cm.c revision 0f29b46d49b0ca50536632c6a33986c3171f5ea1
1/*
2 * Copyright (c) 2004-2007 Intel Corporation.  All rights reserved.
3 * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
4 * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
5 * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
6 *
7 * This software is available to you under a choice of one of two
8 * licenses.  You may choose to be licensed under the terms of the GNU
9 * General Public License (GPL) Version 2, available from the file
10 * COPYING in the main directory of this source tree, or the
11 * OpenIB.org BSD license below:
12 *
13 *     Redistribution and use in source and binary forms, with or
14 *     without modification, are permitted provided that the following
15 *     conditions are met:
16 *
17 *      - Redistributions of source code must retain the above
18 *        copyright notice, this list of conditions and the following
19 *        disclaimer.
20 *
21 *      - Redistributions in binary form must reproduce the above
22 *        copyright notice, this list of conditions and the following
23 *        disclaimer in the documentation and/or other materials
24 *        provided with the distribution.
25 *
26 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33 * SOFTWARE.
34 */
35
36#include <linux/completion.h>
37#include <linux/dma-mapping.h>
38#include <linux/device.h>
39#include <linux/module.h>
40#include <linux/err.h>
41#include <linux/idr.h>
42#include <linux/interrupt.h>
43#include <linux/random.h>
44#include <linux/rbtree.h>
45#include <linux/spinlock.h>
46#include <linux/slab.h>
47#include <linux/sysfs.h>
48#include <linux/workqueue.h>
49#include <linux/kdev_t.h>
50#include <linux/etherdevice.h>
51
52#include <rdma/ib_cache.h>
53#include <rdma/ib_cm.h>
54#include "cm_msgs.h"
55
56MODULE_AUTHOR("Sean Hefty");
57MODULE_DESCRIPTION("InfiniBand CM");
58MODULE_LICENSE("Dual BSD/GPL");
59
60static void cm_add_one(struct ib_device *device);
61static void cm_remove_one(struct ib_device *device);
62
63static struct ib_client cm_client = {
64	.name   = "cm",
65	.add    = cm_add_one,
66	.remove = cm_remove_one
67};
68
69static struct ib_cm {
70	spinlock_t lock;
71	struct list_head device_list;
72	rwlock_t device_lock;
73	struct rb_root listen_service_table;
74	u64 listen_service_id;
75	/* struct rb_root peer_service_table; todo: fix peer to peer */
76	struct rb_root remote_qp_table;
77	struct rb_root remote_id_table;
78	struct rb_root remote_sidr_table;
79	struct idr local_id_table;
80	__be32 random_id_operand;
81	struct list_head timewait_list;
82	struct workqueue_struct *wq;
83} cm;
84
85/* Counter indexes ordered by attribute ID */
86enum {
87	CM_REQ_COUNTER,
88	CM_MRA_COUNTER,
89	CM_REJ_COUNTER,
90	CM_REP_COUNTER,
91	CM_RTU_COUNTER,
92	CM_DREQ_COUNTER,
93	CM_DREP_COUNTER,
94	CM_SIDR_REQ_COUNTER,
95	CM_SIDR_REP_COUNTER,
96	CM_LAP_COUNTER,
97	CM_APR_COUNTER,
98	CM_ATTR_COUNT,
99	CM_ATTR_ID_OFFSET = 0x0010,
100};
101
102enum {
103	CM_XMIT,
104	CM_XMIT_RETRIES,
105	CM_RECV,
106	CM_RECV_DUPLICATES,
107	CM_COUNTER_GROUPS
108};
109
110static char const counter_group_names[CM_COUNTER_GROUPS]
111				     [sizeof("cm_rx_duplicates")] = {
112	"cm_tx_msgs", "cm_tx_retries",
113	"cm_rx_msgs", "cm_rx_duplicates"
114};
115
116struct cm_counter_group {
117	struct kobject obj;
118	atomic_long_t counter[CM_ATTR_COUNT];
119};
120
121struct cm_counter_attribute {
122	struct attribute attr;
123	int index;
124};
125
126#define CM_COUNTER_ATTR(_name, _index) \
127struct cm_counter_attribute cm_##_name##_counter_attr = { \
128	.attr = { .name = __stringify(_name), .mode = 0444 }, \
129	.index = _index \
130}
131
132static CM_COUNTER_ATTR(req, CM_REQ_COUNTER);
133static CM_COUNTER_ATTR(mra, CM_MRA_COUNTER);
134static CM_COUNTER_ATTR(rej, CM_REJ_COUNTER);
135static CM_COUNTER_ATTR(rep, CM_REP_COUNTER);
136static CM_COUNTER_ATTR(rtu, CM_RTU_COUNTER);
137static CM_COUNTER_ATTR(dreq, CM_DREQ_COUNTER);
138static CM_COUNTER_ATTR(drep, CM_DREP_COUNTER);
139static CM_COUNTER_ATTR(sidr_req, CM_SIDR_REQ_COUNTER);
140static CM_COUNTER_ATTR(sidr_rep, CM_SIDR_REP_COUNTER);
141static CM_COUNTER_ATTR(lap, CM_LAP_COUNTER);
142static CM_COUNTER_ATTR(apr, CM_APR_COUNTER);
143
144static struct attribute *cm_counter_default_attrs[] = {
145	&cm_req_counter_attr.attr,
146	&cm_mra_counter_attr.attr,
147	&cm_rej_counter_attr.attr,
148	&cm_rep_counter_attr.attr,
149	&cm_rtu_counter_attr.attr,
150	&cm_dreq_counter_attr.attr,
151	&cm_drep_counter_attr.attr,
152	&cm_sidr_req_counter_attr.attr,
153	&cm_sidr_rep_counter_attr.attr,
154	&cm_lap_counter_attr.attr,
155	&cm_apr_counter_attr.attr,
156	NULL
157};
158
159struct cm_port {
160	struct cm_device *cm_dev;
161	struct ib_mad_agent *mad_agent;
162	struct kobject port_obj;
163	u8 port_num;
164	struct cm_counter_group counter_group[CM_COUNTER_GROUPS];
165};
166
167struct cm_device {
168	struct list_head list;
169	struct ib_device *ib_device;
170	struct device *device;
171	u8 ack_delay;
172	struct cm_port *port[0];
173};
174
175struct cm_av {
176	struct cm_port *port;
177	union ib_gid dgid;
178	struct ib_ah_attr ah_attr;
179	u16 pkey_index;
180	u8 timeout;
181	u8  valid;
182	u8  smac[ETH_ALEN];
183};
184
185struct cm_work {
186	struct delayed_work work;
187	struct list_head list;
188	struct cm_port *port;
189	struct ib_mad_recv_wc *mad_recv_wc;	/* Received MADs */
190	__be32 local_id;			/* Established / timewait */
191	__be32 remote_id;
192	struct ib_cm_event cm_event;
193	struct ib_sa_path_rec path[0];
194};
195
196struct cm_timewait_info {
197	struct cm_work work;			/* Must be first. */
198	struct list_head list;
199	struct rb_node remote_qp_node;
200	struct rb_node remote_id_node;
201	__be64 remote_ca_guid;
202	__be32 remote_qpn;
203	u8 inserted_remote_qp;
204	u8 inserted_remote_id;
205};
206
207struct cm_id_private {
208	struct ib_cm_id	id;
209
210	struct rb_node service_node;
211	struct rb_node sidr_id_node;
212	spinlock_t lock;	/* Do not acquire inside cm.lock */
213	struct completion comp;
214	atomic_t refcount;
215
216	struct ib_mad_send_buf *msg;
217	struct cm_timewait_info *timewait_info;
218	/* todo: use alternate port on send failure */
219	struct cm_av av;
220	struct cm_av alt_av;
221	struct ib_cm_compare_data *compare_data;
222
223	void *private_data;
224	__be64 tid;
225	__be32 local_qpn;
226	__be32 remote_qpn;
227	enum ib_qp_type qp_type;
228	__be32 sq_psn;
229	__be32 rq_psn;
230	int timeout_ms;
231	enum ib_mtu path_mtu;
232	__be16 pkey;
233	u8 private_data_len;
234	u8 max_cm_retries;
235	u8 peer_to_peer;
236	u8 responder_resources;
237	u8 initiator_depth;
238	u8 retry_count;
239	u8 rnr_retry_count;
240	u8 service_timeout;
241	u8 target_ack_delay;
242
243	struct list_head work_list;
244	atomic_t work_count;
245};
246
247static void cm_work_handler(struct work_struct *work);
248
249static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
250{
251	if (atomic_dec_and_test(&cm_id_priv->refcount))
252		complete(&cm_id_priv->comp);
253}
254
255static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
256			struct ib_mad_send_buf **msg)
257{
258	struct ib_mad_agent *mad_agent;
259	struct ib_mad_send_buf *m;
260	struct ib_ah *ah;
261
262	mad_agent = cm_id_priv->av.port->mad_agent;
263	ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
264	if (IS_ERR(ah))
265		return PTR_ERR(ah);
266
267	m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
268			       cm_id_priv->av.pkey_index,
269			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
270			       GFP_ATOMIC);
271	if (IS_ERR(m)) {
272		ib_destroy_ah(ah);
273		return PTR_ERR(m);
274	}
275
276	/* Timeout set by caller if response is expected. */
277	m->ah = ah;
278	m->retries = cm_id_priv->max_cm_retries;
279
280	atomic_inc(&cm_id_priv->refcount);
281	m->context[0] = cm_id_priv;
282	*msg = m;
283	return 0;
284}
285
286static int cm_alloc_response_msg(struct cm_port *port,
287				 struct ib_mad_recv_wc *mad_recv_wc,
288				 struct ib_mad_send_buf **msg)
289{
290	struct ib_mad_send_buf *m;
291	struct ib_ah *ah;
292
293	ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
294				  mad_recv_wc->recv_buf.grh, port->port_num);
295	if (IS_ERR(ah))
296		return PTR_ERR(ah);
297
298	m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,
299			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
300			       GFP_ATOMIC);
301	if (IS_ERR(m)) {
302		ib_destroy_ah(ah);
303		return PTR_ERR(m);
304	}
305	m->ah = ah;
306	*msg = m;
307	return 0;
308}
309
310static void cm_free_msg(struct ib_mad_send_buf *msg)
311{
312	ib_destroy_ah(msg->ah);
313	if (msg->context[0])
314		cm_deref_id(msg->context[0]);
315	ib_free_send_mad(msg);
316}
317
318static void * cm_copy_private_data(const void *private_data,
319				   u8 private_data_len)
320{
321	void *data;
322
323	if (!private_data || !private_data_len)
324		return NULL;
325
326	data = kmemdup(private_data, private_data_len, GFP_KERNEL);
327	if (!data)
328		return ERR_PTR(-ENOMEM);
329
330	return data;
331}
332
333static void cm_set_private_data(struct cm_id_private *cm_id_priv,
334				 void *private_data, u8 private_data_len)
335{
336	if (cm_id_priv->private_data && cm_id_priv->private_data_len)
337		kfree(cm_id_priv->private_data);
338
339	cm_id_priv->private_data = private_data;
340	cm_id_priv->private_data_len = private_data_len;
341}
342
343static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
344				    struct ib_grh *grh, struct cm_av *av)
345{
346	av->port = port;
347	av->pkey_index = wc->pkey_index;
348	ib_init_ah_from_wc(port->cm_dev->ib_device, port->port_num, wc,
349			   grh, &av->ah_attr);
350}
351
352static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
353{
354	struct cm_device *cm_dev;
355	struct cm_port *port = NULL;
356	unsigned long flags;
357	int ret;
358	u8 p;
359
360	read_lock_irqsave(&cm.device_lock, flags);
361	list_for_each_entry(cm_dev, &cm.device_list, list) {
362		if (!ib_find_cached_gid(cm_dev->ib_device, &path->sgid,
363					&p, NULL)) {
364			port = cm_dev->port[p-1];
365			break;
366		}
367	}
368	read_unlock_irqrestore(&cm.device_lock, flags);
369
370	if (!port)
371		return -EINVAL;
372
373	ret = ib_find_cached_pkey(cm_dev->ib_device, port->port_num,
374				  be16_to_cpu(path->pkey), &av->pkey_index);
375	if (ret)
376		return ret;
377
378	av->port = port;
379	ib_init_ah_from_path(cm_dev->ib_device, port->port_num, path,
380			     &av->ah_attr);
381	av->timeout = path->packet_life_time + 1;
382	memcpy(av->smac, path->smac, sizeof(av->smac));
383
384	av->valid = 1;
385	return 0;
386}
387
388static int cm_alloc_id(struct cm_id_private *cm_id_priv)
389{
390	unsigned long flags;
391	int id;
392
393	idr_preload(GFP_KERNEL);
394	spin_lock_irqsave(&cm.lock, flags);
395
396	id = idr_alloc_cyclic(&cm.local_id_table, cm_id_priv, 0, 0, GFP_NOWAIT);
397
398	spin_unlock_irqrestore(&cm.lock, flags);
399	idr_preload_end();
400
401	cm_id_priv->id.local_id = (__force __be32)id ^ cm.random_id_operand;
402	return id < 0 ? id : 0;
403}
404
405static void cm_free_id(__be32 local_id)
406{
407	spin_lock_irq(&cm.lock);
408	idr_remove(&cm.local_id_table,
409		   (__force int) (local_id ^ cm.random_id_operand));
410	spin_unlock_irq(&cm.lock);
411}
412
413static struct cm_id_private * cm_get_id(__be32 local_id, __be32 remote_id)
414{
415	struct cm_id_private *cm_id_priv;
416
417	cm_id_priv = idr_find(&cm.local_id_table,
418			      (__force int) (local_id ^ cm.random_id_operand));
419	if (cm_id_priv) {
420		if (cm_id_priv->id.remote_id == remote_id)
421			atomic_inc(&cm_id_priv->refcount);
422		else
423			cm_id_priv = NULL;
424	}
425
426	return cm_id_priv;
427}
428
429static struct cm_id_private * cm_acquire_id(__be32 local_id, __be32 remote_id)
430{
431	struct cm_id_private *cm_id_priv;
432
433	spin_lock_irq(&cm.lock);
434	cm_id_priv = cm_get_id(local_id, remote_id);
435	spin_unlock_irq(&cm.lock);
436
437	return cm_id_priv;
438}
439
440static void cm_mask_copy(u8 *dst, u8 *src, u8 *mask)
441{
442	int i;
443
444	for (i = 0; i < IB_CM_COMPARE_SIZE / sizeof(unsigned long); i++)
445		((unsigned long *) dst)[i] = ((unsigned long *) src)[i] &
446					     ((unsigned long *) mask)[i];
447}
448
449static int cm_compare_data(struct ib_cm_compare_data *src_data,
450			   struct ib_cm_compare_data *dst_data)
451{
452	u8 src[IB_CM_COMPARE_SIZE];
453	u8 dst[IB_CM_COMPARE_SIZE];
454
455	if (!src_data || !dst_data)
456		return 0;
457
458	cm_mask_copy(src, src_data->data, dst_data->mask);
459	cm_mask_copy(dst, dst_data->data, src_data->mask);
460	return memcmp(src, dst, IB_CM_COMPARE_SIZE);
461}
462
463static int cm_compare_private_data(u8 *private_data,
464				   struct ib_cm_compare_data *dst_data)
465{
466	u8 src[IB_CM_COMPARE_SIZE];
467
468	if (!dst_data)
469		return 0;
470
471	cm_mask_copy(src, private_data, dst_data->mask);
472	return memcmp(src, dst_data->data, IB_CM_COMPARE_SIZE);
473}
474
475/*
476 * Trivial helpers to strip endian annotation and compare; the
477 * endianness doesn't actually matter since we just need a stable
478 * order for the RB tree.
479 */
480static int be32_lt(__be32 a, __be32 b)
481{
482	return (__force u32) a < (__force u32) b;
483}
484
485static int be32_gt(__be32 a, __be32 b)
486{
487	return (__force u32) a > (__force u32) b;
488}
489
490static int be64_lt(__be64 a, __be64 b)
491{
492	return (__force u64) a < (__force u64) b;
493}
494
495static int be64_gt(__be64 a, __be64 b)
496{
497	return (__force u64) a > (__force u64) b;
498}
499
500static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
501{
502	struct rb_node **link = &cm.listen_service_table.rb_node;
503	struct rb_node *parent = NULL;
504	struct cm_id_private *cur_cm_id_priv;
505	__be64 service_id = cm_id_priv->id.service_id;
506	__be64 service_mask = cm_id_priv->id.service_mask;
507	int data_cmp;
508
509	while (*link) {
510		parent = *link;
511		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
512					  service_node);
513		data_cmp = cm_compare_data(cm_id_priv->compare_data,
514					   cur_cm_id_priv->compare_data);
515		if ((cur_cm_id_priv->id.service_mask & service_id) ==
516		    (service_mask & cur_cm_id_priv->id.service_id) &&
517		    (cm_id_priv->id.device == cur_cm_id_priv->id.device) &&
518		    !data_cmp)
519			return cur_cm_id_priv;
520
521		if (cm_id_priv->id.device < cur_cm_id_priv->id.device)
522			link = &(*link)->rb_left;
523		else if (cm_id_priv->id.device > cur_cm_id_priv->id.device)
524			link = &(*link)->rb_right;
525		else if (be64_lt(service_id, cur_cm_id_priv->id.service_id))
526			link = &(*link)->rb_left;
527		else if (be64_gt(service_id, cur_cm_id_priv->id.service_id))
528			link = &(*link)->rb_right;
529		else if (data_cmp < 0)
530			link = &(*link)->rb_left;
531		else
532			link = &(*link)->rb_right;
533	}
534	rb_link_node(&cm_id_priv->service_node, parent, link);
535	rb_insert_color(&cm_id_priv->service_node, &cm.listen_service_table);
536	return NULL;
537}
538
539static struct cm_id_private * cm_find_listen(struct ib_device *device,
540					     __be64 service_id,
541					     u8 *private_data)
542{
543	struct rb_node *node = cm.listen_service_table.rb_node;
544	struct cm_id_private *cm_id_priv;
545	int data_cmp;
546
547	while (node) {
548		cm_id_priv = rb_entry(node, struct cm_id_private, service_node);
549		data_cmp = cm_compare_private_data(private_data,
550						   cm_id_priv->compare_data);
551		if ((cm_id_priv->id.service_mask & service_id) ==
552		     cm_id_priv->id.service_id &&
553		    (cm_id_priv->id.device == device) && !data_cmp)
554			return cm_id_priv;
555
556		if (device < cm_id_priv->id.device)
557			node = node->rb_left;
558		else if (device > cm_id_priv->id.device)
559			node = node->rb_right;
560		else if (be64_lt(service_id, cm_id_priv->id.service_id))
561			node = node->rb_left;
562		else if (be64_gt(service_id, cm_id_priv->id.service_id))
563			node = node->rb_right;
564		else if (data_cmp < 0)
565			node = node->rb_left;
566		else
567			node = node->rb_right;
568	}
569	return NULL;
570}
571
572static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
573						     *timewait_info)
574{
575	struct rb_node **link = &cm.remote_id_table.rb_node;
576	struct rb_node *parent = NULL;
577	struct cm_timewait_info *cur_timewait_info;
578	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
579	__be32 remote_id = timewait_info->work.remote_id;
580
581	while (*link) {
582		parent = *link;
583		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
584					     remote_id_node);
585		if (be32_lt(remote_id, cur_timewait_info->work.remote_id))
586			link = &(*link)->rb_left;
587		else if (be32_gt(remote_id, cur_timewait_info->work.remote_id))
588			link = &(*link)->rb_right;
589		else if (be64_lt(remote_ca_guid, cur_timewait_info->remote_ca_guid))
590			link = &(*link)->rb_left;
591		else if (be64_gt(remote_ca_guid, cur_timewait_info->remote_ca_guid))
592			link = &(*link)->rb_right;
593		else
594			return cur_timewait_info;
595	}
596	timewait_info->inserted_remote_id = 1;
597	rb_link_node(&timewait_info->remote_id_node, parent, link);
598	rb_insert_color(&timewait_info->remote_id_node, &cm.remote_id_table);
599	return NULL;
600}
601
602static struct cm_timewait_info * cm_find_remote_id(__be64 remote_ca_guid,
603						   __be32 remote_id)
604{
605	struct rb_node *node = cm.remote_id_table.rb_node;
606	struct cm_timewait_info *timewait_info;
607
608	while (node) {
609		timewait_info = rb_entry(node, struct cm_timewait_info,
610					 remote_id_node);
611		if (be32_lt(remote_id, timewait_info->work.remote_id))
612			node = node->rb_left;
613		else if (be32_gt(remote_id, timewait_info->work.remote_id))
614			node = node->rb_right;
615		else if (be64_lt(remote_ca_guid, timewait_info->remote_ca_guid))
616			node = node->rb_left;
617		else if (be64_gt(remote_ca_guid, timewait_info->remote_ca_guid))
618			node = node->rb_right;
619		else
620			return timewait_info;
621	}
622	return NULL;
623}
624
625static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
626						      *timewait_info)
627{
628	struct rb_node **link = &cm.remote_qp_table.rb_node;
629	struct rb_node *parent = NULL;
630	struct cm_timewait_info *cur_timewait_info;
631	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
632	__be32 remote_qpn = timewait_info->remote_qpn;
633
634	while (*link) {
635		parent = *link;
636		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
637					     remote_qp_node);
638		if (be32_lt(remote_qpn, cur_timewait_info->remote_qpn))
639			link = &(*link)->rb_left;
640		else if (be32_gt(remote_qpn, cur_timewait_info->remote_qpn))
641			link = &(*link)->rb_right;
642		else if (be64_lt(remote_ca_guid, cur_timewait_info->remote_ca_guid))
643			link = &(*link)->rb_left;
644		else if (be64_gt(remote_ca_guid, cur_timewait_info->remote_ca_guid))
645			link = &(*link)->rb_right;
646		else
647			return cur_timewait_info;
648	}
649	timewait_info->inserted_remote_qp = 1;
650	rb_link_node(&timewait_info->remote_qp_node, parent, link);
651	rb_insert_color(&timewait_info->remote_qp_node, &cm.remote_qp_table);
652	return NULL;
653}
654
655static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
656						    *cm_id_priv)
657{
658	struct rb_node **link = &cm.remote_sidr_table.rb_node;
659	struct rb_node *parent = NULL;
660	struct cm_id_private *cur_cm_id_priv;
661	union ib_gid *port_gid = &cm_id_priv->av.dgid;
662	__be32 remote_id = cm_id_priv->id.remote_id;
663
664	while (*link) {
665		parent = *link;
666		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
667					  sidr_id_node);
668		if (be32_lt(remote_id, cur_cm_id_priv->id.remote_id))
669			link = &(*link)->rb_left;
670		else if (be32_gt(remote_id, cur_cm_id_priv->id.remote_id))
671			link = &(*link)->rb_right;
672		else {
673			int cmp;
674			cmp = memcmp(port_gid, &cur_cm_id_priv->av.dgid,
675				     sizeof *port_gid);
676			if (cmp < 0)
677				link = &(*link)->rb_left;
678			else if (cmp > 0)
679				link = &(*link)->rb_right;
680			else
681				return cur_cm_id_priv;
682		}
683	}
684	rb_link_node(&cm_id_priv->sidr_id_node, parent, link);
685	rb_insert_color(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
686	return NULL;
687}
688
689static void cm_reject_sidr_req(struct cm_id_private *cm_id_priv,
690			       enum ib_cm_sidr_status status)
691{
692	struct ib_cm_sidr_rep_param param;
693
694	memset(&param, 0, sizeof param);
695	param.status = status;
696	ib_send_cm_sidr_rep(&cm_id_priv->id, &param);
697}
698
699struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
700				 ib_cm_handler cm_handler,
701				 void *context)
702{
703	struct cm_id_private *cm_id_priv;
704	int ret;
705
706	cm_id_priv = kzalloc(sizeof *cm_id_priv, GFP_KERNEL);
707	if (!cm_id_priv)
708		return ERR_PTR(-ENOMEM);
709
710	cm_id_priv->id.state = IB_CM_IDLE;
711	cm_id_priv->id.device = device;
712	cm_id_priv->id.cm_handler = cm_handler;
713	cm_id_priv->id.context = context;
714	cm_id_priv->id.remote_cm_qpn = 1;
715	ret = cm_alloc_id(cm_id_priv);
716	if (ret)
717		goto error;
718
719	spin_lock_init(&cm_id_priv->lock);
720	init_completion(&cm_id_priv->comp);
721	INIT_LIST_HEAD(&cm_id_priv->work_list);
722	atomic_set(&cm_id_priv->work_count, -1);
723	atomic_set(&cm_id_priv->refcount, 1);
724	return &cm_id_priv->id;
725
726error:
727	kfree(cm_id_priv);
728	return ERR_PTR(-ENOMEM);
729}
730EXPORT_SYMBOL(ib_create_cm_id);
731
732static struct cm_work * cm_dequeue_work(struct cm_id_private *cm_id_priv)
733{
734	struct cm_work *work;
735
736	if (list_empty(&cm_id_priv->work_list))
737		return NULL;
738
739	work = list_entry(cm_id_priv->work_list.next, struct cm_work, list);
740	list_del(&work->list);
741	return work;
742}
743
744static void cm_free_work(struct cm_work *work)
745{
746	if (work->mad_recv_wc)
747		ib_free_recv_mad(work->mad_recv_wc);
748	kfree(work);
749}
750
751static inline int cm_convert_to_ms(int iba_time)
752{
753	/* approximate conversion to ms from 4.096us x 2^iba_time */
754	return 1 << max(iba_time - 8, 0);
755}
756
757/*
758 * calculate: 4.096x2^ack_timeout = 4.096x2^ack_delay + 2x4.096x2^life_time
759 * Because of how ack_timeout is stored, adding one doubles the timeout.
760 * To avoid large timeouts, select the max(ack_delay, life_time + 1), and
761 * increment it (round up) only if the other is within 50%.
762 */
763static u8 cm_ack_timeout(u8 ca_ack_delay, u8 packet_life_time)
764{
765	int ack_timeout = packet_life_time + 1;
766
767	if (ack_timeout >= ca_ack_delay)
768		ack_timeout += (ca_ack_delay >= (ack_timeout - 1));
769	else
770		ack_timeout = ca_ack_delay +
771			      (ack_timeout >= (ca_ack_delay - 1));
772
773	return min(31, ack_timeout);
774}
775
776static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
777{
778	if (timewait_info->inserted_remote_id) {
779		rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
780		timewait_info->inserted_remote_id = 0;
781	}
782
783	if (timewait_info->inserted_remote_qp) {
784		rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
785		timewait_info->inserted_remote_qp = 0;
786	}
787}
788
789static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
790{
791	struct cm_timewait_info *timewait_info;
792
793	timewait_info = kzalloc(sizeof *timewait_info, GFP_KERNEL);
794	if (!timewait_info)
795		return ERR_PTR(-ENOMEM);
796
797	timewait_info->work.local_id = local_id;
798	INIT_DELAYED_WORK(&timewait_info->work.work, cm_work_handler);
799	timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
800	return timewait_info;
801}
802
803static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
804{
805	int wait_time;
806	unsigned long flags;
807
808	spin_lock_irqsave(&cm.lock, flags);
809	cm_cleanup_timewait(cm_id_priv->timewait_info);
810	list_add_tail(&cm_id_priv->timewait_info->list, &cm.timewait_list);
811	spin_unlock_irqrestore(&cm.lock, flags);
812
813	/*
814	 * The cm_id could be destroyed by the user before we exit timewait.
815	 * To protect against this, we search for the cm_id after exiting
816	 * timewait before notifying the user that we've exited timewait.
817	 */
818	cm_id_priv->id.state = IB_CM_TIMEWAIT;
819	wait_time = cm_convert_to_ms(cm_id_priv->av.timeout);
820	queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
821			   msecs_to_jiffies(wait_time));
822	cm_id_priv->timewait_info = NULL;
823}
824
825static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
826{
827	unsigned long flags;
828
829	cm_id_priv->id.state = IB_CM_IDLE;
830	if (cm_id_priv->timewait_info) {
831		spin_lock_irqsave(&cm.lock, flags);
832		cm_cleanup_timewait(cm_id_priv->timewait_info);
833		spin_unlock_irqrestore(&cm.lock, flags);
834		kfree(cm_id_priv->timewait_info);
835		cm_id_priv->timewait_info = NULL;
836	}
837}
838
839static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
840{
841	struct cm_id_private *cm_id_priv;
842	struct cm_work *work;
843
844	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
845retest:
846	spin_lock_irq(&cm_id_priv->lock);
847	switch (cm_id->state) {
848	case IB_CM_LISTEN:
849		cm_id->state = IB_CM_IDLE;
850		spin_unlock_irq(&cm_id_priv->lock);
851		spin_lock_irq(&cm.lock);
852		rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);
853		spin_unlock_irq(&cm.lock);
854		break;
855	case IB_CM_SIDR_REQ_SENT:
856		cm_id->state = IB_CM_IDLE;
857		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
858		spin_unlock_irq(&cm_id_priv->lock);
859		break;
860	case IB_CM_SIDR_REQ_RCVD:
861		spin_unlock_irq(&cm_id_priv->lock);
862		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
863		break;
864	case IB_CM_REQ_SENT:
865		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
866		spin_unlock_irq(&cm_id_priv->lock);
867		ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,
868			       &cm_id_priv->id.device->node_guid,
869			       sizeof cm_id_priv->id.device->node_guid,
870			       NULL, 0);
871		break;
872	case IB_CM_REQ_RCVD:
873		if (err == -ENOMEM) {
874			/* Do not reject to allow future retries. */
875			cm_reset_to_idle(cm_id_priv);
876			spin_unlock_irq(&cm_id_priv->lock);
877		} else {
878			spin_unlock_irq(&cm_id_priv->lock);
879			ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
880				       NULL, 0, NULL, 0);
881		}
882		break;
883	case IB_CM_MRA_REQ_RCVD:
884	case IB_CM_REP_SENT:
885	case IB_CM_MRA_REP_RCVD:
886		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
887		/* Fall through */
888	case IB_CM_MRA_REQ_SENT:
889	case IB_CM_REP_RCVD:
890	case IB_CM_MRA_REP_SENT:
891		spin_unlock_irq(&cm_id_priv->lock);
892		ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
893			       NULL, 0, NULL, 0);
894		break;
895	case IB_CM_ESTABLISHED:
896		spin_unlock_irq(&cm_id_priv->lock);
897		if (cm_id_priv->qp_type == IB_QPT_XRC_TGT)
898			break;
899		ib_send_cm_dreq(cm_id, NULL, 0);
900		goto retest;
901	case IB_CM_DREQ_SENT:
902		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
903		cm_enter_timewait(cm_id_priv);
904		spin_unlock_irq(&cm_id_priv->lock);
905		break;
906	case IB_CM_DREQ_RCVD:
907		spin_unlock_irq(&cm_id_priv->lock);
908		ib_send_cm_drep(cm_id, NULL, 0);
909		break;
910	default:
911		spin_unlock_irq(&cm_id_priv->lock);
912		break;
913	}
914
915	cm_free_id(cm_id->local_id);
916	cm_deref_id(cm_id_priv);
917	wait_for_completion(&cm_id_priv->comp);
918	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
919		cm_free_work(work);
920	kfree(cm_id_priv->compare_data);
921	kfree(cm_id_priv->private_data);
922	kfree(cm_id_priv);
923}
924
925void ib_destroy_cm_id(struct ib_cm_id *cm_id)
926{
927	cm_destroy_id(cm_id, 0);
928}
929EXPORT_SYMBOL(ib_destroy_cm_id);
930
931int ib_cm_listen(struct ib_cm_id *cm_id, __be64 service_id, __be64 service_mask,
932		 struct ib_cm_compare_data *compare_data)
933{
934	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
935	unsigned long flags;
936	int ret = 0;
937
938	service_mask = service_mask ? service_mask : ~cpu_to_be64(0);
939	service_id &= service_mask;
940	if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
941	    (service_id != IB_CM_ASSIGN_SERVICE_ID))
942		return -EINVAL;
943
944	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
945	if (cm_id->state != IB_CM_IDLE)
946		return -EINVAL;
947
948	if (compare_data) {
949		cm_id_priv->compare_data = kzalloc(sizeof *compare_data,
950						   GFP_KERNEL);
951		if (!cm_id_priv->compare_data)
952			return -ENOMEM;
953		cm_mask_copy(cm_id_priv->compare_data->data,
954			     compare_data->data, compare_data->mask);
955		memcpy(cm_id_priv->compare_data->mask, compare_data->mask,
956		       IB_CM_COMPARE_SIZE);
957	}
958
959	cm_id->state = IB_CM_LISTEN;
960
961	spin_lock_irqsave(&cm.lock, flags);
962	if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
963		cm_id->service_id = cpu_to_be64(cm.listen_service_id++);
964		cm_id->service_mask = ~cpu_to_be64(0);
965	} else {
966		cm_id->service_id = service_id;
967		cm_id->service_mask = service_mask;
968	}
969	cur_cm_id_priv = cm_insert_listen(cm_id_priv);
970	spin_unlock_irqrestore(&cm.lock, flags);
971
972	if (cur_cm_id_priv) {
973		cm_id->state = IB_CM_IDLE;
974		kfree(cm_id_priv->compare_data);
975		cm_id_priv->compare_data = NULL;
976		ret = -EBUSY;
977	}
978	return ret;
979}
980EXPORT_SYMBOL(ib_cm_listen);
981
982static __be64 cm_form_tid(struct cm_id_private *cm_id_priv,
983			  enum cm_msg_sequence msg_seq)
984{
985	u64 hi_tid, low_tid;
986
987	hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
988	low_tid  = (u64) ((__force u32)cm_id_priv->id.local_id |
989			  (msg_seq << 30));
990	return cpu_to_be64(hi_tid | low_tid);
991}
992
993static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
994			      __be16 attr_id, __be64 tid)
995{
996	hdr->base_version  = IB_MGMT_BASE_VERSION;
997	hdr->mgmt_class	   = IB_MGMT_CLASS_CM;
998	hdr->class_version = IB_CM_CLASS_VERSION;
999	hdr->method	   = IB_MGMT_METHOD_SEND;
1000	hdr->attr_id	   = attr_id;
1001	hdr->tid	   = tid;
1002}
1003
1004static void cm_format_req(struct cm_req_msg *req_msg,
1005			  struct cm_id_private *cm_id_priv,
1006			  struct ib_cm_req_param *param)
1007{
1008	struct ib_sa_path_rec *pri_path = param->primary_path;
1009	struct ib_sa_path_rec *alt_path = param->alternate_path;
1010
1011	cm_format_mad_hdr(&req_msg->hdr, CM_REQ_ATTR_ID,
1012			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_REQ));
1013
1014	req_msg->local_comm_id = cm_id_priv->id.local_id;
1015	req_msg->service_id = param->service_id;
1016	req_msg->local_ca_guid = cm_id_priv->id.device->node_guid;
1017	cm_req_set_local_qpn(req_msg, cpu_to_be32(param->qp_num));
1018	cm_req_set_init_depth(req_msg, param->initiator_depth);
1019	cm_req_set_remote_resp_timeout(req_msg,
1020				       param->remote_cm_response_timeout);
1021	cm_req_set_qp_type(req_msg, param->qp_type);
1022	cm_req_set_flow_ctrl(req_msg, param->flow_control);
1023	cm_req_set_starting_psn(req_msg, cpu_to_be32(param->starting_psn));
1024	cm_req_set_local_resp_timeout(req_msg,
1025				      param->local_cm_response_timeout);
1026	req_msg->pkey = param->primary_path->pkey;
1027	cm_req_set_path_mtu(req_msg, param->primary_path->mtu);
1028	cm_req_set_max_cm_retries(req_msg, param->max_cm_retries);
1029
1030	if (param->qp_type != IB_QPT_XRC_INI) {
1031		cm_req_set_resp_res(req_msg, param->responder_resources);
1032		cm_req_set_retry_count(req_msg, param->retry_count);
1033		cm_req_set_rnr_retry_count(req_msg, param->rnr_retry_count);
1034		cm_req_set_srq(req_msg, param->srq);
1035	}
1036
1037	if (pri_path->hop_limit <= 1) {
1038		req_msg->primary_local_lid = pri_path->slid;
1039		req_msg->primary_remote_lid = pri_path->dlid;
1040	} else {
1041		/* Work-around until there's a way to obtain remote LID info */
1042		req_msg->primary_local_lid = IB_LID_PERMISSIVE;
1043		req_msg->primary_remote_lid = IB_LID_PERMISSIVE;
1044	}
1045	req_msg->primary_local_gid = pri_path->sgid;
1046	req_msg->primary_remote_gid = pri_path->dgid;
1047	cm_req_set_primary_flow_label(req_msg, pri_path->flow_label);
1048	cm_req_set_primary_packet_rate(req_msg, pri_path->rate);
1049	req_msg->primary_traffic_class = pri_path->traffic_class;
1050	req_msg->primary_hop_limit = pri_path->hop_limit;
1051	cm_req_set_primary_sl(req_msg, pri_path->sl);
1052	cm_req_set_primary_subnet_local(req_msg, (pri_path->hop_limit <= 1));
1053	cm_req_set_primary_local_ack_timeout(req_msg,
1054		cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
1055			       pri_path->packet_life_time));
1056
1057	if (alt_path) {
1058		if (alt_path->hop_limit <= 1) {
1059			req_msg->alt_local_lid = alt_path->slid;
1060			req_msg->alt_remote_lid = alt_path->dlid;
1061		} else {
1062			req_msg->alt_local_lid = IB_LID_PERMISSIVE;
1063			req_msg->alt_remote_lid = IB_LID_PERMISSIVE;
1064		}
1065		req_msg->alt_local_gid = alt_path->sgid;
1066		req_msg->alt_remote_gid = alt_path->dgid;
1067		cm_req_set_alt_flow_label(req_msg,
1068					  alt_path->flow_label);
1069		cm_req_set_alt_packet_rate(req_msg, alt_path->rate);
1070		req_msg->alt_traffic_class = alt_path->traffic_class;
1071		req_msg->alt_hop_limit = alt_path->hop_limit;
1072		cm_req_set_alt_sl(req_msg, alt_path->sl);
1073		cm_req_set_alt_subnet_local(req_msg, (alt_path->hop_limit <= 1));
1074		cm_req_set_alt_local_ack_timeout(req_msg,
1075			cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
1076				       alt_path->packet_life_time));
1077	}
1078
1079	if (param->private_data && param->private_data_len)
1080		memcpy(req_msg->private_data, param->private_data,
1081		       param->private_data_len);
1082}
1083
1084static int cm_validate_req_param(struct ib_cm_req_param *param)
1085{
1086	/* peer-to-peer not supported */
1087	if (param->peer_to_peer)
1088		return -EINVAL;
1089
1090	if (!param->primary_path)
1091		return -EINVAL;
1092
1093	if (param->qp_type != IB_QPT_RC && param->qp_type != IB_QPT_UC &&
1094	    param->qp_type != IB_QPT_XRC_INI)
1095		return -EINVAL;
1096
1097	if (param->private_data &&
1098	    param->private_data_len > IB_CM_REQ_PRIVATE_DATA_SIZE)
1099		return -EINVAL;
1100
1101	if (param->alternate_path &&
1102	    (param->alternate_path->pkey != param->primary_path->pkey ||
1103	     param->alternate_path->mtu != param->primary_path->mtu))
1104		return -EINVAL;
1105
1106	return 0;
1107}
1108
1109int ib_send_cm_req(struct ib_cm_id *cm_id,
1110		   struct ib_cm_req_param *param)
1111{
1112	struct cm_id_private *cm_id_priv;
1113	struct cm_req_msg *req_msg;
1114	unsigned long flags;
1115	int ret;
1116
1117	ret = cm_validate_req_param(param);
1118	if (ret)
1119		return ret;
1120
1121	/* Verify that we're not in timewait. */
1122	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1123	spin_lock_irqsave(&cm_id_priv->lock, flags);
1124	if (cm_id->state != IB_CM_IDLE) {
1125		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1126		ret = -EINVAL;
1127		goto out;
1128	}
1129	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1130
1131	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1132							    id.local_id);
1133	if (IS_ERR(cm_id_priv->timewait_info)) {
1134		ret = PTR_ERR(cm_id_priv->timewait_info);
1135		goto out;
1136	}
1137
1138	ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
1139	if (ret)
1140		goto error1;
1141	if (param->alternate_path) {
1142		ret = cm_init_av_by_path(param->alternate_path,
1143					 &cm_id_priv->alt_av);
1144		if (ret)
1145			goto error1;
1146	}
1147	cm_id->service_id = param->service_id;
1148	cm_id->service_mask = ~cpu_to_be64(0);
1149	cm_id_priv->timeout_ms = cm_convert_to_ms(
1150				    param->primary_path->packet_life_time) * 2 +
1151				 cm_convert_to_ms(
1152				    param->remote_cm_response_timeout);
1153	cm_id_priv->max_cm_retries = param->max_cm_retries;
1154	cm_id_priv->initiator_depth = param->initiator_depth;
1155	cm_id_priv->responder_resources = param->responder_resources;
1156	cm_id_priv->retry_count = param->retry_count;
1157	cm_id_priv->path_mtu = param->primary_path->mtu;
1158	cm_id_priv->pkey = param->primary_path->pkey;
1159	cm_id_priv->qp_type = param->qp_type;
1160
1161	ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
1162	if (ret)
1163		goto error1;
1164
1165	req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
1166	cm_format_req(req_msg, cm_id_priv, param);
1167	cm_id_priv->tid = req_msg->hdr.tid;
1168	cm_id_priv->msg->timeout_ms = cm_id_priv->timeout_ms;
1169	cm_id_priv->msg->context[1] = (void *) (unsigned long) IB_CM_REQ_SENT;
1170
1171	cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
1172	cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
1173
1174	spin_lock_irqsave(&cm_id_priv->lock, flags);
1175	ret = ib_post_send_mad(cm_id_priv->msg, NULL);
1176	if (ret) {
1177		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1178		goto error2;
1179	}
1180	BUG_ON(cm_id->state != IB_CM_IDLE);
1181	cm_id->state = IB_CM_REQ_SENT;
1182	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1183	return 0;
1184
1185error2:	cm_free_msg(cm_id_priv->msg);
1186error1:	kfree(cm_id_priv->timewait_info);
1187out:	return ret;
1188}
1189EXPORT_SYMBOL(ib_send_cm_req);
1190
1191static int cm_issue_rej(struct cm_port *port,
1192			struct ib_mad_recv_wc *mad_recv_wc,
1193			enum ib_cm_rej_reason reason,
1194			enum cm_msg_response msg_rejected,
1195			void *ari, u8 ari_length)
1196{
1197	struct ib_mad_send_buf *msg = NULL;
1198	struct cm_rej_msg *rej_msg, *rcv_msg;
1199	int ret;
1200
1201	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
1202	if (ret)
1203		return ret;
1204
1205	/* We just need common CM header information.  Cast to any message. */
1206	rcv_msg = (struct cm_rej_msg *) mad_recv_wc->recv_buf.mad;
1207	rej_msg = (struct cm_rej_msg *) msg->mad;
1208
1209	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, rcv_msg->hdr.tid);
1210	rej_msg->remote_comm_id = rcv_msg->local_comm_id;
1211	rej_msg->local_comm_id = rcv_msg->remote_comm_id;
1212	cm_rej_set_msg_rejected(rej_msg, msg_rejected);
1213	rej_msg->reason = cpu_to_be16(reason);
1214
1215	if (ari && ari_length) {
1216		cm_rej_set_reject_info_len(rej_msg, ari_length);
1217		memcpy(rej_msg->ari, ari, ari_length);
1218	}
1219
1220	ret = ib_post_send_mad(msg, NULL);
1221	if (ret)
1222		cm_free_msg(msg);
1223
1224	return ret;
1225}
1226
1227static inline int cm_is_active_peer(__be64 local_ca_guid, __be64 remote_ca_guid,
1228				    __be32 local_qpn, __be32 remote_qpn)
1229{
1230	return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
1231		((local_ca_guid == remote_ca_guid) &&
1232		 (be32_to_cpu(local_qpn) > be32_to_cpu(remote_qpn))));
1233}
1234
1235static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
1236					    struct ib_sa_path_rec *primary_path,
1237					    struct ib_sa_path_rec *alt_path)
1238{
1239	memset(primary_path, 0, sizeof *primary_path);
1240	primary_path->dgid = req_msg->primary_local_gid;
1241	primary_path->sgid = req_msg->primary_remote_gid;
1242	primary_path->dlid = req_msg->primary_local_lid;
1243	primary_path->slid = req_msg->primary_remote_lid;
1244	primary_path->flow_label = cm_req_get_primary_flow_label(req_msg);
1245	primary_path->hop_limit = req_msg->primary_hop_limit;
1246	primary_path->traffic_class = req_msg->primary_traffic_class;
1247	primary_path->reversible = 1;
1248	primary_path->pkey = req_msg->pkey;
1249	primary_path->sl = cm_req_get_primary_sl(req_msg);
1250	primary_path->mtu_selector = IB_SA_EQ;
1251	primary_path->mtu = cm_req_get_path_mtu(req_msg);
1252	primary_path->rate_selector = IB_SA_EQ;
1253	primary_path->rate = cm_req_get_primary_packet_rate(req_msg);
1254	primary_path->packet_life_time_selector = IB_SA_EQ;
1255	primary_path->packet_life_time =
1256		cm_req_get_primary_local_ack_timeout(req_msg);
1257	primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
1258
1259	if (req_msg->alt_local_lid) {
1260		memset(alt_path, 0, sizeof *alt_path);
1261		alt_path->dgid = req_msg->alt_local_gid;
1262		alt_path->sgid = req_msg->alt_remote_gid;
1263		alt_path->dlid = req_msg->alt_local_lid;
1264		alt_path->slid = req_msg->alt_remote_lid;
1265		alt_path->flow_label = cm_req_get_alt_flow_label(req_msg);
1266		alt_path->hop_limit = req_msg->alt_hop_limit;
1267		alt_path->traffic_class = req_msg->alt_traffic_class;
1268		alt_path->reversible = 1;
1269		alt_path->pkey = req_msg->pkey;
1270		alt_path->sl = cm_req_get_alt_sl(req_msg);
1271		alt_path->mtu_selector = IB_SA_EQ;
1272		alt_path->mtu = cm_req_get_path_mtu(req_msg);
1273		alt_path->rate_selector = IB_SA_EQ;
1274		alt_path->rate = cm_req_get_alt_packet_rate(req_msg);
1275		alt_path->packet_life_time_selector = IB_SA_EQ;
1276		alt_path->packet_life_time =
1277			cm_req_get_alt_local_ack_timeout(req_msg);
1278		alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
1279	}
1280}
1281
1282static void cm_format_req_event(struct cm_work *work,
1283				struct cm_id_private *cm_id_priv,
1284				struct ib_cm_id *listen_id)
1285{
1286	struct cm_req_msg *req_msg;
1287	struct ib_cm_req_event_param *param;
1288
1289	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1290	param = &work->cm_event.param.req_rcvd;
1291	param->listen_id = listen_id;
1292	param->port = cm_id_priv->av.port->port_num;
1293	param->primary_path = &work->path[0];
1294	if (req_msg->alt_local_lid)
1295		param->alternate_path = &work->path[1];
1296	else
1297		param->alternate_path = NULL;
1298	param->remote_ca_guid = req_msg->local_ca_guid;
1299	param->remote_qkey = be32_to_cpu(req_msg->local_qkey);
1300	param->remote_qpn = be32_to_cpu(cm_req_get_local_qpn(req_msg));
1301	param->qp_type = cm_req_get_qp_type(req_msg);
1302	param->starting_psn = be32_to_cpu(cm_req_get_starting_psn(req_msg));
1303	param->responder_resources = cm_req_get_init_depth(req_msg);
1304	param->initiator_depth = cm_req_get_resp_res(req_msg);
1305	param->local_cm_response_timeout =
1306					cm_req_get_remote_resp_timeout(req_msg);
1307	param->flow_control = cm_req_get_flow_ctrl(req_msg);
1308	param->remote_cm_response_timeout =
1309					cm_req_get_local_resp_timeout(req_msg);
1310	param->retry_count = cm_req_get_retry_count(req_msg);
1311	param->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1312	param->srq = cm_req_get_srq(req_msg);
1313	work->cm_event.private_data = &req_msg->private_data;
1314}
1315
1316static void cm_process_work(struct cm_id_private *cm_id_priv,
1317			    struct cm_work *work)
1318{
1319	int ret;
1320
1321	/* We will typically only have the current event to report. */
1322	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &work->cm_event);
1323	cm_free_work(work);
1324
1325	while (!ret && !atomic_add_negative(-1, &cm_id_priv->work_count)) {
1326		spin_lock_irq(&cm_id_priv->lock);
1327		work = cm_dequeue_work(cm_id_priv);
1328		spin_unlock_irq(&cm_id_priv->lock);
1329		BUG_ON(!work);
1330		ret = cm_id_priv->id.cm_handler(&cm_id_priv->id,
1331						&work->cm_event);
1332		cm_free_work(work);
1333	}
1334	cm_deref_id(cm_id_priv);
1335	if (ret)
1336		cm_destroy_id(&cm_id_priv->id, ret);
1337}
1338
1339static void cm_format_mra(struct cm_mra_msg *mra_msg,
1340			  struct cm_id_private *cm_id_priv,
1341			  enum cm_msg_response msg_mraed, u8 service_timeout,
1342			  const void *private_data, u8 private_data_len)
1343{
1344	cm_format_mad_hdr(&mra_msg->hdr, CM_MRA_ATTR_ID, cm_id_priv->tid);
1345	cm_mra_set_msg_mraed(mra_msg, msg_mraed);
1346	mra_msg->local_comm_id = cm_id_priv->id.local_id;
1347	mra_msg->remote_comm_id = cm_id_priv->id.remote_id;
1348	cm_mra_set_service_timeout(mra_msg, service_timeout);
1349
1350	if (private_data && private_data_len)
1351		memcpy(mra_msg->private_data, private_data, private_data_len);
1352}
1353
1354static void cm_format_rej(struct cm_rej_msg *rej_msg,
1355			  struct cm_id_private *cm_id_priv,
1356			  enum ib_cm_rej_reason reason,
1357			  void *ari,
1358			  u8 ari_length,
1359			  const void *private_data,
1360			  u8 private_data_len)
1361{
1362	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, cm_id_priv->tid);
1363	rej_msg->remote_comm_id = cm_id_priv->id.remote_id;
1364
1365	switch(cm_id_priv->id.state) {
1366	case IB_CM_REQ_RCVD:
1367		rej_msg->local_comm_id = 0;
1368		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1369		break;
1370	case IB_CM_MRA_REQ_SENT:
1371		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1372		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1373		break;
1374	case IB_CM_REP_RCVD:
1375	case IB_CM_MRA_REP_SENT:
1376		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1377		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REP);
1378		break;
1379	default:
1380		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1381		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_OTHER);
1382		break;
1383	}
1384
1385	rej_msg->reason = cpu_to_be16(reason);
1386	if (ari && ari_length) {
1387		cm_rej_set_reject_info_len(rej_msg, ari_length);
1388		memcpy(rej_msg->ari, ari, ari_length);
1389	}
1390
1391	if (private_data && private_data_len)
1392		memcpy(rej_msg->private_data, private_data, private_data_len);
1393}
1394
1395static void cm_dup_req_handler(struct cm_work *work,
1396			       struct cm_id_private *cm_id_priv)
1397{
1398	struct ib_mad_send_buf *msg = NULL;
1399	int ret;
1400
1401	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1402			counter[CM_REQ_COUNTER]);
1403
1404	/* Quick state check to discard duplicate REQs. */
1405	if (cm_id_priv->id.state == IB_CM_REQ_RCVD)
1406		return;
1407
1408	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1409	if (ret)
1410		return;
1411
1412	spin_lock_irq(&cm_id_priv->lock);
1413	switch (cm_id_priv->id.state) {
1414	case IB_CM_MRA_REQ_SENT:
1415		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1416			      CM_MSG_RESPONSE_REQ, cm_id_priv->service_timeout,
1417			      cm_id_priv->private_data,
1418			      cm_id_priv->private_data_len);
1419		break;
1420	case IB_CM_TIMEWAIT:
1421		cm_format_rej((struct cm_rej_msg *) msg->mad, cm_id_priv,
1422			      IB_CM_REJ_STALE_CONN, NULL, 0, NULL, 0);
1423		break;
1424	default:
1425		goto unlock;
1426	}
1427	spin_unlock_irq(&cm_id_priv->lock);
1428
1429	ret = ib_post_send_mad(msg, NULL);
1430	if (ret)
1431		goto free;
1432	return;
1433
1434unlock:	spin_unlock_irq(&cm_id_priv->lock);
1435free:	cm_free_msg(msg);
1436}
1437
1438static struct cm_id_private * cm_match_req(struct cm_work *work,
1439					   struct cm_id_private *cm_id_priv)
1440{
1441	struct cm_id_private *listen_cm_id_priv, *cur_cm_id_priv;
1442	struct cm_timewait_info *timewait_info;
1443	struct cm_req_msg *req_msg;
1444
1445	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1446
1447	/* Check for possible duplicate REQ. */
1448	spin_lock_irq(&cm.lock);
1449	timewait_info = cm_insert_remote_id(cm_id_priv->timewait_info);
1450	if (timewait_info) {
1451		cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
1452					   timewait_info->work.remote_id);
1453		spin_unlock_irq(&cm.lock);
1454		if (cur_cm_id_priv) {
1455			cm_dup_req_handler(work, cur_cm_id_priv);
1456			cm_deref_id(cur_cm_id_priv);
1457		}
1458		return NULL;
1459	}
1460
1461	/* Check for stale connections. */
1462	timewait_info = cm_insert_remote_qpn(cm_id_priv->timewait_info);
1463	if (timewait_info) {
1464		cm_cleanup_timewait(cm_id_priv->timewait_info);
1465		spin_unlock_irq(&cm.lock);
1466		cm_issue_rej(work->port, work->mad_recv_wc,
1467			     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
1468			     NULL, 0);
1469		return NULL;
1470	}
1471
1472	/* Find matching listen request. */
1473	listen_cm_id_priv = cm_find_listen(cm_id_priv->id.device,
1474					   req_msg->service_id,
1475					   req_msg->private_data);
1476	if (!listen_cm_id_priv) {
1477		cm_cleanup_timewait(cm_id_priv->timewait_info);
1478		spin_unlock_irq(&cm.lock);
1479		cm_issue_rej(work->port, work->mad_recv_wc,
1480			     IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
1481			     NULL, 0);
1482		goto out;
1483	}
1484	atomic_inc(&listen_cm_id_priv->refcount);
1485	atomic_inc(&cm_id_priv->refcount);
1486	cm_id_priv->id.state = IB_CM_REQ_RCVD;
1487	atomic_inc(&cm_id_priv->work_count);
1488	spin_unlock_irq(&cm.lock);
1489out:
1490	return listen_cm_id_priv;
1491}
1492
1493/*
1494 * Work-around for inter-subnet connections.  If the LIDs are permissive,
1495 * we need to override the LID/SL data in the REQ with the LID information
1496 * in the work completion.
1497 */
1498static void cm_process_routed_req(struct cm_req_msg *req_msg, struct ib_wc *wc)
1499{
1500	if (!cm_req_get_primary_subnet_local(req_msg)) {
1501		if (req_msg->primary_local_lid == IB_LID_PERMISSIVE) {
1502			req_msg->primary_local_lid = cpu_to_be16(wc->slid);
1503			cm_req_set_primary_sl(req_msg, wc->sl);
1504		}
1505
1506		if (req_msg->primary_remote_lid == IB_LID_PERMISSIVE)
1507			req_msg->primary_remote_lid = cpu_to_be16(wc->dlid_path_bits);
1508	}
1509
1510	if (!cm_req_get_alt_subnet_local(req_msg)) {
1511		if (req_msg->alt_local_lid == IB_LID_PERMISSIVE) {
1512			req_msg->alt_local_lid = cpu_to_be16(wc->slid);
1513			cm_req_set_alt_sl(req_msg, wc->sl);
1514		}
1515
1516		if (req_msg->alt_remote_lid == IB_LID_PERMISSIVE)
1517			req_msg->alt_remote_lid = cpu_to_be16(wc->dlid_path_bits);
1518	}
1519}
1520
1521static int cm_req_handler(struct cm_work *work)
1522{
1523	struct ib_cm_id *cm_id;
1524	struct cm_id_private *cm_id_priv, *listen_cm_id_priv;
1525	struct cm_req_msg *req_msg;
1526	int ret;
1527
1528	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1529
1530	cm_id = ib_create_cm_id(work->port->cm_dev->ib_device, NULL, NULL);
1531	if (IS_ERR(cm_id))
1532		return PTR_ERR(cm_id);
1533
1534	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1535	cm_id_priv->id.remote_id = req_msg->local_comm_id;
1536	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
1537				work->mad_recv_wc->recv_buf.grh,
1538				&cm_id_priv->av);
1539	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1540							    id.local_id);
1541	if (IS_ERR(cm_id_priv->timewait_info)) {
1542		ret = PTR_ERR(cm_id_priv->timewait_info);
1543		goto destroy;
1544	}
1545	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
1546	cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;
1547	cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);
1548
1549	listen_cm_id_priv = cm_match_req(work, cm_id_priv);
1550	if (!listen_cm_id_priv) {
1551		ret = -EINVAL;
1552		kfree(cm_id_priv->timewait_info);
1553		goto destroy;
1554	}
1555
1556	cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
1557	cm_id_priv->id.context = listen_cm_id_priv->id.context;
1558	cm_id_priv->id.service_id = req_msg->service_id;
1559	cm_id_priv->id.service_mask = ~cpu_to_be64(0);
1560
1561	cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
1562	cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
1563
1564	memcpy(work->path[0].dmac, cm_id_priv->av.ah_attr.dmac, ETH_ALEN);
1565	work->path[0].vlan_id = cm_id_priv->av.ah_attr.vlan_id;
1566	ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
1567	if (ret) {
1568		ib_get_cached_gid(work->port->cm_dev->ib_device,
1569				  work->port->port_num, 0, &work->path[0].sgid);
1570		ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_GID,
1571			       &work->path[0].sgid, sizeof work->path[0].sgid,
1572			       NULL, 0);
1573		goto rejected;
1574	}
1575	if (req_msg->alt_local_lid) {
1576		ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
1577		if (ret) {
1578			ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID,
1579				       &work->path[0].sgid,
1580				       sizeof work->path[0].sgid, NULL, 0);
1581			goto rejected;
1582		}
1583	}
1584	cm_id_priv->tid = req_msg->hdr.tid;
1585	cm_id_priv->timeout_ms = cm_convert_to_ms(
1586					cm_req_get_local_resp_timeout(req_msg));
1587	cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);
1588	cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);
1589	cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
1590	cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
1591	cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
1592	cm_id_priv->pkey = req_msg->pkey;
1593	cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
1594	cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
1595	cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1596	cm_id_priv->qp_type = cm_req_get_qp_type(req_msg);
1597
1598	cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);
1599	cm_process_work(cm_id_priv, work);
1600	cm_deref_id(listen_cm_id_priv);
1601	return 0;
1602
1603rejected:
1604	atomic_dec(&cm_id_priv->refcount);
1605	cm_deref_id(listen_cm_id_priv);
1606destroy:
1607	ib_destroy_cm_id(cm_id);
1608	return ret;
1609}
1610
1611static void cm_format_rep(struct cm_rep_msg *rep_msg,
1612			  struct cm_id_private *cm_id_priv,
1613			  struct ib_cm_rep_param *param)
1614{
1615	cm_format_mad_hdr(&rep_msg->hdr, CM_REP_ATTR_ID, cm_id_priv->tid);
1616	rep_msg->local_comm_id = cm_id_priv->id.local_id;
1617	rep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1618	cm_rep_set_starting_psn(rep_msg, cpu_to_be32(param->starting_psn));
1619	rep_msg->resp_resources = param->responder_resources;
1620	cm_rep_set_target_ack_delay(rep_msg,
1621				    cm_id_priv->av.port->cm_dev->ack_delay);
1622	cm_rep_set_failover(rep_msg, param->failover_accepted);
1623	cm_rep_set_rnr_retry_count(rep_msg, param->rnr_retry_count);
1624	rep_msg->local_ca_guid = cm_id_priv->id.device->node_guid;
1625
1626	if (cm_id_priv->qp_type != IB_QPT_XRC_TGT) {
1627		rep_msg->initiator_depth = param->initiator_depth;
1628		cm_rep_set_flow_ctrl(rep_msg, param->flow_control);
1629		cm_rep_set_srq(rep_msg, param->srq);
1630		cm_rep_set_local_qpn(rep_msg, cpu_to_be32(param->qp_num));
1631	} else {
1632		cm_rep_set_srq(rep_msg, 1);
1633		cm_rep_set_local_eecn(rep_msg, cpu_to_be32(param->qp_num));
1634	}
1635
1636	if (param->private_data && param->private_data_len)
1637		memcpy(rep_msg->private_data, param->private_data,
1638		       param->private_data_len);
1639}
1640
1641int ib_send_cm_rep(struct ib_cm_id *cm_id,
1642		   struct ib_cm_rep_param *param)
1643{
1644	struct cm_id_private *cm_id_priv;
1645	struct ib_mad_send_buf *msg;
1646	struct cm_rep_msg *rep_msg;
1647	unsigned long flags;
1648	int ret;
1649
1650	if (param->private_data &&
1651	    param->private_data_len > IB_CM_REP_PRIVATE_DATA_SIZE)
1652		return -EINVAL;
1653
1654	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1655	spin_lock_irqsave(&cm_id_priv->lock, flags);
1656	if (cm_id->state != IB_CM_REQ_RCVD &&
1657	    cm_id->state != IB_CM_MRA_REQ_SENT) {
1658		ret = -EINVAL;
1659		goto out;
1660	}
1661
1662	ret = cm_alloc_msg(cm_id_priv, &msg);
1663	if (ret)
1664		goto out;
1665
1666	rep_msg = (struct cm_rep_msg *) msg->mad;
1667	cm_format_rep(rep_msg, cm_id_priv, param);
1668	msg->timeout_ms = cm_id_priv->timeout_ms;
1669	msg->context[1] = (void *) (unsigned long) IB_CM_REP_SENT;
1670
1671	ret = ib_post_send_mad(msg, NULL);
1672	if (ret) {
1673		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1674		cm_free_msg(msg);
1675		return ret;
1676	}
1677
1678	cm_id->state = IB_CM_REP_SENT;
1679	cm_id_priv->msg = msg;
1680	cm_id_priv->initiator_depth = param->initiator_depth;
1681	cm_id_priv->responder_resources = param->responder_resources;
1682	cm_id_priv->rq_psn = cm_rep_get_starting_psn(rep_msg);
1683	cm_id_priv->local_qpn = cpu_to_be32(param->qp_num & 0xFFFFFF);
1684
1685out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1686	return ret;
1687}
1688EXPORT_SYMBOL(ib_send_cm_rep);
1689
1690static void cm_format_rtu(struct cm_rtu_msg *rtu_msg,
1691			  struct cm_id_private *cm_id_priv,
1692			  const void *private_data,
1693			  u8 private_data_len)
1694{
1695	cm_format_mad_hdr(&rtu_msg->hdr, CM_RTU_ATTR_ID, cm_id_priv->tid);
1696	rtu_msg->local_comm_id = cm_id_priv->id.local_id;
1697	rtu_msg->remote_comm_id = cm_id_priv->id.remote_id;
1698
1699	if (private_data && private_data_len)
1700		memcpy(rtu_msg->private_data, private_data, private_data_len);
1701}
1702
1703int ib_send_cm_rtu(struct ib_cm_id *cm_id,
1704		   const void *private_data,
1705		   u8 private_data_len)
1706{
1707	struct cm_id_private *cm_id_priv;
1708	struct ib_mad_send_buf *msg;
1709	unsigned long flags;
1710	void *data;
1711	int ret;
1712
1713	if (private_data && private_data_len > IB_CM_RTU_PRIVATE_DATA_SIZE)
1714		return -EINVAL;
1715
1716	data = cm_copy_private_data(private_data, private_data_len);
1717	if (IS_ERR(data))
1718		return PTR_ERR(data);
1719
1720	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1721	spin_lock_irqsave(&cm_id_priv->lock, flags);
1722	if (cm_id->state != IB_CM_REP_RCVD &&
1723	    cm_id->state != IB_CM_MRA_REP_SENT) {
1724		ret = -EINVAL;
1725		goto error;
1726	}
1727
1728	ret = cm_alloc_msg(cm_id_priv, &msg);
1729	if (ret)
1730		goto error;
1731
1732	cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1733		      private_data, private_data_len);
1734
1735	ret = ib_post_send_mad(msg, NULL);
1736	if (ret) {
1737		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1738		cm_free_msg(msg);
1739		kfree(data);
1740		return ret;
1741	}
1742
1743	cm_id->state = IB_CM_ESTABLISHED;
1744	cm_set_private_data(cm_id_priv, data, private_data_len);
1745	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1746	return 0;
1747
1748error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1749	kfree(data);
1750	return ret;
1751}
1752EXPORT_SYMBOL(ib_send_cm_rtu);
1753
1754static void cm_format_rep_event(struct cm_work *work, enum ib_qp_type qp_type)
1755{
1756	struct cm_rep_msg *rep_msg;
1757	struct ib_cm_rep_event_param *param;
1758
1759	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1760	param = &work->cm_event.param.rep_rcvd;
1761	param->remote_ca_guid = rep_msg->local_ca_guid;
1762	param->remote_qkey = be32_to_cpu(rep_msg->local_qkey);
1763	param->remote_qpn = be32_to_cpu(cm_rep_get_qpn(rep_msg, qp_type));
1764	param->starting_psn = be32_to_cpu(cm_rep_get_starting_psn(rep_msg));
1765	param->responder_resources = rep_msg->initiator_depth;
1766	param->initiator_depth = rep_msg->resp_resources;
1767	param->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1768	param->failover_accepted = cm_rep_get_failover(rep_msg);
1769	param->flow_control = cm_rep_get_flow_ctrl(rep_msg);
1770	param->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1771	param->srq = cm_rep_get_srq(rep_msg);
1772	work->cm_event.private_data = &rep_msg->private_data;
1773}
1774
1775static void cm_dup_rep_handler(struct cm_work *work)
1776{
1777	struct cm_id_private *cm_id_priv;
1778	struct cm_rep_msg *rep_msg;
1779	struct ib_mad_send_buf *msg = NULL;
1780	int ret;
1781
1782	rep_msg = (struct cm_rep_msg *) work->mad_recv_wc->recv_buf.mad;
1783	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id,
1784				   rep_msg->local_comm_id);
1785	if (!cm_id_priv)
1786		return;
1787
1788	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1789			counter[CM_REP_COUNTER]);
1790	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1791	if (ret)
1792		goto deref;
1793
1794	spin_lock_irq(&cm_id_priv->lock);
1795	if (cm_id_priv->id.state == IB_CM_ESTABLISHED)
1796		cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1797			      cm_id_priv->private_data,
1798			      cm_id_priv->private_data_len);
1799	else if (cm_id_priv->id.state == IB_CM_MRA_REP_SENT)
1800		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1801			      CM_MSG_RESPONSE_REP, cm_id_priv->service_timeout,
1802			      cm_id_priv->private_data,
1803			      cm_id_priv->private_data_len);
1804	else
1805		goto unlock;
1806	spin_unlock_irq(&cm_id_priv->lock);
1807
1808	ret = ib_post_send_mad(msg, NULL);
1809	if (ret)
1810		goto free;
1811	goto deref;
1812
1813unlock:	spin_unlock_irq(&cm_id_priv->lock);
1814free:	cm_free_msg(msg);
1815deref:	cm_deref_id(cm_id_priv);
1816}
1817
1818static int cm_rep_handler(struct cm_work *work)
1819{
1820	struct cm_id_private *cm_id_priv;
1821	struct cm_rep_msg *rep_msg;
1822	int ret;
1823
1824	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1825	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id, 0);
1826	if (!cm_id_priv) {
1827		cm_dup_rep_handler(work);
1828		return -EINVAL;
1829	}
1830
1831	cm_format_rep_event(work, cm_id_priv->qp_type);
1832
1833	spin_lock_irq(&cm_id_priv->lock);
1834	switch (cm_id_priv->id.state) {
1835	case IB_CM_REQ_SENT:
1836	case IB_CM_MRA_REQ_RCVD:
1837		break;
1838	default:
1839		spin_unlock_irq(&cm_id_priv->lock);
1840		ret = -EINVAL;
1841		goto error;
1842	}
1843
1844	cm_id_priv->timewait_info->work.remote_id = rep_msg->local_comm_id;
1845	cm_id_priv->timewait_info->remote_ca_guid = rep_msg->local_ca_guid;
1846	cm_id_priv->timewait_info->remote_qpn = cm_rep_get_qpn(rep_msg, cm_id_priv->qp_type);
1847
1848	spin_lock(&cm.lock);
1849	/* Check for duplicate REP. */
1850	if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
1851		spin_unlock(&cm.lock);
1852		spin_unlock_irq(&cm_id_priv->lock);
1853		ret = -EINVAL;
1854		goto error;
1855	}
1856	/* Check for a stale connection. */
1857	if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
1858		rb_erase(&cm_id_priv->timewait_info->remote_id_node,
1859			 &cm.remote_id_table);
1860		cm_id_priv->timewait_info->inserted_remote_id = 0;
1861		spin_unlock(&cm.lock);
1862		spin_unlock_irq(&cm_id_priv->lock);
1863		cm_issue_rej(work->port, work->mad_recv_wc,
1864			     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REP,
1865			     NULL, 0);
1866		ret = -EINVAL;
1867		goto error;
1868	}
1869	spin_unlock(&cm.lock);
1870
1871	cm_id_priv->id.state = IB_CM_REP_RCVD;
1872	cm_id_priv->id.remote_id = rep_msg->local_comm_id;
1873	cm_id_priv->remote_qpn = cm_rep_get_qpn(rep_msg, cm_id_priv->qp_type);
1874	cm_id_priv->initiator_depth = rep_msg->resp_resources;
1875	cm_id_priv->responder_resources = rep_msg->initiator_depth;
1876	cm_id_priv->sq_psn = cm_rep_get_starting_psn(rep_msg);
1877	cm_id_priv->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1878	cm_id_priv->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1879	cm_id_priv->av.timeout =
1880			cm_ack_timeout(cm_id_priv->target_ack_delay,
1881				       cm_id_priv->av.timeout - 1);
1882	cm_id_priv->alt_av.timeout =
1883			cm_ack_timeout(cm_id_priv->target_ack_delay,
1884				       cm_id_priv->alt_av.timeout - 1);
1885
1886	/* todo: handle peer_to_peer */
1887
1888	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1889	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1890	if (!ret)
1891		list_add_tail(&work->list, &cm_id_priv->work_list);
1892	spin_unlock_irq(&cm_id_priv->lock);
1893
1894	if (ret)
1895		cm_process_work(cm_id_priv, work);
1896	else
1897		cm_deref_id(cm_id_priv);
1898	return 0;
1899
1900error:
1901	cm_deref_id(cm_id_priv);
1902	return ret;
1903}
1904
1905static int cm_establish_handler(struct cm_work *work)
1906{
1907	struct cm_id_private *cm_id_priv;
1908	int ret;
1909
1910	/* See comment in cm_establish about lookup. */
1911	cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
1912	if (!cm_id_priv)
1913		return -EINVAL;
1914
1915	spin_lock_irq(&cm_id_priv->lock);
1916	if (cm_id_priv->id.state != IB_CM_ESTABLISHED) {
1917		spin_unlock_irq(&cm_id_priv->lock);
1918		goto out;
1919	}
1920
1921	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1922	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1923	if (!ret)
1924		list_add_tail(&work->list, &cm_id_priv->work_list);
1925	spin_unlock_irq(&cm_id_priv->lock);
1926
1927	if (ret)
1928		cm_process_work(cm_id_priv, work);
1929	else
1930		cm_deref_id(cm_id_priv);
1931	return 0;
1932out:
1933	cm_deref_id(cm_id_priv);
1934	return -EINVAL;
1935}
1936
1937static int cm_rtu_handler(struct cm_work *work)
1938{
1939	struct cm_id_private *cm_id_priv;
1940	struct cm_rtu_msg *rtu_msg;
1941	int ret;
1942
1943	rtu_msg = (struct cm_rtu_msg *)work->mad_recv_wc->recv_buf.mad;
1944	cm_id_priv = cm_acquire_id(rtu_msg->remote_comm_id,
1945				   rtu_msg->local_comm_id);
1946	if (!cm_id_priv)
1947		return -EINVAL;
1948
1949	work->cm_event.private_data = &rtu_msg->private_data;
1950
1951	spin_lock_irq(&cm_id_priv->lock);
1952	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
1953	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
1954		spin_unlock_irq(&cm_id_priv->lock);
1955		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1956				counter[CM_RTU_COUNTER]);
1957		goto out;
1958	}
1959	cm_id_priv->id.state = IB_CM_ESTABLISHED;
1960
1961	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1962	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1963	if (!ret)
1964		list_add_tail(&work->list, &cm_id_priv->work_list);
1965	spin_unlock_irq(&cm_id_priv->lock);
1966
1967	if (ret)
1968		cm_process_work(cm_id_priv, work);
1969	else
1970		cm_deref_id(cm_id_priv);
1971	return 0;
1972out:
1973	cm_deref_id(cm_id_priv);
1974	return -EINVAL;
1975}
1976
1977static void cm_format_dreq(struct cm_dreq_msg *dreq_msg,
1978			  struct cm_id_private *cm_id_priv,
1979			  const void *private_data,
1980			  u8 private_data_len)
1981{
1982	cm_format_mad_hdr(&dreq_msg->hdr, CM_DREQ_ATTR_ID,
1983			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_DREQ));
1984	dreq_msg->local_comm_id = cm_id_priv->id.local_id;
1985	dreq_msg->remote_comm_id = cm_id_priv->id.remote_id;
1986	cm_dreq_set_remote_qpn(dreq_msg, cm_id_priv->remote_qpn);
1987
1988	if (private_data && private_data_len)
1989		memcpy(dreq_msg->private_data, private_data, private_data_len);
1990}
1991
1992int ib_send_cm_dreq(struct ib_cm_id *cm_id,
1993		    const void *private_data,
1994		    u8 private_data_len)
1995{
1996	struct cm_id_private *cm_id_priv;
1997	struct ib_mad_send_buf *msg;
1998	unsigned long flags;
1999	int ret;
2000
2001	if (private_data && private_data_len > IB_CM_DREQ_PRIVATE_DATA_SIZE)
2002		return -EINVAL;
2003
2004	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2005	spin_lock_irqsave(&cm_id_priv->lock, flags);
2006	if (cm_id->state != IB_CM_ESTABLISHED) {
2007		ret = -EINVAL;
2008		goto out;
2009	}
2010
2011	if (cm_id->lap_state == IB_CM_LAP_SENT ||
2012	    cm_id->lap_state == IB_CM_MRA_LAP_RCVD)
2013		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2014
2015	ret = cm_alloc_msg(cm_id_priv, &msg);
2016	if (ret) {
2017		cm_enter_timewait(cm_id_priv);
2018		goto out;
2019	}
2020
2021	cm_format_dreq((struct cm_dreq_msg *) msg->mad, cm_id_priv,
2022		       private_data, private_data_len);
2023	msg->timeout_ms = cm_id_priv->timeout_ms;
2024	msg->context[1] = (void *) (unsigned long) IB_CM_DREQ_SENT;
2025
2026	ret = ib_post_send_mad(msg, NULL);
2027	if (ret) {
2028		cm_enter_timewait(cm_id_priv);
2029		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2030		cm_free_msg(msg);
2031		return ret;
2032	}
2033
2034	cm_id->state = IB_CM_DREQ_SENT;
2035	cm_id_priv->msg = msg;
2036out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2037	return ret;
2038}
2039EXPORT_SYMBOL(ib_send_cm_dreq);
2040
2041static void cm_format_drep(struct cm_drep_msg *drep_msg,
2042			  struct cm_id_private *cm_id_priv,
2043			  const void *private_data,
2044			  u8 private_data_len)
2045{
2046	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, cm_id_priv->tid);
2047	drep_msg->local_comm_id = cm_id_priv->id.local_id;
2048	drep_msg->remote_comm_id = cm_id_priv->id.remote_id;
2049
2050	if (private_data && private_data_len)
2051		memcpy(drep_msg->private_data, private_data, private_data_len);
2052}
2053
2054int ib_send_cm_drep(struct ib_cm_id *cm_id,
2055		    const void *private_data,
2056		    u8 private_data_len)
2057{
2058	struct cm_id_private *cm_id_priv;
2059	struct ib_mad_send_buf *msg;
2060	unsigned long flags;
2061	void *data;
2062	int ret;
2063
2064	if (private_data && private_data_len > IB_CM_DREP_PRIVATE_DATA_SIZE)
2065		return -EINVAL;
2066
2067	data = cm_copy_private_data(private_data, private_data_len);
2068	if (IS_ERR(data))
2069		return PTR_ERR(data);
2070
2071	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2072	spin_lock_irqsave(&cm_id_priv->lock, flags);
2073	if (cm_id->state != IB_CM_DREQ_RCVD) {
2074		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2075		kfree(data);
2076		return -EINVAL;
2077	}
2078
2079	cm_set_private_data(cm_id_priv, data, private_data_len);
2080	cm_enter_timewait(cm_id_priv);
2081
2082	ret = cm_alloc_msg(cm_id_priv, &msg);
2083	if (ret)
2084		goto out;
2085
2086	cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
2087		       private_data, private_data_len);
2088
2089	ret = ib_post_send_mad(msg, NULL);
2090	if (ret) {
2091		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2092		cm_free_msg(msg);
2093		return ret;
2094	}
2095
2096out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2097	return ret;
2098}
2099EXPORT_SYMBOL(ib_send_cm_drep);
2100
2101static int cm_issue_drep(struct cm_port *port,
2102			 struct ib_mad_recv_wc *mad_recv_wc)
2103{
2104	struct ib_mad_send_buf *msg = NULL;
2105	struct cm_dreq_msg *dreq_msg;
2106	struct cm_drep_msg *drep_msg;
2107	int ret;
2108
2109	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
2110	if (ret)
2111		return ret;
2112
2113	dreq_msg = (struct cm_dreq_msg *) mad_recv_wc->recv_buf.mad;
2114	drep_msg = (struct cm_drep_msg *) msg->mad;
2115
2116	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, dreq_msg->hdr.tid);
2117	drep_msg->remote_comm_id = dreq_msg->local_comm_id;
2118	drep_msg->local_comm_id = dreq_msg->remote_comm_id;
2119
2120	ret = ib_post_send_mad(msg, NULL);
2121	if (ret)
2122		cm_free_msg(msg);
2123
2124	return ret;
2125}
2126
2127static int cm_dreq_handler(struct cm_work *work)
2128{
2129	struct cm_id_private *cm_id_priv;
2130	struct cm_dreq_msg *dreq_msg;
2131	struct ib_mad_send_buf *msg = NULL;
2132	int ret;
2133
2134	dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
2135	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
2136				   dreq_msg->local_comm_id);
2137	if (!cm_id_priv) {
2138		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2139				counter[CM_DREQ_COUNTER]);
2140		cm_issue_drep(work->port, work->mad_recv_wc);
2141		return -EINVAL;
2142	}
2143
2144	work->cm_event.private_data = &dreq_msg->private_data;
2145
2146	spin_lock_irq(&cm_id_priv->lock);
2147	if (cm_id_priv->local_qpn != cm_dreq_get_remote_qpn(dreq_msg))
2148		goto unlock;
2149
2150	switch (cm_id_priv->id.state) {
2151	case IB_CM_REP_SENT:
2152	case IB_CM_DREQ_SENT:
2153		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2154		break;
2155	case IB_CM_ESTABLISHED:
2156		if (cm_id_priv->id.lap_state == IB_CM_LAP_SENT ||
2157		    cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
2158			ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2159		break;
2160	case IB_CM_MRA_REP_RCVD:
2161		break;
2162	case IB_CM_TIMEWAIT:
2163		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2164				counter[CM_DREQ_COUNTER]);
2165		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2166			goto unlock;
2167
2168		cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
2169			       cm_id_priv->private_data,
2170			       cm_id_priv->private_data_len);
2171		spin_unlock_irq(&cm_id_priv->lock);
2172
2173		if (ib_post_send_mad(msg, NULL))
2174			cm_free_msg(msg);
2175		goto deref;
2176	case IB_CM_DREQ_RCVD:
2177		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2178				counter[CM_DREQ_COUNTER]);
2179		goto unlock;
2180	default:
2181		goto unlock;
2182	}
2183	cm_id_priv->id.state = IB_CM_DREQ_RCVD;
2184	cm_id_priv->tid = dreq_msg->hdr.tid;
2185	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2186	if (!ret)
2187		list_add_tail(&work->list, &cm_id_priv->work_list);
2188	spin_unlock_irq(&cm_id_priv->lock);
2189
2190	if (ret)
2191		cm_process_work(cm_id_priv, work);
2192	else
2193		cm_deref_id(cm_id_priv);
2194	return 0;
2195
2196unlock:	spin_unlock_irq(&cm_id_priv->lock);
2197deref:	cm_deref_id(cm_id_priv);
2198	return -EINVAL;
2199}
2200
2201static int cm_drep_handler(struct cm_work *work)
2202{
2203	struct cm_id_private *cm_id_priv;
2204	struct cm_drep_msg *drep_msg;
2205	int ret;
2206
2207	drep_msg = (struct cm_drep_msg *)work->mad_recv_wc->recv_buf.mad;
2208	cm_id_priv = cm_acquire_id(drep_msg->remote_comm_id,
2209				   drep_msg->local_comm_id);
2210	if (!cm_id_priv)
2211		return -EINVAL;
2212
2213	work->cm_event.private_data = &drep_msg->private_data;
2214
2215	spin_lock_irq(&cm_id_priv->lock);
2216	if (cm_id_priv->id.state != IB_CM_DREQ_SENT &&
2217	    cm_id_priv->id.state != IB_CM_DREQ_RCVD) {
2218		spin_unlock_irq(&cm_id_priv->lock);
2219		goto out;
2220	}
2221	cm_enter_timewait(cm_id_priv);
2222
2223	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2224	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2225	if (!ret)
2226		list_add_tail(&work->list, &cm_id_priv->work_list);
2227	spin_unlock_irq(&cm_id_priv->lock);
2228
2229	if (ret)
2230		cm_process_work(cm_id_priv, work);
2231	else
2232		cm_deref_id(cm_id_priv);
2233	return 0;
2234out:
2235	cm_deref_id(cm_id_priv);
2236	return -EINVAL;
2237}
2238
2239int ib_send_cm_rej(struct ib_cm_id *cm_id,
2240		   enum ib_cm_rej_reason reason,
2241		   void *ari,
2242		   u8 ari_length,
2243		   const void *private_data,
2244		   u8 private_data_len)
2245{
2246	struct cm_id_private *cm_id_priv;
2247	struct ib_mad_send_buf *msg;
2248	unsigned long flags;
2249	int ret;
2250
2251	if ((private_data && private_data_len > IB_CM_REJ_PRIVATE_DATA_SIZE) ||
2252	    (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
2253		return -EINVAL;
2254
2255	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2256
2257	spin_lock_irqsave(&cm_id_priv->lock, flags);
2258	switch (cm_id->state) {
2259	case IB_CM_REQ_SENT:
2260	case IB_CM_MRA_REQ_RCVD:
2261	case IB_CM_REQ_RCVD:
2262	case IB_CM_MRA_REQ_SENT:
2263	case IB_CM_REP_RCVD:
2264	case IB_CM_MRA_REP_SENT:
2265		ret = cm_alloc_msg(cm_id_priv, &msg);
2266		if (!ret)
2267			cm_format_rej((struct cm_rej_msg *) msg->mad,
2268				      cm_id_priv, reason, ari, ari_length,
2269				      private_data, private_data_len);
2270
2271		cm_reset_to_idle(cm_id_priv);
2272		break;
2273	case IB_CM_REP_SENT:
2274	case IB_CM_MRA_REP_RCVD:
2275		ret = cm_alloc_msg(cm_id_priv, &msg);
2276		if (!ret)
2277			cm_format_rej((struct cm_rej_msg *) msg->mad,
2278				      cm_id_priv, reason, ari, ari_length,
2279				      private_data, private_data_len);
2280
2281		cm_enter_timewait(cm_id_priv);
2282		break;
2283	default:
2284		ret = -EINVAL;
2285		goto out;
2286	}
2287
2288	if (ret)
2289		goto out;
2290
2291	ret = ib_post_send_mad(msg, NULL);
2292	if (ret)
2293		cm_free_msg(msg);
2294
2295out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2296	return ret;
2297}
2298EXPORT_SYMBOL(ib_send_cm_rej);
2299
2300static void cm_format_rej_event(struct cm_work *work)
2301{
2302	struct cm_rej_msg *rej_msg;
2303	struct ib_cm_rej_event_param *param;
2304
2305	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2306	param = &work->cm_event.param.rej_rcvd;
2307	param->ari = rej_msg->ari;
2308	param->ari_length = cm_rej_get_reject_info_len(rej_msg);
2309	param->reason = __be16_to_cpu(rej_msg->reason);
2310	work->cm_event.private_data = &rej_msg->private_data;
2311}
2312
2313static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
2314{
2315	struct cm_timewait_info *timewait_info;
2316	struct cm_id_private *cm_id_priv;
2317	__be32 remote_id;
2318
2319	remote_id = rej_msg->local_comm_id;
2320
2321	if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_TIMEOUT) {
2322		spin_lock_irq(&cm.lock);
2323		timewait_info = cm_find_remote_id( *((__be64 *) rej_msg->ari),
2324						  remote_id);
2325		if (!timewait_info) {
2326			spin_unlock_irq(&cm.lock);
2327			return NULL;
2328		}
2329		cm_id_priv = idr_find(&cm.local_id_table, (__force int)
2330				      (timewait_info->work.local_id ^
2331				       cm.random_id_operand));
2332		if (cm_id_priv) {
2333			if (cm_id_priv->id.remote_id == remote_id)
2334				atomic_inc(&cm_id_priv->refcount);
2335			else
2336				cm_id_priv = NULL;
2337		}
2338		spin_unlock_irq(&cm.lock);
2339	} else if (cm_rej_get_msg_rejected(rej_msg) == CM_MSG_RESPONSE_REQ)
2340		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, 0);
2341	else
2342		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, remote_id);
2343
2344	return cm_id_priv;
2345}
2346
2347static int cm_rej_handler(struct cm_work *work)
2348{
2349	struct cm_id_private *cm_id_priv;
2350	struct cm_rej_msg *rej_msg;
2351	int ret;
2352
2353	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2354	cm_id_priv = cm_acquire_rejected_id(rej_msg);
2355	if (!cm_id_priv)
2356		return -EINVAL;
2357
2358	cm_format_rej_event(work);
2359
2360	spin_lock_irq(&cm_id_priv->lock);
2361	switch (cm_id_priv->id.state) {
2362	case IB_CM_REQ_SENT:
2363	case IB_CM_MRA_REQ_RCVD:
2364	case IB_CM_REP_SENT:
2365	case IB_CM_MRA_REP_RCVD:
2366		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2367		/* fall through */
2368	case IB_CM_REQ_RCVD:
2369	case IB_CM_MRA_REQ_SENT:
2370		if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_STALE_CONN)
2371			cm_enter_timewait(cm_id_priv);
2372		else
2373			cm_reset_to_idle(cm_id_priv);
2374		break;
2375	case IB_CM_DREQ_SENT:
2376		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2377		/* fall through */
2378	case IB_CM_REP_RCVD:
2379	case IB_CM_MRA_REP_SENT:
2380		cm_enter_timewait(cm_id_priv);
2381		break;
2382	case IB_CM_ESTABLISHED:
2383		if (cm_id_priv->id.lap_state == IB_CM_LAP_UNINIT ||
2384		    cm_id_priv->id.lap_state == IB_CM_LAP_SENT) {
2385			if (cm_id_priv->id.lap_state == IB_CM_LAP_SENT)
2386				ib_cancel_mad(cm_id_priv->av.port->mad_agent,
2387					      cm_id_priv->msg);
2388			cm_enter_timewait(cm_id_priv);
2389			break;
2390		}
2391		/* fall through */
2392	default:
2393		spin_unlock_irq(&cm_id_priv->lock);
2394		ret = -EINVAL;
2395		goto out;
2396	}
2397
2398	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2399	if (!ret)
2400		list_add_tail(&work->list, &cm_id_priv->work_list);
2401	spin_unlock_irq(&cm_id_priv->lock);
2402
2403	if (ret)
2404		cm_process_work(cm_id_priv, work);
2405	else
2406		cm_deref_id(cm_id_priv);
2407	return 0;
2408out:
2409	cm_deref_id(cm_id_priv);
2410	return -EINVAL;
2411}
2412
2413int ib_send_cm_mra(struct ib_cm_id *cm_id,
2414		   u8 service_timeout,
2415		   const void *private_data,
2416		   u8 private_data_len)
2417{
2418	struct cm_id_private *cm_id_priv;
2419	struct ib_mad_send_buf *msg;
2420	enum ib_cm_state cm_state;
2421	enum ib_cm_lap_state lap_state;
2422	enum cm_msg_response msg_response;
2423	void *data;
2424	unsigned long flags;
2425	int ret;
2426
2427	if (private_data && private_data_len > IB_CM_MRA_PRIVATE_DATA_SIZE)
2428		return -EINVAL;
2429
2430	data = cm_copy_private_data(private_data, private_data_len);
2431	if (IS_ERR(data))
2432		return PTR_ERR(data);
2433
2434	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2435
2436	spin_lock_irqsave(&cm_id_priv->lock, flags);
2437	switch(cm_id_priv->id.state) {
2438	case IB_CM_REQ_RCVD:
2439		cm_state = IB_CM_MRA_REQ_SENT;
2440		lap_state = cm_id->lap_state;
2441		msg_response = CM_MSG_RESPONSE_REQ;
2442		break;
2443	case IB_CM_REP_RCVD:
2444		cm_state = IB_CM_MRA_REP_SENT;
2445		lap_state = cm_id->lap_state;
2446		msg_response = CM_MSG_RESPONSE_REP;
2447		break;
2448	case IB_CM_ESTABLISHED:
2449		if (cm_id->lap_state == IB_CM_LAP_RCVD) {
2450			cm_state = cm_id->state;
2451			lap_state = IB_CM_MRA_LAP_SENT;
2452			msg_response = CM_MSG_RESPONSE_OTHER;
2453			break;
2454		}
2455	default:
2456		ret = -EINVAL;
2457		goto error1;
2458	}
2459
2460	if (!(service_timeout & IB_CM_MRA_FLAG_DELAY)) {
2461		ret = cm_alloc_msg(cm_id_priv, &msg);
2462		if (ret)
2463			goto error1;
2464
2465		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2466			      msg_response, service_timeout,
2467			      private_data, private_data_len);
2468		ret = ib_post_send_mad(msg, NULL);
2469		if (ret)
2470			goto error2;
2471	}
2472
2473	cm_id->state = cm_state;
2474	cm_id->lap_state = lap_state;
2475	cm_id_priv->service_timeout = service_timeout;
2476	cm_set_private_data(cm_id_priv, data, private_data_len);
2477	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2478	return 0;
2479
2480error1:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2481	kfree(data);
2482	return ret;
2483
2484error2:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2485	kfree(data);
2486	cm_free_msg(msg);
2487	return ret;
2488}
2489EXPORT_SYMBOL(ib_send_cm_mra);
2490
2491static struct cm_id_private * cm_acquire_mraed_id(struct cm_mra_msg *mra_msg)
2492{
2493	switch (cm_mra_get_msg_mraed(mra_msg)) {
2494	case CM_MSG_RESPONSE_REQ:
2495		return cm_acquire_id(mra_msg->remote_comm_id, 0);
2496	case CM_MSG_RESPONSE_REP:
2497	case CM_MSG_RESPONSE_OTHER:
2498		return cm_acquire_id(mra_msg->remote_comm_id,
2499				     mra_msg->local_comm_id);
2500	default:
2501		return NULL;
2502	}
2503}
2504
2505static int cm_mra_handler(struct cm_work *work)
2506{
2507	struct cm_id_private *cm_id_priv;
2508	struct cm_mra_msg *mra_msg;
2509	int timeout, ret;
2510
2511	mra_msg = (struct cm_mra_msg *)work->mad_recv_wc->recv_buf.mad;
2512	cm_id_priv = cm_acquire_mraed_id(mra_msg);
2513	if (!cm_id_priv)
2514		return -EINVAL;
2515
2516	work->cm_event.private_data = &mra_msg->private_data;
2517	work->cm_event.param.mra_rcvd.service_timeout =
2518					cm_mra_get_service_timeout(mra_msg);
2519	timeout = cm_convert_to_ms(cm_mra_get_service_timeout(mra_msg)) +
2520		  cm_convert_to_ms(cm_id_priv->av.timeout);
2521
2522	spin_lock_irq(&cm_id_priv->lock);
2523	switch (cm_id_priv->id.state) {
2524	case IB_CM_REQ_SENT:
2525		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REQ ||
2526		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2527				  cm_id_priv->msg, timeout))
2528			goto out;
2529		cm_id_priv->id.state = IB_CM_MRA_REQ_RCVD;
2530		break;
2531	case IB_CM_REP_SENT:
2532		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REP ||
2533		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2534				  cm_id_priv->msg, timeout))
2535			goto out;
2536		cm_id_priv->id.state = IB_CM_MRA_REP_RCVD;
2537		break;
2538	case IB_CM_ESTABLISHED:
2539		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_OTHER ||
2540		    cm_id_priv->id.lap_state != IB_CM_LAP_SENT ||
2541		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2542				  cm_id_priv->msg, timeout)) {
2543			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
2544				atomic_long_inc(&work->port->
2545						counter_group[CM_RECV_DUPLICATES].
2546						counter[CM_MRA_COUNTER]);
2547			goto out;
2548		}
2549		cm_id_priv->id.lap_state = IB_CM_MRA_LAP_RCVD;
2550		break;
2551	case IB_CM_MRA_REQ_RCVD:
2552	case IB_CM_MRA_REP_RCVD:
2553		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2554				counter[CM_MRA_COUNTER]);
2555		/* fall through */
2556	default:
2557		goto out;
2558	}
2559
2560	cm_id_priv->msg->context[1] = (void *) (unsigned long)
2561				      cm_id_priv->id.state;
2562	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2563	if (!ret)
2564		list_add_tail(&work->list, &cm_id_priv->work_list);
2565	spin_unlock_irq(&cm_id_priv->lock);
2566
2567	if (ret)
2568		cm_process_work(cm_id_priv, work);
2569	else
2570		cm_deref_id(cm_id_priv);
2571	return 0;
2572out:
2573	spin_unlock_irq(&cm_id_priv->lock);
2574	cm_deref_id(cm_id_priv);
2575	return -EINVAL;
2576}
2577
2578static void cm_format_lap(struct cm_lap_msg *lap_msg,
2579			  struct cm_id_private *cm_id_priv,
2580			  struct ib_sa_path_rec *alternate_path,
2581			  const void *private_data,
2582			  u8 private_data_len)
2583{
2584	cm_format_mad_hdr(&lap_msg->hdr, CM_LAP_ATTR_ID,
2585			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_LAP));
2586	lap_msg->local_comm_id = cm_id_priv->id.local_id;
2587	lap_msg->remote_comm_id = cm_id_priv->id.remote_id;
2588	cm_lap_set_remote_qpn(lap_msg, cm_id_priv->remote_qpn);
2589	/* todo: need remote CM response timeout */
2590	cm_lap_set_remote_resp_timeout(lap_msg, 0x1F);
2591	lap_msg->alt_local_lid = alternate_path->slid;
2592	lap_msg->alt_remote_lid = alternate_path->dlid;
2593	lap_msg->alt_local_gid = alternate_path->sgid;
2594	lap_msg->alt_remote_gid = alternate_path->dgid;
2595	cm_lap_set_flow_label(lap_msg, alternate_path->flow_label);
2596	cm_lap_set_traffic_class(lap_msg, alternate_path->traffic_class);
2597	lap_msg->alt_hop_limit = alternate_path->hop_limit;
2598	cm_lap_set_packet_rate(lap_msg, alternate_path->rate);
2599	cm_lap_set_sl(lap_msg, alternate_path->sl);
2600	cm_lap_set_subnet_local(lap_msg, 1); /* local only... */
2601	cm_lap_set_local_ack_timeout(lap_msg,
2602		cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
2603			       alternate_path->packet_life_time));
2604
2605	if (private_data && private_data_len)
2606		memcpy(lap_msg->private_data, private_data, private_data_len);
2607}
2608
2609int ib_send_cm_lap(struct ib_cm_id *cm_id,
2610		   struct ib_sa_path_rec *alternate_path,
2611		   const void *private_data,
2612		   u8 private_data_len)
2613{
2614	struct cm_id_private *cm_id_priv;
2615	struct ib_mad_send_buf *msg;
2616	unsigned long flags;
2617	int ret;
2618
2619	if (private_data && private_data_len > IB_CM_LAP_PRIVATE_DATA_SIZE)
2620		return -EINVAL;
2621
2622	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2623	spin_lock_irqsave(&cm_id_priv->lock, flags);
2624	if (cm_id->state != IB_CM_ESTABLISHED ||
2625	    (cm_id->lap_state != IB_CM_LAP_UNINIT &&
2626	     cm_id->lap_state != IB_CM_LAP_IDLE)) {
2627		ret = -EINVAL;
2628		goto out;
2629	}
2630
2631	ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
2632	if (ret)
2633		goto out;
2634	cm_id_priv->alt_av.timeout =
2635			cm_ack_timeout(cm_id_priv->target_ack_delay,
2636				       cm_id_priv->alt_av.timeout - 1);
2637
2638	ret = cm_alloc_msg(cm_id_priv, &msg);
2639	if (ret)
2640		goto out;
2641
2642	cm_format_lap((struct cm_lap_msg *) msg->mad, cm_id_priv,
2643		      alternate_path, private_data, private_data_len);
2644	msg->timeout_ms = cm_id_priv->timeout_ms;
2645	msg->context[1] = (void *) (unsigned long) IB_CM_ESTABLISHED;
2646
2647	ret = ib_post_send_mad(msg, NULL);
2648	if (ret) {
2649		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2650		cm_free_msg(msg);
2651		return ret;
2652	}
2653
2654	cm_id->lap_state = IB_CM_LAP_SENT;
2655	cm_id_priv->msg = msg;
2656
2657out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2658	return ret;
2659}
2660EXPORT_SYMBOL(ib_send_cm_lap);
2661
2662static void cm_format_path_from_lap(struct cm_id_private *cm_id_priv,
2663				    struct ib_sa_path_rec *path,
2664				    struct cm_lap_msg *lap_msg)
2665{
2666	memset(path, 0, sizeof *path);
2667	path->dgid = lap_msg->alt_local_gid;
2668	path->sgid = lap_msg->alt_remote_gid;
2669	path->dlid = lap_msg->alt_local_lid;
2670	path->slid = lap_msg->alt_remote_lid;
2671	path->flow_label = cm_lap_get_flow_label(lap_msg);
2672	path->hop_limit = lap_msg->alt_hop_limit;
2673	path->traffic_class = cm_lap_get_traffic_class(lap_msg);
2674	path->reversible = 1;
2675	path->pkey = cm_id_priv->pkey;
2676	path->sl = cm_lap_get_sl(lap_msg);
2677	path->mtu_selector = IB_SA_EQ;
2678	path->mtu = cm_id_priv->path_mtu;
2679	path->rate_selector = IB_SA_EQ;
2680	path->rate = cm_lap_get_packet_rate(lap_msg);
2681	path->packet_life_time_selector = IB_SA_EQ;
2682	path->packet_life_time = cm_lap_get_local_ack_timeout(lap_msg);
2683	path->packet_life_time -= (path->packet_life_time > 0);
2684}
2685
2686static int cm_lap_handler(struct cm_work *work)
2687{
2688	struct cm_id_private *cm_id_priv;
2689	struct cm_lap_msg *lap_msg;
2690	struct ib_cm_lap_event_param *param;
2691	struct ib_mad_send_buf *msg = NULL;
2692	int ret;
2693
2694	/* todo: verify LAP request and send reject APR if invalid. */
2695	lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;
2696	cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,
2697				   lap_msg->local_comm_id);
2698	if (!cm_id_priv)
2699		return -EINVAL;
2700
2701	param = &work->cm_event.param.lap_rcvd;
2702	param->alternate_path = &work->path[0];
2703	cm_format_path_from_lap(cm_id_priv, param->alternate_path, lap_msg);
2704	work->cm_event.private_data = &lap_msg->private_data;
2705
2706	spin_lock_irq(&cm_id_priv->lock);
2707	if (cm_id_priv->id.state != IB_CM_ESTABLISHED)
2708		goto unlock;
2709
2710	switch (cm_id_priv->id.lap_state) {
2711	case IB_CM_LAP_UNINIT:
2712	case IB_CM_LAP_IDLE:
2713		break;
2714	case IB_CM_MRA_LAP_SENT:
2715		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2716				counter[CM_LAP_COUNTER]);
2717		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2718			goto unlock;
2719
2720		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2721			      CM_MSG_RESPONSE_OTHER,
2722			      cm_id_priv->service_timeout,
2723			      cm_id_priv->private_data,
2724			      cm_id_priv->private_data_len);
2725		spin_unlock_irq(&cm_id_priv->lock);
2726
2727		if (ib_post_send_mad(msg, NULL))
2728			cm_free_msg(msg);
2729		goto deref;
2730	case IB_CM_LAP_RCVD:
2731		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2732				counter[CM_LAP_COUNTER]);
2733		goto unlock;
2734	default:
2735		goto unlock;
2736	}
2737
2738	cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
2739	cm_id_priv->tid = lap_msg->hdr.tid;
2740	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
2741				work->mad_recv_wc->recv_buf.grh,
2742				&cm_id_priv->av);
2743	cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
2744	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2745	if (!ret)
2746		list_add_tail(&work->list, &cm_id_priv->work_list);
2747	spin_unlock_irq(&cm_id_priv->lock);
2748
2749	if (ret)
2750		cm_process_work(cm_id_priv, work);
2751	else
2752		cm_deref_id(cm_id_priv);
2753	return 0;
2754
2755unlock:	spin_unlock_irq(&cm_id_priv->lock);
2756deref:	cm_deref_id(cm_id_priv);
2757	return -EINVAL;
2758}
2759
2760static void cm_format_apr(struct cm_apr_msg *apr_msg,
2761			  struct cm_id_private *cm_id_priv,
2762			  enum ib_cm_apr_status status,
2763			  void *info,
2764			  u8 info_length,
2765			  const void *private_data,
2766			  u8 private_data_len)
2767{
2768	cm_format_mad_hdr(&apr_msg->hdr, CM_APR_ATTR_ID, cm_id_priv->tid);
2769	apr_msg->local_comm_id = cm_id_priv->id.local_id;
2770	apr_msg->remote_comm_id = cm_id_priv->id.remote_id;
2771	apr_msg->ap_status = (u8) status;
2772
2773	if (info && info_length) {
2774		apr_msg->info_length = info_length;
2775		memcpy(apr_msg->info, info, info_length);
2776	}
2777
2778	if (private_data && private_data_len)
2779		memcpy(apr_msg->private_data, private_data, private_data_len);
2780}
2781
2782int ib_send_cm_apr(struct ib_cm_id *cm_id,
2783		   enum ib_cm_apr_status status,
2784		   void *info,
2785		   u8 info_length,
2786		   const void *private_data,
2787		   u8 private_data_len)
2788{
2789	struct cm_id_private *cm_id_priv;
2790	struct ib_mad_send_buf *msg;
2791	unsigned long flags;
2792	int ret;
2793
2794	if ((private_data && private_data_len > IB_CM_APR_PRIVATE_DATA_SIZE) ||
2795	    (info && info_length > IB_CM_APR_INFO_LENGTH))
2796		return -EINVAL;
2797
2798	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2799	spin_lock_irqsave(&cm_id_priv->lock, flags);
2800	if (cm_id->state != IB_CM_ESTABLISHED ||
2801	    (cm_id->lap_state != IB_CM_LAP_RCVD &&
2802	     cm_id->lap_state != IB_CM_MRA_LAP_SENT)) {
2803		ret = -EINVAL;
2804		goto out;
2805	}
2806
2807	ret = cm_alloc_msg(cm_id_priv, &msg);
2808	if (ret)
2809		goto out;
2810
2811	cm_format_apr((struct cm_apr_msg *) msg->mad, cm_id_priv, status,
2812		      info, info_length, private_data, private_data_len);
2813	ret = ib_post_send_mad(msg, NULL);
2814	if (ret) {
2815		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2816		cm_free_msg(msg);
2817		return ret;
2818	}
2819
2820	cm_id->lap_state = IB_CM_LAP_IDLE;
2821out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2822	return ret;
2823}
2824EXPORT_SYMBOL(ib_send_cm_apr);
2825
2826static int cm_apr_handler(struct cm_work *work)
2827{
2828	struct cm_id_private *cm_id_priv;
2829	struct cm_apr_msg *apr_msg;
2830	int ret;
2831
2832	apr_msg = (struct cm_apr_msg *)work->mad_recv_wc->recv_buf.mad;
2833	cm_id_priv = cm_acquire_id(apr_msg->remote_comm_id,
2834				   apr_msg->local_comm_id);
2835	if (!cm_id_priv)
2836		return -EINVAL; /* Unmatched reply. */
2837
2838	work->cm_event.param.apr_rcvd.ap_status = apr_msg->ap_status;
2839	work->cm_event.param.apr_rcvd.apr_info = &apr_msg->info;
2840	work->cm_event.param.apr_rcvd.info_len = apr_msg->info_length;
2841	work->cm_event.private_data = &apr_msg->private_data;
2842
2843	spin_lock_irq(&cm_id_priv->lock);
2844	if (cm_id_priv->id.state != IB_CM_ESTABLISHED ||
2845	    (cm_id_priv->id.lap_state != IB_CM_LAP_SENT &&
2846	     cm_id_priv->id.lap_state != IB_CM_MRA_LAP_RCVD)) {
2847		spin_unlock_irq(&cm_id_priv->lock);
2848		goto out;
2849	}
2850	cm_id_priv->id.lap_state = IB_CM_LAP_IDLE;
2851	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2852	cm_id_priv->msg = NULL;
2853
2854	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2855	if (!ret)
2856		list_add_tail(&work->list, &cm_id_priv->work_list);
2857	spin_unlock_irq(&cm_id_priv->lock);
2858
2859	if (ret)
2860		cm_process_work(cm_id_priv, work);
2861	else
2862		cm_deref_id(cm_id_priv);
2863	return 0;
2864out:
2865	cm_deref_id(cm_id_priv);
2866	return -EINVAL;
2867}
2868
2869static int cm_timewait_handler(struct cm_work *work)
2870{
2871	struct cm_timewait_info *timewait_info;
2872	struct cm_id_private *cm_id_priv;
2873	int ret;
2874
2875	timewait_info = (struct cm_timewait_info *)work;
2876	spin_lock_irq(&cm.lock);
2877	list_del(&timewait_info->list);
2878	spin_unlock_irq(&cm.lock);
2879
2880	cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
2881				   timewait_info->work.remote_id);
2882	if (!cm_id_priv)
2883		return -EINVAL;
2884
2885	spin_lock_irq(&cm_id_priv->lock);
2886	if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
2887	    cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
2888		spin_unlock_irq(&cm_id_priv->lock);
2889		goto out;
2890	}
2891	cm_id_priv->id.state = IB_CM_IDLE;
2892	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2893	if (!ret)
2894		list_add_tail(&work->list, &cm_id_priv->work_list);
2895	spin_unlock_irq(&cm_id_priv->lock);
2896
2897	if (ret)
2898		cm_process_work(cm_id_priv, work);
2899	else
2900		cm_deref_id(cm_id_priv);
2901	return 0;
2902out:
2903	cm_deref_id(cm_id_priv);
2904	return -EINVAL;
2905}
2906
2907static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
2908			       struct cm_id_private *cm_id_priv,
2909			       struct ib_cm_sidr_req_param *param)
2910{
2911	cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
2912			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
2913	sidr_req_msg->request_id = cm_id_priv->id.local_id;
2914	sidr_req_msg->pkey = param->path->pkey;
2915	sidr_req_msg->service_id = param->service_id;
2916
2917	if (param->private_data && param->private_data_len)
2918		memcpy(sidr_req_msg->private_data, param->private_data,
2919		       param->private_data_len);
2920}
2921
2922int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
2923			struct ib_cm_sidr_req_param *param)
2924{
2925	struct cm_id_private *cm_id_priv;
2926	struct ib_mad_send_buf *msg;
2927	unsigned long flags;
2928	int ret;
2929
2930	if (!param->path || (param->private_data &&
2931	     param->private_data_len > IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE))
2932		return -EINVAL;
2933
2934	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2935	ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
2936	if (ret)
2937		goto out;
2938
2939	cm_id->service_id = param->service_id;
2940	cm_id->service_mask = ~cpu_to_be64(0);
2941	cm_id_priv->timeout_ms = param->timeout_ms;
2942	cm_id_priv->max_cm_retries = param->max_cm_retries;
2943	ret = cm_alloc_msg(cm_id_priv, &msg);
2944	if (ret)
2945		goto out;
2946
2947	cm_format_sidr_req((struct cm_sidr_req_msg *) msg->mad, cm_id_priv,
2948			   param);
2949	msg->timeout_ms = cm_id_priv->timeout_ms;
2950	msg->context[1] = (void *) (unsigned long) IB_CM_SIDR_REQ_SENT;
2951
2952	spin_lock_irqsave(&cm_id_priv->lock, flags);
2953	if (cm_id->state == IB_CM_IDLE)
2954		ret = ib_post_send_mad(msg, NULL);
2955	else
2956		ret = -EINVAL;
2957
2958	if (ret) {
2959		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2960		cm_free_msg(msg);
2961		goto out;
2962	}
2963	cm_id->state = IB_CM_SIDR_REQ_SENT;
2964	cm_id_priv->msg = msg;
2965	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2966out:
2967	return ret;
2968}
2969EXPORT_SYMBOL(ib_send_cm_sidr_req);
2970
2971static void cm_format_sidr_req_event(struct cm_work *work,
2972				     struct ib_cm_id *listen_id)
2973{
2974	struct cm_sidr_req_msg *sidr_req_msg;
2975	struct ib_cm_sidr_req_event_param *param;
2976
2977	sidr_req_msg = (struct cm_sidr_req_msg *)
2978				work->mad_recv_wc->recv_buf.mad;
2979	param = &work->cm_event.param.sidr_req_rcvd;
2980	param->pkey = __be16_to_cpu(sidr_req_msg->pkey);
2981	param->listen_id = listen_id;
2982	param->port = work->port->port_num;
2983	work->cm_event.private_data = &sidr_req_msg->private_data;
2984}
2985
2986static int cm_sidr_req_handler(struct cm_work *work)
2987{
2988	struct ib_cm_id *cm_id;
2989	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
2990	struct cm_sidr_req_msg *sidr_req_msg;
2991	struct ib_wc *wc;
2992
2993	cm_id = ib_create_cm_id(work->port->cm_dev->ib_device, NULL, NULL);
2994	if (IS_ERR(cm_id))
2995		return PTR_ERR(cm_id);
2996	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2997
2998	/* Record SGID/SLID and request ID for lookup. */
2999	sidr_req_msg = (struct cm_sidr_req_msg *)
3000				work->mad_recv_wc->recv_buf.mad;
3001	wc = work->mad_recv_wc->wc;
3002	cm_id_priv->av.dgid.global.subnet_prefix = cpu_to_be64(wc->slid);
3003	cm_id_priv->av.dgid.global.interface_id = 0;
3004	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
3005				work->mad_recv_wc->recv_buf.grh,
3006				&cm_id_priv->av);
3007	cm_id_priv->id.remote_id = sidr_req_msg->request_id;
3008	cm_id_priv->tid = sidr_req_msg->hdr.tid;
3009	atomic_inc(&cm_id_priv->work_count);
3010
3011	spin_lock_irq(&cm.lock);
3012	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
3013	if (cur_cm_id_priv) {
3014		spin_unlock_irq(&cm.lock);
3015		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
3016				counter[CM_SIDR_REQ_COUNTER]);
3017		goto out; /* Duplicate message. */
3018	}
3019	cm_id_priv->id.state = IB_CM_SIDR_REQ_RCVD;
3020	cur_cm_id_priv = cm_find_listen(cm_id->device,
3021					sidr_req_msg->service_id,
3022					sidr_req_msg->private_data);
3023	if (!cur_cm_id_priv) {
3024		spin_unlock_irq(&cm.lock);
3025		cm_reject_sidr_req(cm_id_priv, IB_SIDR_UNSUPPORTED);
3026		goto out; /* No match. */
3027	}
3028	atomic_inc(&cur_cm_id_priv->refcount);
3029	atomic_inc(&cm_id_priv->refcount);
3030	spin_unlock_irq(&cm.lock);
3031
3032	cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
3033	cm_id_priv->id.context = cur_cm_id_priv->id.context;
3034	cm_id_priv->id.service_id = sidr_req_msg->service_id;
3035	cm_id_priv->id.service_mask = ~cpu_to_be64(0);
3036
3037	cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
3038	cm_process_work(cm_id_priv, work);
3039	cm_deref_id(cur_cm_id_priv);
3040	return 0;
3041out:
3042	ib_destroy_cm_id(&cm_id_priv->id);
3043	return -EINVAL;
3044}
3045
3046static void cm_format_sidr_rep(struct cm_sidr_rep_msg *sidr_rep_msg,
3047			       struct cm_id_private *cm_id_priv,
3048			       struct ib_cm_sidr_rep_param *param)
3049{
3050	cm_format_mad_hdr(&sidr_rep_msg->hdr, CM_SIDR_REP_ATTR_ID,
3051			  cm_id_priv->tid);
3052	sidr_rep_msg->request_id = cm_id_priv->id.remote_id;
3053	sidr_rep_msg->status = param->status;
3054	cm_sidr_rep_set_qpn(sidr_rep_msg, cpu_to_be32(param->qp_num));
3055	sidr_rep_msg->service_id = cm_id_priv->id.service_id;
3056	sidr_rep_msg->qkey = cpu_to_be32(param->qkey);
3057
3058	if (param->info && param->info_length)
3059		memcpy(sidr_rep_msg->info, param->info, param->info_length);
3060
3061	if (param->private_data && param->private_data_len)
3062		memcpy(sidr_rep_msg->private_data, param->private_data,
3063		       param->private_data_len);
3064}
3065
3066int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
3067			struct ib_cm_sidr_rep_param *param)
3068{
3069	struct cm_id_private *cm_id_priv;
3070	struct ib_mad_send_buf *msg;
3071	unsigned long flags;
3072	int ret;
3073
3074	if ((param->info && param->info_length > IB_CM_SIDR_REP_INFO_LENGTH) ||
3075	    (param->private_data &&
3076	     param->private_data_len > IB_CM_SIDR_REP_PRIVATE_DATA_SIZE))
3077		return -EINVAL;
3078
3079	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3080	spin_lock_irqsave(&cm_id_priv->lock, flags);
3081	if (cm_id->state != IB_CM_SIDR_REQ_RCVD) {
3082		ret = -EINVAL;
3083		goto error;
3084	}
3085
3086	ret = cm_alloc_msg(cm_id_priv, &msg);
3087	if (ret)
3088		goto error;
3089
3090	cm_format_sidr_rep((struct cm_sidr_rep_msg *) msg->mad, cm_id_priv,
3091			   param);
3092	ret = ib_post_send_mad(msg, NULL);
3093	if (ret) {
3094		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3095		cm_free_msg(msg);
3096		return ret;
3097	}
3098	cm_id->state = IB_CM_IDLE;
3099	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3100
3101	spin_lock_irqsave(&cm.lock, flags);
3102	rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
3103	spin_unlock_irqrestore(&cm.lock, flags);
3104	return 0;
3105
3106error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3107	return ret;
3108}
3109EXPORT_SYMBOL(ib_send_cm_sidr_rep);
3110
3111static void cm_format_sidr_rep_event(struct cm_work *work)
3112{
3113	struct cm_sidr_rep_msg *sidr_rep_msg;
3114	struct ib_cm_sidr_rep_event_param *param;
3115
3116	sidr_rep_msg = (struct cm_sidr_rep_msg *)
3117				work->mad_recv_wc->recv_buf.mad;
3118	param = &work->cm_event.param.sidr_rep_rcvd;
3119	param->status = sidr_rep_msg->status;
3120	param->qkey = be32_to_cpu(sidr_rep_msg->qkey);
3121	param->qpn = be32_to_cpu(cm_sidr_rep_get_qpn(sidr_rep_msg));
3122	param->info = &sidr_rep_msg->info;
3123	param->info_len = sidr_rep_msg->info_length;
3124	work->cm_event.private_data = &sidr_rep_msg->private_data;
3125}
3126
3127static int cm_sidr_rep_handler(struct cm_work *work)
3128{
3129	struct cm_sidr_rep_msg *sidr_rep_msg;
3130	struct cm_id_private *cm_id_priv;
3131
3132	sidr_rep_msg = (struct cm_sidr_rep_msg *)
3133				work->mad_recv_wc->recv_buf.mad;
3134	cm_id_priv = cm_acquire_id(sidr_rep_msg->request_id, 0);
3135	if (!cm_id_priv)
3136		return -EINVAL; /* Unmatched reply. */
3137
3138	spin_lock_irq(&cm_id_priv->lock);
3139	if (cm_id_priv->id.state != IB_CM_SIDR_REQ_SENT) {
3140		spin_unlock_irq(&cm_id_priv->lock);
3141		goto out;
3142	}
3143	cm_id_priv->id.state = IB_CM_IDLE;
3144	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
3145	spin_unlock_irq(&cm_id_priv->lock);
3146
3147	cm_format_sidr_rep_event(work);
3148	cm_process_work(cm_id_priv, work);
3149	return 0;
3150out:
3151	cm_deref_id(cm_id_priv);
3152	return -EINVAL;
3153}
3154
3155static void cm_process_send_error(struct ib_mad_send_buf *msg,
3156				  enum ib_wc_status wc_status)
3157{
3158	struct cm_id_private *cm_id_priv;
3159	struct ib_cm_event cm_event;
3160	enum ib_cm_state state;
3161	int ret;
3162
3163	memset(&cm_event, 0, sizeof cm_event);
3164	cm_id_priv = msg->context[0];
3165
3166	/* Discard old sends or ones without a response. */
3167	spin_lock_irq(&cm_id_priv->lock);
3168	state = (enum ib_cm_state) (unsigned long) msg->context[1];
3169	if (msg != cm_id_priv->msg || state != cm_id_priv->id.state)
3170		goto discard;
3171
3172	switch (state) {
3173	case IB_CM_REQ_SENT:
3174	case IB_CM_MRA_REQ_RCVD:
3175		cm_reset_to_idle(cm_id_priv);
3176		cm_event.event = IB_CM_REQ_ERROR;
3177		break;
3178	case IB_CM_REP_SENT:
3179	case IB_CM_MRA_REP_RCVD:
3180		cm_reset_to_idle(cm_id_priv);
3181		cm_event.event = IB_CM_REP_ERROR;
3182		break;
3183	case IB_CM_DREQ_SENT:
3184		cm_enter_timewait(cm_id_priv);
3185		cm_event.event = IB_CM_DREQ_ERROR;
3186		break;
3187	case IB_CM_SIDR_REQ_SENT:
3188		cm_id_priv->id.state = IB_CM_IDLE;
3189		cm_event.event = IB_CM_SIDR_REQ_ERROR;
3190		break;
3191	default:
3192		goto discard;
3193	}
3194	spin_unlock_irq(&cm_id_priv->lock);
3195	cm_event.param.send_status = wc_status;
3196
3197	/* No other events can occur on the cm_id at this point. */
3198	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &cm_event);
3199	cm_free_msg(msg);
3200	if (ret)
3201		ib_destroy_cm_id(&cm_id_priv->id);
3202	return;
3203discard:
3204	spin_unlock_irq(&cm_id_priv->lock);
3205	cm_free_msg(msg);
3206}
3207
3208static void cm_send_handler(struct ib_mad_agent *mad_agent,
3209			    struct ib_mad_send_wc *mad_send_wc)
3210{
3211	struct ib_mad_send_buf *msg = mad_send_wc->send_buf;
3212	struct cm_port *port;
3213	u16 attr_index;
3214
3215	port = mad_agent->context;
3216	attr_index = be16_to_cpu(((struct ib_mad_hdr *)
3217				  msg->mad)->attr_id) - CM_ATTR_ID_OFFSET;
3218
3219	/*
3220	 * If the send was in response to a received message (context[0] is not
3221	 * set to a cm_id), and is not a REJ, then it is a send that was
3222	 * manually retried.
3223	 */
3224	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
3225		msg->retries = 1;
3226
3227	atomic_long_add(1 + msg->retries,
3228			&port->counter_group[CM_XMIT].counter[attr_index]);
3229	if (msg->retries)
3230		atomic_long_add(msg->retries,
3231				&port->counter_group[CM_XMIT_RETRIES].
3232				counter[attr_index]);
3233
3234	switch (mad_send_wc->status) {
3235	case IB_WC_SUCCESS:
3236	case IB_WC_WR_FLUSH_ERR:
3237		cm_free_msg(msg);
3238		break;
3239	default:
3240		if (msg->context[0] && msg->context[1])
3241			cm_process_send_error(msg, mad_send_wc->status);
3242		else
3243			cm_free_msg(msg);
3244		break;
3245	}
3246}
3247
3248static void cm_work_handler(struct work_struct *_work)
3249{
3250	struct cm_work *work = container_of(_work, struct cm_work, work.work);
3251	int ret;
3252
3253	switch (work->cm_event.event) {
3254	case IB_CM_REQ_RECEIVED:
3255		ret = cm_req_handler(work);
3256		break;
3257	case IB_CM_MRA_RECEIVED:
3258		ret = cm_mra_handler(work);
3259		break;
3260	case IB_CM_REJ_RECEIVED:
3261		ret = cm_rej_handler(work);
3262		break;
3263	case IB_CM_REP_RECEIVED:
3264		ret = cm_rep_handler(work);
3265		break;
3266	case IB_CM_RTU_RECEIVED:
3267		ret = cm_rtu_handler(work);
3268		break;
3269	case IB_CM_USER_ESTABLISHED:
3270		ret = cm_establish_handler(work);
3271		break;
3272	case IB_CM_DREQ_RECEIVED:
3273		ret = cm_dreq_handler(work);
3274		break;
3275	case IB_CM_DREP_RECEIVED:
3276		ret = cm_drep_handler(work);
3277		break;
3278	case IB_CM_SIDR_REQ_RECEIVED:
3279		ret = cm_sidr_req_handler(work);
3280		break;
3281	case IB_CM_SIDR_REP_RECEIVED:
3282		ret = cm_sidr_rep_handler(work);
3283		break;
3284	case IB_CM_LAP_RECEIVED:
3285		ret = cm_lap_handler(work);
3286		break;
3287	case IB_CM_APR_RECEIVED:
3288		ret = cm_apr_handler(work);
3289		break;
3290	case IB_CM_TIMEWAIT_EXIT:
3291		ret = cm_timewait_handler(work);
3292		break;
3293	default:
3294		ret = -EINVAL;
3295		break;
3296	}
3297	if (ret)
3298		cm_free_work(work);
3299}
3300
3301static int cm_establish(struct ib_cm_id *cm_id)
3302{
3303	struct cm_id_private *cm_id_priv;
3304	struct cm_work *work;
3305	unsigned long flags;
3306	int ret = 0;
3307
3308	work = kmalloc(sizeof *work, GFP_ATOMIC);
3309	if (!work)
3310		return -ENOMEM;
3311
3312	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3313	spin_lock_irqsave(&cm_id_priv->lock, flags);
3314	switch (cm_id->state)
3315	{
3316	case IB_CM_REP_SENT:
3317	case IB_CM_MRA_REP_RCVD:
3318		cm_id->state = IB_CM_ESTABLISHED;
3319		break;
3320	case IB_CM_ESTABLISHED:
3321		ret = -EISCONN;
3322		break;
3323	default:
3324		ret = -EINVAL;
3325		break;
3326	}
3327	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3328
3329	if (ret) {
3330		kfree(work);
3331		goto out;
3332	}
3333
3334	/*
3335	 * The CM worker thread may try to destroy the cm_id before it
3336	 * can execute this work item.  To prevent potential deadlock,
3337	 * we need to find the cm_id once we're in the context of the
3338	 * worker thread, rather than holding a reference on it.
3339	 */
3340	INIT_DELAYED_WORK(&work->work, cm_work_handler);
3341	work->local_id = cm_id->local_id;
3342	work->remote_id = cm_id->remote_id;
3343	work->mad_recv_wc = NULL;
3344	work->cm_event.event = IB_CM_USER_ESTABLISHED;
3345	queue_delayed_work(cm.wq, &work->work, 0);
3346out:
3347	return ret;
3348}
3349
3350static int cm_migrate(struct ib_cm_id *cm_id)
3351{
3352	struct cm_id_private *cm_id_priv;
3353	unsigned long flags;
3354	int ret = 0;
3355
3356	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3357	spin_lock_irqsave(&cm_id_priv->lock, flags);
3358	if (cm_id->state == IB_CM_ESTABLISHED &&
3359	    (cm_id->lap_state == IB_CM_LAP_UNINIT ||
3360	     cm_id->lap_state == IB_CM_LAP_IDLE)) {
3361		cm_id->lap_state = IB_CM_LAP_IDLE;
3362		cm_id_priv->av = cm_id_priv->alt_av;
3363	} else
3364		ret = -EINVAL;
3365	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3366
3367	return ret;
3368}
3369
3370int ib_cm_notify(struct ib_cm_id *cm_id, enum ib_event_type event)
3371{
3372	int ret;
3373
3374	switch (event) {
3375	case IB_EVENT_COMM_EST:
3376		ret = cm_establish(cm_id);
3377		break;
3378	case IB_EVENT_PATH_MIG:
3379		ret = cm_migrate(cm_id);
3380		break;
3381	default:
3382		ret = -EINVAL;
3383	}
3384	return ret;
3385}
3386EXPORT_SYMBOL(ib_cm_notify);
3387
3388static void cm_recv_handler(struct ib_mad_agent *mad_agent,
3389			    struct ib_mad_recv_wc *mad_recv_wc)
3390{
3391	struct cm_port *port = mad_agent->context;
3392	struct cm_work *work;
3393	enum ib_cm_event_type event;
3394	u16 attr_id;
3395	int paths = 0;
3396
3397	switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
3398	case CM_REQ_ATTR_ID:
3399		paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
3400						    alt_local_lid != 0);
3401		event = IB_CM_REQ_RECEIVED;
3402		break;
3403	case CM_MRA_ATTR_ID:
3404		event = IB_CM_MRA_RECEIVED;
3405		break;
3406	case CM_REJ_ATTR_ID:
3407		event = IB_CM_REJ_RECEIVED;
3408		break;
3409	case CM_REP_ATTR_ID:
3410		event = IB_CM_REP_RECEIVED;
3411		break;
3412	case CM_RTU_ATTR_ID:
3413		event = IB_CM_RTU_RECEIVED;
3414		break;
3415	case CM_DREQ_ATTR_ID:
3416		event = IB_CM_DREQ_RECEIVED;
3417		break;
3418	case CM_DREP_ATTR_ID:
3419		event = IB_CM_DREP_RECEIVED;
3420		break;
3421	case CM_SIDR_REQ_ATTR_ID:
3422		event = IB_CM_SIDR_REQ_RECEIVED;
3423		break;
3424	case CM_SIDR_REP_ATTR_ID:
3425		event = IB_CM_SIDR_REP_RECEIVED;
3426		break;
3427	case CM_LAP_ATTR_ID:
3428		paths = 1;
3429		event = IB_CM_LAP_RECEIVED;
3430		break;
3431	case CM_APR_ATTR_ID:
3432		event = IB_CM_APR_RECEIVED;
3433		break;
3434	default:
3435		ib_free_recv_mad(mad_recv_wc);
3436		return;
3437	}
3438
3439	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
3440	atomic_long_inc(&port->counter_group[CM_RECV].
3441			counter[attr_id - CM_ATTR_ID_OFFSET]);
3442
3443	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
3444		       GFP_KERNEL);
3445	if (!work) {
3446		ib_free_recv_mad(mad_recv_wc);
3447		return;
3448	}
3449
3450	INIT_DELAYED_WORK(&work->work, cm_work_handler);
3451	work->cm_event.event = event;
3452	work->mad_recv_wc = mad_recv_wc;
3453	work->port = port;
3454	queue_delayed_work(cm.wq, &work->work, 0);
3455}
3456
3457static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
3458				struct ib_qp_attr *qp_attr,
3459				int *qp_attr_mask)
3460{
3461	unsigned long flags;
3462	int ret;
3463
3464	spin_lock_irqsave(&cm_id_priv->lock, flags);
3465	switch (cm_id_priv->id.state) {
3466	case IB_CM_REQ_SENT:
3467	case IB_CM_MRA_REQ_RCVD:
3468	case IB_CM_REQ_RCVD:
3469	case IB_CM_MRA_REQ_SENT:
3470	case IB_CM_REP_RCVD:
3471	case IB_CM_MRA_REP_SENT:
3472	case IB_CM_REP_SENT:
3473	case IB_CM_MRA_REP_RCVD:
3474	case IB_CM_ESTABLISHED:
3475		*qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
3476				IB_QP_PKEY_INDEX | IB_QP_PORT;
3477		qp_attr->qp_access_flags = IB_ACCESS_REMOTE_WRITE;
3478		if (cm_id_priv->responder_resources)
3479			qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_READ |
3480						    IB_ACCESS_REMOTE_ATOMIC;
3481		qp_attr->pkey_index = cm_id_priv->av.pkey_index;
3482		qp_attr->port_num = cm_id_priv->av.port->port_num;
3483		ret = 0;
3484		break;
3485	default:
3486		ret = -EINVAL;
3487		break;
3488	}
3489	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3490	return ret;
3491}
3492
3493static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
3494			       struct ib_qp_attr *qp_attr,
3495			       int *qp_attr_mask)
3496{
3497	unsigned long flags;
3498	int ret;
3499
3500	spin_lock_irqsave(&cm_id_priv->lock, flags);
3501	switch (cm_id_priv->id.state) {
3502	case IB_CM_REQ_RCVD:
3503	case IB_CM_MRA_REQ_SENT:
3504	case IB_CM_REP_RCVD:
3505	case IB_CM_MRA_REP_SENT:
3506	case IB_CM_REP_SENT:
3507	case IB_CM_MRA_REP_RCVD:
3508	case IB_CM_ESTABLISHED:
3509		*qp_attr_mask = IB_QP_STATE | IB_QP_AV | IB_QP_PATH_MTU |
3510				IB_QP_DEST_QPN | IB_QP_RQ_PSN;
3511		qp_attr->ah_attr = cm_id_priv->av.ah_attr;
3512		if (!cm_id_priv->av.valid) {
3513			spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3514			return -EINVAL;
3515		}
3516		if (cm_id_priv->av.ah_attr.vlan_id != 0xffff) {
3517			qp_attr->vlan_id = cm_id_priv->av.ah_attr.vlan_id;
3518			*qp_attr_mask |= IB_QP_VID;
3519		}
3520		if (!is_zero_ether_addr(cm_id_priv->av.smac)) {
3521			memcpy(qp_attr->smac, cm_id_priv->av.smac,
3522			       sizeof(qp_attr->smac));
3523			*qp_attr_mask |= IB_QP_SMAC;
3524		}
3525		if (cm_id_priv->alt_av.valid) {
3526			if (cm_id_priv->alt_av.ah_attr.vlan_id != 0xffff) {
3527				qp_attr->alt_vlan_id =
3528					cm_id_priv->alt_av.ah_attr.vlan_id;
3529				*qp_attr_mask |= IB_QP_ALT_VID;
3530			}
3531			if (!is_zero_ether_addr(cm_id_priv->alt_av.smac)) {
3532				memcpy(qp_attr->alt_smac,
3533				       cm_id_priv->alt_av.smac,
3534				       sizeof(qp_attr->alt_smac));
3535				*qp_attr_mask |= IB_QP_ALT_SMAC;
3536			}
3537		}
3538		qp_attr->path_mtu = cm_id_priv->path_mtu;
3539		qp_attr->dest_qp_num = be32_to_cpu(cm_id_priv->remote_qpn);
3540		qp_attr->rq_psn = be32_to_cpu(cm_id_priv->rq_psn);
3541		if (cm_id_priv->qp_type == IB_QPT_RC ||
3542		    cm_id_priv->qp_type == IB_QPT_XRC_TGT) {
3543			*qp_attr_mask |= IB_QP_MAX_DEST_RD_ATOMIC |
3544					 IB_QP_MIN_RNR_TIMER;
3545			qp_attr->max_dest_rd_atomic =
3546					cm_id_priv->responder_resources;
3547			qp_attr->min_rnr_timer = 0;
3548		}
3549		if (cm_id_priv->alt_av.ah_attr.dlid) {
3550			*qp_attr_mask |= IB_QP_ALT_PATH;
3551			qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3552			qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
3553			qp_attr->alt_timeout = cm_id_priv->alt_av.timeout;
3554			qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3555		}
3556		ret = 0;
3557		break;
3558	default:
3559		ret = -EINVAL;
3560		break;
3561	}
3562	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3563	return ret;
3564}
3565
3566static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
3567			       struct ib_qp_attr *qp_attr,
3568			       int *qp_attr_mask)
3569{
3570	unsigned long flags;
3571	int ret;
3572
3573	spin_lock_irqsave(&cm_id_priv->lock, flags);
3574	switch (cm_id_priv->id.state) {
3575	/* Allow transition to RTS before sending REP */
3576	case IB_CM_REQ_RCVD:
3577	case IB_CM_MRA_REQ_SENT:
3578
3579	case IB_CM_REP_RCVD:
3580	case IB_CM_MRA_REP_SENT:
3581	case IB_CM_REP_SENT:
3582	case IB_CM_MRA_REP_RCVD:
3583	case IB_CM_ESTABLISHED:
3584		if (cm_id_priv->id.lap_state == IB_CM_LAP_UNINIT) {
3585			*qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
3586			qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
3587			switch (cm_id_priv->qp_type) {
3588			case IB_QPT_RC:
3589			case IB_QPT_XRC_INI:
3590				*qp_attr_mask |= IB_QP_RETRY_CNT | IB_QP_RNR_RETRY |
3591						 IB_QP_MAX_QP_RD_ATOMIC;
3592				qp_attr->retry_cnt = cm_id_priv->retry_count;
3593				qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
3594				qp_attr->max_rd_atomic = cm_id_priv->initiator_depth;
3595				/* fall through */
3596			case IB_QPT_XRC_TGT:
3597				*qp_attr_mask |= IB_QP_TIMEOUT;
3598				qp_attr->timeout = cm_id_priv->av.timeout;
3599				break;
3600			default:
3601				break;
3602			}
3603			if (cm_id_priv->alt_av.ah_attr.dlid) {
3604				*qp_attr_mask |= IB_QP_PATH_MIG_STATE;
3605				qp_attr->path_mig_state = IB_MIG_REARM;
3606			}
3607		} else {
3608			*qp_attr_mask = IB_QP_ALT_PATH | IB_QP_PATH_MIG_STATE;
3609			qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3610			qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
3611			qp_attr->alt_timeout = cm_id_priv->alt_av.timeout;
3612			qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3613			qp_attr->path_mig_state = IB_MIG_REARM;
3614		}
3615		ret = 0;
3616		break;
3617	default:
3618		ret = -EINVAL;
3619		break;
3620	}
3621	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3622	return ret;
3623}
3624
3625int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
3626		       struct ib_qp_attr *qp_attr,
3627		       int *qp_attr_mask)
3628{
3629	struct cm_id_private *cm_id_priv;
3630	int ret;
3631
3632	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3633	switch (qp_attr->qp_state) {
3634	case IB_QPS_INIT:
3635		ret = cm_init_qp_init_attr(cm_id_priv, qp_attr, qp_attr_mask);
3636		break;
3637	case IB_QPS_RTR:
3638		ret = cm_init_qp_rtr_attr(cm_id_priv, qp_attr, qp_attr_mask);
3639		break;
3640	case IB_QPS_RTS:
3641		ret = cm_init_qp_rts_attr(cm_id_priv, qp_attr, qp_attr_mask);
3642		break;
3643	default:
3644		ret = -EINVAL;
3645		break;
3646	}
3647	return ret;
3648}
3649EXPORT_SYMBOL(ib_cm_init_qp_attr);
3650
3651static void cm_get_ack_delay(struct cm_device *cm_dev)
3652{
3653	struct ib_device_attr attr;
3654
3655	if (ib_query_device(cm_dev->ib_device, &attr))
3656		cm_dev->ack_delay = 0; /* acks will rely on packet life time */
3657	else
3658		cm_dev->ack_delay = attr.local_ca_ack_delay;
3659}
3660
3661static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
3662			       char *buf)
3663{
3664	struct cm_counter_group *group;
3665	struct cm_counter_attribute *cm_attr;
3666
3667	group = container_of(obj, struct cm_counter_group, obj);
3668	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
3669
3670	return sprintf(buf, "%ld\n",
3671		       atomic_long_read(&group->counter[cm_attr->index]));
3672}
3673
3674static const struct sysfs_ops cm_counter_ops = {
3675	.show = cm_show_counter
3676};
3677
3678static struct kobj_type cm_counter_obj_type = {
3679	.sysfs_ops = &cm_counter_ops,
3680	.default_attrs = cm_counter_default_attrs
3681};
3682
3683static void cm_release_port_obj(struct kobject *obj)
3684{
3685	struct cm_port *cm_port;
3686
3687	cm_port = container_of(obj, struct cm_port, port_obj);
3688	kfree(cm_port);
3689}
3690
3691static struct kobj_type cm_port_obj_type = {
3692	.release = cm_release_port_obj
3693};
3694
3695static char *cm_devnode(struct device *dev, umode_t *mode)
3696{
3697	if (mode)
3698		*mode = 0666;
3699	return kasprintf(GFP_KERNEL, "infiniband/%s", dev_name(dev));
3700}
3701
3702struct class cm_class = {
3703	.owner   = THIS_MODULE,
3704	.name    = "infiniband_cm",
3705	.devnode = cm_devnode,
3706};
3707EXPORT_SYMBOL(cm_class);
3708
3709static int cm_create_port_fs(struct cm_port *port)
3710{
3711	int i, ret;
3712
3713	ret = kobject_init_and_add(&port->port_obj, &cm_port_obj_type,
3714				   &port->cm_dev->device->kobj,
3715				   "%d", port->port_num);
3716	if (ret) {
3717		kfree(port);
3718		return ret;
3719	}
3720
3721	for (i = 0; i < CM_COUNTER_GROUPS; i++) {
3722		ret = kobject_init_and_add(&port->counter_group[i].obj,
3723					   &cm_counter_obj_type,
3724					   &port->port_obj,
3725					   "%s", counter_group_names[i]);
3726		if (ret)
3727			goto error;
3728	}
3729
3730	return 0;
3731
3732error:
3733	while (i--)
3734		kobject_put(&port->counter_group[i].obj);
3735	kobject_put(&port->port_obj);
3736	return ret;
3737
3738}
3739
3740static void cm_remove_port_fs(struct cm_port *port)
3741{
3742	int i;
3743
3744	for (i = 0; i < CM_COUNTER_GROUPS; i++)
3745		kobject_put(&port->counter_group[i].obj);
3746
3747	kobject_put(&port->port_obj);
3748}
3749
3750static void cm_add_one(struct ib_device *ib_device)
3751{
3752	struct cm_device *cm_dev;
3753	struct cm_port *port;
3754	struct ib_mad_reg_req reg_req = {
3755		.mgmt_class = IB_MGMT_CLASS_CM,
3756		.mgmt_class_version = IB_CM_CLASS_VERSION,
3757	};
3758	struct ib_port_modify port_modify = {
3759		.set_port_cap_mask = IB_PORT_CM_SUP
3760	};
3761	unsigned long flags;
3762	int ret;
3763	u8 i;
3764
3765	if (rdma_node_get_transport(ib_device->node_type) != RDMA_TRANSPORT_IB)
3766		return;
3767
3768	cm_dev = kzalloc(sizeof(*cm_dev) + sizeof(*port) *
3769			 ib_device->phys_port_cnt, GFP_KERNEL);
3770	if (!cm_dev)
3771		return;
3772
3773	cm_dev->ib_device = ib_device;
3774	cm_get_ack_delay(cm_dev);
3775
3776	cm_dev->device = device_create(&cm_class, &ib_device->dev,
3777				       MKDEV(0, 0), NULL,
3778				       "%s", ib_device->name);
3779	if (IS_ERR(cm_dev->device)) {
3780		kfree(cm_dev);
3781		return;
3782	}
3783
3784	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
3785	for (i = 1; i <= ib_device->phys_port_cnt; i++) {
3786		port = kzalloc(sizeof *port, GFP_KERNEL);
3787		if (!port)
3788			goto error1;
3789
3790		cm_dev->port[i-1] = port;
3791		port->cm_dev = cm_dev;
3792		port->port_num = i;
3793
3794		ret = cm_create_port_fs(port);
3795		if (ret)
3796			goto error1;
3797
3798		port->mad_agent = ib_register_mad_agent(ib_device, i,
3799							IB_QPT_GSI,
3800							&reg_req,
3801							0,
3802							cm_send_handler,
3803							cm_recv_handler,
3804							port,
3805							0);
3806		if (IS_ERR(port->mad_agent))
3807			goto error2;
3808
3809		ret = ib_modify_port(ib_device, i, 0, &port_modify);
3810		if (ret)
3811			goto error3;
3812	}
3813	ib_set_client_data(ib_device, &cm_client, cm_dev);
3814
3815	write_lock_irqsave(&cm.device_lock, flags);
3816	list_add_tail(&cm_dev->list, &cm.device_list);
3817	write_unlock_irqrestore(&cm.device_lock, flags);
3818	return;
3819
3820error3:
3821	ib_unregister_mad_agent(port->mad_agent);
3822error2:
3823	cm_remove_port_fs(port);
3824error1:
3825	port_modify.set_port_cap_mask = 0;
3826	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
3827	while (--i) {
3828		port = cm_dev->port[i-1];
3829		ib_modify_port(ib_device, port->port_num, 0, &port_modify);
3830		ib_unregister_mad_agent(port->mad_agent);
3831		cm_remove_port_fs(port);
3832	}
3833	device_unregister(cm_dev->device);
3834	kfree(cm_dev);
3835}
3836
3837static void cm_remove_one(struct ib_device *ib_device)
3838{
3839	struct cm_device *cm_dev;
3840	struct cm_port *port;
3841	struct ib_port_modify port_modify = {
3842		.clr_port_cap_mask = IB_PORT_CM_SUP
3843	};
3844	unsigned long flags;
3845	int i;
3846
3847	cm_dev = ib_get_client_data(ib_device, &cm_client);
3848	if (!cm_dev)
3849		return;
3850
3851	write_lock_irqsave(&cm.device_lock, flags);
3852	list_del(&cm_dev->list);
3853	write_unlock_irqrestore(&cm.device_lock, flags);
3854
3855	for (i = 1; i <= ib_device->phys_port_cnt; i++) {
3856		port = cm_dev->port[i-1];
3857		ib_modify_port(ib_device, port->port_num, 0, &port_modify);
3858		ib_unregister_mad_agent(port->mad_agent);
3859		flush_workqueue(cm.wq);
3860		cm_remove_port_fs(port);
3861	}
3862	device_unregister(cm_dev->device);
3863	kfree(cm_dev);
3864}
3865
3866static int __init ib_cm_init(void)
3867{
3868	int ret;
3869
3870	memset(&cm, 0, sizeof cm);
3871	INIT_LIST_HEAD(&cm.device_list);
3872	rwlock_init(&cm.device_lock);
3873	spin_lock_init(&cm.lock);
3874	cm.listen_service_table = RB_ROOT;
3875	cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
3876	cm.remote_id_table = RB_ROOT;
3877	cm.remote_qp_table = RB_ROOT;
3878	cm.remote_sidr_table = RB_ROOT;
3879	idr_init(&cm.local_id_table);
3880	get_random_bytes(&cm.random_id_operand, sizeof cm.random_id_operand);
3881	INIT_LIST_HEAD(&cm.timewait_list);
3882
3883	ret = class_register(&cm_class);
3884	if (ret) {
3885		ret = -ENOMEM;
3886		goto error1;
3887	}
3888
3889	cm.wq = create_workqueue("ib_cm");
3890	if (!cm.wq) {
3891		ret = -ENOMEM;
3892		goto error2;
3893	}
3894
3895	ret = ib_register_client(&cm_client);
3896	if (ret)
3897		goto error3;
3898
3899	return 0;
3900error3:
3901	destroy_workqueue(cm.wq);
3902error2:
3903	class_unregister(&cm_class);
3904error1:
3905	idr_destroy(&cm.local_id_table);
3906	return ret;
3907}
3908
3909static void __exit ib_cm_cleanup(void)
3910{
3911	struct cm_timewait_info *timewait_info, *tmp;
3912
3913	spin_lock_irq(&cm.lock);
3914	list_for_each_entry(timewait_info, &cm.timewait_list, list)
3915		cancel_delayed_work(&timewait_info->work.work);
3916	spin_unlock_irq(&cm.lock);
3917
3918	ib_unregister_client(&cm_client);
3919	destroy_workqueue(cm.wq);
3920
3921	list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
3922		list_del(&timewait_info->list);
3923		kfree(timewait_info);
3924	}
3925
3926	class_unregister(&cm_class);
3927	idr_destroy(&cm.local_id_table);
3928}
3929
3930module_init(ib_cm_init);
3931module_exit(ib_cm_cleanup);
3932
3933