9 files changed, 214 insertions, 180 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index c639f90cfda4..3edce617c31b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -86,7 +86,6 @@ enum {
        IPOIB_FLAG_INITIALIZED    = 1,
        IPOIB_FLAG_ADMIN_UP       = 2,
        IPOIB_PKEY_ASSIGNED       = 3,
-        IPOIB_PKEY_STOP           = 4,
        IPOIB_FLAG_SUBINTERFACE   = 5,
        IPOIB_MCAST_RUN           = 6,
        IPOIB_STOP_REAPER         = 7,
@@ -312,7 +311,6 @@ struct ipoib_dev_priv {
        struct list_head multicast_list;
        struct rb_root multicast_tree;
-        struct delayed_work pkey_poll_task;
        struct delayed_work mcast_task;
        struct work_struct carrier_on_task;
        struct work_struct flush_light;
@@ -473,10 +471,11 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work);
 void ipoib_pkey_event(struct work_struct *work);
 void ipoib_ib_dev_cleanup(struct net_device *dev);
-int ipoib_ib_dev_open(struct net_device *dev);
+int ipoib_ib_dev_open(struct net_device *dev, int flush);
 int ipoib_ib_dev_up(struct net_device *dev);
 int ipoib_ib_dev_down(struct net_device *dev, int flush);
 int ipoib_ib_dev_stop(struct net_device *dev, int flush);
+void ipoib_pkey_dev_check_presence(struct net_device *dev);
 int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_dev_cleanup(struct net_device *dev);
@@ -532,8 +531,7 @@ int  ipoib_set_mode(struct net_device *dev, const char *buf);
 void ipoib_setup(struct net_device *dev);
-void ipoib_pkey_poll(struct work_struct *work);
+void ipoib_pkey_open(struct ipoib_dev_priv *priv);
-int ipoib_pkey_dev_delay_open(struct net_device *dev);
 void ipoib_drain_cq(struct net_device *dev);
 void ipoib_set_ethtool_ops(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 50061854616e..6bd5740e2691 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -281,10 +281,8 @@ void ipoib_delete_debug_files(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        if (priv->mcg_dentry)
+        debugfs_remove(priv->mcg_dentry);
-                debugfs_remove(priv->mcg_dentry);
+        debugfs_remove(priv->path_dentry);
-        if (priv->path_dentry)
-                debugfs_remove(priv->path_dentry);
 }
 int ipoib_register_debugfs(void)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 6a7003ddb0be..72626c348174 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -664,17 +664,18 @@ static void ipoib_ib_tx_timer_func(unsigned long ctx)
        drain_tx_cq((struct net_device *)ctx);
 }
-int ipoib_ib_dev_open(struct net_device *dev)
+int ipoib_ib_dev_open(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        int ret;
-        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &priv->pkey_index)) {
+        ipoib_pkey_dev_check_presence(dev);
-                ipoib_warn(priv, "P_Key 0x%04x not found\n", priv->pkey);
-                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
+                ipoib_warn(priv, "P_Key 0x%04x is %s\n", priv->pkey,
+                           (!(priv->pkey & 0x7fff) ? "Invalid" : "not found"));
                return -1;
        }
-        set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
        ret = ipoib_init_qp(dev);
        if (ret) {
@@ -705,16 +706,17 @@ int ipoib_ib_dev_open(struct net_device *dev)
 dev_stop:
        if (!test_and_set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
                napi_enable(&priv->napi);
-        ipoib_ib_dev_stop(dev, 1);
+        ipoib_ib_dev_stop(dev, flush);
        return -1;
 }
-static void ipoib_pkey_dev_check_presence(struct net_device *dev)
+void ipoib_pkey_dev_check_presence(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        u16 pkey_index = 0;
-        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &pkey_index))
+        if (!(priv->pkey & 0x7fff) ||
+            ib_find_pkey(priv->ca, priv->port, priv->pkey,
+                         &priv->pkey_index))
                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
        else
                set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
@@ -745,14 +747,6 @@ int ipoib_ib_dev_down(struct net_device *dev, int flush)
        clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
        netif_carrier_off(dev);
-        /* Shutdown the P_Key thread if still active */
-        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
-                mutex_lock(&pkey_mutex);
-                set_bit(IPOIB_PKEY_STOP, &priv->flags);
-                cancel_delayed_work_sync(&priv->pkey_poll_task);
-                mutex_unlock(&pkey_mutex);
-        }
        ipoib_mcast_stop_thread(dev, flush);
        ipoib_mcast_dev_flush(dev);
@@ -924,7 +918,7 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
                    (unsigned long) dev);
        if (dev->flags & IFF_UP) {
-                if (ipoib_ib_dev_open(dev)) {
+                if (ipoib_ib_dev_open(dev, 1)) {
                        ipoib_transport_dev_cleanup(dev);
                        return -ENODEV;
                }
@@ -966,13 +960,27 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
        return 1;
 }
+/*
+ * returns 0 if pkey value was found in a different slot.
+ */
+static inline int update_child_pkey(struct ipoib_dev_priv *priv)
+{
+        u16 old_index = priv->pkey_index;
+        priv->pkey_index = 0;
+        ipoib_pkey_dev_check_presence(priv->dev);
+        if (test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
+            (old_index == priv->pkey_index))
+                return 1;
+        return 0;
+}
 static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                                enum ipoib_flush_level level)
 {
        struct ipoib_dev_priv *cpriv;
        struct net_device *dev = priv->dev;
-        u16 new_index;
        int result;
        down_read(&priv->vlan_rwsem);
@@ -986,16 +994,20 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
        up_read(&priv->vlan_rwsem);
-        if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) {
+        if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags) &&
-                /* for non-child devices must check/update the pkey value here */
+            level != IPOIB_FLUSH_HEAVY) {
-                if (level == IPOIB_FLUSH_HEAVY &&
-                    !test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags))
-                        update_parent_pkey(priv);
                ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_INITIALIZED not set.\n");
                return;
        }
        if (!test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) {
+                /* interface is down. update pkey and leave. */
+                if (level == IPOIB_FLUSH_HEAVY) {
+                        if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags))
+                                update_parent_pkey(priv);
+                        else
+                                update_child_pkey(priv);
+                }
                ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_ADMIN_UP not set.\n");
                return;
        }
@@ -1005,20 +1017,13 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                 * (parent) devices should always takes what present in pkey index 0
                 */
                if (test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
-                        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
+                        result = update_child_pkey(priv);
-                                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                        if (result) {
-                                ipoib_ib_dev_down(dev, 0);
+                                /* restart QP only if P_Key index is changed */
-                                ipoib_ib_dev_stop(dev, 0);
-                                if (ipoib_pkey_dev_delay_open(dev))
-                                        return;
-                        }
-                        /* restart QP only if P_Key index is changed */
-                        if (test_and_set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
-                            new_index == priv->pkey_index) {
                                ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
                                return;
                        }
-                        priv->pkey_index = new_index;
                } else {
                        result = update_parent_pkey(priv);
                        /* restart QP only if P_Key value changed */
@@ -1038,8 +1043,12 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                ipoib_ib_dev_down(dev, 0);
        if (level == IPOIB_FLUSH_HEAVY) {
-                ipoib_ib_dev_stop(dev, 0);
+                if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
-                ipoib_ib_dev_open(dev);
+                        ipoib_ib_dev_stop(dev, 0);
+                if (ipoib_ib_dev_open(dev, 0) != 0)
+                        return;
+                if (netif_queue_stopped(dev))
+                        netif_start_queue(dev);
        }
        /*
@@ -1094,54 +1103,4 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
        ipoib_transport_dev_cleanup(dev);
 }
-/*
- * Delayed P_Key Assigment Interim Support
- *
- * The following is initial implementation of delayed P_Key assigment
- * mechanism. It is using the same approach implemented for the multicast
- * group join. The single goal of this implementation is to quickly address
- * Bug #2507. This implementation will probably be removed when the P_Key
- * change async notification is available.
- */
-void ipoib_pkey_poll(struct work_struct *work)
-{
-        struct ipoib_dev_priv *priv =
-                container_of(work, struct ipoib_dev_priv, pkey_poll_task.work);
-        struct net_device *dev = priv->dev;
-        ipoib_pkey_dev_check_presence(dev);
-        if (test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags))
-                ipoib_open(dev);
-        else {
-                mutex_lock(&pkey_mutex);
-                if (!test_bit(IPOIB_PKEY_STOP, &priv->flags))
-                        queue_delayed_work(ipoib_workqueue,
-                                           &priv->pkey_poll_task,
-                                           HZ);
-                mutex_unlock(&pkey_mutex);
-        }
-}
-int ipoib_pkey_dev_delay_open(struct net_device *dev)
-{
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        /* Look for the interface pkey value in the IB Port P_Key table and */
-        /* set the interface pkey assigment flag                            */
-        ipoib_pkey_dev_check_presence(dev);
-        /* P_Key value not assigned yet - start polling */
-        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
-                mutex_lock(&pkey_mutex);
-                clear_bit(IPOIB_PKEY_STOP, &priv->flags);
-                queue_delayed_work(ipoib_workqueue,
-                                   &priv->pkey_poll_task,
-                                   HZ);
-                mutex_unlock(&pkey_mutex);
-                return 1;
-        }
-        return 0;
-}
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 5786a78ff8bc..1310acf6bf92 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -108,11 +108,11 @@ int ipoib_open(struct net_device *dev)
        set_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags);
-        if (ipoib_pkey_dev_delay_open(dev))
+        if (ipoib_ib_dev_open(dev, 1)) {
-                return 0;
+                if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags))
+                        return 0;
-        if (ipoib_ib_dev_open(dev))
                goto err_disable;
+        }
        if (ipoib_ib_dev_up(dev))
                goto err_stop;
@@ -1379,7 +1379,6 @@ void ipoib_setup(struct net_device *dev)
        INIT_LIST_HEAD(&priv->dead_ahs);
        INIT_LIST_HEAD(&priv->multicast_list);
-        INIT_DELAYED_WORK(&priv->pkey_poll_task, ipoib_pkey_poll);
        INIT_DELAYED_WORK(&priv->mcast_task,   ipoib_mcast_join_task);
        INIT_WORK(&priv->carrier_on_task, ipoib_mcast_carrier_on_task);
        INIT_WORK(&priv->flush_light,   ipoib_ib_dev_flush_light);
@@ -1394,8 +1393,8 @@ struct ipoib_dev_priv *ipoib_intf_alloc(const char *name)
 {
        struct net_device *dev;
-        dev = alloc_netdev((int) sizeof (struct ipoib_dev_priv), name,
+        dev = alloc_netdev((int)sizeof(struct ipoib_dev_priv), name,
-                           ipoib_setup);
+                           NET_NAME_UNKNOWN, ipoib_setup);
        if (!dev)
                return NULL;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index eb7973957a6e..61ee91d88380 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -596,20 +596,28 @@ iscsi_iser_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
        struct iser_conn *ib_conn;
        struct iscsi_endpoint *ep;
-        ep = iscsi_create_endpoint(sizeof(*ib_conn));
+        ep = iscsi_create_endpoint(0);
        if (!ep)
                return ERR_PTR(-ENOMEM);
-        ib_conn = ep->dd_data;
+        ib_conn = kzalloc(sizeof(*ib_conn), GFP_KERNEL);
+        if (!ib_conn) {
+                err = -ENOMEM;
+                goto failure;
+        }
+        ep->dd_data = ib_conn;
        ib_conn->ep = ep;
        iser_conn_init(ib_conn);
-        err = iser_connect(ib_conn, NULL, (struct sockaddr_in *)dst_addr,
+        err = iser_connect(ib_conn, NULL, dst_addr, non_blocking);
-                           non_blocking);
        if (err)
-                return ERR_PTR(err);
+                goto failure;
        return ep;
+failure:
+        iscsi_destroy_endpoint(ep);
+        return ERR_PTR(err);
 }
 static int
@@ -619,15 +627,16 @@ iscsi_iser_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
        int rc;
        ib_conn = ep->dd_data;
-        rc = wait_event_interruptible_timeout(ib_conn->wait,
+        rc = wait_for_completion_interruptible_timeout(&ib_conn->up_completion,
-                             ib_conn->state == ISER_CONN_UP,
+                                                       msecs_to_jiffies(timeout_ms));
-                             msecs_to_jiffies(timeout_ms));
        /* if conn establishment failed, return error code to iscsi */
-        if (!rc &&
+        if (rc == 0) {
-            (ib_conn->state == ISER_CONN_TERMINATING ||
+                mutex_lock(&ib_conn->state_mutex);
-             ib_conn->state == ISER_CONN_DOWN))
+                if (ib_conn->state == ISER_CONN_TERMINATING ||
-                rc = -1;
+                    ib_conn->state == ISER_CONN_DOWN)
+                        rc = -1;
+                mutex_unlock(&ib_conn->state_mutex);
+        }
        iser_info("ib conn %p rc = %d\n", ib_conn, rc);
@@ -646,19 +655,25 @@ iscsi_iser_ep_disconnect(struct iscsi_endpoint *ep)
        ib_conn = ep->dd_data;
        iser_info("ep %p ib conn %p state %d\n", ep, ib_conn, ib_conn->state);
+        mutex_lock(&ib_conn->state_mutex);
        iser_conn_terminate(ib_conn);
        /*
-         * if iser_conn and iscsi_conn are bound, we must wait iscsi_conn_stop
+         * if iser_conn and iscsi_conn are bound, we must wait for
-         * call and ISER_CONN_DOWN state before freeing the iser resources.
+         * iscsi_conn_stop and flush errors completion before freeing
-         * otherwise we are safe to free resources immediately.
+         * the iser resources. Otherwise we are safe to free resources
+         * immediately.
         */
        if (ib_conn->iscsi_conn) {
                INIT_WORK(&ib_conn->release_work, iser_release_work);
                queue_work(release_wq, &ib_conn->release_work);
+                mutex_unlock(&ib_conn->state_mutex);
        } else {
+                ib_conn->state = ISER_CONN_DOWN;
+                mutex_unlock(&ib_conn->state_mutex);
                iser_conn_release(ib_conn);
        }
+        iscsi_destroy_endpoint(ep);
 }
 static umode_t iser_attr_is_visible(int param_type, int param)
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 97cd385bf7f7..c877dad381cb 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -326,7 +326,6 @@ struct iser_conn {
        struct iser_device           *device;       /* device context          */
        struct rdma_cm_id            *cma_id;       /* CMA ID                  */
        struct ib_qp                 *qp;           /* QP                      */
-        wait_queue_head_t            wait;          /* waitq for conn/disconn  */
        unsigned                     qp_max_recv_dtos; /* num of rx buffers */
        unsigned                     qp_max_recv_dtos_mask; /* above minus 1 */
        unsigned                     min_posted_rx; /* qp_max_recv_dtos >> 2 */
@@ -335,6 +334,9 @@ struct iser_conn {
        char                         name[ISER_OBJECT_NAME_SIZE];
        struct work_struct           release_work;
        struct completion            stop_completion;
+        struct mutex                 state_mutex;
+        struct completion            flush_completion;
+        struct completion            up_completion;
        struct list_head             conn_list;       /* entry in ig conn list */
        char                         *login_buf;
@@ -448,8 +450,8 @@ int  iser_reg_rdma_mem_fastreg(struct iscsi_iser_task *task,
                               enum iser_data_dir cmd_dir);
 int  iser_connect(struct iser_conn   *ib_conn,
-                  struct sockaddr_in *src_addr,
+                  struct sockaddr    *src_addr,
-                  struct sockaddr_in *dst_addr,
+                  struct sockaddr    *dst_addr,
                  int                non_blocking);
 int  iser_reg_page_vec(struct iser_conn     *ib_conn,
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index ea01075f9f9b..3ef167f97d6f 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -491,10 +491,9 @@ out_err:
 }
 /**
- * releases the QP objects, returns 0 on success,
+ * releases the QP object
- * -1 on failure
 */
-static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
+static void iser_free_ib_conn_res(struct iser_conn *ib_conn)
 {
        int cq_index;
        BUG_ON(ib_conn == NULL);
@@ -513,8 +512,6 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
        }
        ib_conn->qp       = NULL;
-        return 0;
 }
 /**
@@ -568,31 +565,40 @@ static void iser_device_try_release(struct iser_device *device)
        mutex_unlock(&ig.device_list_mutex);
 }
+/**
+ * Called with state mutex held
+ **/
 static int iser_conn_state_comp_exch(struct iser_conn *ib_conn,
                                     enum iser_ib_conn_state comp,
                                     enum iser_ib_conn_state exch)
 {
        int ret;
-        spin_lock_bh(&ib_conn->lock);
        if ((ret = (ib_conn->state == comp)))
                ib_conn->state = exch;
-        spin_unlock_bh(&ib_conn->lock);
        return ret;
 }
 void iser_release_work(struct work_struct *work)
 {
        struct iser_conn *ib_conn;
+        int rc;
        ib_conn = container_of(work, struct iser_conn, release_work);
        /* wait for .conn_stop callback */
-        wait_for_completion(&ib_conn->stop_completion);
+        rc = wait_for_completion_timeout(&ib_conn->stop_completion, 30 * HZ);
+        WARN_ON(rc == 0);
        /* wait for the qp`s post send and post receive buffers to empty */
-        wait_event_interruptible(ib_conn->wait,
+        rc = wait_for_completion_timeout(&ib_conn->flush_completion, 30 * HZ);
-                                 ib_conn->state == ISER_CONN_DOWN);
+        WARN_ON(rc == 0);
+        ib_conn->state = ISER_CONN_DOWN;
+        mutex_lock(&ib_conn->state_mutex);
+        ib_conn->state = ISER_CONN_DOWN;
+        mutex_unlock(&ib_conn->state_mutex);
        iser_conn_release(ib_conn);
 }
@@ -604,23 +610,27 @@ void iser_conn_release(struct iser_conn *ib_conn)
 {
        struct iser_device  *device = ib_conn->device;
-        BUG_ON(ib_conn->state == ISER_CONN_UP);
        mutex_lock(&ig.connlist_mutex);
        list_del(&ib_conn->conn_list);
        mutex_unlock(&ig.connlist_mutex);
+        mutex_lock(&ib_conn->state_mutex);
+        BUG_ON(ib_conn->state != ISER_CONN_DOWN);
        iser_free_rx_descriptors(ib_conn);
        iser_free_ib_conn_res(ib_conn);
        ib_conn->device = NULL;
        /* on EVENT_ADDR_ERROR there's no device yet for this conn */
        if (device != NULL)
                iser_device_try_release(device);
+        mutex_unlock(&ib_conn->state_mutex);
        /* if cma handler context, the caller actually destroy the id */
        if (ib_conn->cma_id != NULL) {
                rdma_destroy_id(ib_conn->cma_id);
                ib_conn->cma_id = NULL;
        }
-        iscsi_destroy_endpoint(ib_conn->ep);
+        kfree(ib_conn);
 }
 /**
@@ -642,22 +652,31 @@ void iser_conn_terminate(struct iser_conn *ib_conn)
                         ib_conn,err);
 }
+/**
+ * Called with state mutex held
+ **/
 static void iser_connect_error(struct rdma_cm_id *cma_id)
 {
        struct iser_conn *ib_conn;
        ib_conn = (struct iser_conn *)cma_id->context;
        ib_conn->state = ISER_CONN_DOWN;
-        wake_up_interruptible(&ib_conn->wait);
 }
+/**
+ * Called with state mutex held
+ **/
 static void iser_addr_handler(struct rdma_cm_id *cma_id)
 {
        struct iser_device *device;
        struct iser_conn   *ib_conn;
        int    ret;
+        ib_conn = (struct iser_conn *)cma_id->context;
+        if (ib_conn->state != ISER_CONN_PENDING)
+                /* bailout */
+                return;
        device = iser_device_find_by_ib_device(cma_id);
        if (!device) {
                iser_err("device lookup/creation failed\n");
@@ -665,7 +684,6 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
                return;
        }
-        ib_conn = (struct iser_conn *)cma_id->context;
        ib_conn->device = device;
        /* connection T10-PI support */
@@ -689,18 +707,27 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
        }
 }
+/**
+ * Called with state mutex held
+ **/
 static void iser_route_handler(struct rdma_cm_id *cma_id)
 {
        struct rdma_conn_param conn_param;
        int    ret;
        struct iser_cm_hdr req_hdr;
+        struct iser_conn *ib_conn = (struct iser_conn *)cma_id->context;
+        struct iser_device *device = ib_conn->device;
+        if (ib_conn->state != ISER_CONN_PENDING)
+                /* bailout */
+                return;
        ret = iser_create_ib_conn_res((struct iser_conn *)cma_id->context);
        if (ret)
                goto failure;
        memset(&conn_param, 0, sizeof conn_param);
-        conn_param.responder_resources = 4;
+        conn_param.responder_resources = device->dev_attr.max_qp_rd_atom;
        conn_param.initiator_depth     = 1;
        conn_param.retry_count         = 7;
        conn_param.rnr_retry_count     = 6;
@@ -728,12 +755,16 @@ static void iser_connected_handler(struct rdma_cm_id *cma_id)
        struct ib_qp_attr attr;
        struct ib_qp_init_attr init_attr;
+        ib_conn = (struct iser_conn *)cma_id->context;
+        if (ib_conn->state != ISER_CONN_PENDING)
+                /* bailout */
+                return;
        (void)ib_query_qp(cma_id->qp, &attr, ~0, &init_attr);
        iser_info("remote qpn:%x my qpn:%x\n", attr.dest_qp_num, cma_id->qp->qp_num);
-        ib_conn = (struct iser_conn *)cma_id->context;
+        ib_conn->state = ISER_CONN_UP;
-        if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_PENDING, ISER_CONN_UP))
+        complete(&ib_conn->up_completion);
-                wake_up_interruptible(&ib_conn->wait);
 }
 static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
@@ -752,19 +783,25 @@ static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
                        iser_err("iscsi_iser connection isn't bound\n");
        }
-        /* Complete the termination process if no posts are pending */
+        /* Complete the termination process if no posts are pending. This code
+         * block also exists in iser_handle_comp_error(), but it is needed here
+         * for cases of no flushes at all, e.g. discovery over rdma.
+         */
        if (ib_conn->post_recv_buf_count == 0 &&
            (atomic_read(&ib_conn->post_send_buf_count) == 0)) {
-                ib_conn->state = ISER_CONN_DOWN;
+                complete(&ib_conn->flush_completion);
-                wake_up_interruptible(&ib_conn->wait);
        }
 }
 static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
+        struct iser_conn *ib_conn;
+        ib_conn = (struct iser_conn *)cma_id->context;
        iser_info("event %d status %d conn %p id %p\n",
                  event->event, event->status, cma_id->context, cma_id);
+        mutex_lock(&ib_conn->state_mutex);
        switch (event->event) {
        case RDMA_CM_EVENT_ADDR_RESOLVED:
                iser_addr_handler(cma_id);
@@ -785,24 +822,28 @@ static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *eve
        case RDMA_CM_EVENT_DISCONNECTED:
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
        case RDMA_CM_EVENT_ADDR_CHANGE:
+        case RDMA_CM_EVENT_TIMEWAIT_EXIT:
                iser_disconnected_handler(cma_id);
                break;
        default:
                iser_err("Unexpected RDMA CM event (%d)\n", event->event);
                break;
        }
+        mutex_unlock(&ib_conn->state_mutex);
        return 0;
 }
 void iser_conn_init(struct iser_conn *ib_conn)
 {
        ib_conn->state = ISER_CONN_INIT;
-        init_waitqueue_head(&ib_conn->wait);
        ib_conn->post_recv_buf_count = 0;
        atomic_set(&ib_conn->post_send_buf_count, 0);
        init_completion(&ib_conn->stop_completion);
+        init_completion(&ib_conn->flush_completion);
+        init_completion(&ib_conn->up_completion);
        INIT_LIST_HEAD(&ib_conn->conn_list);
        spin_lock_init(&ib_conn->lock);
+        mutex_init(&ib_conn->state_mutex);
 }
 /**
@@ -810,22 +851,21 @@ void iser_conn_init(struct iser_conn *ib_conn)
 * sleeps until the connection is established or rejected
 */
 int iser_connect(struct iser_conn   *ib_conn,
-                 struct sockaddr_in *src_addr,
+                 struct sockaddr    *src_addr,
-                 struct sockaddr_in *dst_addr,
+                 struct sockaddr    *dst_addr,
                 int                 non_blocking)
 {
-        struct sockaddr *src, *dst;
        int err = 0;
-        sprintf(ib_conn->name, "%pI4:%d",
+        mutex_lock(&ib_conn->state_mutex);
-                &dst_addr->sin_addr.s_addr, dst_addr->sin_port);
+        sprintf(ib_conn->name, "%pISp", dst_addr);
+        iser_info("connecting to: %s\n", ib_conn->name);
        /* the device is known only --after-- address resolution */
        ib_conn->device = NULL;
-        iser_info("connecting to: %pI4, port 0x%x\n",
-                  &dst_addr->sin_addr, dst_addr->sin_port);
        ib_conn->state = ISER_CONN_PENDING;
        ib_conn->cma_id = rdma_create_id(iser_cma_handler,
@@ -837,23 +877,21 @@ int iser_connect(struct iser_conn   *ib_conn,
                goto id_failure;
        }
-        src = (struct sockaddr *)src_addr;
+        err = rdma_resolve_addr(ib_conn->cma_id, src_addr, dst_addr, 1000);
-        dst = (struct sockaddr *)dst_addr;
-        err = rdma_resolve_addr(ib_conn->cma_id, src, dst, 1000);
        if (err) {
                iser_err("rdma_resolve_addr failed: %d\n", err);
                goto addr_failure;
        }
        if (!non_blocking) {
-                wait_event_interruptible(ib_conn->wait,
+                wait_for_completion_interruptible(&ib_conn->up_completion);
-                                         (ib_conn->state != ISER_CONN_PENDING));
                if (ib_conn->state != ISER_CONN_UP) {
                        err =  -EIO;
                        goto connect_failure;
                }
        }
+        mutex_unlock(&ib_conn->state_mutex);
        mutex_lock(&ig.connlist_mutex);
        list_add(&ib_conn->conn_list, &ig.connlist);
@@ -865,6 +903,7 @@ id_failure:
 addr_failure:
        ib_conn->state = ISER_CONN_DOWN;
 connect_failure:
+        mutex_unlock(&ib_conn->state_mutex);
        iser_conn_release(ib_conn);
        return err;
 }
@@ -1049,18 +1088,19 @@ static void iser_handle_comp_error(struct iser_tx_desc *desc,
        if (ib_conn->post_recv_buf_count == 0 &&
            atomic_read(&ib_conn->post_send_buf_count) == 0) {
-                /* getting here when the state is UP means that the conn is *
+                /**
-                 * being terminated asynchronously from the iSCSI layer's   *
+                 * getting here when the state is UP means that the conn is
-                 * perspective.                                             */
+                 * being terminated asynchronously from the iSCSI layer's
-                if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
+                 * perspective. It is safe to peek at the connection state
-                    ISER_CONN_TERMINATING))
+                 * since iscsi_conn_failure is allowed to be called twice.
+                 **/
+                if (ib_conn->state == ISER_CONN_UP)
                        iscsi_conn_failure(ib_conn->iscsi_conn,
                                           ISCSI_ERR_CONN_FAILED);
                /* no more non completed posts to the QP, complete the
                 * termination process w.o worrying on disconnect event */
-                ib_conn->state = ISER_CONN_DOWN;
+                complete(&ib_conn->flush_completion);
-                wake_up_interruptible(&ib_conn->wait);
        }
 }
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index e3c2c5b4297f..62d2a18e1b41 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -130,6 +130,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr);
 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
 static struct scsi_transport_template *ib_srp_transport_template;
+static struct workqueue_struct *srp_remove_wq;
 static struct ib_client srp_client = {
        .name   = "srp",
@@ -731,7 +732,7 @@ static bool srp_queue_remove_work(struct srp_target_port *target)
        spin_unlock_irq(&target->lock);
        if (changed)
-                queue_work(system_long_wq, &target->remove_work);
+                queue_work(srp_remove_wq, &target->remove_work);
        return changed;
 }
@@ -1643,10 +1644,14 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                                     SCSI_SENSE_BUFFERSIZE));
                }
-                if (rsp->flags & (SRP_RSP_FLAG_DOOVER | SRP_RSP_FLAG_DOUNDER))
+                if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER))
-                        scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
-                else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
                        scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
+                else if (unlikely(rsp->flags & SRP_RSP_FLAG_DIOVER))
+                        scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_in_res_cnt));
+                else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOUNDER))
+                        scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
+                else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOOVER))
+                        scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_out_res_cnt));
                srp_free_req(target, req, scmnd,
                             be32_to_cpu(rsp->req_lim_delta));
@@ -3261,9 +3266,10 @@ static void srp_remove_one(struct ib_device *device)
                spin_unlock(&host->target_lock);
                /*
-                 * Wait for target port removal tasks.
+                 * Wait for tl_err and target port removal tasks.
                 */
                flush_workqueue(system_long_wq);
+                flush_workqueue(srp_remove_wq);
                kfree(host);
        }
@@ -3313,16 +3319,22 @@ static int __init srp_init_module(void)
                indirect_sg_entries = cmd_sg_entries;
        }
+        srp_remove_wq = create_workqueue("srp_remove");
+        if (!srp_remove_wq) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        ret = -ENOMEM;
        ib_srp_transport_template =
                srp_attach_transport(&ib_srp_transport_functions);
        if (!ib_srp_transport_template)
-                return -ENOMEM;
+                goto destroy_wq;
        ret = class_register(&srp_class);
        if (ret) {
                pr_err("couldn't register class infiniband_srp\n");
-                srp_release_transport(ib_srp_transport_template);
+                goto release_tr;
-                return ret;
        }
        ib_sa_register_client(&srp_sa_client);
@@ -3330,13 +3342,22 @@ static int __init srp_init_module(void)
        ret = ib_register_client(&srp_client);
        if (ret) {
                pr_err("couldn't register IB client\n");
-                srp_release_transport(ib_srp_transport_template);
+                goto unreg_sa;
-                ib_sa_unregister_client(&srp_sa_client);
-                class_unregister(&srp_class);
-                return ret;
        }
-        return 0;
+out:
+        return ret;
+unreg_sa:
+        ib_sa_unregister_client(&srp_sa_client);
+        class_unregister(&srp_class);
+release_tr:
+        srp_release_transport(ib_srp_transport_template);
+destroy_wq:
+        destroy_workqueue(srp_remove_wq);
+        goto out;
 }
 static void __exit srp_cleanup_module(void)
@@ -3345,6 +3366,7 @@ static void __exit srp_cleanup_module(void)
        ib_sa_unregister_client(&srp_sa_client);
        class_unregister(&srp_class);
        srp_release_transport(ib_srp_transport_template);
+        destroy_workqueue(srp_remove_wq);
 }
 module_init(srp_init_module);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index fe09f2788b15..d28a8c284da9 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -198,6 +198,7 @@ static void srpt_event_handler(struct ib_event_handler *handler,
        case IB_EVENT_PKEY_CHANGE:
        case IB_EVENT_SM_CHANGE:
        case IB_EVENT_CLIENT_REREGISTER:
+        case IB_EVENT_GID_CHANGE:
                /* Refresh port data asynchronously. */
                if (event->element.port_num <= sdev->device->phys_port_cnt) {
                        sport = &sdev->port[event->element.port_num - 1];
@@ -563,7 +564,7 @@ static int srpt_refresh_port(struct srpt_port *sport)
                                                         &reg_req, 0,
                                                         srpt_mad_send_handler,
                                                         srpt_mad_recv_handler,
-                                                         sport);
+                                                         sport, 0);
                if (IS_ERR(sport->mad_agent)) {
                        ret = PTR_ERR(sport->mad_agent);
                        sport->mad_agent = NULL;