--- initial
+++ final
@@ -1,95 +1,95 @@
 static void bnx2fc_cmd_timeout(struct work_struct *work) {
   struct bnx2fc_cmd *io_req = container_of(work, struct bnx2fc_cmd, timeout_work.work);
   u8 cmd_type = io_req->cmd_type;
   struct bnx2fc_rport *tgt = io_req->tgt;
   int rc;
   BNX2FC_IO_DBG(io_req,
                 "cmd_timeout, cmd_type = %d,"
                 "req_flags = %lx\n",
                 cmd_type, io_req->req_flags);
   spin_lock_bh(&tgt->tgt_lock);
   if (test_and_clear_bit(BNX2FC_FLAG_ISSUE_RRQ, &io_req->req_flags)) {
     clear_bit(BNX2FC_FLAG_RETIRE_OXID, &io_req->req_flags);
     /*
      * ideally we should hold the io_req until RRQ complets,
      * and release io_req from timeout hold.
      */
     spin_unlock_bh(&tgt->tgt_lock);
     bnx2fc_send_rrq(io_req);
     return;
   }
   if (test_and_clear_bit(BNX2FC_FLAG_RETIRE_OXID, &io_req->req_flags)) {
     BNX2FC_IO_DBG(io_req, "IO ready for reuse now\n");
     goto done;
   }
   switch (cmd_type) {
   case BNX2FC_SCSI_CMD:
     if (test_and_clear_bit(BNX2FC_FLAG_EH_ABORT, &io_req->req_flags)) {
       /* Handle eh_abort timeout */
       BNX2FC_IO_DBG(io_req, "eh_abort timed out\n");
       complete(&io_req->tm_done);
     } else if (test_bit(BNX2FC_FLAG_ISSUE_ABTS, &io_req->req_flags)) {
       /* Handle internally generated ABTS timeout */
-      BNX2FC_IO_DBG(io_req, "ABTS timed out refcnt = %d\n", io_req->refcount.refcount.counter);
+      BNX2FC_IO_DBG(io_req, "ABTS timed out refcnt = %d\n", kref_read(&io_req->refcount));
       if (!(test_and_set_bit(BNX2FC_FLAG_ABTS_DONE, &io_req->req_flags))) {
         /*
          * Cleanup and return original command to
          * mid-layer.
          */
         bnx2fc_initiate_cleanup(io_req);
         kref_put(&io_req->refcount, bnx2fc_cmd_release);
         spin_unlock_bh(&tgt->tgt_lock);
         return;
       }
     } else {
       /* Hanlde IO timeout */
       BNX2FC_IO_DBG(io_req, "IO timed out. issue ABTS\n");
       if (test_and_set_bit(BNX2FC_FLAG_IO_COMPL, &io_req->req_flags)) {
         BNX2FC_IO_DBG(io_req, "IO completed before "
                               " timer expiry\n");
         goto done;
       }
       if (!test_and_set_bit(BNX2FC_FLAG_ISSUE_ABTS, &io_req->req_flags)) {
         rc = bnx2fc_initiate_abts(io_req);
         if (rc == SUCCESS) goto done;
         kref_put(&io_req->refcount, bnx2fc_cmd_release);
         spin_unlock_bh(&tgt->tgt_lock);
         return;
       } else {
         BNX2FC_IO_DBG(io_req, "IO already in "
                               "ABTS processing\n");
       }
     }
     break;
   case BNX2FC_ELS:
     if (test_bit(BNX2FC_FLAG_ISSUE_ABTS, &io_req->req_flags)) {
       BNX2FC_IO_DBG(io_req, "ABTS for ELS timed out\n");
       if (!test_and_set_bit(BNX2FC_FLAG_ABTS_DONE, &io_req->req_flags)) {
         kref_put(&io_req->refcount, bnx2fc_cmd_release);
         spin_unlock_bh(&tgt->tgt_lock);
         return;
       }
     } else {
       /*
        * Handle ELS timeout.
        * tgt_lock is used to sync compl path and timeout
        * path. If els compl path is processing this IO, we
        * have nothing to do here, just release the timer hold
        */
       BNX2FC_IO_DBG(io_req, "ELS timed out\n");
       if (test_and_set_bit(BNX2FC_FLAG_ELS_DONE, &io_req->req_flags)) goto done;
       /* Indicate the cb_func that this ELS is timed out */
       set_bit(BNX2FC_FLAG_ELS_TIMEOUT, &io_req->req_flags);
       if ((io_req->cb_func) && (io_req->cb_arg)) {
         io_req->cb_func(io_req->cb_arg);
         io_req->cb_arg = NULL;
       }
     }
     break;
   default: printk(KERN_ERR PFX "cmd_timeout: invalid cmd_type %d\n", cmd_type); break;
   }
 done:
   /* release the cmd that was held when timer was set */
   kref_put(&io_req->refcount, bnx2fc_cmd_release);
   spin_unlock_bh(&tgt->tgt_lock);
 }<sep>@@
expression e;
@@
-		e.refcount.counter
+		kref_read(&e)