Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (46 commits)
  IB/uverbs: Don't serialize with ib_uverbs_idr_mutex
  IB/mthca: Make all device methods truly reentrant
  IB/mthca: Fix memory leak on modify_qp error paths
  IB/uverbs: Factor out common idr code
  IB/uverbs: Don't decrement usecnt on error paths
  IB/uverbs: Release lock on error path
  IB/cm: Use address handle helpers
  IB/sa: Add ib_init_ah_from_path()
  IB: Add ib_init_ah_from_wc()
  IB/ucm: Get rid of duplicate P_Key parameter
  IB/srp: Factor out common request reset code
  IB/srp: Support SRP rev. 10 targets
  [SCSI] srp.h: Add I/O Class values
  IB/fmr: Use device's max_map_map_per_fmr attribute in FMR pool.
  IB/mthca: Fill in max_map_per_fmr device attribute
  IB/ipath: Add client reregister event generation
  IB/mthca: Add client reregister event generation
  IB: Move struct port_info from ipath to <rdma/ib_smi.h>
  IPoIB: Handle client reregister events
  IB: Add client reregister event type
  ...

10 files changed, 146 insertions, 89 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index f7f8391fe43f..1a9d0a2c33c3 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -137,47 +137,11 @@ static int recv_subn_get_guidinfo(struct ib_smp *smp,
         return reply(smp);
 }
 
-struct port_info {
-        __be64 mkey;
-        __be64 gid_prefix;
-        __be16 lid;
-        __be16 sm_lid;
-        __be32 cap_mask;
-        __be16 diag_code;
-        __be16 mkey_lease_period;
-        u8 local_port_num;
-        u8 link_width_enabled;
-        u8 link_width_supported;
-        u8 link_width_active;
-        u8 linkspeed_portstate;                 /* 4 bits, 4 bits */
-        u8 portphysstate_linkdown;              /* 4 bits, 4 bits */
-        u8 mkeyprot_resv_lmc;                   /* 2 bits, 3, 3 */
-        u8 linkspeedactive_enabled;             /* 4 bits, 4 bits */
-        u8 neighbormtu_mastersmsl;              /* 4 bits, 4 bits */
-        u8 vlcap_inittype;                      /* 4 bits, 4 bits */
-        u8 vl_high_limit;
-        u8 vl_arb_high_cap;
-        u8 vl_arb_low_cap;
-        u8 inittypereply_mtucap;                /* 4 bits, 4 bits */
-        u8 vlstallcnt_hoqlife;                  /* 3 bits, 5 bits */
-        u8 operationalvl_pei_peo_fpi_fpo;       /* 4 bits, 1, 1, 1, 1 */
-        __be16 mkey_violations;
-        __be16 pkey_violations;
-        __be16 qkey_violations;
-        u8 guid_cap;
-        u8 clientrereg_resv_subnetto;           /* 1 bit, 2 bits, 5 */
-        u8 resv_resptimevalue;                  /* 3 bits, 5 bits */
-        u8 localphyerrors_overrunerrors;        /* 4 bits, 4 bits */
-        __be16 max_credit_hint;
-        u8 resv;
-        u8 link_roundtrip_latency[3];
-} __attribute__ ((packed));
-
 static int recv_subn_get_portinfo(struct ib_smp *smp,
                                   struct ib_device *ibdev, u8 port)
 {
         struct ipath_ibdev *dev;
-        struct port_info *pip = (struct port_info *)smp->data;
+        struct ib_port_info *pip = (struct ib_port_info *)smp->data;
         u16 lid;
         u8 ibcstat;
         u8 mtu;
@@ -312,7 +276,7 @@ static int recv_subn_set_guidinfo(struct ib_smp *smp,
 static int recv_subn_set_portinfo(struct ib_smp *smp,
                                   struct ib_device *ibdev, u8 port)
 {
-        struct port_info *pip = (struct port_info *)smp->data;
+        struct ib_port_info *pip = (struct ib_port_info *)smp->data;
         struct ib_event event;
         struct ipath_ibdev *dev;
         u32 flags;
@@ -445,7 +409,7 @@ static int recv_subn_set_portinfo(struct ib_smp *smp,
 
         if (pip->clientrereg_resv_subnetto & 0x80) {
                 clientrereg = 1;
-                event.event = IB_EVENT_LID_CHANGE;
+                event.event = IB_EVENT_CLIENT_REREGISTER;
                 ib_dispatch_event(&event);
         }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 798e13e14faf..d0f7731802c9 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -174,7 +174,6 @@ enum {
 
 struct mthca_cmd_context {
         struct completion done;
-        struct timer_list timer;
         int               result;
         int               next;
         u64               out_param;
@@ -362,15 +361,6 @@ void mthca_cmd_event(struct mthca_dev *dev,
         complete(&context->done);
 }
 
-static void event_timeout(unsigned long context_ptr)
-{
-        struct mthca_cmd_context *context =
-                (struct mthca_cmd_context *) context_ptr;
-
-        context->result = -EBUSY;
-        complete(&context->done);
-}
-
 static int mthca_cmd_wait(struct mthca_dev *dev,
                           u64 in_param,
                           u64 *out_param,
@@ -401,11 +391,10 @@ static int mthca_cmd_wait(struct mthca_dev *dev,
         if (err)
                 goto out;
 
-        context->timer.expires  = jiffies + timeout;
-        add_timer(&context->timer);
-
-        wait_for_completion(&context->done);
-        del_timer_sync(&context->timer);
+        if (!wait_for_completion_timeout(&context->done, timeout)) {
+                err = -EBUSY;
+                goto out;
+        }
 
         err = context->result;
         if (err)
@@ -535,10 +524,6 @@ int mthca_cmd_use_events(struct mthca_dev *dev)
         for (i = 0; i < dev->cmd.max_cmds; ++i) {
                 dev->cmd.context[i].token = i;
                 dev->cmd.context[i].next = i + 1;
-                init_timer(&dev->cmd.context[i].timer);
-                dev->cmd.context[i].timer.data     =
-                        (unsigned long) &dev->cmd.context[i];
-                dev->cmd.context[i].timer.function = event_timeout;
         }
 
         dev->cmd.context[dev->cmd.max_cmds - 1].next = -1;
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 205854e9c662..3e27a084257e 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -540,8 +540,17 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
                 entry->wr_id = srq->wrid[wqe_index];
                 mthca_free_srq_wqe(srq, wqe);
         } else {
+                s32 wqe;
                 wq = &(*cur_qp)->rq;
-                wqe_index = be32_to_cpu(cqe->wqe) >> wq->wqe_shift;
+                wqe = be32_to_cpu(cqe->wqe);
+                wqe_index = wqe >> wq->wqe_shift;
+               /*
+                * WQE addr == base - 1 might be reported in receive completion
+                * with error instead of (rq size - 1) by Sinai FW 1.0.800 and
+                * Arbel FW 5.1.400.  This bug should be fixed in later FW revs.
+                */
+                if (unlikely(wqe_index < 0))
+                        wqe_index = wq->max - 1;
                 entry->wr_id = (*cur_qp)->wrid[wqe_index];
         }
 
@@ -813,6 +822,7 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
         spin_lock_init(&cq->lock);
         cq->refcount = 1;
         init_waitqueue_head(&cq->wait);
+        mutex_init(&cq->mutex);
 
         memset(cq_context, 0, sizeof *cq_context);
         cq_context->flags           = cpu_to_be32(MTHCA_CQ_STATUS_OK      |
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 99f109c3815d..d536217e700e 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -695,10 +695,6 @@ static void mthca_unmap_reg(struct mthca_dev *dev, unsigned long offset,
 
 static int __devinit mthca_map_eq_regs(struct mthca_dev *dev)
 {
-        unsigned long mthca_base;
-
-        mthca_base = pci_resource_start(dev->pdev, 0);
-
         if (mthca_is_memfree(dev)) {
                 /*
                  * We assume that the EQ arm and EQ set CI registers
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 4730863ece9a..d9bc030bcccc 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -114,14 +114,22 @@ static void smp_snoop(struct ib_device *ibdev,
              mad->mad_hdr.mgmt_class  == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) &&
             mad->mad_hdr.method     == IB_MGMT_METHOD_SET) {
                 if (mad->mad_hdr.attr_id == IB_SMP_ATTR_PORT_INFO) {
+                        struct ib_port_info *pinfo =
+                                (struct ib_port_info *) ((struct ib_smp *) mad)->data;
+
                         mthca_update_rate(to_mdev(ibdev), port_num);
                         update_sm_ah(to_mdev(ibdev), port_num,
-                                     be16_to_cpup((__be16 *) (mad->data + 58)),
-                                     (*(u8 *) (mad->data + 76)) & 0xf);
+                                     be16_to_cpu(pinfo->lid),
+                                     pinfo->neighbormtu_mastersmsl & 0xf);
 
                         event.device           = ibdev;
-                        event.event            = IB_EVENT_LID_CHANGE;
                         event.element.port_num = port_num;
+
+                        if(pinfo->clientrereg_resv_subnetto & 0x80)
+                                event.event    = IB_EVENT_CLIENT_REREGISTER;
+                        else
+                                event.event    = IB_EVENT_LID_CHANGE;
+
                         ib_dispatch_event(&event);
                 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index a2eae8a30167..230ae21db8fd 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -115,6 +115,16 @@ static int mthca_query_device(struct ib_device *ibdev,
         props->max_mcast_qp_attach = MTHCA_QP_PER_MGM;
         props->max_total_mcast_qp_attach = props->max_mcast_qp_attach *
                                            props->max_mcast_grp;
+        /*
+         * If Sinai memory key optimization is being used, then only
+         * the 8-bit key portion will change.  For other HCAs, the
+         * unused index bits will also be used for FMR remapping.
+         */
+        if (mdev->mthca_flags & MTHCA_FLAG_SINAI_OPT)
+                props->max_map_per_fmr = 255;
+        else
+                props->max_map_per_fmr =
+                        (1 << (32 - long_log2(mdev->limits.num_mpts))) - 1;
 
         err = 0;
  out:
@@ -783,18 +793,24 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda
         if (entries < 1 || entries > dev->limits.max_cqes)
                 return -EINVAL;
 
+        mutex_lock(&cq->mutex);
+
         entries = roundup_pow_of_two(entries + 1);
-        if (entries == ibcq->cqe + 1)
-                return 0;
+        if (entries == ibcq->cqe + 1) {
+                ret = 0;
+                goto out;
+        }
 
         if (cq->is_kernel) {
                 ret = mthca_alloc_resize_buf(dev, cq, entries);
                 if (ret)
-                        return ret;
+                        goto out;
                 lkey = cq->resize_buf->buf.mr.ibmr.lkey;
         } else {
-                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
-                        return -EFAULT;
+                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) {
+                        ret = -EFAULT;
+                        goto out;
+                }
                 lkey = ucmd.lkey;
         }
 
@@ -811,7 +827,7 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda
                         cq->resize_buf = NULL;
                         spin_unlock_irq(&cq->lock);
                 }
-                return ret;
+                goto out;
         }
 
         if (cq->is_kernel) {
@@ -838,7 +854,10 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda
         } else
                 ibcq->cqe = entries - 1;
 
-        return 0;
+out:
+        mutex_unlock(&cq->mutex);
+
+        return ret;
 }
 
 static int mthca_destroy_cq(struct ib_cq *cq)
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 179a8f610d0f..8de2887ba15c 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -214,6 +214,7 @@ struct mthca_cq {
         int                     arm_sn;
 
         wait_queue_head_t       wait;
+        struct mutex            mutex;
 };
 
 struct mthca_srq {
@@ -237,6 +238,7 @@ struct mthca_srq {
         struct mthca_mr         mr;
 
         wait_queue_head_t       wait;
+        struct mutex            mutex;
 };
 
 struct mthca_wq {
@@ -278,6 +280,7 @@ struct mthca_qp {
         union mthca_buf        queue;
 
         wait_queue_head_t      wait;
+        struct mutex           mutex;
 };
 
 struct mthca_sqp {
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 07c13be07a4a..16c387d8170c 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -534,7 +534,9 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         struct mthca_qp_context *qp_context;
         u32 sqd_event = 0;
         u8 status;
-        int err;
+        int err = -EINVAL;
+
+        mutex_lock(&qp->mutex);
 
         if (attr_mask & IB_QP_CUR_STATE) {
                 cur_state = attr->cur_qp_state;
@@ -553,39 +555,41 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                           "%d->%d with attr 0x%08x\n",
                           qp->transport, cur_state, new_state,
                           attr_mask);
-                return -EINVAL;
+                goto out;
         }
 
         if ((attr_mask & IB_QP_PKEY_INDEX) &&
              attr->pkey_index >= dev->limits.pkey_table_len) {
                 mthca_dbg(dev, "P_Key index (%u) too large. max is %d\n",
                           attr->pkey_index, dev->limits.pkey_table_len-1);
-                return -EINVAL;
+                goto out;
         }
 
         if ((attr_mask & IB_QP_PORT) &&
             (attr->port_num == 0 || attr->port_num > dev->limits.num_ports)) {
                 mthca_dbg(dev, "Port number (%u) is invalid\n", attr->port_num);
-                return -EINVAL;
+                goto out;
         }
 
         if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
             attr->max_rd_atomic > dev->limits.max_qp_init_rdma) {
                 mthca_dbg(dev, "Max rdma_atomic as initiator %u too large (max is %d)\n",
                           attr->max_rd_atomic, dev->limits.max_qp_init_rdma);
-                return -EINVAL;
+                goto out;
         }
 
         if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
             attr->max_dest_rd_atomic > 1 << dev->qp_table.rdb_shift) {
                 mthca_dbg(dev, "Max rdma_atomic as responder %u too large (max %d)\n",
                           attr->max_dest_rd_atomic, 1 << dev->qp_table.rdb_shift);
-                return -EINVAL;
+                goto out;
         }
 
         mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
-        if (IS_ERR(mailbox))
-                return PTR_ERR(mailbox);
+        if (IS_ERR(mailbox)) {
+                err = PTR_ERR(mailbox);
+                goto out;
+        }
         qp_param = mailbox->buf;
         qp_context = &qp_param->context;
         memset(qp_param, 0, sizeof *qp_param);
@@ -618,7 +622,7 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                 if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_2048) {
                         mthca_dbg(dev, "path MTU (%u) is invalid\n",
                                   attr->path_mtu);
-                        return -EINVAL;
+                        goto out_mailbox;
                 }
                 qp_context->mtu_msgmax = (attr->path_mtu << 5) | 31;
         }
@@ -672,7 +676,7 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         if (attr_mask & IB_QP_AV) {
                 if (mthca_path_set(dev, &attr->ah_attr, &qp_context->pri_path,
                                    attr_mask & IB_QP_PORT ? attr->port_num : qp->port))
-                        return -EINVAL;
+                        goto out_mailbox;
 
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_PRIMARY_ADDR_PATH);
         }
@@ -686,18 +690,18 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                 if (attr->alt_pkey_index >= dev->limits.pkey_table_len) {
                         mthca_dbg(dev, "Alternate P_Key index (%u) too large. max is %d\n",
                                   attr->alt_pkey_index, dev->limits.pkey_table_len-1);
-                        return -EINVAL;
+                        goto out_mailbox;
                 }
 
                 if (attr->alt_port_num == 0 || attr->alt_port_num > dev->limits.num_ports) {
                         mthca_dbg(dev, "Alternate port number (%u) is invalid\n",
                                 attr->alt_port_num);
-                        return -EINVAL;
+                        goto out_mailbox;
                 }
 
                 if (mthca_path_set(dev, &attr->alt_ah_attr, &qp_context->alt_path,
                                    attr->alt_ah_attr.port_num))
-                        return -EINVAL;
+                        goto out_mailbox;
 
                 qp_context->alt_path.port_pkey |= cpu_to_be32(attr->alt_pkey_index |
                                                               attr->alt_port_num << 24);
@@ -793,12 +797,12 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         err = mthca_MODIFY_QP(dev, cur_state, new_state, qp->qpn, 0,
                               mailbox, sqd_event, &status);
         if (err)
-                goto out;
+                goto out_mailbox;
         if (status) {
                 mthca_warn(dev, "modify QP %d->%d returned status %02x.\n",
                            cur_state, new_state, status);
                 err = -EINVAL;
-                goto out;
+                goto out_mailbox;
         }
 
         qp->state = new_state;
@@ -853,8 +857,11 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                 }
         }
 
-out:
+out_mailbox:
         mthca_free_mailbox(dev, mailbox);
+
+out:
+        mutex_unlock(&qp->mutex);
         return err;
 }
 
@@ -1100,6 +1107,7 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
 
         qp->refcount = 1;
         init_waitqueue_head(&qp->wait);
+        mutex_init(&qp->mutex);
         qp->state        = IB_QPS_RESET;
         qp->atomic_rd_en = 0;
         qp->resp_depth   = 0;
diff --git a/drivers/infiniband/hw/mthca/mthca_reset.c b/drivers/infiniband/hw/mthca/mthca_reset.c
index df5e494a9d38..f4fddd5327f5 100644
--- a/drivers/infiniband/hw/mthca/mthca_reset.c
+++ b/drivers/infiniband/hw/mthca/mthca_reset.c
@@ -49,6 +49,12 @@ int mthca_reset(struct mthca_dev *mdev)
         u32 *hca_header    = NULL;
         u32 *bridge_header = NULL;
         struct pci_dev *bridge = NULL;
+        int bridge_pcix_cap = 0;
+        int hca_pcie_cap = 0;
+        int hca_pcix_cap = 0;
+
+        u16 devctl;
+        u16 linkctl;
 
 #define MTHCA_RESET_OFFSET 0xf0010
 #define MTHCA_RESET_VALUE  swab32(1)
@@ -110,6 +116,9 @@ int mthca_reset(struct mthca_dev *mdev)
                 }
         }
 
+        hca_pcix_cap = pci_find_capability(mdev->pdev, PCI_CAP_ID_PCIX);
+        hca_pcie_cap = pci_find_capability(mdev->pdev, PCI_CAP_ID_EXP);
+
         if (bridge) {
                 bridge_header = kmalloc(256, GFP_KERNEL);
                 if (!bridge_header) {
@@ -129,6 +138,13 @@ int mthca_reset(struct mthca_dev *mdev)
                                 goto out;
                         }
                 }
+                bridge_pcix_cap = pci_find_capability(bridge, PCI_CAP_ID_PCIX);
+                if (!bridge_pcix_cap) {
+                                err = -ENODEV;
+                                mthca_err(mdev, "Couldn't locate HCA bridge "
+                                          "PCI-X capability, aborting.\n");
+                                goto out;
+                }
         }
 
         /* actually hit reset */
@@ -178,6 +194,20 @@ int mthca_reset(struct mthca_dev *mdev)
 good:
         /* Now restore the PCI headers */
         if (bridge) {
+                if (pci_write_config_dword(bridge, bridge_pcix_cap + 0x8,
+                                 bridge_header[(bridge_pcix_cap + 0x8) / 4])) {
+                        err = -ENODEV;
+                        mthca_err(mdev, "Couldn't restore HCA bridge Upstream "
+                                  "split transaction control, aborting.\n");
+                        goto out;
+                }
+                if (pci_write_config_dword(bridge, bridge_pcix_cap + 0xc,
+                                 bridge_header[(bridge_pcix_cap + 0xc) / 4])) {
+                        err = -ENODEV;
+                        mthca_err(mdev, "Couldn't restore HCA bridge Downstream "
+                                  "split transaction control, aborting.\n");
+                        goto out;
+                }
                 /*
                  * Bridge control register is at 0x3e, so we'll
                  * naturally restore it last in this loop.
@@ -203,6 +233,35 @@ good:
                 }
         }
 
+        if (hca_pcix_cap) {
+                if (pci_write_config_dword(mdev->pdev, hca_pcix_cap,
+                                 hca_header[hca_pcix_cap / 4])) {
+                        err = -ENODEV;
+                        mthca_err(mdev, "Couldn't restore HCA PCI-X "
+                                  "command register, aborting.\n");
+                        goto out;
+                }
+        }
+
+        if (hca_pcie_cap) {
+                devctl = hca_header[(hca_pcie_cap + PCI_EXP_DEVCTL) / 4];
+                if (pci_write_config_word(mdev->pdev, hca_pcie_cap + PCI_EXP_DEVCTL,
+                                           devctl)) {
+                        err = -ENODEV;
+                        mthca_err(mdev, "Couldn't restore HCA PCI Express "
+                                  "Device Control register, aborting.\n");
+                        goto out;
+                }
+                linkctl = hca_header[(hca_pcie_cap + PCI_EXP_LNKCTL) / 4];
+                if (pci_write_config_word(mdev->pdev, hca_pcie_cap + PCI_EXP_LNKCTL,
+                                           linkctl)) {
+                        err = -ENODEV;
+                        mthca_err(mdev, "Couldn't restore HCA PCI Express "
+                                  "Link control register, aborting.\n");
+                        goto out;
+                }
+        }
+
         for (i = 0; i < 16; ++i) {
                 if (i * 4 == PCI_COMMAND)
                         continue;
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index b292fefa3b41..fab417c5cf43 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -243,6 +243,7 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
         spin_lock_init(&srq->lock);
         srq->refcount = 1;
         init_waitqueue_head(&srq->wait);
+        mutex_init(&srq->mutex);
 
         if (mthca_is_memfree(dev))
                 mthca_arbel_init_srq_context(dev, pd, srq, mailbox->buf);
@@ -371,7 +372,11 @@ int mthca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
         if (attr_mask & IB_SRQ_LIMIT) {
                 if (attr->srq_limit > srq->max)
                         return -EINVAL;
+
+                mutex_lock(&srq->mutex);
                 ret = mthca_ARM_SRQ(dev, srq->srqn, attr->srq_limit, &status);
+                mutex_unlock(&srq->mutex);
+
                 if (ret)
                         return ret;
                 if (status)