30 files changed, 625 insertions, 210 deletions

diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 7275e727e0f5..d53cf519f42a 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1238,15 +1238,4 @@ static struct pci_driver c2_pci_driver = {
         .remove = c2_remove,
 };
 
-static int __init c2_init_module(void)
-{
-        return pci_register_driver(&c2_pci_driver);
-}
-
-static void __exit c2_exit_module(void)
-{
-        pci_unregister_driver(&c2_pci_driver);
-}
-
-module_init(c2_init_module);
-module_exit(c2_exit_module);
+module_pci_driver(c2_pci_driver);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index c13745cde7fa..565bfb161c1a 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -143,14 +143,28 @@ static void connect_reply_upcall(struct c4iw_ep *ep, int status);
 static LIST_HEAD(timeout_list);
 static spinlock_t timeout_lock;
 
+static void deref_qp(struct c4iw_ep *ep)
+{
+        c4iw_qp_rem_ref(&ep->com.qp->ibqp);
+        clear_bit(QP_REFERENCED, &ep->com.flags);
+}
+
+static void ref_qp(struct c4iw_ep *ep)
+{
+        set_bit(QP_REFERENCED, &ep->com.flags);
+        c4iw_qp_add_ref(&ep->com.qp->ibqp);
+}
+
 static void start_ep_timer(struct c4iw_ep *ep)
 {
         PDBG("%s ep %p\n", __func__, ep);
         if (timer_pending(&ep->timer)) {
-                PDBG("%s stopped / restarted timer ep %p\n", __func__, ep);
-                del_timer_sync(&ep->timer);
-        } else
-                c4iw_get_ep(&ep->com);
+                pr_err("%s timer already started! ep %p\n",
+                       __func__, ep);
+                return;
+        }
+        clear_bit(TIMEOUT, &ep->com.flags);
+        c4iw_get_ep(&ep->com);
         ep->timer.expires = jiffies + ep_timeout_secs * HZ;
         ep->timer.data = (unsigned long)ep;
         ep->timer.function = ep_timeout;
@@ -159,14 +173,10 @@ static void start_ep_timer(struct c4iw_ep *ep)
 
 static void stop_ep_timer(struct c4iw_ep *ep)
 {
-        PDBG("%s ep %p\n", __func__, ep);
-        if (!timer_pending(&ep->timer)) {
-                WARN(1, "%s timer stopped when its not running! "
-                       "ep %p state %u\n", __func__, ep, ep->com.state);
-                return;
-        }
+        PDBG("%s ep %p stopping\n", __func__, ep);
         del_timer_sync(&ep->timer);
-        c4iw_put_ep(&ep->com);
+        if (!test_and_set_bit(TIMEOUT, &ep->com.flags))
+                c4iw_put_ep(&ep->com);
 }
 
 static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
@@ -271,11 +281,13 @@ void _c4iw_free_ep(struct kref *kref)
 
         ep = container_of(kref, struct c4iw_ep, com.kref);
         PDBG("%s ep %p state %s\n", __func__, ep, states[state_read(&ep->com)]);
+        if (test_bit(QP_REFERENCED, &ep->com.flags))
+                deref_qp(ep);
         if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
+                remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid);
                 cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, ep->hwtid);
                 dst_release(ep->dst);
                 cxgb4_l2t_release(ep->l2t);
-                remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid);
         }
         kfree(ep);
 }
@@ -687,7 +699,7 @@ static int send_mpa_reject(struct c4iw_ep *ep, const void *pdata, u8 plen)
         memset(mpa, 0, sizeof(*mpa));
         memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
         mpa->flags = MPA_REJECT;
-        mpa->revision = mpa_rev;
+        mpa->revision = ep->mpa_attr.version;
         mpa->private_data_size = htons(plen);
 
         if (ep->mpa_attr.version == 2 && ep->mpa_attr.enhanced_rdma_conn) {
@@ -863,7 +875,6 @@ static void close_complete_upcall(struct c4iw_ep *ep)
                 ep->com.cm_id->event_handler(ep->com.cm_id, &event);
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
                 set_bit(CLOSE_UPCALL, &ep->com.history);
         }
 }
@@ -906,7 +917,6 @@ static void peer_abort_upcall(struct c4iw_ep *ep)
                 ep->com.cm_id->event_handler(ep->com.cm_id, &event);
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
                 set_bit(ABORT_UPCALL, &ep->com.history);
         }
 }
@@ -946,7 +956,6 @@ static void connect_reply_upcall(struct c4iw_ep *ep, int status)
         if (status < 0) {
                 ep->com.cm_id->rem_ref(ep->com.cm_id);
                 ep->com.cm_id = NULL;
-                ep->com.qp = NULL;
         }
 }
 
@@ -1291,11 +1300,13 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
         if (mpa->revision > mpa_rev) {
                 printk(KERN_ERR MOD "%s MPA version mismatch. Local = %d,"