17 files changed, 148 insertions, 105 deletions

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index d393b504bf26..c82f47a66e48 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -665,7 +665,15 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         struct ib_wc mad_wc;
         struct ib_send_wr *send_wr = &mad_send_wr->send_wr;
 
-        if (!smi_handle_dr_smp_send(smp, device->node_type, port_num)) {
+        /*
+         * Directed route handling starts if the initial LID routed part of
+         * a request or the ending LID routed part of a response is empty.
+         * If we are at the start of the LID routed part, don't update the
+         * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
+         */
+        if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
+             IB_LID_PERMISSIVE &&
+            !smi_handle_dr_smp_send(smp, device->node_type, port_num)) {
                 ret = -EINVAL;
                 printk(KERN_ERR PFX "Invalid directed route\n");
                 goto out;
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index acda7d63d6fe..501cc054cb3b 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -956,6 +956,8 @@ static void ib_sa_remove_one(struct ib_device *device)
 
         ib_unregister_event_handler(&sa_dev->event_handler);
 
+        flush_scheduled_work();
+
         for (i = 0; i <= sa_dev->end_port - sa_dev->start_port; ++i) {
                 ib_unregister_mad_agent(sa_dev->port[i].agent);
                 kref_put(&sa_dev->port[i].sm_ah->ref, free_sm_ah);
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index e95c4293a496..f6a05965a4e8 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1319,15 +1319,6 @@ static struct class ucm_class = {
         .release = ib_ucm_release_class_dev
 };
 
-static ssize_t show_dev(struct class_device *class_dev, char *buf)
-{
-        struct ib_ucm_device *dev;
-        
-        dev = container_of(class_dev, struct ib_ucm_device, class_dev);
-        return print_dev_t(buf, dev->dev.dev);
-}
-static CLASS_DEVICE_ATTR(dev, S_IRUGO, show_dev, NULL);
-
 static ssize_t show_ibdev(struct class_device *class_dev, char *buf)
 {
         struct ib_ucm_device *dev;
@@ -1364,15 +1355,13 @@ static void ib_ucm_add_one(struct ib_device *device)
 
         ucm_dev->class_dev.class = &ucm_class;
         ucm_dev->class_dev.dev = device->dma_device;
+        ucm_dev->class_dev.devt = ucm_dev->dev.dev;
         snprintf(ucm_dev->class_dev.class_id, BUS_ID_SIZE, "ucm%d",
                  ucm_dev->devnum);
         if (class_device_register(&ucm_dev->class_dev))
                 goto err_cdev;
 
         if (class_device_create_file(&ucm_dev->class_dev,
-                                     &class_device_attr_dev))
-                goto err_class;
-        if (class_device_create_file(&ucm_dev->class_dev,
                                      &class_device_attr_ibdev))
                 goto err_class;
 
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 96ea79b63df7..903f85a4bc0c 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -902,6 +902,7 @@ static void __exit ib_uverbs_cleanup(void)
         unregister_filesystem(&uverbs_event_fs);
         class_destroy(uverbs_class);
         unregister_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES);
+        flush_scheduled_work();
         idr_destroy(&ib_uverbs_pd_idr);
         idr_destroy(&ib_uverbs_mr_idr);
         idr_destroy(&ib_uverbs_mw_idr);
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index a14eed08a0fc..a19e0ed03d7c 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -184,7 +184,7 @@ int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
                         ah->av->sl_tclass_flowlabel & cpu_to_be32(0xfffff);
                 ib_get_cached_gid(&dev->ib_dev,
                                   be32_to_cpu(ah->av->port_pd) >> 24,
-                                  ah->av->gid_index,
+                                  ah->av->gid_index % dev->limits.gid_table_len,
                                   &header->grh.source_gid);
                 memcpy(header->grh.destination_gid.raw,
                        ah->av->dgid, 16);
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index be1791be627b..2825615ce81c 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -199,8 +199,7 @@ static int mthca_cmd_post(struct mthca_dev *dev,
 {
         int err = 0;
 
-        if (down_interruptible(&dev->cmd.hcr_sem))
-                return -EINTR;
+        mutex_lock(&dev->cmd.hcr_mutex);
 
         if (event) {
                 unsigned long end = jiffies + GO_BIT_TIMEOUT;
@@ -238,7 +237,7 @@ static int mthca_cmd_post(struct mthca_dev *dev,
                                                op),                       dev->hcr + 6 * 4);
 
 out:
-        up(&dev->cmd.hcr_sem);
+        mutex_unlock(&dev->cmd.hcr_mutex);
         return err;
 }
 
@@ -255,8 +254,7 @@ static int mthca_cmd_poll(struct mthca_dev *dev,
         int err = 0;
         unsigned long end;
 
-        if (down_interruptible(&dev->cmd.poll_sem))
-                return -EINTR;
+        down(&dev->cmd.poll_sem);
 
         err = mthca_cmd_post(dev, in_param,
                              out_param ? *out_param : 0,
@@ -333,8 +331,7 @@ static int mthca_cmd_wait(struct mthca_dev *dev,
         int err = 0;
         struct mthca_cmd_context *context;
 
-        if (down_interruptible(&dev->cmd.event_sem))
-                return -EINTR;
+        down(&dev->cmd.event_sem);
 
         spin_lock(&dev->cmd.context_lock);
         BUG_ON(dev->cmd.free_head < 0);
@@ -438,7 +435,7 @@ static int mthca_cmd_imm(struct mthca_dev *dev,
 
 int mthca_cmd_init(struct mthca_dev *dev)
 {
-        sema_init(&dev->cmd.hcr_sem, 1);
+        mutex_init(&dev->cmd.hcr_mutex);
         sema_init(&dev->cmd.poll_sem, 1);
         dev->cmd.use_events = 0;
 
@@ -1032,25 +1029,6 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
         MTHCA_GET(size, outbox, QUERY_DEV_LIM_UAR_ENTRY_SZ_OFFSET);
         dev_lim->uar_scratch_entry_sz = size;
 
-        mthca_dbg(dev, "Max QPs: %d, reserved QPs: %d, entry size: %d\n",
-                  dev_lim->max_qps, dev_lim->reserved_qps, dev_lim->qpc_entry_sz);
-        mthca_dbg(dev, "Max SRQs: %d, reserved SRQs: %d, entry size: %d\n",
-                  dev_lim->max_srqs, dev_lim->reserved_srqs, dev_lim->srq_entry_sz);
-        mthca_dbg(dev, "Max CQs: %d, reserved CQs: %d, entry size: %d\n",
-                  dev_lim->max_cqs, dev_lim->reserved_cqs, dev_lim->cqc_entry_sz);
-        mthca_dbg(dev, "Max EQs: %d, reserved EQs: %d, entry size: %d\n",
-                  dev_lim->max_eqs, dev_lim->reserved_eqs, dev_lim->eqc_entry_sz);
-        mthca_dbg(dev, "reserved MPTs: %d, reserved MTTs: %d\n",
-                  dev_lim->reserved_mrws, dev_lim->reserved_mtts);
-        mthca_dbg(dev, "Max PDs: %d, reserved PDs: %d, reserved UARs: %d\n",
-                  dev_lim->max_pds, dev_lim->reserved_pds, dev_lim->reserved_uars);
-        mthca_dbg(dev, "Max QP/MCG: %d, reserved MGMs: %d\n",
-                  dev_lim->max_pds, dev_lim->reserved_mgms);
-        mthca_dbg(dev, "Max CQEs: %d, max WQEs: %d, max SRQ WQEs: %d\n",
-                  dev_lim->max_cq_sz, dev_lim->max_qp_sz, dev_lim->max_srq_sz);
-
-        mthca_dbg(dev, "Flags: %08x\n", dev_lim->flags);
-
         if (mthca_is_memfree(dev)) {
                 MTHCA_GET(field, outbox, QUERY_DEV_LIM_MAX_SRQ_SZ_OFFSET);
                 dev_lim->max_srq_sz = 1 << field;
@@ -1096,6 +1074,25 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
                 dev_lim->mpt_entry_sz = MTHCA_MPT_ENTRY_SIZE;
         }
 
+        mthca_dbg(dev, "Max QPs: %d, reserved QPs: %d, entry size: %d\n",
+                  dev_lim->max_qps, dev_lim->reserved_qps, dev_lim->qpc_entry_sz);
+        mthca_dbg(dev, "Max SRQs: %d, reserved SRQs: %d, entry size: %d\n",
+                  dev_lim->max_srqs, dev_lim->reserved_srqs, dev_lim->srq_entry_sz);
+        mthca_dbg(dev, "Max CQs: %d, reserved CQs: %d, entry size: %d\n",
+                  dev_lim->max_cqs, dev_lim->reserved_cqs, dev_lim->cqc_entry_sz);
+        mthca_dbg(dev, "Max EQs: %d, reserved EQs: %d, entry size: %d\n",
+                  dev_lim->max_eqs, dev_lim->reserved_eqs, dev_lim->eqc_entry_sz);
+        mthca_dbg(dev, "reserved MPTs: %d, reserved MTTs: %d\n",
+                  dev_lim->reserved_mrws, dev_lim->reserved_mtts);
+        mthca_dbg(dev, "Max PDs: %d, reserved PDs: %d, reserved UARs: %d\n",
+                  dev_lim->max_pds, dev_lim->reserved_pds, dev_lim->reserved_uars);
+        mthca_dbg(dev, "Max QP/MCG: %d, reserved MGMs: %d\n",
+                  dev_lim->max_pds, dev_lim->reserved_mgms);
+        mthca_dbg(dev, "Max CQEs: %d, max WQEs: %d, max SRQ WQEs: %d\n",
+                  dev_lim->max_cq_sz, dev_lim->max_qp_sz, dev_lim->max_srq_sz);
+
+        mthca_dbg(dev, "Flags: %08x\n", dev_lim->flags);
+
 out:
         mthca_free_mailbox(dev, mailbox);
         return err;
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index a104ab041ea3..e481037288d6 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -44,6 +44,8 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/timer.h>
+#include <linux/mutex.h>
+
 #include <asm/semaphore.h>
 
 #include "mthca_provider.h"
@@ -51,8 +53,8 @@
 
 #define DRV_NAME        "ib_mthca"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "0.06"
-#define DRV_RELDATE     "June 23, 2005"
+#define DRV_VERSION     "0.07"
+#define DRV_RELDATE     "February 13, 2006"
 
 enum {
         MTHCA_FLAG_DDR_HIDDEN = 1 << 1,
@@ -111,7 +113,7 @@ enum {
 struct mthca_cmd {
         struct pci_pool          *pool;
         int                       use_events;
-        struct semaphore          hcr_sem;
+        struct mutex              hcr_mutex;
         struct semaphore          poll_sem;
         struct semaphore          event_sem;
         int                       max_cmds;
@@ -256,7 +258,7 @@ struct mthca_av_table {
 };
 
 struct mthca_mcg_table {
-        struct semaphore        sem;
+        struct mutex            mutex;
         struct mthca_alloc      alloc;
         struct mthca_icm_table *table;
 };
@@ -301,7 +303,7 @@ struct mthca_dev {
         u64              ddr_end;
 
         MTHCA_DECLARE_DOORBELL_LOCK(doorbell_lock)
-        struct semaphore cap_mask_mutex;
+        struct mutex cap_mask_mutex;
 
         void __iomem    *hcr;
         void __iomem    *kar;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 8b00d9a0f6f4..9c849d27b06e 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -155,6 +155,13 @@ static int __devinit mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim
                 return -ENODEV;
         }
 
+        if (dev_lim->uar_size > pci_resource_len(mdev->pdev, 2)) {
+                mthca_err(mdev, "HCA reported UAR size of 0x%x bigger than "
+                          "PCI resource 2 size of 0x%lx, aborting.\n",
+                          dev_lim->uar_size, pci_resource_len(mdev->pdev, 2));
+                return -ENODEV;
+        }
+
         mdev->limits.num_ports          = dev_lim->num_ports;
         mdev->limits.vl_cap             = dev_lim->max_vl;
         mdev->limits.mtu_cap            = dev_lim->max_mtu;
@@ -976,8 +983,7 @@ static int __devinit mthca_init_one(struct pci_dev *pdev,
                 err = -ENODEV;
                 goto err_disable_pdev;
         }
-        if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM) ||
-            pci_resource_len(pdev, 2) != 1 << 23) {
+        if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
                 dev_err(&pdev->dev, "Missing UAR, aborting.\n");
                 err = -ENODEV;
                 goto err_disable_pdev;
diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index 77bc6c746f43..321f11e707f2 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -154,10 +154,7 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 return PTR_ERR(mailbox);
         mgm = mailbox->buf;
 
-        if (down_interruptible(&dev->mcg_table.sem)) {
-                err = -EINTR;
-                goto err_sem;
-        }
+        mutex_lock(&dev->mcg_table.mutex);
 
         err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index);
         if (err)
@@ -241,8 +238,8 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 BUG_ON(index < dev->limits.num_mgms);
                 mthca_free(&dev->mcg_table.alloc, index);
         }
-        up(&dev->mcg_table.sem);
- err_sem:
+        mutex_unlock(&dev->mcg_table.mutex);
+
         mthca_free_mailbox(dev, mailbox);
         return err;
 }
@@ -263,10 +260,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 return PTR_ERR(mailbox);
         mgm = mailbox->buf;
 
-        if (down_interruptible(&dev->mcg_table.sem)) {
-                err = -EINTR;
-                goto err_sem;
-        }
+        mutex_lock(&dev->mcg_table.mutex);
 
         err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index);
         if (err)
@@ -371,8 +365,8 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
         }
 
  out:
-        up(&dev->mcg_table.sem);
- err_sem:
+        mutex_unlock(&dev->mcg_table.mutex);
+
         mthca_free_mailbox(dev, mailbox);
         return err;
 }
@@ -389,7 +383,7 @@ int __devinit mthca_init_mcg_table(struct mthca_dev *dev)
         if (err)
                 return err;
 
-        init_MUTEX(&dev->mcg_table.sem);
+        mutex_init(&dev->mcg_table.mutex);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 9fb985a016e9..d709cb162a72 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -50,7 +50,7 @@ enum {
 };
 
 struct mthca_user_db_table {
-        struct semaphore mutex;
+        struct mutex mutex;
         struct {
                 u64                uvirt;
                 struct scatterlist mem;
@@ -158,7 +158,7 @@ int mthca_table_get(struct mthca_dev *dev, struct mthca_icm_table *table, int ob
         int ret = 0;
         u8 status;
 
-        down(&table->mutex);
+        mutex_lock(&table->mutex);
 
         if (table->icm[i]) {
                 ++table->icm[i]->refcount;
@@ -184,7 +184,7 @@ int mthca_table_get(struct mthca_dev *dev, struct mthca_icm_table *table, int ob
         ++table->icm[i]->refcount;
 
 out:
-        up(&table->mutex);
+        mutex_unlock(&table->mutex);
         return ret;
 }
 
@@ -198,7 +198,7 @@ void mthca_table_put(struct mthca_dev *dev, struct mthca_icm_table *table, int o
 
         i = (obj & (table->num_obj - 1)) * table->obj_size / MTHCA_TABLE_CHUNK_SIZE;
 
-        down(&table->mutex);
+        mutex_lock(&table->mutex);
 
         if (--table->icm[i]->refcount == 0) {
                 mthca_UNMAP_ICM(dev, table->virt + i * MTHCA_TABLE_CHUNK_SIZE,
@@ -207,7 +207,7 @@ void mthca_table_put(struct mthca_dev *dev, struct mthca_icm_table *table, int o
                 table->icm[i] = NULL;
         }
 
-        up(&table->mutex);
+        mutex_unlock(&table->mutex);
 }
 
 void *mthca_table_find(struct mthca_icm_table *table, int obj)
@@ -220,7 +220,7 @@ void *mthca_table_find(struct mthca_icm_table *table, int obj)
         if (!table->lowmem)
                 return NULL;
 
-        down(&table->mutex);
+        mutex_lock(&table->mutex);
 
         idx = (obj & (table->num_obj - 1)) * table->obj_size;
         icm = table->icm[idx / MTHCA_TABLE_CHUNK_SIZE];
@@ -240,7 +240,7 @@ void *mthca_table_find(struct mthca_icm_table *table, int obj)
         }
 
 out:
-        up(&table->mutex);
+        mutex_unlock(&table->mutex);
         return page ? lowmem_page_address(page) + offset : NULL;
 }
 
@@ -301,7 +301,7 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
         table->num_obj  = nobj;
         table->obj_size = obj_size;
         table->lowmem   = use_lowmem;
-        init_MUTEX(&table->mutex);
+        mutex_init(&table->mutex);
 
         for (i = 0; i < num_icm; ++i)
                 table->icm[i] = NULL;
@@ -380,7 +380,7 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
         if (index < 0 || index > dev->uar_table.uarc_size / 8)
                 return -EINVAL;
 
-        down(&db_tab->mutex);
+        mutex_lock(&db_tab->mutex);
 
         i = index / MTHCA_DB_REC_PER_PAGE;
 
@@ -424,7 +424,7 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
         db_tab->page[i].refcount = 1;
 
 out:
-        up(&db_tab->mutex);
+        mutex_unlock(&db_tab->mutex);
         return ret;
 }
 
@@ -439,11 +439,11 @@ void mthca_unmap_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
          * pages until we clean up the whole db table.
          */
 
-        down(&db_tab->mutex);
+        mutex_lock(&db_tab->mutex);
 
         --db_tab->page[index / MTHCA_DB_REC_PER_PAGE].refcount;
 
-        up(&db_tab->mutex);
+        mutex_unlock(&db_tab->mutex);
 }
 
 struct mthca_user_db_table *mthca_init_user_db_tab(struct mthca_dev *dev)
@@ -460,7 +460,7 @@ struct mthca_user_db_table *mthca_init_user_db_tab(struct mthca_dev *dev)
         if (!db_tab)
                 return ERR_PTR(-ENOMEM);
 
-        init_MUTEX(&db_tab->mutex);
+        mutex_init(&db_tab->mutex);
         for (i = 0; i < npages; ++i) {
                 db_tab->page[i].refcount = 0;
                 db_tab->page[i].uvirt    = 0;
@@ -499,7 +499,7 @@ int mthca_alloc_db(struct mthca_dev *dev, enum mthca_db_type type,
         int ret = 0;
         u8 status;
 
-        down(&dev->db_tab->mutex);
+        mutex_lock(&dev->db_tab->mutex);
 
         switch (type) {
         case MTHCA_DB_TYPE_CQ_ARM:
@@ -585,7 +585,7 @@ found:
         *db = (__be32 *) &page->db_rec[j];
 
 out:
-        up(&dev->db_tab->mutex);
+        mutex_unlock(&dev->db_tab->mutex);
 
         return ret;
 }
@@ -601,7 +601,7 @@ void mthca_free_db(struct mthca_dev *dev, int type, int db_index)
 
         page = dev->db_tab->page + i;
 
-        down(&dev->db_tab->mutex);
+        mutex_lock(&dev->db_tab->mutex);
 
         page->db_rec[j] = 0;
         if (i >= dev->db_tab->min_group2)
@@ -624,7 +624,7 @@ void mthca_free_db(struct mthca_dev *dev, int type, int db_index)
                         ++dev->db_tab->min_group2;
         }
 
-        up(&dev->db_tab->mutex);
+        mutex_unlock(&dev->db_tab->mutex);
 }
 
 int mthca_init_db_tab(struct mthca_dev *dev)
@@ -638,7 +638,7 @@ int mthca_init_db_tab(struct mthca_dev *dev)
         if (!dev->db_tab)
                 return -ENOMEM;
 
-        init_MUTEX(&dev->db_tab->mutex);
+        mutex_init(&dev->db_tab->mutex);
 
         dev->db_tab->npages     = dev->uar_table.uarc_size / 4096;
         dev->db_tab->max_group1 = 0;
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.h b/drivers/infiniband/hw/mthca/mthca_memfree.h
index 4fdca26eea85..36f1141a08aa 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.h
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.h
@@ -39,8 +39,7 @@
 
 #include <linux/list.h>
 #include <linux/pci.h>
-
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 #define MTHCA_ICM_CHUNK_LEN \
         ((256 - sizeof (struct list_head) - 2 * sizeof (int)) /         \
@@ -64,7 +63,7 @@ struct mthca_icm_table {
         int               num_obj;
         int               obj_size;
         int               lowmem;
-        struct semaphore  mutex;
+        struct mutex      mutex;
         struct mthca_icm *icm[0];
 };
 
@@ -147,7 +146,7 @@ struct mthca_db_table {
         int                   max_group1;
         int                   min_group2;
         struct mthca_db_page *page;
-        struct semaphore      mutex;
+        struct mutex          mutex;
 };
 
 enum mthca_db_type {
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 484a7e6b7f8c..e88e39aef85a 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -185,7 +185,7 @@ static int mthca_modify_port(struct ib_device *ibdev,
         int err;
         u8 status;
 
-        if (down_interruptible(&to_mdev(ibdev)->cap_mask_mutex))
+        if (mutex_lock_interruptible(&to_mdev(ibdev)->cap_mask_mutex))
                 return -ERESTARTSYS;
 
         err = mthca_query_port(ibdev, port, &attr);
@@ -207,7 +207,7 @@ static int mthca_modify_port(struct ib_device *ibdev,
         }
 
 out:
-        up(&to_mdev(ibdev)->cap_mask_mutex);
+        mutex_unlock(&to_mdev(ibdev)->cap_mask_mutex);
         return err;
 }
 
@@ -1185,7 +1185,7 @@ int mthca_register_device(struct mthca_dev *dev)
                 dev->ib_dev.post_recv     = mthca_tavor_post_receive;
         }
 
-        init_MUTEX(&dev->cap_mask_mutex);
+        mutex_init(&dev->cap_mask_mutex);
 
         ret = ib_register_device(&dev->ib_dev);
         if (ret)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index e0a5412b7e68..2f85a9a831b1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -78,6 +78,7 @@ enum {
         IPOIB_FLAG_SUBINTERFACE   = 4,
         IPOIB_MCAST_RUN           = 5,
         IPOIB_STOP_REAPER         = 6,
+        IPOIB_MCAST_STARTED       = 7,
 
         IPOIB_MAX_BACKOFF_SECONDS = 16,
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index fd3f5c862a5d..c3b5f79d1168 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -505,7 +505,7 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
 
         list_add_tail(&neigh->list, &path->neigh_list);
 
-        if (path->pathrec.dlid) {
+        if (path->ah) {
                 kref_get(&path->ah->ref);
                 neigh->ah = path->ah;
 
@@ -591,7 +591,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
                 return;
         }
 
-        if (path->pathrec.dlid) {
+        if (path->ah) {
                 ipoib_dbg(priv, "Send unicast ARP to %04x\n",
                           be16_to_cpu(path->pathrec.dlid));
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 98039da0caf0..a2408d7ec598 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -97,6 +97,7 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_neigh *neigh, *tmp;
         unsigned long flags;
+        int tx_dropped = 0;
 
         ipoib_dbg_mcast(netdev_priv(dev),
                         "deleting multicast group " IPOIB_GID_FMT "\n",
@@ -123,8 +124,14 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
         if (mcast->ah)
                 ipoib_put_ah(mcast->ah);
 
-        while (!skb_queue_empty(&mcast->pkt_queue))
+        while (!skb_queue_empty(&mcast->pkt_queue)) {
+                ++tx_dropped;
                 dev_kfree_skb_any(skb_dequeue(&mcast->pkt_queue));
+        }
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        priv->stats.tx_dropped += tx_dropped;
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
 
         kfree(mcast);
 }
@@ -276,8 +283,10 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
         }
 
         /* actually send any queued packets */
+        spin_lock_irq(&priv->tx_lock);
         while (!skb_queue_empty(&mcast->pkt_queue)) {
                 struct sk_buff *skb = skb_dequeue(&mcast->pkt_queue);
+                spin_unlock_irq(&priv->tx_lock);
 
                 skb->dev = dev;
 
@@ -288,7 +297,9 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
 
                 if (dev_queue_xmit(skb))
                         ipoib_warn(priv, "dev_queue_xmit failed to requeue packet\n");
+                spin_lock_irq(&priv->tx_lock);
         }
+        spin_unlock_irq(&priv->tx_lock);
 
         return 0;
 }
@@ -300,6 +311,7 @@ ipoib_mcast_sendonly_join_complete(int status,
 {
         struct ipoib_mcast *mcast = mcast_ptr;
         struct net_device *dev = mcast->dev;
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
 
         if (!status)
                 ipoib_mcast_join_finish(mcast, mcmember);
@@ -310,8 +322,12 @@ ipoib_mcast_sendonly_join_complete(int status,
                                         IPOIB_GID_ARG(mcast->mcmember.mgid), status);
 
                 /* Flush out any queued packets */
-                while (!skb_queue_empty(&mcast->pkt_queue))
+                spin_lock_irq(&priv->tx_lock);
+                while (!skb_queue_empty(&mcast->pkt_queue)) {
+                        ++priv->stats.tx_dropped;
                         dev_kfree_skb_any(skb_dequeue(&mcast->pkt_queue));
+                }
+                spin_unlock_irq(&priv->tx_lock);
 
                 /* Clear the busy flag so we try again */
                 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
@@ -517,8 +533,10 @@ void ipoib_mcast_join_task(void *dev_ptr)
         }
 
         if (!priv->broadcast) {
-                priv->broadcast = ipoib_mcast_alloc(dev, 1);
-                if (!priv->broadcast) {
+                struct ipoib_mcast *broadcast;
+
+                broadcast = ipoib_mcast_alloc(dev, 1);
+                if (!broadcast) {
                         ipoib_warn(priv, "failed to allocate broadcast group\n");
                         mutex_lock(&mcast_mutex);
                         if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
@@ -528,10 +546,11 @@ void ipoib_mcast_join_task(void *dev_ptr)
                         return;
                 }
 
-                memcpy(priv->broadcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
+                spin_lock_irq(&priv->lock);
+                memcpy(broadcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
                        sizeof (union ib_gid));
+                priv->broadcast = broadcast;
 
-                spin_lock_irq(&priv->lock);
                 __ipoib_mcast_add(dev, priv->broadcast);
                 spin_unlock_irq(&priv->lock);
         }
@@ -585,6 +604,10 @@ int ipoib_mcast_start_thread(struct net_device *dev)
                 queue_work(ipoib_workqueue, &priv->mcast_task);
         mutex_unlock(&mcast_mutex);
 
+        spin_lock_irq(&priv->lock);
+        set_bit(IPOIB_MCAST_STARTED, &priv->flags);
+        spin_unlock_irq(&priv->lock);
+
         return 0;
 }
 
@@ -595,6 +618,10 @@ int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 
         ipoib_dbg_mcast(priv, "stopping multicast thread\n");
 
+        spin_lock_irq(&priv->lock);
+        clear_bit(IPOIB_MCAST_STARTED, &priv->flags);
+        spin_unlock_irq(&priv->lock);
+
         mutex_lock(&mcast_mutex);
         clear_bit(IPOIB_MCAST_RUN, &priv->flags);
         cancel_delayed_work(&priv->mcast_task);
@@ -677,6 +704,14 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
          */
         spin_lock(&priv->lock);
 
+        if (!test_bit(IPOIB_MCAST_STARTED, &priv->flags)        ||
+            !priv->broadcast                                    ||
+            !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &priv->broadcast->flags)) {
+                ++priv->stats.tx_dropped;
+                dev_kfree_skb_any(skb);
+                goto unlock;
+        }
+
         mcast = __ipoib_mcast_find(dev, mgid);
         if (!mcast) {
                 /* Let's create a new send only group now */
@@ -687,6 +722,7 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
                 if (!mcast) {
                         ipoib_warn(priv, "unable to allocate memory for "
                                    "multicast structure\n");
+                        ++priv->stats.tx_dropped;
                         dev_kfree_skb_any(skb);
                         goto out;
                 }
@@ -700,8 +736,10 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
         if (!mcast->ah) {
                 if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE)
                         skb_queue_tail(&mcast->pkt_queue, skb);
-                else
+                else {
+                        ++priv->stats.tx_dropped;
                         dev_kfree_skb_any(skb);
+                }
 
                 if (mcast->query)
                         ipoib_dbg_mcast(priv, "no address vector, "
@@ -735,6 +773,7 @@ out:
                 ipoib_send(dev, skb, mcast->ah, IB_MULTICAST_QPN);
         }
 
+unlock:
         spin_unlock(&priv->lock);
 }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 31207e664148..960dae5c87d1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -357,9 +357,9 @@ static void srp_remove_work(void *target_ptr)
         target->state = SRP_TARGET_REMOVED;
         spin_unlock_irq(target->scsi_host->host_lock);
 
-        down(&target->srp_host->target_mutex);
+        mutex_lock(&target->srp_host->target_mutex);
         list_del(&target->list);
-        up(&target->srp_host->target_mutex);
+        mutex_unlock(&target->srp_host->target_mutex);
 
         scsi_remove_host(target->scsi_host);
         ib_destroy_cm_id(target->cm_id);
@@ -1155,6 +1155,12 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
 
         spin_lock_irq(target->scsi_host->host_lock);
 
+        if (target->state == SRP_TARGET_DEAD ||
+            target->state == SRP_TARGET_REMOVED) {
+                scmnd->result = DID_BAD_TARGET << 16;
+                goto out;
+        }
+
         if (scmnd->host_scribble == (void *) -1L)
                 goto out;
 
@@ -1254,9 +1260,9 @@ static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
         if (scsi_add_host(target->scsi_host, host->dev->dma_device))
                 return -ENODEV;
 
-        down(&host->target_mutex);
+        mutex_lock(&host->target_mutex);
         list_add_tail(&target->list, &host->target_list);
-        up(&host->target_mutex);
+        mutex_unlock(&host->target_mutex);
 
         target->state = SRP_TARGET_LIVE;
 
@@ -1525,7 +1531,7 @@ static struct srp_host *srp_add_port(struct ib_device *device, u8 port)
                 return NULL;
 
         INIT_LIST_HEAD(&host->target_list);
-        init_MUTEX(&host->target_mutex);
+        mutex_init(&host->target_mutex);
         init_completion(&host->released);
         host->dev  = device;
         host->port = port;
@@ -1626,7 +1632,7 @@ static void srp_remove_one(struct ib_device *device)
                  * Mark all target ports as removed, so we stop queueing
                  * commands and don't try to reconnect.
                  */
-                down(&host->target_mutex);
+                mutex_lock(&host->target_mutex);
                 list_for_each_entry_safe(target, tmp_target,
                                          &host->target_list, list) {
                         spin_lock_irqsave(target->scsi_host->host_lock, flags);
@@ -1634,7 +1640,7 @@ static void srp_remove_one(struct ib_device *device)
                                 target->state = SRP_TARGET_REMOVED;
                         spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
                 }
-                up(&host->target_mutex);
+                mutex_unlock(&host->target_mutex);
 
                 /*
                  * Wait for any reconnection tasks that may have
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index b564f18caf78..4e7727df32f1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -37,8 +37,7 @@
 
 #include <linux/types.h>
 #include <linux/list.h>
-
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
@@ -85,7 +84,7 @@ struct srp_host {
         struct ib_mr           *mr;
         struct class_device     class_dev;
         struct list_head        target_list;
-        struct semaphore        target_mutex;
+        struct mutex            target_mutex;
         struct completion       released;
         struct list_head        list;
 };