_ioctl_msg *msg)
+{
+	struct erdma_ext_attr_info *info = &msg->out.ext_attr_info;
+	struct erdma_cmdq_query_ext_attr_resp resp;
+	int ret = 0;
+
+	ret = erdma_query_ext_attr(dev, &resp);
+
+	info->cap = dev->attrs.cap_flags;
+	info->ext_cap = resp.cap_mask;
+	info->attr_mask = resp.attr_mask;
+	info->dack_count = resp.dack_count;
+
+	return ret;
+}
+
 static int erdma_ioctl_ver_cmd(struct erdma_dev *edev,
 			       struct erdma_ioctl_msg *msg)
 {
@@ -244,7 +305,7 @@ static int erdma_fill_qp_info(struct erdma_dev *dev, u32 qpn,
 {
 	struct erdma_cmdq_query_qpc_resp resp;
 	struct rdma_restrack_entry *res;
-	struct erdma_mem *sq_mtt, *rq_mtt;
+	struct erdma_mem *mtt;
 	struct erdma_qp *qp;
 	int ret;
 
@@ -301,32 +362,29 @@ static int erdma_fill_qp_info(struct erdma_dev *dev, u32 qpn,
 	if (qp_info->is_user) {
 		qp_info->pid = res->task->pid;
 		get_task_comm(qp_info->buf, res->task);
-	}
-	sq_mtt = qp_info->is_user ? &qp->user_qp.sq_mtt :
-				    &qp->kern_qp.sq_mtt;
-
-	qp_info->sq_mtt.page_size = sq_mtt->page_size;
-	qp_info->sq_mtt.page_offset = sq_mtt->page_offset;
-	qp_info->sq_mtt.page_cnt = sq_mtt->page_cnt;
-	qp_info->sq_mtt.mtt_nents = sq_mtt->mtt_nents;
-	qp_info->sq_mtt.va = sq_mtt->va;
-	qp_info->sq_mtt.len = sq_mtt->len;
-
-	rq_mtt = qp_info->is_user ? &qp->user_qp.rq_mtt :
-				    &qp->kern_qp.rq_mtt;
-
-	qp_info->rq_mtt.page_size = rq_mtt->page_size;
-	qp_info->rq_mtt.page_offset = rq_mtt->page_offset;
-	qp_info->rq_mtt.page_cnt = rq_mtt->page_cnt;
-	qp_info->rq_mtt.mtt_nents = rq_mtt->mtt_nents;
-	qp_info->rq_mtt.va = rq_mtt->va;
-	qp_info->rq_mtt.len = rq_mtt->len;
-
-	if (!qp_info->is_user) {
+		mtt = &qp->user_qp.sq_mtt;
+		qp_info->sq_mtt.page_size = mtt->page_size;
+		qp_info->sq_mtt.page_offset = mtt->page_offset;
+		qp_info->sq_mtt.page_cnt = mtt->page_cnt;
+		qp_info->sq_mtt.mtt_nents = mtt->mtt_nents;
+		qp_info->sq_mtt.va = mtt->va;
+		qp_info->sq_mtt.len = mtt->len;
+
+		mtt = &qp->user_qp.rq_mtt;
+		qp_info->rq_mtt.page_size = mtt->page_size;
+		qp_info->rq_mtt.page_offset = mtt->page_offset;
+		qp_info->rq_mtt.page_cnt = mtt->page_cnt;
+		qp_info->rq_mtt.mtt_nents = mtt->mtt_nents;
+		qp_info->rq_mtt.va = mtt->va;
+		qp_info->rq_mtt.len = mtt->len;
+	} else {
 		qp_info->sqci = qp->kern_qp.sq_ci;
 		qp_info->sqpi = qp->kern_qp.sq_pi;
 		qp_info->rqci = qp->kern_qp.rq_ci;
 		qp_info->rqpi = qp->kern_qp.rq_pi;
+
+		qp_info->sqbuf_dma = qp->kern_qp.sq_buf_dma_addr;
+		qp_info->rqbuf_dma = qp->kern_qp.rq_buf_dma_addr;
 		qp_info->sqdbrec_dma = qp->kern_qp.sq_db_info_dma_addr;
 		qp_info->rqdbrec_dma = qp->kern_qp.rq_db_info_dma_addr;
 	}
@@ -447,6 +505,9 @@ static int erdma_ioctl_info_cmd(struct erdma_dev *edev,
 	case ERDMA_INFO_TYPE_CQ:
 		ret = fill_cq_info(edev, msg->in.info_req.qn, msg);
 		break;
+	case ERDMA_INFO_TYPE_EXT_ATTR:
+		ret = fill_ext_attr_info(edev, msg);
+		break;
 	default:
 		pr_info("unknown opcode:%u\n", msg->in.opcode);
 		return -EINVAL;
diff --git a/drivers/infiniband/hw/erdma/erdma_ioctl.h b/drivers/infiniband/hw/erdma/erdma_ioctl.h
index 505f1b3f592d393203f7b1192099e2afdafeba8d..beb8491df58a6d2cf32f093ab1f11717c8e56d82 100644
--- a/drivers/infiniband/hw/erdma/erdma_ioctl.h
+++ b/drivers/infiniband/hw/erdma/erdma_ioctl.h
@@ -55,6 +55,7 @@ enum erdma_info_type {
 	ERDMA_INFO_TYPE_CQ,
 	ERDMA_INFO_TYPE_EQ,
 	ERDMA_INFO_TYPE_CEP,
+	ERDMA_INFO_TYPE_EXT_ATTR,
 	ERDMA_INFO_TYPE_MAX,
 };
 
@@ -62,6 +63,7 @@ enum erdma_config_type {
 	ERDMA_CONFIG_TYPE_CC = 0,
 	ERDMA_CONFIG_TYPE_DISCARD0,
 	ERDMA_CONFIG_TYPE_RETRANS_NUM,
+	ERDMA_CONFIG_TYPE_DACK_COUNT,
 	ERDMA_CONFIG_MAX
 };
 
@@ -240,6 +242,14 @@ struct erdma_eq_info {
 
 };
 
+struct erdma_ext_attr_info {
+	__u8 cap;
+	__u8 rsvd[3];
+	__u32 ext_cap;
+	__u32 attr_mask;
+	__u8 dack_count;
+};
+
 struct erdma_ioctl_inbuf {
 	__u32 opcode;
 	char ibdev_name[ERDMA_DEVICE_NAME_MAX_LEN + 1];
@@ -279,6 +289,7 @@ struct erdma_ioctl_outbuf {
 		/* 0: AEQ, 1: Cmd-EQ, 2-32: Completion-EQ */
 		struct erdma_eq_info eq_info[33];
 		struct erdma_cq_info cq_info;
+		struct erdma_ext_attr_info ext_attr_info;
 
 		__u32 version;
 		__u64 stats[512];
@@ -290,6 +301,12 @@ struct erdma_ioctl_msg {
 	struct erdma_ioctl_outbuf out;
 };
 
+#define ERDMA_EXT_ATTR_DACK_COUNT_MASK BIT(0)
+struct erdma_ext_attr {
+	u32 attr_mask;
+	u8 dack_count;
+};
+
 /* 定义幻数 */
 #define ERDMA_IOC_MAGIC  'k'
 
diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c
index ad2fe518400d48d61c06f735d409e1c9e6b2a936..e7282279a629ae80bae1320f1b5c60a4ef68be18 100644
--- a/drivers/infiniband/hw/erdma/erdma_qp.c
+++ b/drivers/infiniband/hw/erdma/erdma_qp.c
@@ -53,12 +53,12 @@ static int erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
 					struct erdma_qp_attrs *attrs,
 					enum erdma_qp_attr_mask mask)
 {
+	int ret;
 	struct erdma_dev *dev = qp->dev;
 	struct erdma_cmdq_modify_qp_req req;
 	struct tcp_sock *tp;
 	struct erdma_cep *cep = qp->cep;
 	struct sockaddr_storage local_addr, remote_addr;
-	int ret;
 
 	if (qp->attrs.connect_without_cm) {
 		req.cookie = FIELD_PREP(ERDMA_CMD_MODIFY_QP_IW_OOB_MASK, 1) |
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 5631d95ba52fe06c2ee7d619d14f2055723be388..d016b9fbb08fe6d3cc405c9b972f43e3371fb9ef 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -27,8 +27,6 @@ bool rand_qpn;
 module_param(rand_qpn, bool, 0444);
 MODULE_PARM_DESC(rand_qpn, "randomized qpn");
 
-extern bool compat_mode;
-
 static void assemble_qbuf_mtt_for_cmd(struct erdma_mem *mtt, u32 *cfg,
 				      u64 *addr0, u64 *addr1)
 {
@@ -46,41 +44,12 @@ static void assemble_qbuf_mtt_for_cmd(struct erdma_mem *mtt, u32 *cfg,
 	}
 }
 
-static void create_qp_mtt_cfg(struct erdma_cmdq_create_qp_req *req,
-			      struct erdma_mem *sq_mtt, struct erdma_mem *rq_mtt,
-			      u32 scqn, u32 rcqn)
-{
-	req->sq_cqn_mtt_cfg = FIELD_PREP(
-		ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
-		ilog2(sq_mtt->page_size) - ERDMA_HW_PAGE_SHIFT);
-	req->sq_cqn_mtt_cfg |=
-		FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, scqn);
-
-	req->rq_cqn_mtt_cfg = FIELD_PREP(
-		ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
-		ilog2(rq_mtt->page_size) - ERDMA_HW_PAGE_SHIFT);
-	req->rq_cqn_mtt_cfg |=
-		FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, rcqn);
-
-	req->sq_mtt_cfg = sq_mtt->page_offset;
-	req->sq_mtt_cfg |= FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_CNT_MASK,
-				      sq_mtt->mtt_nents);
-
-	req->rq_mtt_cfg = rq_mtt->page_offset;
-	req->rq_mtt_cfg |= FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_CNT_MASK,
-				      rq_mtt->mtt_nents);
-
-	assemble_qbuf_mtt_for_cmd(sq_mtt, &req->sq_mtt_cfg,
-				  &req->sq_buf_addr, req->sq_mtt_entry);
-	assemble_qbuf_mtt_for_cmd(rq_mtt, &req->rq_mtt_cfg,
-				  &req->rq_buf_addr, req->rq_mtt_entry);
-}
-
 static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp,
 			 bool is_user)
 {
 	struct erdma_pd *pd = to_epd(qp->ibqp.pd);
 	struct erdma_cmdq_create_qp_req req;
+	struct erdma_uqp *user_qp;
 	u64 resp0, resp1;
 	int err;
 
@@ -94,14 +63,59 @@ static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp,
 			      ilog2(qp->attrs.rq_size)) |
 		   FIELD_PREP(ERDMA_CMD_CREATE_QP_PD_MASK, pd->pdn);
 
-	create_qp_mtt_cfg(&req, is_user ? &qp->user_qp.sq_mtt : &qp->kern_qp.sq_mtt,
-			  is_user ? &qp->user_qp.rq_mtt : &qp->kern_qp.rq_mtt,
-			  qp->scq->cqn, qp->rcq->cqn);
+	if (!is_user) {
+		u32 pgsz_range = ilog2(SZ_1M) - ERDMA_HW_PAGE_SHIFT;
+
+		req.sq_cqn_mtt_cfg =
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+				   pgsz_range) |
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->scq->cqn);
+		req.rq_cqn_mtt_cfg =
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+				   pgsz_range) |
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->rcq->cqn);
+
+		req.sq_mtt_cfg =
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_PAGE_OFFSET_MASK, 0) |
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_CNT_MASK, 1) |
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_TYPE_MASK,
+				   ERDMA_MR_INLINE_MTT);
+		req.rq_mtt_cfg = req.sq_mtt_cfg;
+
+		req.rq_buf_addr = qp->kern_qp.rq_buf_dma_addr;
+		req.sq_buf_addr = qp->kern_qp.sq_buf_dma_addr;
+		req.sq_db_info_dma_addr = qp->kern_qp.sq_db_info_dma_addr;
+		req.rq_db_info_dma_addr = qp->kern_qp.rq_db_info_dma_addr;
+	} else {
+		user_qp = &qp->user_qp;
+		req.sq_cqn_mtt_cfg = FIELD_PREP(
+			ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+			ilog2(user_qp->sq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT);
+		req.sq_cqn_mtt_cfg |=
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->scq->cqn);
+
+		req.rq_cqn_mtt_cfg = FIELD_PREP(
+			ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+			ilog2(user_qp->rq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT);
+		req.rq_cqn_mtt_cfg |=
+			FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->rcq->cqn);
+
+		req.sq_mtt_cfg = user_qp->sq_mtt.page_offset;
+		req.sq_mtt_cfg |= FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_CNT_MASK,
+					     user_qp->sq_mtt.mtt_nents);
+
+		req.rq_mtt_cfg = user_qp->rq_mtt.page_offset;
+		req.rq_mtt_cfg |= FIELD_PREP(ERDMA_CMD_CREATE_QP_MTT_CNT_MASK,
+					     user_qp->rq_mtt.mtt_nents);
 
-	req.sq_db_info_dma_addr = is_user ? qp->user_qp.sq_db_info_dma_addr :
-					    qp->kern_qp.sq_db_info_dma_addr;
-	req.rq_db_info_dma_addr = is_user ? qp->user_qp.rq_db_info_dma_addr :
-					    qp->kern_qp.rq_db_info_dma_addr;
+		assemble_qbuf_mtt_for_cmd(&user_qp->sq_mtt, &req.sq_mtt_cfg,
+					  &req.sq_buf_addr, req.sq_mtt_entry);
+		assemble_qbuf_mtt_for_cmd(&user_qp->rq_mtt, &req.rq_mtt_cfg,
+					  &req.rq_buf_addr, req.rq_mtt_entry);
+
+		req.sq_db_info_dma_addr = user_qp->sq_db_info_dma_addr;
+		req.rq_db_info_dma_addr = user_qp->rq_db_info_dma_addr;
+	}
 
 	err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
 				  &resp1);
@@ -180,8 +194,8 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq,
 			 bool is_user)
 {
 	struct erdma_cmdq_create_cq_req req;
-	struct erdma_mem *mtt = is_user ? &cq->user_cq.qbuf_mtt :
-					  &cq->kern_cq.qbuf_mtt;
+	struct erdma_mem *mtt;
+	u32 page_size;
 
 	erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
 				CMDQ_OPCODE_CREATE_CQ);
@@ -190,25 +204,44 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq,
 		   FIELD_PREP(ERDMA_CMD_CREATE_CQ_DEPTH_MASK, ilog2(cq->depth));
 	req.cfg1 = FIELD_PREP(ERDMA_CMD_CREATE_CQ_EQN_MASK, cq->assoc_eqn);
 
-	req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
-			ilog2(mtt->page_size) - ERDMA_HW_PAGE_SHIFT);
-	if (mtt->mtt_nents == 1) {
-		req.qbuf_addr_l = lower_32_bits(mtt->pbl->buf[0]);
-		req.qbuf_addr_h = upper_32_bits(mtt->pbl->buf[0]);
-		req.cfg1 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_TYPE_MASK,
+	if (!is_user) {
+		page_size = SZ_32M;
+		req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
+				       ilog2(page_size) - ERDMA_HW_PAGE_SHIFT);
+		req.qbuf_addr_l = lower_32_bits(cq->kern_cq.qbuf_dma_addr);
+		req.qbuf_addr_h = upper_32_bits(cq->kern_cq.qbuf_dma_addr);
+
+		req.cfg1 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_CNT_MASK, 1) |
+			    FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_TYPE_MASK,
 				       ERDMA_MR_INLINE_MTT);
+
+		req.first_page_offset = 0;
+		req.cq_db_info_addr =
+			cq->kern_cq.qbuf_dma_addr + (cq->depth << CQE_SHIFT);
 	} else {
-		req.qbuf_addr_l = lower_32_bits(mtt->pbl->buf_dma);
-		req.qbuf_addr_h = upper_32_bits(mtt->pbl->buf_dma);
-		req.cfg1 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_TYPE_MASK,
-				       ERDMA_MR_INDIRECT_MTT);
-	}
-	req.cfg1 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_CNT_MASK,
-			       mtt->mtt_nents);
+		mtt = &cq->user_cq.qbuf_mtt;
+		req.cfg0 |=
+			FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
+				   ilog2(mtt->page_size) - ERDMA_HW_PAGE_SHIFT);
+		if (mtt->mtt_nents == 1) {
+			req.qbuf_addr_l = lower_32_bits(mtt->pbl->buf[0]);
+			req.qbuf_addr_h = upper_32_bits(mtt->pbl->buf[0]);
+			req.cfg1 |=
+				FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_TYPE_MASK,
+					   ERDMA_MR_INLINE_MTT);
+		} else {
+			req.qbuf_addr_l = lower_32_bits(mtt->pbl->buf_dma);
+			req.qbuf_addr_h = upper_32_bits(mtt->pbl->buf_dma);
+			req.cfg1 |=
+				FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_TYPE_MASK,
+					   ERDMA_MR_INDIRECT_MTT);
+		}
+		req.cfg1 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_MTT_CNT_MASK,
+				       mtt->mtt_nents);
 
-	req.first_page_offset = mtt->page_offset;
-	req.cq_db_info_addr = is_user ? cq->user_cq.db_info_dma_addr :
-					cq->kern_cq.db_info_dma_addr;
+		req.first_page_offset = mtt->page_offset;
+		req.cq_db_info_addr = cq->user_cq.db_info_dma_addr;
+	}
 
 	return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
 }
@@ -464,6 +497,34 @@ static int erdma_qp_validate_attr(struct erdma_dev *dev,
 	return 0;
 }
 
+static void free_kernel_qp(struct erdma_qp *qp)
+{
+	struct erdma_dev *dev = qp->dev;
+
+	vfree(qp->kern_qp.swr_tbl);
+	vfree(qp->kern_qp.rwr_tbl);
+
+	if (qp->kern_qp.sq_buf)
+		dma_free_coherent(&dev->pdev->dev,
+				  qp->attrs.sq_size << SQEBB_SHIFT,
+				  qp->kern_qp.sq_buf,
+				  qp->kern_qp.sq_buf_dma_addr);
+
+	if (qp->kern_qp.rq_buf)
+		dma_free_coherent(&dev->pdev->dev,
+				  qp->attrs.rq_size << RQE_SHIFT,
+				  qp->kern_qp.rq_buf,
+				  qp->kern_qp.rq_buf_dma_addr);
+
+	if (qp->kern_qp.sq_db_info)
+		dma_pool_free(dev->db_pool, qp->kern_qp.sq_db_info,
+			      qp->kern_qp.sq_db_info_dma_addr);
+
+	if (qp->kern_qp.rq_db_info)
+		dma_pool_free(dev->db_pool, qp->kern_qp.rq_db_info,
+			      qp->kern_qp.rq_db_info_dma_addr);
+}
+
 static int update_kernel_qp_oob_attr(struct erdma_qp *qp, struct ib_qp_attr *attr, int attr_mask)
 {
 	struct iw_ext_conn_param *param =
@@ -499,6 +560,83 @@ static int update_kernel_qp_oob_attr(struct erdma_qp *qp, struct ib_qp_attr *att
 	return 0;
 }
 
+static int init_kernel_qp(struct erdma_dev *dev, struct erdma_qp *qp,
+			  struct ib_qp_init_attr *attrs)
+{
+	struct erdma_kqp *kqp = &qp->kern_qp;
+	int ret = -ENOMEM;
+
+	if (attrs->sq_sig_type == IB_SIGNAL_ALL_WR)
+		kqp->sig_all = 1;
+
+	kqp->sq_pi = 0;
+	kqp->sq_ci = 0;
+	kqp->rq_pi = 0;
+	kqp->rq_ci = 0;
+	kqp->hw_sq_db = dev->func_bar +
+			(ERDMA_SDB_SHARED_PAGE_INDEX << ERDMA_HW_PAGE_SHIFT);
+	kqp->hw_rq_db = dev->func_bar + ERDMA_BAR_RQDB_SPACE_OFFSET;
+
+	kqp->swr_tbl = vmalloc(qp->attrs.sq_size * sizeof(u64));
+	kqp->rwr_tbl = vmalloc(qp->attrs.rq_size * sizeof(u64));
+	if (!kqp->swr_tbl || !kqp->rwr_tbl)
+		goto err_out;
+
+	kqp->sq_buf = dma_alloc_coherent(&dev->pdev->dev,
+					 qp->attrs.sq_size << SQEBB_SHIFT,
+					 &kqp->sq_buf_dma_addr, GFP_KERNEL);
+	if (!kqp->sq_buf)
+		goto err_out;
+
+	kqp->rq_buf = dma_alloc_coherent(&dev->pdev->dev,
+					 qp->attrs.rq_size << RQE_SHIFT,
+					 &kqp->rq_buf_dma_addr, GFP_KERNEL);
+	if (!kqp->rq_buf)
+		goto err_out;
+
+	kqp->sq_db_info = dma_pool_alloc(dev->db_pool, GFP_KERNEL,
+					 &kqp->sq_db_info_dma_addr);
+	if (!kqp->sq_db_info)
+		goto err_out;
+
+	kqp->rq_db_info = dma_pool_alloc(dev->db_pool, GFP_KERNEL,
+					 &kqp->rq_db_info_dma_addr);
+	if (!kqp->rq_db_info)
+		goto err_out;
+
+	if (attrs->create_flags & IB_QP_CREATE_IWARP_WITHOUT_CM) {
+		struct iw_ext_conn_param *param =
+			(struct iw_ext_conn_param *)(attrs->qp_context);
+
+		if (param == NULL) {
+			ret = -EINVAL;
+			goto err_out;
+		}
+		if (param->sk_addr.family != PF_INET) {
+			ibdev_err_ratelimited(
+				&dev->ibdev,
+				"IPv4 address is required for connection without CM.\n");
+			ret = -EINVAL;
+			goto err_out;
+		}
+		qp->attrs.connect_without_cm = true;
+		((struct sockaddr_in *)&qp->attrs.raddr)->sin_family = AF_INET;
+		((struct sockaddr_in *)&qp->attrs.laddr)->sin_family = AF_INET;
+		qp->attrs.raddr.in.sin_addr.s_addr = param->sk_addr.daddr_v4;
+		qp->attrs.laddr.in.sin_addr.s_addr = param->sk_addr.saddr_v4;
+		qp->attrs.dport = ntohs(param->sk_addr.dport);
+		qp->attrs.sport = param->sk_addr.sport;
+	}
+	spin_lock_init(&kqp->sq_lock);
+	spin_lock_init(&kqp->rq_lock);
+
+	return 0;
+
+err_out:
+	free_kernel_qp(qp);
+	return ret;
+}
+
 static struct erdma_pbl *erdma_create_cont_pbl(struct erdma_dev *dev,
 					       size_t size)
 {
@@ -531,17 +669,21 @@ static struct erdma_pbl *erdma_create_cont_pbl(struct erdma_dev *dev,
 	return ERR_PTR(ret);
 }
 
-static u32 vmalloc_to_sgl(struct erdma_dev *dev, struct scatterlist **sgl_ptr,
-			  void *buf, u64 len)
+static int erdma_create_pbl_buf_sg(struct erdma_dev *dev, struct erdma_pbl *pbl)
 {
-	u32 npages, i, nsg;
 	struct scatterlist *sglist;
+	void *buf = pbl->buf;
+	u32 npages, i, nsg;
 	struct page *pg;
 
-	npages = DIV_ROUND_UP(len, PAGE_SIZE);
-	sglist = vzalloc(npages * sizeof(struct scatterlist));
+	/* Failed if buf is not page aligned */
+	if ((uintptr_t)buf & ~PAGE_MASK)
+		return -EINVAL;
+
+	npages = DIV_ROUND_UP(pbl->size, PAGE_SIZE);
+	sglist = vzalloc(npages * sizeof(*sglist));
 	if (!sglist)
-		return 0;
+		return -ENOMEM;
 
 	sg_init_table(sglist, npages);
 	for (i = 0; i < npages; i++) {
@@ -552,39 +694,19 @@ static u32 vmalloc_to_sgl(struct erdma_dev *dev, struct scatterlist **sgl_ptr,
 		buf += PAGE_SIZE;
 	}
 
-	nsg = dma_map_sg(&dev->pdev->dev, sglist, npages, DMA_BIDIRECTIONAL);
+	nsg = dma_map_sg(&dev->pdev->dev, sglist, npages, DMA_TO_DEVICE);
 	if (!nsg)
 		goto err;
 
-	if (nsg != npages)
-		ibdev_warn(&dev->ibdev, "sgl len before DMA: %u sgl len after DMA: %u\n",
-			   npages, nsg);
+	pbl->sglist = sglist;
+	pbl->nsg = nsg;
 
-	*sgl_ptr = sglist;
-	return nsg;
+	return 0;
 
 err:
 	vfree(sglist);
-	return 0;
-}
 
-static int erdma_create_pbl_buf_sg(struct erdma_dev *dev, struct erdma_pbl *pbl)
-{
-	struct scatterlist *sglist;
-	u32 nsg;
-
-	/* Failed if buf is not page aligned */
-	if ((uintptr_t)pbl->buf & ~PAGE_MASK)
-		return -EINVAL;
-
-	nsg = vmalloc_to_sgl(dev, &sglist, pbl->buf, pbl->size);
-	if (!nsg)
-		return -ENOMEM;
-
-	pbl->sglist = sglist;
-	pbl->nsg = nsg;
-
-	return 0;
+	return -ENOMEM;
 }
 
 static void erdma_destroy_pbl_buf_sg(struct erdma_dev *dev,
@@ -700,44 +822,14 @@ static struct erdma_pbl *erdma_create_pbl(struct erdma_dev *dev, size_t size,
 	return ERR_PTR(ret);
 }
 
-static void fill_mtt_entries_with_sgl(struct scatterlist *sgl, u64 *page_list,
-				      u64 nents)
-{
-	u32 i, entry, chunk_pages, idx = 0;
-	u64 pg_addr;
-	struct scatterlist *sg;
-
-	for_each_sg(sgl, sg, nents, entry) {
-		chunk_pages = sg_dma_len(sg) >> PAGE_SHIFT;
-		for (i = 0; i < chunk_pages; i++) {
-			pg_addr = sg_dma_address(sg) + (i << PAGE_SHIFT);
-
-			if ((entry + i) == 0)
-				page_list[idx] = pg_addr & PAGE_MASK;
-			else if (!(pg_addr & ~PAGE_MASK))
-				page_list[idx] = pg_addr;
-			else
-				continue;
-			idx++;
-		}
-	}
-}
-
 static void erdma_init_pbl_leaf(struct erdma_mem *mem, struct erdma_pbl *pbl)
 {
 	u64 *page_list = pbl->buf;
-	bool is_user = !mem->type;
-	u32 idx = 0;
 	struct ib_block_iter biter;
+	u32 idx = 0;
 
-	if (is_user && mem->umem) {
-		rdma_umem_for_each_dma_block(mem->umem, &biter, mem->page_size)
-			page_list[idx++] = rdma_block_iter_dma_address(&biter);
-		return;
-	}
-
-	fill_mtt_entries_with_sgl(is_user ? mem->umem->sg_head.sgl : mem->kmem->sgl,
-				  page_list, is_user ? mem->umem->nmap : mem->kmem->nmap);
+	rdma_umem_for_each_dma_block(mem->umem, &biter, mem->page_size)
+		page_list[idx++] = rdma_block_iter_dma_address(&biter);
 }
 
 static void erdma_init_bottom_pbl(struct erdma_dev *dev, struct erdma_mem *mem)
@@ -768,76 +860,26 @@ static void erdma_destroy_pbl(struct erdma_dev *dev, struct erdma_pbl *pbl)
 	}
 }
 
-static void erdma_mem_free(struct erdma_dev *dev, struct erdma_mem *mem)
-{
-	switch (mem->type) {
-	case ERDMA_UMEM:
-		if (mem->umem) {
-			ib_umem_release(mem->umem);
-			mem->umem = NULL;
-		}
-		break;
-	case ERDMA_KMEM:
-		if (mem->kmem) {
-			if (mem->kmem->sgl) {
-				dma_unmap_sg(&dev->pdev->dev, mem->kmem->sgl,
-					     mem->kmem->nmap, DMA_TO_DEVICE);
-				vfree(mem->kmem->sgl);
-				mem->kmem->sgl = NULL;
-			}
-			kfree(mem->kmem);
-			mem->kmem = NULL;
-		}
-		break;
-	default:
-		break;
-	}
-}
-
-static u32 range_num_blocks(u64 start, u64 len, u64 blk_sz)
-{
-	return (ALIGN(start + len, blk_sz) - ALIGN_DOWN(start, blk_sz)) / blk_sz;
-}
-
-static int get_mtt_entries(void *data, struct erdma_ucontext *ctx,
+static int get_mtt_entries(struct ib_udata *udata, struct erdma_ucontext *ctx,
 			   struct erdma_mem *mem, u64 start, u64 len,
 			   int access, u64 virt, unsigned long req_page_size,
 			   bool is_mr)
 {
+	struct erdma_dev *dev = to_edev(ctx->ibucontext.device);
 	int ret;
-	bool is_user = ctx ? true : false;
-	struct erdma_dev *dev = is_user ? to_edev(ctx->ibucontext.device) :
-					  (struct erdma_dev *)data;
-
-	if (is_user) {
-		mem->type = ERDMA_UMEM;
-			mem->umem = ib_umem_get(&dev->ibdev, start, len, access);
-		if (IS_ERR(mem->umem)) {
-			ret = PTR_ERR(mem->umem);
-			mem->umem = NULL;
-			return ret;
-		}
-	} else {
-		mem->type = ERDMA_KMEM;
-		mem->kmem = kzalloc(sizeof(struct erdma_kmem), GFP_KERNEL);
-		if (!mem->kmem)
-			return -ENOMEM;
-
-		mem->kmem->nmap = vmalloc_to_sgl(dev, &mem->kmem->sgl, (void *)start, len);
-		if (!mem->kmem->nmap) {
-			kfree(mem->kmem);
-			mem->kmem = NULL;
-			return -ENOMEM;
-		}
+
+	mem->umem = ib_umem_get(&dev->ibdev, start, len, access);
+	if (IS_ERR(mem->umem)) {
+		ret = PTR_ERR(mem->umem);
+		mem->umem = NULL;
+		return ret;
 	}
 
 	mem->va = virt;
 	mem->len = len;
-	mem->page_size = is_user ? ib_umem_find_best_pgsz(mem->umem, req_page_size, virt) :
-				   PAGE_SIZE;
+	mem->page_size = ib_umem_find_best_pgsz(mem->umem, req_page_size, virt);
 	mem->page_offset = start & (mem->page_size - 1);
-	mem->mtt_nents = is_user ? ib_umem_num_dma_blocks(mem->umem, mem->page_size) :
-				   range_num_blocks(mem->va, mem->len, mem->page_size);
+	mem->mtt_nents = ib_umem_num_dma_blocks(mem->umem, mem->page_size);
 	mem->page_cnt = mem->mtt_nents;
 
 	ibdev_dbg(&dev->ibdev, "page_size:%u, page_offset:%u, mtt_nents:%u\n",
@@ -854,132 +896,23 @@ static int get_mtt_entries(void *data, struct erdma_ucontext *ctx,
 	return 0;
 
 error_ret:
-	erdma_mem_free(dev, mem);
+	if (mem->umem) {
+		ib_umem_release(mem->umem);
+		mem->umem = NULL;
+	}
 
 	return ret;
 }
 
 static void put_mtt_entries(struct erdma_dev *dev, struct erdma_mem *mem)
 {
-	if (mem->pbl) {
+	if (mem->pbl)
 		erdma_destroy_pbl(dev, mem->pbl);
-		mem->pbl = NULL;
-	}
-
-	erdma_mem_free(dev, mem);
-}
-
-static void free_kernel_qp(struct erdma_qp *qp)
-{
-	struct erdma_dev *dev = qp->dev;
-
-	vfree(qp->kern_qp.swr_tbl);
-	vfree(qp->kern_qp.rwr_tbl);
-
-	if (qp->kern_qp.sq_buf) {
-		put_mtt_entries(dev, &qp->kern_qp.sq_mtt);
-		vfree(qp->kern_qp.sq_buf);
-		qp->kern_qp.sq_buf = NULL;
-	}
 
-	if (qp->kern_qp.rq_buf) {
-		put_mtt_entries(dev, &qp->kern_qp.rq_mtt);
-		vfree(qp->kern_qp.rq_buf);
-		qp->kern_qp.rq_buf = NULL;
+	if (mem->umem) {
+		ib_umem_release(mem->umem);
+		mem->umem = NULL;
 	}
-
-	if (qp->kern_qp.sq_db_info)
-		dma_pool_free(dev->db_pool, qp->kern_qp.sq_db_info,
-			      qp->kern_qp.sq_db_info_dma_addr);
-
-	if (qp->kern_qp.rq_db_info)
-		dma_pool_free(dev->db_pool, qp->kern_qp.rq_db_info,
-			      qp->kern_qp.rq_db_info_dma_addr);
-}
-
-static int init_kernel_qp(struct erdma_dev *dev, struct erdma_qp *qp,
-			  struct ib_qp_init_attr *attrs)
-{
-	struct erdma_kqp *kqp = &qp->kern_qp;
-	int ret = -ENOMEM;
-
-	if (attrs->sq_sig_type == IB_SIGNAL_ALL_WR)
-		kqp->sig_all = 1;
-
-	kqp->sq_pi = 0;
-	kqp->sq_ci = 0;
-	kqp->rq_pi = 0;
-	kqp->rq_ci = 0;
-	kqp->hw_sq_db = dev->func_bar +
-			(ERDMA_SDB_SHARED_PAGE_INDEX << ERDMA_HW_PAGE_SHIFT);
-	kqp->hw_rq_db = dev->func_bar + ERDMA_BAR_RQDB_SPACE_OFFSET;
-
-	kqp->swr_tbl = vmalloc(qp->attrs.sq_size * sizeof(u64));
-	kqp->rwr_tbl = vmalloc(qp->attrs.rq_size * sizeof(u64));
-	if (!kqp->swr_tbl || !kqp->rwr_tbl)
-		goto err_out;
-
-	kqp->sq_buf = vmalloc(qp->attrs.sq_size << SQEBB_SHIFT);
-	if (!kqp->sq_buf)
-		goto err_out;
-
-	ret = get_mtt_entries(dev, NULL, &kqp->sq_mtt, (u64)kqp->sq_buf,
-			      qp->attrs.sq_size << SQEBB_SHIFT, 0,
-			      (u64)kqp->sq_buf, 0, false);
-	if (ret)
-		goto err_out;
-
-	kqp->rq_buf = vmalloc(qp->attrs.rq_size << RQE_SHIFT);
-	if (!kqp->rq_buf)
-		goto err_out;
-
-	ret = get_mtt_entries(dev, NULL, &kqp->rq_mtt, (u64)kqp->rq_buf,
-			      qp->attrs.rq_size << RQE_SHIFT, 0, (u64)kqp->rq_buf,
-			      0, false);
-	if (ret)
-		goto err_out;
-
-	kqp->sq_db_info = dma_pool_alloc(dev->db_pool, GFP_KERNEL,
-					 &kqp->sq_db_info_dma_addr);
-	if (!kqp->sq_db_info)
-		goto err_out;
-
-	kqp->rq_db_info = dma_pool_alloc(dev->db_pool, GFP_KERNEL,
-					 &kqp->rq_db_info_dma_addr);
-	if (!kqp->rq_db_info)
-		goto err_out;
-
-	if (attrs->create_flags & IB_QP_CREATE_IWARP_WITHOUT_CM) {
-		struct iw_ext_conn_param *param =
-			(struct iw_ext_conn_param *)(attrs->qp_context);
-
-		if (param == NULL) {
-			ret = -EINVAL;
-			goto err_out;
-		}
-		if (param->sk_addr.family != PF_INET) {
-			ibdev_err_ratelimited(
-				&dev->ibdev,
-				"IPv4 address is required for connection without CM.\n");
-			ret = -EINVAL;
-			goto err_out;
-		}
-		qp->attrs.connect_without_cm = true;
-		((struct sockaddr_in *)&qp->attrs.raddr)->sin_family = AF_INET;
-		((struct sockaddr_in *)&qp->attrs.laddr)->sin_family = AF_INET;
-		qp->attrs.raddr.in.sin_addr.s_addr = param->sk_addr.daddr_v4;
-		qp->attrs.laddr.in.sin_addr.s_addr = param->sk_addr.saddr_v4;
-		qp->attrs.dport = ntohs(param->sk_addr.dport);
-		qp->attrs.sport = param->sk_addr.sport;
-	}
-	spin_lock_init(&kqp->sq_lock);
-	spin_lock_init(&kqp->rq_lock);
-
-	return 0;
-
-err_out:
-	free_kernel_qp(qp);
-	return ret;
 }
 
 static int erdma_map_user_dbrecords(struct ib_udata *udata,
@@ -1492,21 +1425,6 @@ int erdma_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
 	return 0;
 }
 
-static void free_kernel_cq(struct erdma_dev *dev, struct erdma_kcq_info *kcq)
-{
-	if (kcq->qbuf) {
-		put_mtt_entries(dev, &kcq->qbuf_mtt);
-		vfree(kcq->qbuf);
-		kcq->qbuf = NULL;
-	}
-
-	if (kcq->db_record) {
-		dma_pool_free(dev->db_pool, kcq->db_record,
-			      kcq->db_info_dma_addr);
-		kcq->db_record = NULL;
-	}
-}
-
 int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
 {
 	struct erdma_cq *cq = to_ecq(ibcq);
@@ -1535,7 +1453,9 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
 		return err;
 	}
 	if (rdma_is_kernel_res(&cq->ibcq.res)) {
-		free_kernel_cq(dev, &cq->kern_cq);
+		dma_free_coherent(&dev->pdev->dev,
+				  WARPPED_BUFSIZE(cq->depth << CQE_SHIFT),
+				  cq->kern_cq.qbuf, cq->kern_cq.qbuf_dma_addr);
 	} else {
 		erdma_unmap_user_dbrecords(ctx, &cq->user_cq.user_dbr_page);
 		put_mtt_entries(dev, &cq->user_cq.qbuf_mtt);
@@ -1989,41 +1909,22 @@ static int erdma_init_user_cq(struct ib_udata *udata,
 
 static int erdma_init_kernel_cq(struct erdma_cq *cq)
 {
-	int ret;
-	u64 cq_sz = cq->depth << CQE_SHIFT;
 	struct erdma_dev *dev = to_edev(cq->ibcq.device);
 
-	cq->kern_cq.qbuf = vzalloc(cq_sz);
-	if (!cq->kern_cq.qbuf) {
-		ret = -ENOMEM;
-		goto err_out;
-	}
-
-	ret = get_mtt_entries(dev, NULL, &cq->kern_cq.qbuf_mtt, (u64)cq->kern_cq.qbuf,
-			      cq_sz, 0, (u64)cq->kern_cq.qbuf, 0, false);
-	if (ret)
-		goto err_free_qbuf;
-
-	cq->kern_cq.db_record = dma_pool_alloc(dev->db_pool, GFP_KERNEL,
-					       &cq->kern_cq.db_info_dma_addr);
-	if (!cq->kern_cq.db_record) {
-		ret = -ENOMEM;
-		goto err_free_mtt;
-	}
+	cq->kern_cq.qbuf =
+		dma_alloc_coherent(&dev->pdev->dev,
+				   WARPPED_BUFSIZE(cq->depth << CQE_SHIFT),
+				   &cq->kern_cq.qbuf_dma_addr, GFP_KERNEL);
+	if (!cq->kern_cq.qbuf)
+		return -ENOMEM;
 
+	cq->kern_cq.db_record =
+		(u64 *)(cq->kern_cq.qbuf + (cq->depth << CQE_SHIFT));
 	spin_lock_init(&cq->kern_cq.lock);
 	/* use default cqdb addr */
 	cq->kern_cq.db = dev->func_bar + ERDMA_BAR_CQDB_SPACE_OFFSET;
 
 	return 0;
-
-err_free_mtt:
-	put_mtt_entries(dev, &cq->kern_cq.qbuf_mtt);
-err_free_qbuf:
-	vfree(cq->kern_cq.qbuf);
-	cq->kern_cq.qbuf = NULL;
-err_out:
-	return ret;
 }
 
 int erdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
@@ -2099,7 +2000,9 @@ int erdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 		erdma_unmap_user_dbrecords(uctx, &cq->user_cq.user_dbr_page);
 		put_mtt_entries(dev, &cq->user_cq.qbuf_mtt);
 	} else {
-		free_kernel_cq(dev, &cq->kern_cq);
+		dma_free_coherent(&dev->pdev->dev,
+				  WARPPED_BUFSIZE(depth << CQE_SHIFT),
+				  cq->kern_cq.qbuf, cq->kern_cq.qbuf_dma_addr);
 	}
 
 err_out_xa:
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index e91c53e36a1f65034b71c38cfbdc7e2412a8625b..13d580c95075c82aa831ca137b3d273484110d82 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -102,22 +102,8 @@ struct erdma_pbl {
 	struct erdma_pbl *low_level;
 };
 
-enum erdma_mem_type {
-	ERDMA_UMEM = 0,
-	ERDMA_KMEM = 1,
-};
-
-struct erdma_kmem {
-	struct scatterlist *sgl;
-	u64 nmap;
-};
-
 struct erdma_mem {
-	enum erdma_mem_type type;
-	union {
-		struct ib_umem *umem;
-		struct erdma_kmem *kmem;
-	};
+	struct ib_umem *umem;
 	u32 page_size;
 	u32 page_offset;
 	u32 page_cnt;
@@ -163,6 +149,7 @@ struct erdma_kqp {
 	u64 *swr_tbl;
 	void *hw_sq_db;
 	void *sq_buf;
+	dma_addr_t sq_buf_dma_addr;
 	void *sq_db_info;
 
 	spinlock_t rq_lock ____cacheline_aligned;
@@ -171,11 +158,9 @@ struct erdma_kqp {
 	u64 *rwr_tbl;
 	void *hw_rq_db;
 	void *rq_buf;
+	dma_addr_t rq_buf_dma_addr;
 	void *rq_db_info;
 
-	struct erdma_mem sq_mtt;
-	struct erdma_mem rq_mtt;
-
 	dma_addr_t sq_db_info_dma_addr;
 	dma_addr_t rq_db_info_dma_addr;
 
@@ -262,8 +247,7 @@ struct erdma_qp {
 
 struct erdma_kcq_info {
 	void *qbuf;
-	struct erdma_mem qbuf_mtt;
-	dma_addr_t db_info_dma_addr;
+	dma_addr_t qbuf_dma_addr;
 	u32 ci;
 	u32 cmdsn;
 	u32 notify_cnt;
diff --git a/drivers/infiniband/hw/erdma/kcompat.h b/drivers/infiniband/hw/erdma/kcompat.h
index 70dae74fb2d204c113b945fc7ba0deccb093c8a5..c08285beda1f55dad7555aaf1457f68b2c278704 100644
--- a/drivers/infiniband/hw/erdma/kcompat.h
+++ b/drivers/infiniband/hw/erdma/kcompat.h
@@ -17,7 +17,7 @@
 
 #define ERDMA_MAJOR_VER 0
 #define ERDMA_MEDIUM_VER 2
-#define ERDMA_MINOR_VER 36
+#define ERDMA_MINOR_VER 37
 
 #include <rdma/ib_verbs.h>
 #ifndef RDMA_DRIVER_ERDMA