5 files changed, 32 insertions, 19 deletions

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f29dbb767e87..9559248f265b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1342,6 +1342,12 @@ static __be32 convert_access(int acc)
 static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
 {
         struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(wr->wr.fast_reg.page_list);
+        int i;
+
+        for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
+                wr->wr.fast_reg.page_list->page_list[i] =
+                        cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
+                                    MLX4_MTT_FLAG_PRESENT);
 
         fseg->flags             = convert_access(wr->wr.fast_reg.access_flags);
         fseg->mem_key           = cpu_to_be32(wr->wr.fast_reg.rkey);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 9f0b964b2c99..499d3cf83e1f 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1956,13 +1956,6 @@ static int mini_cm_reject(struct nes_cm_core *cm_core,
                 return ret;
         cleanup_retrans_entry(cm_node);
         cm_node->state = NES_CM_STATE_CLOSED;
-        ret = send_fin(cm_node, NULL);
-
-        if (cm_node->accept_pend) {
-                BUG_ON(!cm_node->listener);
-                atomic_dec(&cm_node->listener->pend_accepts_cnt);
-                BUG_ON(atomic_read(&cm_node->listener->pend_accepts_cnt) < 0);
-        }
 
         ret = send_reset(cm_node, NULL);
         return ret;
@@ -2383,6 +2376,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
                         atomic_inc(&cm_disconnects);
                         cm_event.event = IW_CM_EVENT_DISCONNECT;
                         if (last_ae == NES_AEQE_AEID_LLP_CONNECTION_RESET) {
+                                issued_disconnect_reset = 1;
                                 cm_event.status = IW_CM_EVENT_STATUS_RESET;
                                 nes_debug(NES_DBG_CM, "Generating a CM "
                                         "Disconnect Event (status reset) for "
@@ -2508,7 +2502,6 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
                 nes_debug(NES_DBG_CM, "Call close API\n");
 
                 g_cm_core->api->close(g_cm_core, nesqp->cm_node);
-                nesqp->cm_node = NULL;
         }
 
         return ret;
@@ -2837,6 +2830,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         cm_node->apbvt_set = 1;
         nesqp->cm_node = cm_node;
         cm_node->nesqp = nesqp;
+        nes_add_ref(&nesqp->ibqp);
 
         return 0;
 }
@@ -3167,7 +3161,6 @@ static void cm_event_connect_error(struct nes_cm_event *event)
         if (ret)
                 printk(KERN_ERR "%s[%u] OFA CM event_handler returned, "
                         "ret=%d\n", __func__, __LINE__, ret);
-        nes_rem_ref(&nesqp->ibqp);
         cm_id->rem_ref(cm_id);
 
         rem_ref_cm_node(event->cm_node->cm_core, event->cm_node);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index b0ffc9abe8c0..05eb41b8ab63 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -293,6 +293,7 @@ struct ipoib_dev_priv {
 
         struct delayed_work pkey_poll_task;
         struct delayed_work mcast_task;
+        struct work_struct carrier_on_task;
         struct work_struct flush_light;
         struct work_struct flush_normal;
         struct work_struct flush_heavy;
@@ -464,6 +465,7 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_dev_cleanup(struct net_device *dev);
 
 void ipoib_mcast_join_task(struct work_struct *work);
+void ipoib_mcast_carrier_on_task(struct work_struct *work);
 void ipoib_mcast_send(struct net_device *dev, void *mgid, struct sk_buff *skb);
 
 void ipoib_mcast_restart_task(struct work_struct *work);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 7e9e218738fa..1b1df5cc4113 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1075,6 +1075,7 @@ static void ipoib_setup(struct net_device *dev)
 
         INIT_DELAYED_WORK(&priv->pkey_poll_task, ipoib_pkey_poll);
         INIT_DELAYED_WORK(&priv->mcast_task,   ipoib_mcast_join_task);
+        INIT_WORK(&priv->carrier_on_task, ipoib_mcast_carrier_on_task);
         INIT_WORK(&priv->flush_light,   ipoib_ib_dev_flush_light);
         INIT_WORK(&priv->flush_normal,   ipoib_ib_dev_flush_normal);
         INIT_WORK(&priv->flush_heavy,   ipoib_ib_dev_flush_heavy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ac33c8f3ea85..aae28620a6e5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -366,6 +366,21 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
         return ret;
 }
 
+void ipoib_mcast_carrier_on_task(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   carrier_on_task);
+
+        /*
+         * Take rtnl_lock to avoid racing with ipoib_stop() and
+         * turning the carrier back on while a device is being
+         * removed.
+         */
+        rtnl_lock();
+        netif_carrier_on(priv->dev);
+        rtnl_unlock();
+}
+
 static int ipoib_mcast_join_complete(int status,
                                      struct ib_sa_multicast *multicast)
 {
@@ -392,16 +407,12 @@ static int ipoib_mcast_join_complete(int status,
                                            &priv->mcast_task, 0);
                 mutex_unlock(&mcast_mutex);
 
-                if (mcast == priv->broadcast) {
-                        /*
-                         * Take RTNL lock here to avoid racing with
-                         * ipoib_stop() and turning the carrier back
-                         * on while a device is being removed.
-                         */
-                        rtnl_lock();
-                        netif_carrier_on(dev);
-                        rtnl_unlock();
-                }
+                /*
+                 * Defer carrier on work to ipoib_workqueue to avoid a
+                 * deadlock on rtnl_lock here.
+                 */
+                if (mcast == priv->broadcast)
+                        queue_work(ipoib_workqueue, &priv->carrier_on_task);
 
                 return 0;
         }