36 files changed, 290 insertions, 139 deletions
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 8f9509e1ebf7..55d093a36ae4 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -362,6 +362,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id)
                 * In either case, must tell the provider to reject.
                 */
                cm_id_priv->state = IW_CM_STATE_DESTROYING;
+                cm_id->device->iwcm->reject(cm_id, NULL, 0);
                break;
        case IW_CM_STATE_CONN_SENT:
        case IW_CM_STATE_DESTROYING:
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index de922a04ca2d..5cef8f87b96b 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -51,8 +51,7 @@ static struct list_head ib_mad_port_list;
 static u32 ib_mad_client_id = 0;
 /* Port list lock */
-static spinlock_t ib_mad_port_list_lock;
+static DEFINE_SPINLOCK(ib_mad_port_list_lock);
 /* Forward declarations */
 static int method_in_use(struct ib_mad_mgmt_method_table **method,
@@ -2984,8 +2983,6 @@ static int __init ib_mad_init_module(void)
 {
        int ret;
-        spin_lock_init(&ib_mad_port_list_lock);
        ib_mad_cache = kmem_cache_create("ib_mad",
                                         sizeof(struct ib_mad_private),
                                         0,
@@ -3021,4 +3018,3 @@ static void __exit ib_mad_cleanup_module(void)
 module_init(ib_mad_init_module);
 module_exit(ib_mad_cleanup_module);
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 107f170c57cd..8d82ba171353 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -106,6 +106,8 @@ struct mcast_group {
        struct ib_sa_query      *query;
        int                     query_id;
        u16                     pkey_index;
+        u8                      leave_state;
+        int                     retries;
 };
 struct mcast_member {
@@ -350,6 +352,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
        rec = group->rec;
        rec.join_state = leave_state;
+        group->leave_state = leave_state;
        ret = ib_sa_mcmember_rec_query(&sa_client, port->dev->device,
                                       port->port_num, IB_SA_METHOD_DELETE, &rec,
@@ -542,7 +545,11 @@ static void leave_handler(int status, struct ib_sa_mcmember_rec *rec,
 {
        struct mcast_group *group = context;
-        mcast_work_handler(&group->work);
+        if (status && group->retries > 0 &&
+            !send_leave(group, group->leave_state))
+                group->retries--;
+        else
+                mcast_work_handler(&group->work);
 }
 static struct mcast_group *acquire_group(struct mcast_port *port,
@@ -565,6 +572,7 @@ static struct mcast_group *acquire_group(struct mcast_port *port,
        if (!group)
                return NULL;
+        group->retries = 3;
        group->port = port;
        group->rec.mgid = *mgid;
        group->pkey_index = MCAST_INVALID_PKEY_INDEX;
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 1865049e80f7..82543716d59e 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -109,10 +109,10 @@ static struct ib_client sa_client = {
        .remove = ib_sa_remove_one
 };
-static spinlock_t idr_lock;
+static DEFINE_SPINLOCK(idr_lock);
 static DEFINE_IDR(query_idr);
-static spinlock_t tid_lock;
+static DEFINE_SPINLOCK(tid_lock);
 static u32 tid;
 #define PATH_REC_FIELD(field) \
@@ -1077,9 +1077,6 @@ static int __init ib_sa_init(void)
 {
        int ret;
-        spin_lock_init(&idr_lock);
-        spin_lock_init(&tid_lock);
        get_random_bytes(&tid, sizeof tid);
        ret = ib_register_client(&sa_client);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index eb36a81dd09b..d3fff9e008a3 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -73,7 +73,7 @@ DEFINE_IDR(ib_uverbs_cq_idr);
 DEFINE_IDR(ib_uverbs_qp_idr);
 DEFINE_IDR(ib_uverbs_srq_idr);
-static spinlock_t map_lock;
+static DEFINE_SPINLOCK(map_lock);
 static struct ib_uverbs_device *dev_table[IB_UVERBS_MAX_DEVICES];
 static DECLARE_BITMAP(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -584,14 +584,16 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        if (hdr.command < 0                             ||
            hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
-            !uverbs_cmd_table[hdr.command]              ||
+            !uverbs_cmd_table[hdr.command])
-            !(file->device->ib_dev->uverbs_cmd_mask & (1ull << hdr.command)))
                return -EINVAL;
        if (!file->ucontext &&
            hdr.command != IB_USER_VERBS_CMD_GET_CONTEXT)
                return -EINVAL;
+        if (!(file->device->ib_dev->uverbs_cmd_mask & (1ull << hdr.command)))
+                return -ENOSYS;
        return uverbs_cmd_table[hdr.command](file, buf + sizeof hdr,
                                             hdr.in_words * 4, hdr.out_words * 4);
 }
@@ -836,8 +838,6 @@ static int __init ib_uverbs_init(void)
 {
        int ret;
-        spin_lock_init(&map_lock);
        ret = register_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES,
                                     "infiniband_verbs");
        if (ret) {
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 0cfbb6d2f762..8250740c94b0 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -86,11 +86,7 @@ MODULE_DEVICE_TABLE(pci, c2_pci_table);
 static void c2_print_macaddr(struct net_device *netdev)
 {
-        pr_debug("%s: MAC %02X:%02X:%02X:%02X:%02X:%02X, "
+        pr_debug("%s: MAC %pM, IRQ %u\n", netdev->name, netdev->dev_addr, netdev->irq);
-                "IRQ %u\n", netdev->name,
-                netdev->dev_addr[0], netdev->dev_addr[1], netdev->dev_addr[2],
-                netdev->dev_addr[3], netdev->dev_addr[4], netdev->dev_addr[5],
-                netdev->irq);
 }
 static void c2_set_rxbufsize(struct c2_port *c2_port)
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.c b/drivers/infiniband/hw/amso1100/c2_provider.c
index f1948fad85d7..ad723bd8bf49 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.c
+++ b/drivers/infiniband/hw/amso1100/c2_provider.c
@@ -780,11 +780,11 @@ int c2_register_device(struct c2_dev *dev)
        /* Register pseudo network device */
        dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
        if (!dev->pseudo_netdev)
-                goto out3;
+                goto out;
        ret = register_netdev(dev->pseudo_netdev);
        if (ret)
-                goto out2;
+                goto out_free_netdev;
        pr_debug("%s:%u\n", __func__, __LINE__);
        strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@@ -851,6 +851,10 @@ int c2_register_device(struct c2_dev *dev)
        dev->ibdev.post_recv = c2_post_receive;
        dev->ibdev.iwcm = kmalloc(sizeof(*dev->ibdev.iwcm), GFP_KERNEL);
+        if (dev->ibdev.iwcm == NULL) {
+                ret = -ENOMEM;
+                goto out_unregister_netdev;
+        }
        dev->ibdev.iwcm->add_ref = c2_add_ref;
        dev->ibdev.iwcm->rem_ref = c2_rem_ref;
        dev->ibdev.iwcm->get_qp = c2_get_qp;
@@ -862,23 +866,25 @@ int c2_register_device(struct c2_dev *dev)
        ret = ib_register_device(&dev->ibdev);
        if (ret)
-                goto out1;
+                goto out_free_iwcm;
        for (i = 0; i < ARRAY_SIZE(c2_dev_attributes); ++i) {
                ret = device_create_file(&dev->ibdev.dev,
                                               c2_dev_attributes[i]);
                if (ret)
-                        goto out0;
+                        goto out_unregister_ibdev;
        }
-        goto out3;
+        goto out;
-out0:
+out_unregister_ibdev:
        ib_unregister_device(&dev->ibdev);
-out1:
+out_free_iwcm:
+        kfree(dev->ibdev.iwcm);
+out_unregister_netdev:
        unregister_netdev(dev->pseudo_netdev);
-out2:
+out_free_netdev:
        free_netdev(dev->pseudo_netdev);
-out3:
+out:
        pr_debug("%s:%u ret=%d\n", __func__, __LINE__, ret);
        return ret;
 }
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 62f9cf2f94ec..72ed3396b721 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -852,7 +852,9 @@ int cxio_rdma_init(struct cxio_rdev *rdev_p, struct t3_rdma_init_attr *attr)
        wqe->qpcaps = attr->qpcaps;
        wqe->ulpdu_size = cpu_to_be16(attr->tcp_emss);
        wqe->rqe_count = cpu_to_be16(attr->rqe_count);
-        wqe->flags_rtr_type = cpu_to_be16(attr->flags|V_RTR_TYPE(attr->rtr_type));
+        wqe->flags_rtr_type = cpu_to_be16(attr->flags |
+                                          V_RTR_TYPE(attr->rtr_type) |
+                                          V_CHAN(attr->chan));
        wqe->ord = cpu_to_be32(attr->ord);
        wqe->ird = cpu_to_be32(attr->ird);
        wqe->qp_dma_addr = cpu_to_be64(attr->qp_dma_addr);
@@ -1032,6 +1034,7 @@ err3:
 err2:
        cxio_hal_destroy_ctrl_qp(rdev_p);
 err1:
+        rdev_p->t3cdev_p->ulp = NULL;
        list_del(&rdev_p->entry);
        return err;
 }
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
index 32e3b1461d81..a197a5b7ac7f 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_wr.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -327,6 +327,11 @@ enum rdma_init_rtr_types {
 #define V_RTR_TYPE(x)   ((x) << S_RTR_TYPE)
 #define G_RTR_TYPE(x)   ((((x) >> S_RTR_TYPE)) & M_RTR_TYPE)
+#define S_CHAN          4
+#define M_CHAN          0x3
+#define V_CHAN(x)       ((x) << S_CHAN)
+#define G_CHAN(x)       ((((x) >> S_CHAN)) & M_CHAN)
 struct t3_rdma_init_attr {
        u32 tid;
        u32 qpid;
@@ -346,6 +351,7 @@ struct t3_rdma_init_attr {
        u16 flags;
        u16 rqe_count;
        u32 irs;
+        u32 chan;
 };
 struct t3_rdma_init_wr {
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
index 26fc0a4eaa74..b0ea0105ddf6 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.c
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -51,7 +51,7 @@ cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS];
 static void open_rnic_dev(struct t3cdev *);
 static void close_rnic_dev(struct t3cdev *);
-static void iwch_err_handler(struct t3cdev *, u32, u32);
+static void iwch_event_handler(struct t3cdev *, u32, u32);
 struct cxgb3_client t3c_client = {
        .name = "iw_cxgb3",
@@ -59,7 +59,7 @@ struct cxgb3_client t3c_client = {
        .remove = close_rnic_dev,
        .handlers = t3c_handlers,
        .redirect = iwch_ep_redirect,
-        .err_handler = iwch_err_handler
+        .event_handler = iwch_event_handler
 };
 static LIST_HEAD(dev_list);
@@ -105,11 +105,9 @@ static void rnic_init(struct iwch_dev *rnicp)
 static void open_rnic_dev(struct t3cdev *tdev)
 {
        struct iwch_dev *rnicp;
-        static int vers_printed;
        PDBG("%s t3cdev %p\n", __func__,  tdev);
-        if (!vers_printed++)
+        printk_once(KERN_INFO MOD "Chelsio T3 RDMA Driver - version %s\n",
-                printk(KERN_INFO MOD "Chelsio T3 RDMA Driver - version %s\n",
                       DRV_VERSION);
        rnicp = (struct iwch_dev *)ib_alloc_device(sizeof(*rnicp));
        if (!rnicp) {
@@ -162,21 +160,36 @@ static void close_rnic_dev(struct t3cdev *tdev)
        mutex_unlock(&dev_mutex);
 }
-static void iwch_err_handler(struct t3cdev *tdev, u32 status, u32 error)
+static void iwch_event_handler(struct t3cdev *tdev, u32 evt, u32 port_id)
 {
        struct cxio_rdev *rdev = tdev->ulp;
-        struct iwch_dev *rnicp = rdev_to_iwch_dev(rdev);
+        struct iwch_dev *rnicp;
        struct ib_event event;
+        u32    portnum = port_id + 1;
-        if (status == OFFLOAD_STATUS_DOWN) {
+        if (!rdev)
+                return;
+        rnicp = rdev_to_iwch_dev(rdev);
+        switch (evt) {
+        case OFFLOAD_STATUS_DOWN: {
                rdev->flags = CXIO_ERROR_FATAL;
-                event.device = &rnicp->ibdev;
                event.event  = IB_EVENT_DEVICE_FATAL;
-                event.element.port_num = 0;
+                break;
-                ib_dispatch_event(&event);
+                }
+        case OFFLOAD_PORT_DOWN: {
+                event.event  = IB_EVENT_PORT_ERR;
+                break;
+                }
+        case OFFLOAD_PORT_UP: {
+                event.event  = IB_EVENT_PORT_ACTIVE;
+                break;
+                }
        }
+        event.device = &rnicp->ibdev;
+        event.element.port_num = portnum;
+        ib_dispatch_event(&event);
        return;
 }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 52d7bb0c2a12..66b41351910a 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -286,7 +286,7 @@ void __free_ep(struct kref *kref)
        ep = container_of(container_of(kref, struct iwch_ep_common, kref),
                          struct iwch_ep, com);
        PDBG("%s ep %p state %s\n", __func__, ep, states[state_read(&ep->com)]);
-        if (ep->com.flags & RELEASE_RESOURCES) {
+        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
                cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
                dst_release(ep->dst);
                l2t_release(L2DATA(ep->com.tdev), ep->l2t);
@@ -297,7 +297,7 @@ void __free_ep(struct kref *kref)
 static void release_ep_resources(struct iwch_ep *ep)
 {
        PDBG("%s ep %p tid %d\n", __func__, ep, ep->hwtid);
-        ep->com.flags |= RELEASE_RESOURCES;
+        set_bit(RELEASE_RESOURCES, &ep->com.flags);
        put_ep(&ep->com);
 }
@@ -786,10 +786,12 @@ static void connect_request_upcall(struct iwch_ep *ep)
        event.private_data_len = ep->plen;
        event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
        event.provider_data = ep;
-        if (state_read(&ep->parent_ep->com) != DEAD)
+        if (state_read(&ep->parent_ep->com) != DEAD) {
+                get_ep(&ep->com);
                ep->parent_ep->com.cm_id->event_handler(
                                                ep->parent_ep->com.cm_id,
                                                &event);
+        }
        put_ep(&ep->parent_ep->com);
        ep->parent_ep = NULL;
 }
@@ -1156,8 +1158,7 @@ static int abort_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         * We get 2 abort replies from the HW.  The first one must
         * be ignored except for scribbling that we need one more.
         */
-        if (!(ep->com.flags & ABORT_REQ_IN_PROGRESS)) {
+        if (!test_and_set_bit(ABORT_REQ_IN_PROGRESS, &ep->com.flags)) {
-                ep->com.flags |= ABORT_REQ_IN_PROGRESS;
                return CPL_RET_BUF_DONE;
        }
@@ -1477,10 +1478,14 @@ static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                /*
                 * We're gonna mark this puppy DEAD, but keep
                 * the reference on it until the ULP accepts or
-                 * rejects the CR.
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see iwch_accept_cr()).
                 */
                __state_set(&ep->com, CLOSING);
-                get_ep(&ep->com);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
                break;
        case MPA_REP_SENT:
                __state_set(&ep->com, CLOSING);
@@ -1561,8 +1566,7 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         * We get 2 peer aborts from the HW.  The first one must
         * be ignored except for scribbling that we need one more.
         */
-        if (!(ep->com.flags & PEER_ABORT_IN_PROGRESS)) {
+        if (!test_and_set_bit(PEER_ABORT_IN_PROGRESS, &ep->com.flags)) {
-                ep->com.flags |= PEER_ABORT_IN_PROGRESS;
                return CPL_RET_BUF_DONE;
        }
@@ -1589,9 +1593,13 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                /*
                 * We're gonna mark this puppy DEAD, but keep
                 * the reference on it until the ULP accepts or
-                 * rejects the CR.
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see iwch_accept_cr()).
                 */
-                get_ep(&ep->com);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
                break;
        case MORIBUND:
        case CLOSING:
@@ -1797,6 +1805,7 @@ int iwch_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
                err = send_mpa_reject(ep, pdata, pdata_len);
                err = iwch_ep_disconnect(ep, 0, GFP_KERNEL);
        }
+        put_ep(&ep->com);
        return 0;
 }
@@ -1810,8 +1819,10 @@ int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        struct iwch_qp *qp = get_qhp(h, conn_param->qpn);
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        if (state_read(&ep->com) == DEAD)
+        if (state_read(&ep->com) == DEAD) {
-                return -ECONNRESET;
+                err = -ECONNRESET;
+                goto err;
+        }
        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
        BUG_ON(!qp);
@@ -1819,15 +1830,14 @@ int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        if ((conn_param->ord > qp->rhp->attr.max_rdma_read_qp_depth) ||
            (conn_param->ird > qp->rhp->attr.max_rdma_reads_per_qp)) {
                abort_connection(ep, NULL, GFP_KERNEL);
-                return -EINVAL;
+                err = -EINVAL;
+                goto err;
        }
        cm_id->add_ref(cm_id);
        ep->com.cm_id = cm_id;
        ep->com.qp = qp;
-        ep->com.rpl_done = 0;
-        ep->com.rpl_err = 0;
        ep->ird = conn_param->ird;
        ep->ord = conn_param->ord;
@@ -1836,8 +1846,6 @@ int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        PDBG("%s %d ird %d ord %d\n", __func__, __LINE__, ep->ird, ep->ord);
-        get_ep(&ep->com);
        /* bind QP to EP and move to RTS */
        attrs.mpa_attr = ep->mpa_attr;
        attrs.max_ird = ep->ird;
@@ -1855,30 +1863,31 @@ int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        err = iwch_modify_qp(ep->com.qp->rhp,
                             ep->com.qp, mask, &attrs, 1);
        if (err)
-                goto err;
+                goto err1;
        /* if needed, wait for wr_ack */
        if (iwch_rqes_posted(qp)) {
                wait_event(ep->com.waitq, ep->com.rpl_done);
                err = ep->com.rpl_err;
                if (err)
-                        goto err;
+                        goto err1;
        }
        err = send_mpa_reply(ep, conn_param->private_data,
                             conn_param->private_data_len);
        if (err)
-                goto err;
+                goto err1;
        state_set(&ep->com, FPDU_MODE);
        established_upcall(ep);
        put_ep(&ep->com);
        return 0;
-err:
+err1:
        ep->com.cm_id = NULL;
        ep->com.qp = NULL;
        cm_id->rem_ref(cm_id);
+err:
        put_ep(&ep->com);
        return err;
 }
@@ -2097,14 +2106,17 @@ int iwch_ep_disconnect(struct iwch_ep *ep, int abrupt, gfp_t gfp)
                        ep->com.state = CLOSING;
                        start_ep_timer(ep);
                }
+                set_bit(CLOSE_SENT, &ep->com.flags);
                break;
        case CLOSING:
-                close = 1;
+                if (!test_and_set_bit(CLOSE_SENT, &ep->com.flags)) {
-                if (abrupt) {
+                        close = 1;
-                        stop_ep_timer(ep);
+                        if (abrupt) {
-                        ep->com.state = ABORTING;
+                                stop_ep_timer(ep);
-                } else
+                                ep->com.state = ABORTING;
-                        ep->com.state = MORIBUND;
+                        } else
+                                ep->com.state = MORIBUND;
+                }
                break;
        case MORIBUND:
        case ABORTING:
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.h b/drivers/infiniband/hw/cxgb3/iwch_cm.h
index 43c0aea7eadc..b9efadfffb4f 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.h
@@ -145,9 +145,10 @@ enum iwch_ep_state {
 };
 enum iwch_ep_flags {
-        PEER_ABORT_IN_PROGRESS  = (1 << 0),
+        PEER_ABORT_IN_PROGRESS  = 0,
-        ABORT_REQ_IN_PROGRESS   = (1 << 1),
+        ABORT_REQ_IN_PROGRESS   = 1,
-        RELEASE_RESOURCES       = (1 << 2),
+        RELEASE_RESOURCES       = 2,
+        CLOSE_SENT              = 3,
 };
 struct iwch_ep_common {
@@ -162,7 +163,7 @@ struct iwch_ep_common {
        wait_queue_head_t waitq;
        int rpl_done;
        int rpl_err;
-        u32 flags;
+        unsigned long flags;
 };
 struct iwch_listen_ep {
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
index ec49a5cbdebb..e1ec65ebb016 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_mem.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -39,7 +39,7 @@
 #include "iwch.h"
 #include "iwch_provider.h"
-static void iwch_finish_mem_reg(struct iwch_mr *mhp, u32 stag)
+static int iwch_finish_mem_reg(struct iwch_mr *mhp, u32 stag)
 {
        u32 mmid;
@@ -47,14 +47,15 @@ static void iwch_finish_mem_reg(struct iwch_mr *mhp, u32 stag)
        mhp->attr.stag = stag;
        mmid = stag >> 8;
        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
-        insert_handle(mhp->rhp, &mhp->rhp->mmidr, mhp, mmid);
        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+        return insert_handle(mhp->rhp, &mhp->rhp->mmidr, mhp, mmid);
 }
 int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                      struct iwch_mr *mhp, int shift)
 {
        u32 stag;
+        int ret;
        if (cxio_register_phys_mem(&rhp->rdev,
                                   &stag, mhp->attr.pdid,
@@ -66,9 +67,11 @@ int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                   mhp->attr.pbl_size, mhp->attr.pbl_addr))
                return -ENOMEM;
-        iwch_finish_mem_reg(mhp, stag);
+        ret = iwch_finish_mem_reg(mhp, stag);
+        if (ret)
-        return 0;
+                cxio_dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        return ret;
 }
 int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
@@ -77,6 +80,7 @@ int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                        int npages)
 {
        u32 stag;
+        int ret;
        /* We could support this... */
        if (npages > mhp->attr.pbl_size)
@@ -93,9 +97,12 @@ int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                   mhp->attr.pbl_size, mhp->attr.pbl_addr))
                return -ENOMEM;
-        iwch_finish_mem_reg(mhp, stag);
+        ret = iwch_finish_mem_reg(mhp, stag);
+        if (ret)
+                cxio_dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
-        return 0;
+        return ret;
 }
 int iwch_alloc_pbl(struct iwch_mr *mhp, int npages)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index e2a63214008a..6895523779d0 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -195,7 +195,11 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
        spin_lock_init(&chp->lock);
        atomic_set(&chp->refcnt, 1);
        init_waitqueue_head(&chp->wait);
-        insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid);
+        if (insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid)) {
+                cxio_destroy_cq(&chp->rhp->rdev, &chp->cq);
+                kfree(chp);
+                return ERR_PTR(-ENOMEM);
+        }
        if (ucontext) {
                struct iwch_mm_entry *mm;
@@ -750,7 +754,11 @@ static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd)
        mhp->attr.stag = stag;
        mmid = (stag) >> 8;
        mhp->ibmw.rkey = stag;
-        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid)) {
+                cxio_deallocate_window(&rhp->rdev, mhp->attr.stag);
+                kfree(mhp);
+                return ERR_PTR(-ENOMEM);
+        }
        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
        return &(mhp->ibmw);
 }
@@ -778,37 +786,43 @@ static struct ib_mr *iwch_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth)
        struct iwch_mr *mhp;
        u32 mmid;
        u32 stag = 0;
-        int ret;
+        int ret = 0;
        php = to_iwch_pd(pd);
        rhp = php->rhp;
        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
        if (!mhp)
-                return ERR_PTR(-ENOMEM);
+                goto err;
        mhp->rhp = rhp;
        ret = iwch_alloc_pbl(mhp, pbl_depth);
-        if (ret) {
+        if (ret)
-                kfree(mhp);
+                goto err1;
-                return ERR_PTR(ret);
-        }
        mhp->attr.pbl_size = pbl_depth;
        ret = cxio_allocate_stag(&rhp->rdev, &stag, php->pdid,
                                 mhp->attr.pbl_size, mhp->attr.pbl_addr);
-        if (ret) {
+        if (ret)
-                iwch_free_pbl(mhp);
+                goto err2;
-                kfree(mhp);
-                return ERR_PTR(ret);
-        }
        mhp->attr.pdid = php->pdid;
        mhp->attr.type = TPT_NON_SHARED_MR;
        mhp->attr.stag = stag;
        mhp->attr.state = 1;
        mmid = (stag) >> 8;
        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
-        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid))
+                goto err3;
        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
        return &(mhp->ibmr);
+err3:
+        cxio_dereg_mem(&rhp->rdev, stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+err2:
+        iwch_free_pbl(mhp);
+err1:
+        kfree(mhp);
+err:
+        return ERR_PTR(ret);
 }
 static struct ib_fast_reg_page_list *iwch_alloc_fastreg_pbl(
@@ -961,7 +975,13 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
        spin_lock_init(&qhp->lock);
        init_waitqueue_head(&qhp->wait);
        atomic_set(&qhp->refcnt, 1);
-        insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.qpid);
+        if (insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.qpid)) {
+                cxio_destroy_qp(&rhp->rdev, &qhp->wq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+                kfree(qhp);
+                return ERR_PTR(-ENOMEM);
+        }
        if (udata) {
@@ -1418,6 +1438,7 @@ int iwch_register_device(struct iwch_dev *dev)
 bail2:
        ib_unregister_device(&dev->ibdev);
 bail1:
+        kfree(dev->ibdev.iwcm);
        return ret;
 }
@@ -1430,5 +1451,6 @@ void iwch_unregister_device(struct iwch_dev *dev)
                device_remove_file(&dev->ibdev.dev,
                                   iwch_class_attributes[i]);
        ib_unregister_device(&dev->ibdev);
+        kfree(dev->ibdev.iwcm);
        return;
 }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 27bbdc8e773a..6e8653471941 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -889,6 +889,7 @@ static int rdma_init(struct iwch_dev *rhp, struct iwch_qp *qhp,
        init_attr.qp_dma_size = (1UL << qhp->wq.size_log2);
        init_attr.rqe_count = iwch_rqes_posted(qhp);
        init_attr.flags = qhp->attr.mpa_attr.initiator ? MPA_INITIATOR : 0;
+        init_attr.chan = qhp->ep->l2t->smt_idx;
        if (peer2peer) {
                init_attr.rtr_type = RTR_READ;
                if (init_attr.ord == 0 && qhp->attr.mpa_attr.initiator)
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index fab18a2c74a8..5b635aa5947e 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -52,7 +52,7 @@
 #include "ehca_tools.h"
 #include "hcp_if.h"
-#define HCAD_VERSION "0028"
+#define HCAD_VERSION "0029"
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
@@ -64,7 +64,7 @@ static int ehca_hw_level      = 0;
 static int ehca_poll_all_eqs  = 1;
 int ehca_debug_level   = 0;
-int ehca_nr_ports      = 2;
+int ehca_nr_ports      = -1;
 int ehca_use_hp_mr     = 0;
 int ehca_port_act_time = 30;
 int ehca_static_rate   = -1;
@@ -95,8 +95,8 @@ MODULE_PARM_DESC(hw_level,
                 "Hardware level (0: autosensing (default), "
                 "0x10..0x14: eHCA, 0x20..0x23: eHCA2)");
 MODULE_PARM_DESC(nr_ports,
-                 "number of connected ports (-1: autodetect, 1: port one only, "
+                 "number of connected ports (-1: autodetect (default), "
-                 "2: two ports (default)");
+                 "1: port one only, 2: two ports)");
 MODULE_PARM_DESC(use_hp_mr,
                 "Use high performance MRs (default: no)");
 MODULE_PARM_DESC(port_act_time,
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/infiniband/hw/ehca/ehca_reqs.c
index 5a3d96f84c79..8fd88cd828fd 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/infiniband/hw/ehca/ehca_reqs.c
@@ -786,7 +786,11 @@ repoll:
        wc->slid = cqe->rlid;
        wc->dlid_path_bits = cqe->dlid;
        wc->src_qp = cqe->remote_qp_number;
-        wc->wc_flags = cqe->w_completion_flags;
+        /*
+         * HW has "Immed data present" and "GRH present" in bits 6 and 5.
+         * SW defines those in bits 1 and 0, so we can just shift and mask.
+         */
+        wc->wc_flags = (cqe->w_completion_flags >> 5) & 3;
        wc->ex.imm_data = cpu_to_be32(cqe->immediate_data);
        wc->sl = cqe->service_level;
diff --git a/drivers/infiniband/hw/ehca/ehca_sqp.c b/drivers/infiniband/hw/ehca/ehca_sqp.c
index c568b28f4e20..8c1213f8916a 100644
--- a/drivers/infiniband/hw/ehca/ehca_sqp.c
+++ b/drivers/infiniband/hw/ehca/ehca_sqp.c
@@ -125,14 +125,30 @@ struct ib_perf {
        u8 data[192];
 } __attribute__ ((packed));
+/* TC/SL/FL packed into 32 bits, as in ClassPortInfo */
+struct tcslfl {
+        u32 tc:8;
+        u32 sl:4;
+        u32 fl:20;
+} __attribute__ ((packed));
+/* IP Version/TC/FL packed into 32 bits, as in GRH */
+struct vertcfl {
+        u32 ver:4;
+        u32 tc:8;
+        u32 fl:20;
+} __attribute__ ((packed));
 static int ehca_process_perf(struct ib_device *ibdev, u8 port_num,
+                             struct ib_wc *in_wc, struct ib_grh *in_grh,
                             struct ib_mad *in_mad, struct ib_mad *out_mad)
 {
        struct ib_perf *in_perf = (struct ib_perf *)in_mad;
        struct ib_perf *out_perf = (struct ib_perf *)out_mad;
        struct ib_class_port_info *poi =
                (struct ib_class_port_info *)out_perf->data;
+        struct tcslfl *tcslfl =
+                (struct tcslfl *)&poi->redirect_tcslfl;
        struct ehca_shca *shca =
                container_of(ibdev, struct ehca_shca, ib_device);
        struct ehca_sport *sport = &shca->sport[port_num - 1];
@@ -158,10 +174,29 @@ static int ehca_process_perf(struct ib_device *ibdev, u8 port_num,
                poi->base_version = 1;
                poi->class_version = 1;
                poi->resp_time_value = 18;
-                poi->redirect_lid = sport->saved_attr.lid;
-                poi->redirect_qp = sport->pma_qp_nr;
+                /* copy local routing information from WC where applicable */
+                tcslfl->sl         = in_wc->sl;
+                poi->redirect_lid  =
+                        sport->saved_attr.lid | in_wc->dlid_path_bits;
+                poi->redirect_qp   = sport->pma_qp_nr;
                poi->redirect_qkey = IB_QP1_QKEY;
-                poi->redirect_pkey = IB_DEFAULT_PKEY_FULL;
+                ehca_query_pkey(ibdev, port_num, in_wc->pkey_index,
+                                &poi->redirect_pkey);
+                /* if request was globally routed, copy route info */
+                if (in_grh) {
+                        struct vertcfl *vertcfl =
+                                (struct vertcfl *)&in_grh->version_tclass_flow;
+                        memcpy(poi->redirect_gid, in_grh->dgid.raw,
+                               sizeof(poi->redirect_gid));
+                        tcslfl->tc        = vertcfl->tc;
+                        tcslfl->fl        = vertcfl->fl;
+                } else
+                        /* else only fill in default GID */
+                        ehca_query_gid(ibdev, port_num, 0,
+                                       (union ib_gid *)&poi->redirect_gid);
                ehca_dbg(ibdev, "ehca_pma_lid=%x ehca_pma_qp=%x",
                         sport->saved_attr.lid, sport->pma_qp_nr);
@@ -183,8 +218,7 @@ perf_reply:
 int ehca_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
                     struct ib_wc *in_wc, struct ib_grh *in_grh,
-                     struct ib_mad *in_mad,
+                     struct ib_mad *in_mad, struct ib_mad *out_mad)
-                     struct ib_mad *out_mad)
 {
        int ret;
@@ -196,7 +230,8 @@ int ehca_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
                return IB_MAD_RESULT_SUCCESS;
        ehca_dbg(ibdev, "port_num=%x src_qp=%x", port_num, in_wc->src_qp);
-        ret = ehca_process_perf(ibdev, port_num, in_mad, out_mad);
+        ret = ehca_process_perf(ibdev, port_num, in_wc, in_grh,
+                                in_mad, out_mad);
        return ret;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 23173982b32c..38a287006612 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -1616,7 +1616,7 @@ static int try_alloc_port(struct ipath_devdata *dd, int port,
                pd->port_cnt = 1;
                port_fp(fp) = pd;
                pd->port_pid = get_pid(task_pid(current));
-                strncpy(pd->port_comm, current->comm, sizeof(pd->port_comm));
+                strlcpy(pd->port_comm, current->comm, sizeof(pd->port_comm));
                ipath_stats.sps_ports++;
                ret = 0;
        } else
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 16a702d46018..ceb98ee78666 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -60,7 +60,7 @@ static int recv_subn_get_nodedescription(struct ib_smp *smp,
        if (smp->attr_mod)
                smp->status |= IB_SMP_INVALID_FIELD;
-        strncpy(smp->data, ibdev->node_desc, sizeof(smp->data));
+        memcpy(smp->data, ibdev->node_desc, sizeof(smp->data));
        return reply(smp);
 }
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ae3d7590346e..3cb3f47a10b8 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -342,6 +342,9 @@ static struct ib_ucontext *mlx4_ib_alloc_ucontext(struct ib_device *ibdev,
        struct mlx4_ib_alloc_ucontext_resp resp;
        int err;
+        if (!dev->ib_active)
+                return ERR_PTR(-EAGAIN);
        resp.qp_tab_size      = dev->dev->caps.num_qps;
        resp.bf_reg_size      = dev->dev->caps.bf_reg_size;
        resp.bf_regs_per_page = dev->dev->caps.bf_regs_per_page;
@@ -540,15 +543,11 @@ static struct device_attribute *mlx4_class_attributes[] = {
 static void *mlx4_ib_add(struct mlx4_dev *dev)
 {
-        static int mlx4_ib_version_printed;
        struct mlx4_ib_dev *ibdev;
        int num_ports = 0;
        int i;
-        if (!mlx4_ib_version_printed) {
+        printk_once(KERN_INFO "%s", mlx4_ib_version);
-                printk(KERN_INFO "%s", mlx4_ib_version);
-                ++mlx4_ib_version_printed;
-        }
        mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_IB)
                num_ports++;
@@ -673,6 +672,8 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                        goto err_reg;
        }
+        ibdev->ib_active = true;
        return ibdev;
 err_reg:
@@ -729,6 +730,7 @@ static void mlx4_ib_event(struct mlx4_dev *dev, void *ibdev_ptr,
                break;
        case MLX4_DEV_EVENT_CATASTROPHIC_ERROR:
+                ibdev->ib_active = false;
                ibev.event = IB_EVENT_DEVICE_FATAL;
                break;
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 8a7dd6795fa0..3486d7675e56 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -175,6 +175,7 @@ struct mlx4_ib_dev {
        spinlock_t              sm_lock;
        struct mutex            cap_mask_mutex;
+        bool                    ib_active;
 };
 static inline struct mlx4_ib_dev *to_mdev(struct ib_device *ibdev)
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index c4a02648c8af..219b10397b4d 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -615,10 +615,12 @@ static enum mlx4_qp_state to_mlx4_state(enum ib_qp_state state)
 }
 static void mlx4_ib_lock_cqs(struct mlx4_ib_cq *send_cq, struct mlx4_ib_cq *recv_cq)
+        __acquires(&send_cq->lock) __acquires(&recv_cq->lock)
 {
-        if (send_cq == recv_cq)
+        if (send_cq == recv_cq) {
                spin_lock_irq(&send_cq->lock);
-        else if (send_cq->mcq.cqn < recv_cq->mcq.cqn) {
+                __acquire(&recv_cq->lock);
+        } else if (send_cq->mcq.cqn < recv_cq->mcq.cqn) {
                spin_lock_irq(&send_cq->lock);
                spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
        } else {
@@ -628,10 +630,12 @@ static void mlx4_ib_lock_cqs(struct mlx4_ib_cq *send_cq, struct mlx4_ib_cq *recv
 }
 static void mlx4_ib_unlock_cqs(struct mlx4_ib_cq *send_cq, struct mlx4_ib_cq *recv_cq)
+        __releases(&send_cq->lock) __releases(&recv_cq->lock)
 {
-        if (send_cq == recv_cq)
+        if (send_cq == recv_cq) {
+                __release(&recv_cq->lock);
                spin_unlock_irq(&send_cq->lock);
-        else if (send_cq->mcq.cqn < recv_cq->mcq.cqn) {
+        } else if (send_cq->mcq.cqn < recv_cq->mcq.cqn) {
                spin_unlock(&recv_cq->lock);
                spin_unlock_irq(&send_cq->lock);
        } else {
diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c
index 65ad359fdf16..056b2a4c6970 100644
--- a/drivers/infiniband/hw/mthca/mthca_catas.c
+++ b/drivers/infiniband/hw/mthca/mthca_catas.c
@@ -88,6 +88,7 @@ static void handle_catas(struct mthca_dev *dev)
        event.device = &dev->ib_dev;
        event.event  = IB_EVENT_DEVICE_FATAL;
        event.element.port_num = 0;
+        dev->active = false;
        ib_dispatch_event(&event);
diff --git a/drivers/infiniband/hw/mthca/mthca_config_reg.h b/drivers/infiniband/hw/mthca/mthca_config_reg.h
index 75671f75cac4..155bc66395be 100644
--- a/drivers/infiniband/hw/mthca/mthca_config_reg.h
+++ b/drivers/infiniband/hw/mthca/mthca_config_reg.h
@@ -34,8 +34,6 @@
 #ifndef MTHCA_CONFIG_REG_H
 #define MTHCA_CONFIG_REG_H
-#include <asm/page.h>
 #define MTHCA_HCR_BASE         0x80680
 #define MTHCA_HCR_SIZE         0x0001c
 #define MTHCA_ECR_BASE         0x80700
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 9ef611f6dd36..7e6a6d64ad4e 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -357,6 +357,7 @@ struct mthca_dev {
        struct ib_ah         *sm_ah[MTHCA_MAX_PORTS];
        spinlock_t            sm_lock;
        u8                    rate[MTHCA_MAX_PORTS];
+        bool                  active;
 };
 #ifdef CONFIG_INFINIBAND_MTHCA_DEBUG
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 90e4e450a120..8c31fa36e95e 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -829,27 +829,34 @@ int mthca_init_eq_table(struct mthca_dev *dev)
        if (dev->mthca_flags & MTHCA_FLAG_MSI_X) {
                static const char *eq_name[] = {
-                        [MTHCA_EQ_COMP]  = DRV_NAME " (comp)",
+                        [MTHCA_EQ_COMP]  = DRV_NAME "-comp",
-                        [MTHCA_EQ_ASYNC] = DRV_NAME " (async)",
+                        [MTHCA_EQ_ASYNC] = DRV_NAME "-async",
-                        [MTHCA_EQ_CMD]   = DRV_NAME " (cmd)"
+                        [MTHCA_EQ_CMD]   = DRV_NAME "-cmd"
                };
                for (i = 0; i < MTHCA_NUM_EQ; ++i) {
+                        snprintf(dev->eq_table.eq[i].irq_name,
+                                 IB_DEVICE_NAME_MAX,
+                                 "%s@pci:%s", eq_name[i],
+                                 pci_name(dev->pdev));
                        err = request_irq(dev->eq_table.eq[i].msi_x_vector,
                                          mthca_is_memfree(dev) ?
                                          mthca_arbel_msi_x_interrupt :
                                          mthca_tavor_msi_x_interrupt,
-                                          0, eq_name[i], dev->eq_table.eq + i);
+                                          0, dev->eq_table.eq[i].irq_name,
+                                          dev->eq_table.eq + i);
                        if (err)
                                goto err_out_cmd;
                        dev->eq_table.eq[i].have_irq = 1;
                }
        } else {
+                snprintf(dev->eq_table.eq[0].irq_name, IB_DEVICE_NAME_MAX,
+                         DRV_NAME "@pci:%s", pci_name(dev->pdev));
                err = request_irq(dev->pdev->irq,
                                  mthca_is_memfree(dev) ?
                                  mthca_arbel_interrupt :
                                  mthca_tavor_interrupt,
-                                  IRQF_SHARED, DRV_NAME, dev);
+                                  IRQF_SHARED, dev->eq_table.eq[0].irq_name, dev);
                if (err)
                        goto err_out_cmd;
                dev->eq_table.have_irq = 1;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 13da9f1d24c0..b01b28987874 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -1116,6 +1116,8 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type)
        pci_set_drvdata(pdev, mdev);
        mdev->hca_type = hca_type;
+        mdev->active = true;
        return 0;
 err_unregister:
@@ -1215,15 +1217,11 @@ int __mthca_restart_one(struct pci_dev *pdev)
 static int __devinit mthca_init_one(struct pci_dev *pdev,
                                    const struct pci_device_id *id)
 {
-        static int mthca_version_printed = 0;
        int ret;
        mutex_lock(&mthca_device_mutex);
-        if (!mthca_version_printed) {
+        printk_once(KERN_INFO "%s", mthca_version);
-                printk(KERN_INFO "%s", mthca_version);
-                ++mthca_version_printed;
-        }
        if (id->driver_data >= ARRAY_SIZE(mthca_hca_table)) {
                printk(KERN_ERR PFX "%s has invalid driver data %lx\n",
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 87ad889e367b..bcf7a4014820 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -334,6 +334,9 @@ static struct ib_ucontext *mthca_alloc_ucontext(struct ib_device *ibdev,
        struct mthca_ucontext           *context;
        int                              err;
+        if (!(to_mdev(ibdev)->active))
+                return ERR_PTR(-EAGAIN);
        memset(&uresp, 0, sizeof uresp);
        uresp.qp_tab_size = to_mdev(ibdev)->limits.num_qps;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index c621f8794b88..90f4c4d2e983 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -113,6 +113,7 @@ struct mthca_eq {
        int                    nent;
        struct mthca_buf_list *page_list;
        struct mthca_mr        mr;
+        char                   irq_name[IB_DEVICE_NAME_MAX];
 };
 struct mthca_av;
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index f5081bfde6db..c10576fa60c1 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1319,10 +1319,12 @@ int mthca_alloc_qp(struct mthca_dev *dev,
 }
 static void mthca_lock_cqs(struct mthca_cq *send_cq, struct mthca_cq *recv_cq)
+        __acquires(&send_cq->lock) __acquires(&recv_cq->lock)
 {
-        if (send_cq == recv_cq)
+        if (send_cq == recv_cq) {
                spin_lock_irq(&send_cq->lock);
-        else if (send_cq->cqn < recv_cq->cqn) {
+                __acquire(&recv_cq->lock);
+        } else if (send_cq->cqn < recv_cq->cqn) {
                spin_lock_irq(&send_cq->lock);
                spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
        } else {
@@ -1332,10 +1334,12 @@ static void mthca_lock_cqs(struct mthca_cq *send_cq, struct mthca_cq *recv_cq)
 }
 static void mthca_unlock_cqs(struct mthca_cq *send_cq, struct mthca_cq *recv_cq)
+        __releases(&send_cq->lock) __releases(&recv_cq->lock)
 {
-        if (send_cq == recv_cq)
+        if (send_cq == recv_cq) {
+                __release(&recv_cq->lock);
                spin_unlock_irq(&send_cq->lock);
-        else if (send_cq->cqn < recv_cq->cqn) {
+        } else if (send_cq->cqn < recv_cq->cqn) {
                spin_unlock(&recv_cq->lock);
                spin_unlock_irq(&send_cq->lock);
        } else {
diff --git a/drivers/infiniband/hw/mthca/mthca_reset.c b/drivers/infiniband/hw/mthca/mthca_reset.c
index acb6817f6060..2a13a163d337 100644
--- a/drivers/infiniband/hw/mthca/mthca_reset.c
+++ b/drivers/infiniband/hw/mthca/mthca_reset.c
@@ -30,7 +30,6 @@
 * SOFTWARE.
 */
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 181b1f32325f..8f4b4fca2a1d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -31,7 +31,6 @@
 */
 #include <rdma/ib_cm.h>
-#include <rdma/ib_cache.h>
 #include <net/dst.h>
 #include <net/icmp.h>
 #include <linux/icmpv6.h>
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index e7e5adf84e84..e35f4a0ea9d5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -36,7 +36,6 @@
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
-#include <rdma/ib_cache.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index e319d91f60a6..2bf5116deec4 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -604,8 +604,11 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                                           skb_queue_len(&neigh->queue));
                                goto err_drop;
                        }
-                } else
+                } else {
+                        spin_unlock_irqrestore(&priv->lock, flags);
                        ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb_dst(skb)->neighbour->ha));
+                        return;
+                }
        } else {
                neigh->ah  = NULL;
@@ -688,7 +691,9 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
                ipoib_dbg(priv, "Send unicast ARP to %04x\n",
                          be16_to_cpu(path->pathrec.dlid));
+                spin_unlock_irqrestore(&priv->lock, flags);
                ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
+                return;
        } else if ((path->query || !path_rec_start(dev, path)) &&
                   skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
                /* put pseudoheader back on for next time */
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index a0e97532e714..25874fc680c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -720,7 +720,9 @@ out:
                        }
                }
+                spin_unlock_irqrestore(&priv->lock, flags);
                ipoib_send(dev, skb, mcast->ah, IB_MULTICAST_QPN);
+                return;
        }
 unlock:
@@ -758,6 +760,20 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
        }
 }
+static int ipoib_mcast_addr_is_valid(const u8 *addr, unsigned int addrlen,
+                                     const u8 *broadcast)
+{
+        if (addrlen != INFINIBAND_ALEN)
+                return 0;
+        /* reserved QPN, prefix, scope */
+        if (memcmp(addr, broadcast, 6))
+                return 0;
+        /* signature lower, pkey */
+        if (memcmp(addr + 7, broadcast + 7, 3))
+                return 0;
+        return 1;
+}
 void ipoib_mcast_restart_task(struct work_struct *work)
 {
        struct ipoib_dev_priv *priv =
@@ -791,6 +807,11 @@ void ipoib_mcast_restart_task(struct work_struct *work)
        for (mclist = dev->mc_list; mclist; mclist = mclist->next) {
                union ib_gid mgid;
+                if (!ipoib_mcast_addr_is_valid(mclist->dmi_addr,
+                                               mclist->dmi_addrlen,
+                                               dev->broadcast))
+                        continue;
                memcpy(mgid.raw, mclist->dmi_addr + 4, sizeof mgid);
                mcast = __ipoib_mcast_find(dev, &mgid);