5 files changed, 33 insertions, 7 deletions

diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index c325c44807e8..44e936e48a31 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -1942,6 +1942,7 @@ fail4:
 fail3:
         cxgb3_free_atid(ep->com.tdev, ep->atid);
 fail2:
+        cm_id->rem_ref(cm_id);
         put_ep(&ep->com);
 out:
         return err;
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index cdca3a511e1c..606f1e2ef284 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -298,7 +298,7 @@ int mlx4_ib_mad_init(struct mlx4_ib_dev *dev)
         int p, q;
         int ret;
 
-        for (p = 0; p < dev->dev->caps.num_ports; ++p)
+        for (p = 0; p < dev->num_ports; ++p)
                 for (q = 0; q <= 1; ++q) {
                         agent = ib_register_mad_agent(&dev->ib_dev, p + 1,
                                                       q ? IB_QPT_GSI : IB_QPT_SMI,
@@ -314,7 +314,7 @@ int mlx4_ib_mad_init(struct mlx4_ib_dev *dev)
         return 0;
 
 err:
-        for (p = 0; p < dev->dev->caps.num_ports; ++p)
+        for (p = 0; p < dev->num_ports; ++p)
                 for (q = 0; q <= 1; ++q)
                         if (dev->send_agent[p][q])
                                 ib_unregister_mad_agent(dev->send_agent[p][q]);
@@ -327,7 +327,7 @@ void mlx4_ib_mad_cleanup(struct mlx4_ib_dev *dev)
         struct ib_mad_agent *agent;
         int p, q;
 
-        for (p = 0; p < dev->dev->caps.num_ports; ++p) {
+        for (p = 0; p < dev->num_ports; ++p) {
                 for (q = 0; q <= 1; ++q) {
                         agent = dev->send_agent[p][q];
                         dev->send_agent[p][q] = NULL;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index a3c2851c0545..2e80f8f47b02 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -574,7 +574,10 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
         ibdev->ib_dev.owner             = THIS_MODULE;
         ibdev->ib_dev.node_type         = RDMA_NODE_IB_CA;
         ibdev->ib_dev.local_dma_lkey    = dev->caps.reserved_lkey;
-        ibdev->ib_dev.phys_port_cnt     = dev->caps.num_ports;
+        ibdev->num_ports = 0;
+        mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_IB)
+                ibdev->num_ports++;
+        ibdev->ib_dev.phys_port_cnt     = ibdev->num_ports;
         ibdev->ib_dev.num_comp_vectors  = 1;
         ibdev->ib_dev.dma_device        = &dev->pdev->dev;
 
@@ -691,7 +694,7 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
         struct mlx4_ib_dev *ibdev = ibdev_ptr;
         int p;
 
-        for (p = 1; p <= dev->caps.num_ports; ++p)
+        for (p = 1; p <= ibdev->num_ports; ++p)
                 mlx4_CLOSE_PORT(dev, p);
 
         mlx4_ib_mad_cleanup(ibdev);
@@ -706,6 +709,10 @@ static void mlx4_ib_event(struct mlx4_dev *dev, void *ibdev_ptr,
                           enum mlx4_dev_event event, int port)
 {
         struct ib_event ibev;
+        struct mlx4_ib_dev *ibdev = to_mdev((struct ib_device *) ibdev_ptr);
+
+        if (port > ibdev->num_ports)
+                return;
 
         switch (event) {
         case MLX4_DEV_EVENT_PORT_UP:
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 6e2b0dc21b61..9974e886b8de 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -162,6 +162,7 @@ struct mlx4_ib_ah {
 struct mlx4_ib_dev {
         struct ib_device        ib_dev;
         struct mlx4_dev        *dev;
+        int                     num_ports;
         void __iomem           *uar_map;
 
         struct mlx4_uar         priv_uar;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index baa01deb2436..39167a797f99 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -451,6 +451,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                             struct ib_qp_init_attr *init_attr,
                             struct ib_udata *udata, int sqpn, struct mlx4_ib_qp *qp)
 {
+        int qpn;
         int err;
 
         mutex_init(&qp->mutex);
@@ -545,9 +546,17 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                 }
         }
 
-        err = mlx4_qp_alloc(dev->dev, sqpn, &qp->mqp);
+        if (sqpn) {
+                qpn = sqpn;
+        } else {
+                err = mlx4_qp_reserve_range(dev->dev, 1, 1, &qpn);
+                if (err)
+                        goto err_wrid;
+        }
+
+        err = mlx4_qp_alloc(dev->dev, qpn, &qp->mqp);
         if (err)
-                goto err_wrid;
+                goto err_qpn;
 
         /*
          * Hardware wants QPN written in big-endian order (after
@@ -560,6 +569,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
 
         return 0;
 
+err_qpn:
+        if (!sqpn)
+                mlx4_qp_release_range(dev->dev, qpn, 1);
+
 err_wrid:
         if (pd->uobject) {
                 if (!init_attr->srq)
@@ -655,6 +668,10 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
         mlx4_ib_unlock_cqs(send_cq, recv_cq);
 
         mlx4_qp_free(dev->dev, &qp->mqp);
+
+        if (!is_sqp(dev, qp))
+                mlx4_qp_release_range(dev->dev, qp->mqp.qpn, 1);
+
         mlx4_mtt_cleanup(dev->dev, &qp->mtt);
 
         if (is_user) {