Update from upstream with manual merge of Yasunori Goto's

changes to swiotlb.c made in commit 281dd25cdc0d6903929b79183816d151ea626341
since this file has been moved from arch/ia64/lib/swiotlb.c to
lib/swiotlb.c

Signed-off-by: Tony Luck <tony.luck@intel.com>

18 files changed, 194 insertions, 175 deletions

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index a4a4d9c1eef..a14ca87fda1 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -783,7 +783,7 @@ struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
                                             u32 remote_qpn, u16 pkey_index,
                                             struct ib_ah *ah, int rmpp_active,
                                             int hdr_len, int data_len,
-                                            unsigned int __nocast gfp_mask)
+                                            gfp_t gfp_mask)
 {
         struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_send_buf *send_buf;
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 2bd8b1cc57c..e23836d0e21 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -412,8 +412,8 @@ static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
 
         hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
         data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
-        pad = data_size - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
-        if (pad > data_size || pad < 0)
+        pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (pad > IB_MGMT_RMPP_DATA || pad < 0)
                 pad = 0;
 
         return hdr_size + rmpp_recv->seg_num * data_size - pad;
@@ -583,6 +583,7 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 {
         struct ib_rmpp_mad *rmpp_mad;
         int timeout;
+        u32 paylen;
 
         rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
         ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
@@ -590,11 +591,9 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == 1) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(mad_send_wr->total_seg *
-                                    (sizeof(struct ib_rmpp_mad) -
-                                       offsetof(struct ib_rmpp_mad, data)) -
-                                    mad_send_wr->pad);
+                paylen = mad_send_wr->total_seg * IB_MGMT_RMPP_DATA -
+                         mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
                 mad_send_wr->sg_list[0].length = sizeof(struct ib_rmpp_mad);
         } else {
                 mad_send_wr->send_wr.num_sge = 2;
@@ -608,10 +607,8 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == mad_send_wr->total_seg) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(sizeof(struct ib_rmpp_mad) -
-                                    offsetof(struct ib_rmpp_mad, data) -
-                                    mad_send_wr->pad);
+                paylen = IB_MGMT_RMPP_DATA - mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
         }
 
         /* 2 seconds for an ACK until we can find the packet lifetime */
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 78de2dd1a4f..262618210c1 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -574,7 +574,7 @@ static void ib_sa_path_rec_release(struct ib_sa_query *sa_query)
 int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
                        struct ib_sa_path_rec *rec,
                        ib_sa_comp_mask comp_mask,
-                       int timeout_ms, unsigned int __nocast gfp_mask,
+                       int timeout_ms, gfp_t gfp_mask,
                        void (*callback)(int status,
                                         struct ib_sa_path_rec *resp,
                                         void *context),
@@ -676,7 +676,7 @@ static void ib_sa_service_rec_release(struct ib_sa_query *sa_query)
 int ib_sa_service_rec_query(struct ib_device *device, u8 port_num, u8 method,
                             struct ib_sa_service_rec *rec,
                             ib_sa_comp_mask comp_mask,
-                            int timeout_ms, unsigned int __nocast gfp_mask,
+                            int timeout_ms, gfp_t gfp_mask,
                             void (*callback)(int status,
                                              struct ib_sa_service_rec *resp,
                                              void *context),
@@ -759,7 +759,7 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
                              u8 method,
                              struct ib_sa_mcmember_rec *rec,
                              ib_sa_comp_mask comp_mask,
-                             int timeout_ms, unsigned int __nocast gfp_mask,
+                             int timeout_ms, gfp_t gfp_mask,
                              void (*callback)(int status,
                                               struct ib_sa_mcmember_rec *resp,
                                               void *context),
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 7c2f03057dd..a64d6b4dcc1 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -334,10 +334,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                         ret = -EINVAL;
                         goto err_ah;
                 }
-                /* Validate that management class can support RMPP */
+
+                /* Validate that the management class can support RMPP */
                 if (rmpp_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_ADM) {
                         hdr_len = offsetof(struct ib_sa_mad, data);
-                        data_len = length;
+                        data_len = length - hdr_len;
                 } else if ((rmpp_mad->mad_hdr.mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
                             (rmpp_mad->mad_hdr.mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)) {
                                 hdr_len = offsetof(struct ib_vendor_mad, data);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index b1897bed14a..cc124344dd2 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -69,6 +69,7 @@ struct ib_uverbs_event_file {
 
 struct ib_uverbs_file {
         struct kref                             ref;
+        struct semaphore                        mutex;
         struct ib_uverbs_device                *device;
         struct ib_ucontext                     *ucontext;
         struct ib_event_handler                 event_handler;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index e91ebde4648..562445165d2 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -76,8 +76,9 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
         struct ib_uverbs_get_context_resp resp;
         struct ib_udata                   udata;
         struct ib_device                 *ibdev = file->device->ib_dev;
+        struct ib_ucontext               *ucontext;
         int i;
-        int ret = in_len;
+        int ret;
 
         if (out_len < sizeof resp)
                 return -ENOSPC;
@@ -85,45 +86,56 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
 
+        down(&file->mutex);
+
+        if (file->ucontext) {
+                ret = -EINVAL;
+                goto err;
+        }
+
         INIT_UDATA(&udata, buf + sizeof cmd,
                    (unsigned long) cmd.response + sizeof resp,
                    in_len - sizeof cmd, out_len - sizeof resp);
 
-        file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);
-        if (IS_ERR(file->ucontext)) {
-                ret = PTR_ERR(file->ucontext);
-                file->ucontext = NULL;
-                return ret;
-        }
+        ucontext = ibdev->alloc_ucontext(ibdev, &udata);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(file->ucontext);
 
-        file->ucontext->device = ibdev;
-        INIT_LIST_HEAD(&file->ucontext->pd_list);
-        INIT_LIST_HEAD(&file->ucontext->mr_list);
-        INIT_LIST_HEAD(&file->ucontext->mw_list);
-        INIT_LIST_HEAD(&file->ucontext->cq_list);
-        INIT_LIST_HEAD(&file->ucontext->qp_list);
-        INIT_LIST_HEAD(&file->ucontext->srq_list);
-        INIT_LIST_HEAD(&file->ucontext->ah_list);
-        spin_lock_init(&file->ucontext->lock);
+        ucontext->device = ibdev;
+        INIT_LIST_HEAD(&ucontext->pd_list);
+        INIT_LIST_HEAD(&ucontext->mr_list);
+        INIT_LIST_HEAD(&ucontext->mw_list);
+        INIT_LIST_HEAD(&ucontext->cq_list);
+        INIT_LIST_HEAD(&ucontext->qp_list);
+        INIT_LIST_HEAD(&ucontext->srq_list);
+        INIT_LIST_HEAD(&ucontext->ah_list);
 
         resp.async_fd = file->async_file.fd;
         for (i = 0; i < file->device->num_comp; ++i)
                 if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
                                  i * sizeof (__u32),
-                                 &file->comp_file[i].fd, sizeof (__u32)))
-                        goto err;
+                                 &file->comp_file[i].fd, sizeof (__u32))) {
+                        ret = -EFAULT;
+                        goto err_free;
+                }
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
-                         &resp, sizeof resp))
-                goto err;
+                         &resp, sizeof resp)) {
+                ret = -EFAULT;
+                goto err_free;
+        }
+
+        file->ucontext = ucontext;
+        up(&file->mutex);
 
         return in_len;
 
-err:
-        ibdev->dealloc_ucontext(file->ucontext);
-        file->ucontext = NULL;
+err_free:
+        ibdev->dealloc_ucontext(ucontext);
 
-        return -EFAULT;
+err:
+        up(&file->mutex);
+        return ret;
 }
 
 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
@@ -352,9 +364,9 @@ retry:
         if (ret)
                 goto err_pd;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->list, &file->ucontext->pd_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         memset(&resp, 0, sizeof resp);
         resp.pd_handle = uobj->id;
@@ -368,9 +380,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         down(&ib_uverbs_idr_mutex);
         idr_remove(&ib_uverbs_pd_idr, uobj->id);
@@ -410,9 +422,9 @@ ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         kfree(uobj);
 
@@ -512,9 +524,9 @@ retry:
 
         resp.mr_handle = obj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -527,9 +539,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&obj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_unreg:
         ib_dereg_mr(mr);
@@ -570,9 +582,9 @@ ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&memobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         ib_umem_release(file->device->ib_dev, &memobj->umem);
         kfree(memobj);
@@ -647,9 +659,9 @@ retry:
         if (ret)
                 goto err_cq;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         memset(&resp, 0, sizeof resp);
         resp.cq_handle = uobj->uobject.id;
@@ -664,9 +676,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         down(&ib_uverbs_idr_mutex);
         idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
@@ -712,9 +724,9 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->comp_file[0].lock);
         list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
@@ -847,9 +859,9 @@ retry:
 
         resp.qp_handle = uobj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -862,9 +874,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_destroy:
         ib_destroy_qp(qp);
@@ -989,9 +1001,9 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->async_file.lock);
         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
@@ -1136,9 +1148,9 @@ retry:
 
         resp.srq_handle = uobj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -1151,9 +1163,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_destroy:
         ib_destroy_srq(srq);
@@ -1227,9 +1239,9 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->async_file.lock);
         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index ce5bdb7af30..12511808de2 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -448,7 +448,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
         if (hdr.in_words * 4 != count)
                 return -EINVAL;
 
-        if (hdr.command < 0 || hdr.command >= ARRAY_SIZE(uverbs_cmd_table))
+        if (hdr.command < 0                             ||
+            hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
+            !uverbs_cmd_table[hdr.command])
                 return -EINVAL;
 
         if (!file->ucontext                               &&
@@ -484,27 +486,29 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
         file = kmalloc(sizeof *file +
                        (dev->num_comp - 1) * sizeof (struct ib_uverbs_event_file),
                        GFP_KERNEL);
-        if (!file)
-                return -ENOMEM;
+        if (!file) {
+                ret = -ENOMEM;
+                goto err;
+        }
 
         file->device = dev;
         kref_init(&file->ref);
+        init_MUTEX(&file->mutex);
 
         file->ucontext = NULL;
 
+        kref_get(&file->ref);
         ret = ib_uverbs_event_init(&file->async_file, file);
         if (ret)
-                goto err;
+                goto err_kref;
 
         file->async_file.is_async = 1;
 
-        kref_get(&file->ref);
-
         for (i = 0; i < dev->num_comp; ++i) {
+                kref_get(&file->ref);
                 ret = ib_uverbs_event_init(&file->comp_file[i], file);
                 if (ret)
                         goto err_async;
-                kref_get(&file->ref);
                 file->comp_file[i].is_async = 0;
         }
 
@@ -524,9 +528,16 @@ err_async:
 
         ib_uverbs_event_release(&file->async_file);
 
-err:
+err_kref:
+        /*
+         * One extra kref_put() because we took a reference before the
+         * event file creation that failed and got us here.
+         */
+        kref_put(&file->ref, ib_uverbs_release_file);
         kref_put(&file->ref, ib_uverbs_release_file);
 
+err:
+        module_put(dev->ib_dev->owner);
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index cc758a2d2bc..f6a8ac02655 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -605,7 +605,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
                         err = -EINVAL;
                         goto out;
                 }
-                for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i, ++nent) {
+                for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) {
                         if (virt != -1) {
                                 pages[nent * 2] = cpu_to_be64(virt);
                                 virt += 1 << lg;
@@ -616,7 +616,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
                         ts += 1 << (lg - 10);
                         ++tc;
 
-                        if (nent == MTHCA_MAILBOX_SIZE / 16) {
+                        if (++nent == MTHCA_MAILBOX_SIZE / 16) {
                                 err = mthca_cmd(dev, mailbox->dma, nent, 0, op,
                                                 CMD_TIME_CLASS_B, status);
                                 if (err || *status)
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 18f0981eb0c..c81fa8e975e 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -476,12 +476,8 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         int i;
         u8 status;
 
-        /* Make sure EQ size is aligned to a power of 2 size. */
-        for (i = 1; i < nent; i <<= 1)
-                ; /* nothing */
-        nent = i;
-
-        eq->dev = dev;
+        eq->dev  = dev;
+        eq->nent = roundup_pow_of_two(max(nent, 2));
 
         eq->page_list = kmalloc(npages * sizeof *eq->page_list,
                                 GFP_KERNEL);
@@ -512,7 +508,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
                 memset(eq->page_list[i].buf, 0, PAGE_SIZE);
         }
 
-        for (i = 0; i < nent; ++i)
+        for (i = 0; i < eq->nent; ++i)
                 set_eqe_hw(get_eqe(eq, i));
 
         eq->eqn = mthca_alloc(&dev->eq_table.alloc);
@@ -528,8 +524,6 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (err)
                 goto err_out_free_eq;
 
-        eq->nent = nent;
-
         memset(eq_context, 0, sizeof *eq_context);
         eq_context->flags           = cpu_to_be32(MTHCA_EQ_STATUS_OK   |
                                                   MTHCA_EQ_OWNER_HW    |
@@ -538,7 +532,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (mthca_is_memfree(dev))
                 eq_context->flags  |= cpu_to_be32(MTHCA_EQ_STATE_ARBEL);
 
-        eq_context->logsize_usrpage = cpu_to_be32((ffs(nent) - 1) << 24);
+        eq_context->logsize_usrpage = cpu_to_be32((ffs(eq->nent) - 1) << 24);
         if (mthca_is_memfree(dev)) {
                 eq_context->arbel_pd = cpu_to_be32(dev->driver_pd.pd_num);
         } else {
@@ -569,7 +563,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         dev->eq_table.arm_mask |= eq->eqn_mask;
 
         mthca_dbg(dev, "Allocated EQ %d with %d entries\n",
-                  eq->eqn, nent);
+                  eq->eqn, eq->nent);
 
         return err;
 
@@ -842,7 +836,7 @@ int __devinit mthca_init_eq_table(struct mthca_dev *dev)
                 dev->eq_table.clr_mask =
                         swab32(1 << (dev->eq_table.inta_pin & 31));
                 dev->eq_table.clr_int  = dev->clr_base +
-                        (dev->eq_table.inta_pin < 31 ? 4 : 0);
+                        (dev->eq_table.inta_pin < 32 ? 4 : 0);
         }
 
         dev->eq_table.arm_mask = 0;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index ffbcd40418d..23a3f56c789 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -503,6 +503,25 @@ err_free_aux:
         return err;
 }
 
+static void mthca_free_icms(struct mthca_dev *mdev)
+{
+        u8 status;
+
+        mthca_free_icm_table(mdev, mdev->mcg_table.table);
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                mthca_free_icm_table(mdev, mdev->srq_table.table);
+        mthca_free_icm_table(mdev, mdev->cq_table.table);
+        mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
+        mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
+        mthca_free_icm_table(mdev, mdev->qp_table.qp_table);
+        mthca_free_icm_table(mdev, mdev->mr_table.mpt_table);
+        mthca_free_icm_table(mdev, mdev->mr_table.mtt_table);
+        mthca_unmap_eq_icm(mdev);
+
+        mthca_UNMAP_ICM_AUX(mdev, &status);
+        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+}
+
 static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
 {
         struct mthca_dev_lim        dev_lim;
@@ -580,18 +599,7 @@ static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
         return 0;
 
 err_free_icm:
-        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
-                mthca_free_icm_table(mdev, mdev->srq_table.table);
-        mthca_free_icm_table(mdev, mdev->cq_table.table);
-        mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
-        mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
-        mthca_free_icm_table(mdev, mdev->qp_table.qp_table);
-        mthca_free_icm_table(mdev, mdev->mr_table.mpt_table);
-        mthca_free_icm_table(mdev, mdev->mr_table.mtt_table);
-        mthca_unmap_eq_icm(mdev);
-
-        mthca_UNMAP_ICM_AUX(mdev, &status);
-        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+        mthca_free_icms(mdev);
 
 err_stop_fw:
         mthca_UNMAP_FA(mdev, &status);
@@ -611,18 +619,7 @@ static void mthca_close_hca(struct mthca_dev *mdev)
         mthca_CLOSE_HCA(mdev, 0, &status);
 
         if (mthca_is_memfree(mdev)) {
-                if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
-                        mthca_free_icm_table(mdev, mdev->srq_table.table);
-                mthca_free_icm_table(mdev, mdev->cq_table.table);
-                mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
-                mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
-                mthca_free_icm_table(mdev, mdev->qp_table.qp_table);
-                mthca_free_icm_table(mdev, mdev->mr_table.mpt_table);
-                mthca_free_icm_table(mdev, mdev->mr_table.mtt_table);
-                mthca_unmap_eq_icm(mdev);
-
-                mthca_UNMAP_ICM_AUX(mdev, &status);
-                mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+                mthca_free_icms(mdev);
 
                 mthca_UNMAP_FA(mdev, &status);
                 mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 1827400f189..7bd7a4bec7b 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -290,7 +290,7 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
         int i;
         u8 status;
 
-        num_icm = obj_size * nobj / MTHCA_TABLE_CHUNK_SIZE;
+        num_icm = (obj_size * nobj + MTHCA_TABLE_CHUNK_SIZE - 1) / MTHCA_TABLE_CHUNK_SIZE;
 
         table = kmalloc(sizeof *table + num_icm * sizeof *table->icm, GFP_KERNEL);
         if (!table)
@@ -529,12 +529,25 @@ int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db)
                         goto found;
                 }
 
+        for (i = start; i != end; i += dir)
+                if (!dev->db_tab->page[i].db_rec) {
+                        page = dev->db_tab->page + i;
+                        goto alloc;
+                }
+
         if (dev->db_tab->max_group1 >= dev->db_tab->min_group2 - 1) {
                 ret = -ENOMEM;
                 goto out;
         }
 
+        if (group == 0)
+                ++dev->db_tab->max_group1;
+        else
+                --dev->db_tab->min_group2;
+
         page = dev->db_tab->page + end;
+
+alloc:
         page->db_rec = dma_alloc_coherent(&dev->pdev->dev, 4096,
                                           &page->mapping, GFP_KERNEL);
         if (!page->db_rec) {
@@ -554,10 +567,6 @@ int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db)
         }
 
         bitmap_zero(page->used, MTHCA_DB_REC_PER_PAGE);
-        if (group == 0)
-                ++dev->db_tab->max_group1;
-        else
-                --dev->db_tab->min_group2;
 
 found:
         j = find_first_zero_bit(page->used, MTHCA_DB_REC_PER_PAGE);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 1c1c2e23087..3f5319a4657 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -84,7 +84,7 @@ static int mthca_query_device(struct ib_device *ibdev,
         props->vendor_id           = be32_to_cpup((__be32 *) (out_mad->data + 36)) &
                 0xffffff;
         props->vendor_part_id      = be16_to_cpup((__be16 *) (out_mad->data + 30));
-        props->hw_ver              = be16_to_cpup((__be16 *) (out_mad->data + 32));
+        props->hw_ver              = be32_to_cpup((__be32 *) (out_mad->data + 32));
         memcpy(&props->sys_image_guid, out_mad->data +  4, 8);
         memcpy(&props->node_guid,      out_mad->data + 12, 8);
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index bcef06bf15e..5fa00669f9b 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -227,7 +227,6 @@ static void mthca_wq_init(struct mthca_wq *wq)
         wq->last_comp = wq->max - 1;
         wq->head      = 0;
         wq->tail      = 0;
-        wq->last      = NULL;
 }
 
 void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
@@ -687,7 +686,7 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         }
 
         if (attr_mask & IB_QP_TIMEOUT) {
-                qp_context->pri_path.ackto = attr->timeout;
+                qp_context->pri_path.ackto = attr->timeout << 3;
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_ACK_TIMEOUT);
         }
 
@@ -1103,6 +1102,9 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
                 }
         }
 
+        qp->sq.last = get_send_wqe(qp, qp->sq.max - 1);
+        qp->rq.last = get_recv_wqe(qp, qp->rq.max - 1);
+
         return 0;
 }
 
@@ -1583,15 +1585,13 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (prev_wqe) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
 
                 if (!size0) {
                         size0 = size;
@@ -1688,13 +1688,11 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
                 qp->wrid[ind] = wr->wr_id;
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0)
                         size0 = size;
@@ -1905,15 +1903,13 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0) {
                         size0 = size;
@@ -2127,5 +2123,6 @@ void __devexit mthca_cleanup_qp_table(struct mthca_dev *dev)
         for (i = 0; i < 2; ++i)
                 mthca_CONF_SPECIAL_QP(dev, i, 0, &status);
 
+        mthca_array_cleanup(&dev->qp_table.qp, dev->limits.num_qps);
         mthca_alloc_cleanup(&dev->qp_table.alloc);
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 75cd2d84ef1..18998d48c53 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -172,6 +172,8 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
                         scatter->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
         }
 
+        srq->last = get_wqe(srq, srq->max - 1);
+
         return 0;
 }
 
@@ -189,7 +191,6 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
 
         srq->max      = attr->max_wr;
         srq->max_gs   = attr->max_sge;
-        srq->last     = NULL;
         srq->counter  = 0;
 
         if (mthca_is_memfree(dev))
@@ -409,7 +410,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -427,7 +428,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         err = -EINVAL;
                         *bad_wr = wr;
                         srq->last = prev_wqe;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
@@ -446,20 +447,16 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         ((struct mthca_data_seg *) wqe)->addr = 0;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << srq->wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << srq->wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD);
 
                 srq->wrid[ind]  = wr->wr_id;
                 srq->first_free = next_ind;
         }
 
-        return nreq;
-
         if (likely(nreq)) {
                 __be32 doorbell[2];
 
@@ -503,7 +500,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -519,7 +516,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                 if (unlikely(wr->num_sge > srq->max_gs)) {
                         err = -EINVAL;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bea960b8191..4ea1c1ca85b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -257,7 +257,7 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
 
 void ipoib_mcast_restart_task(void *dev_ptr);
 int ipoib_mcast_start_thread(struct net_device *dev);
-int ipoib_mcast_stop_thread(struct net_device *dev);
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush);
 
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index ef0e3894863..f7440096b5e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -432,7 +432,7 @@ int ipoib_ib_dev_down(struct net_device *dev)
                 flush_workqueue(ipoib_workqueue);
         }
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /*
          * Flush the multicast groups first so we stop any multicast joins. The
@@ -599,7 +599,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
 
         ipoib_dbg(priv, "cleaning up ib_dev\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /* Delete the broadcast address and the local address */
         ipoib_mcast_dev_down(dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 49d120d2b92..6c5bf07489f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -474,7 +474,7 @@ err:
         spin_unlock(&priv->lock);
 }
 
-static void path_lookup(struct sk_buff *skb, struct net_device *dev)
+static void ipoib_path_lookup(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(skb->dev);
 
@@ -569,7 +569,7 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->dst && skb->dst->neighbour) {
                 if (unlikely(!*to_ipoib_neigh(skb->dst->neighbour))) {
-                        path_lookup(skb, dev);
+                        ipoib_path_lookup(skb, dev);
                         goto out;
                 }
 
@@ -1005,6 +1005,7 @@ debug_failed:
 
 register_failed:
         ib_unregister_event_handler(&priv->event_handler);
+        flush_scheduled_work();
 
 event_failed:
         ipoib_dev_cleanup(priv->dev);
@@ -1057,6 +1058,7 @@ static void ipoib_remove_one(struct ib_device *device)
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
                 ib_unregister_event_handler(&priv->event_handler);
+                flush_scheduled_work();
 
                 unregister_netdev(priv->dev);
                 ipoib_dev_cleanup(priv->dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index aca7aea18a6..36ce29836bf 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -145,7 +145,7 @@ static struct ipoib_mcast *ipoib_mcast_alloc(struct net_device *dev,
 
         mcast->dev = dev;
         mcast->created = jiffies;
-        mcast->backoff = HZ;
+        mcast->backoff = 1;
         mcast->logcount = 0;
 
         INIT_LIST_HEAD(&mcast->list);
@@ -396,7 +396,7 @@ static void ipoib_mcast_join_complete(int status,
                         IPOIB_GID_ARG(mcast->mcmember.mgid), status);
 
         if (!status && !ipoib_mcast_join_finish(mcast, mcmember)) {
-                mcast->backoff = HZ;
+                mcast->backoff = 1;
                 down(&mcast_mutex);
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_work(ipoib_workqueue, &priv->mcast_task);
@@ -496,7 +496,7 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_delayed_work(ipoib_workqueue,
                                            &priv->mcast_task,
-                                           mcast->backoff);
+                                           mcast->backoff * HZ);
                 up(&mcast_mutex);
         } else
                 mcast->query_id = ret;
@@ -598,7 +598,7 @@ int ipoib_mcast_start_thread(struct net_device *dev)
         return 0;
 }
 
-int ipoib_mcast_stop_thread(struct net_device *dev)
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_mcast *mcast;
@@ -610,7 +610,8 @@ int ipoib_mcast_stop_thread(struct net_device *dev)
         cancel_delayed_work(&priv->mcast_task);
         up(&mcast_mutex);
 
-        flush_workqueue(ipoib_workqueue);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
 
         if (priv->broadcast && priv->broadcast->query) {
                 ib_sa_cancel_query(priv->broadcast->query_id, priv->broadcast->query);
@@ -832,7 +833,7 @@ void ipoib_mcast_restart_task(void *dev_ptr)
 
         ipoib_dbg_mcast(priv, "restarting multicast task\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 0);
 
         spin_lock_irqsave(&priv->lock, flags);