cm.c revision 3971c9f6dbf26f077b929dbe14ced60a697ebcf0
1/*
2 * Copyright (c) 2004-2007 Intel Corporation.  All rights reserved.
3 * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
4 * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
5 * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
6 *
7 * This software is available to you under a choice of one of two
8 * licenses.  You may choose to be licensed under the terms of the GNU
9 * General Public License (GPL) Version 2, available from the file
10 * COPYING in the main directory of this source tree, or the
11 * OpenIB.org BSD license below:
12 *
13 *     Redistribution and use in source and binary forms, with or
14 *     without modification, are permitted provided that the following
15 *     conditions are met:
16 *
17 *      - Redistributions of source code must retain the above
18 *        copyright notice, this list of conditions and the following
19 *        disclaimer.
20 *
21 *      - Redistributions in binary form must reproduce the above
22 *        copyright notice, this list of conditions and the following
23 *        disclaimer in the documentation and/or other materials
24 *        provided with the distribution.
25 *
26 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33 * SOFTWARE.
34 *
35 * $Id: cm.c 4311 2005-12-05 18:42:01Z sean.hefty $
36 */
37
38#include <linux/completion.h>
39#include <linux/dma-mapping.h>
40#include <linux/device.h>
41#include <linux/err.h>
42#include <linux/idr.h>
43#include <linux/interrupt.h>
44#include <linux/random.h>
45#include <linux/rbtree.h>
46#include <linux/spinlock.h>
47#include <linux/sysfs.h>
48#include <linux/workqueue.h>
49
50#include <rdma/ib_cache.h>
51#include <rdma/ib_cm.h>
52#include "cm_msgs.h"
53
54MODULE_AUTHOR("Sean Hefty");
55MODULE_DESCRIPTION("InfiniBand CM");
56MODULE_LICENSE("Dual BSD/GPL");
57
58static void cm_add_one(struct ib_device *device);
59static void cm_remove_one(struct ib_device *device);
60
61static struct ib_client cm_client = {
62	.name   = "cm",
63	.add    = cm_add_one,
64	.remove = cm_remove_one
65};
66
67static struct ib_cm {
68	spinlock_t lock;
69	struct list_head device_list;
70	rwlock_t device_lock;
71	struct rb_root listen_service_table;
72	u64 listen_service_id;
73	/* struct rb_root peer_service_table; todo: fix peer to peer */
74	struct rb_root remote_qp_table;
75	struct rb_root remote_id_table;
76	struct rb_root remote_sidr_table;
77	struct idr local_id_table;
78	__be32 random_id_operand;
79	struct list_head timewait_list;
80	struct workqueue_struct *wq;
81} cm;
82
83/* Counter indexes ordered by attribute ID */
84enum {
85	CM_REQ_COUNTER,
86	CM_MRA_COUNTER,
87	CM_REJ_COUNTER,
88	CM_REP_COUNTER,
89	CM_RTU_COUNTER,
90	CM_DREQ_COUNTER,
91	CM_DREP_COUNTER,
92	CM_SIDR_REQ_COUNTER,
93	CM_SIDR_REP_COUNTER,
94	CM_LAP_COUNTER,
95	CM_APR_COUNTER,
96	CM_ATTR_COUNT,
97	CM_ATTR_ID_OFFSET = 0x0010,
98};
99
100enum {
101	CM_XMIT,
102	CM_XMIT_RETRIES,
103	CM_RECV,
104	CM_RECV_DUPLICATES,
105	CM_COUNTER_GROUPS
106};
107
108static char const counter_group_names[CM_COUNTER_GROUPS]
109				     [sizeof("cm_rx_duplicates")] = {
110	"cm_tx_msgs", "cm_tx_retries",
111	"cm_rx_msgs", "cm_rx_duplicates"
112};
113
114struct cm_counter_group {
115	struct kobject obj;
116	atomic_long_t counter[CM_ATTR_COUNT];
117};
118
119struct cm_counter_attribute {
120	struct attribute attr;
121	int index;
122};
123
124#define CM_COUNTER_ATTR(_name, _index) \
125struct cm_counter_attribute cm_##_name##_counter_attr = { \
126	.attr = { .name = __stringify(_name), .mode = 0444, .owner = THIS_MODULE }, \
127	.index = _index \
128}
129
130static CM_COUNTER_ATTR(req, CM_REQ_COUNTER);
131static CM_COUNTER_ATTR(mra, CM_MRA_COUNTER);
132static CM_COUNTER_ATTR(rej, CM_REJ_COUNTER);
133static CM_COUNTER_ATTR(rep, CM_REP_COUNTER);
134static CM_COUNTER_ATTR(rtu, CM_RTU_COUNTER);
135static CM_COUNTER_ATTR(dreq, CM_DREQ_COUNTER);
136static CM_COUNTER_ATTR(drep, CM_DREP_COUNTER);
137static CM_COUNTER_ATTR(sidr_req, CM_SIDR_REQ_COUNTER);
138static CM_COUNTER_ATTR(sidr_rep, CM_SIDR_REP_COUNTER);
139static CM_COUNTER_ATTR(lap, CM_LAP_COUNTER);
140static CM_COUNTER_ATTR(apr, CM_APR_COUNTER);
141
142static struct attribute *cm_counter_default_attrs[] = {
143	&cm_req_counter_attr.attr,
144	&cm_mra_counter_attr.attr,
145	&cm_rej_counter_attr.attr,
146	&cm_rep_counter_attr.attr,
147	&cm_rtu_counter_attr.attr,
148	&cm_dreq_counter_attr.attr,
149	&cm_drep_counter_attr.attr,
150	&cm_sidr_req_counter_attr.attr,
151	&cm_sidr_rep_counter_attr.attr,
152	&cm_lap_counter_attr.attr,
153	&cm_apr_counter_attr.attr,
154	NULL
155};
156
157struct cm_port {
158	struct cm_device *cm_dev;
159	struct ib_mad_agent *mad_agent;
160	struct kobject port_obj;
161	u8 port_num;
162	struct cm_counter_group counter_group[CM_COUNTER_GROUPS];
163};
164
165struct cm_device {
166	struct list_head list;
167	struct ib_device *device;
168	struct kobject dev_obj;
169	u8 ack_delay;
170	struct cm_port *port[0];
171};
172
173struct cm_av {
174	struct cm_port *port;
175	union ib_gid dgid;
176	struct ib_ah_attr ah_attr;
177	u16 pkey_index;
178	u8 timeout;
179};
180
181struct cm_work {
182	struct delayed_work work;
183	struct list_head list;
184	struct cm_port *port;
185	struct ib_mad_recv_wc *mad_recv_wc;	/* Received MADs */
186	__be32 local_id;			/* Established / timewait */
187	__be32 remote_id;
188	struct ib_cm_event cm_event;
189	struct ib_sa_path_rec path[0];
190};
191
192struct cm_timewait_info {
193	struct cm_work work;			/* Must be first. */
194	struct list_head list;
195	struct rb_node remote_qp_node;
196	struct rb_node remote_id_node;
197	__be64 remote_ca_guid;
198	__be32 remote_qpn;
199	u8 inserted_remote_qp;
200	u8 inserted_remote_id;
201};
202
203struct cm_id_private {
204	struct ib_cm_id	id;
205
206	struct rb_node service_node;
207	struct rb_node sidr_id_node;
208	spinlock_t lock;	/* Do not acquire inside cm.lock */
209	struct completion comp;
210	atomic_t refcount;
211
212	struct ib_mad_send_buf *msg;
213	struct cm_timewait_info *timewait_info;
214	/* todo: use alternate port on send failure */
215	struct cm_av av;
216	struct cm_av alt_av;
217	struct ib_cm_compare_data *compare_data;
218
219	void *private_data;
220	__be64 tid;
221	__be32 local_qpn;
222	__be32 remote_qpn;
223	enum ib_qp_type qp_type;
224	__be32 sq_psn;
225	__be32 rq_psn;
226	int timeout_ms;
227	enum ib_mtu path_mtu;
228	__be16 pkey;
229	u8 private_data_len;
230	u8 max_cm_retries;
231	u8 peer_to_peer;
232	u8 responder_resources;
233	u8 initiator_depth;
234	u8 retry_count;
235	u8 rnr_retry_count;
236	u8 service_timeout;
237	u8 target_ack_delay;
238
239	struct list_head work_list;
240	atomic_t work_count;
241};
242
243static void cm_work_handler(struct work_struct *work);
244
245static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
246{
247	if (atomic_dec_and_test(&cm_id_priv->refcount))
248		complete(&cm_id_priv->comp);
249}
250
251static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
252			struct ib_mad_send_buf **msg)
253{
254	struct ib_mad_agent *mad_agent;
255	struct ib_mad_send_buf *m;
256	struct ib_ah *ah;
257
258	mad_agent = cm_id_priv->av.port->mad_agent;
259	ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
260	if (IS_ERR(ah))
261		return PTR_ERR(ah);
262
263	m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
264			       cm_id_priv->av.pkey_index,
265			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
266			       GFP_ATOMIC);
267	if (IS_ERR(m)) {
268		ib_destroy_ah(ah);
269		return PTR_ERR(m);
270	}
271
272	/* Timeout set by caller if response is expected. */
273	m->ah = ah;
274	m->retries = cm_id_priv->max_cm_retries;
275
276	atomic_inc(&cm_id_priv->refcount);
277	m->context[0] = cm_id_priv;
278	*msg = m;
279	return 0;
280}
281
282static int cm_alloc_response_msg(struct cm_port *port,
283				 struct ib_mad_recv_wc *mad_recv_wc,
284				 struct ib_mad_send_buf **msg)
285{
286	struct ib_mad_send_buf *m;
287	struct ib_ah *ah;
288
289	ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
290				  mad_recv_wc->recv_buf.grh, port->port_num);
291	if (IS_ERR(ah))
292		return PTR_ERR(ah);
293
294	m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,
295			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
296			       GFP_ATOMIC);
297	if (IS_ERR(m)) {
298		ib_destroy_ah(ah);
299		return PTR_ERR(m);
300	}
301	m->ah = ah;
302	*msg = m;
303	return 0;
304}
305
306static void cm_free_msg(struct ib_mad_send_buf *msg)
307{
308	ib_destroy_ah(msg->ah);
309	if (msg->context[0])
310		cm_deref_id(msg->context[0]);
311	ib_free_send_mad(msg);
312}
313
314static void * cm_copy_private_data(const void *private_data,
315				   u8 private_data_len)
316{
317	void *data;
318
319	if (!private_data || !private_data_len)
320		return NULL;
321
322	data = kmemdup(private_data, private_data_len, GFP_KERNEL);
323	if (!data)
324		return ERR_PTR(-ENOMEM);
325
326	return data;
327}
328
329static void cm_set_private_data(struct cm_id_private *cm_id_priv,
330				 void *private_data, u8 private_data_len)
331{
332	if (cm_id_priv->private_data && cm_id_priv->private_data_len)
333		kfree(cm_id_priv->private_data);
334
335	cm_id_priv->private_data = private_data;
336	cm_id_priv->private_data_len = private_data_len;
337}
338
339static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
340				    struct ib_grh *grh, struct cm_av *av)
341{
342	av->port = port;
343	av->pkey_index = wc->pkey_index;
344	ib_init_ah_from_wc(port->cm_dev->device, port->port_num, wc,
345			   grh, &av->ah_attr);
346}
347
348static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
349{
350	struct cm_device *cm_dev;
351	struct cm_port *port = NULL;
352	unsigned long flags;
353	int ret;
354	u8 p;
355
356	read_lock_irqsave(&cm.device_lock, flags);
357	list_for_each_entry(cm_dev, &cm.device_list, list) {
358		if (!ib_find_cached_gid(cm_dev->device, &path->sgid,
359					&p, NULL)) {
360			port = cm_dev->port[p-1];
361			break;
362		}
363	}
364	read_unlock_irqrestore(&cm.device_lock, flags);
365
366	if (!port)
367		return -EINVAL;
368
369	ret = ib_find_cached_pkey(cm_dev->device, port->port_num,
370				  be16_to_cpu(path->pkey), &av->pkey_index);
371	if (ret)
372		return ret;
373
374	av->port = port;
375	ib_init_ah_from_path(cm_dev->device, port->port_num, path,
376			     &av->ah_attr);
377	av->timeout = path->packet_life_time + 1;
378	return 0;
379}
380
381static int cm_alloc_id(struct cm_id_private *cm_id_priv)
382{
383	unsigned long flags;
384	int ret, id;
385	static int next_id;
386
387	do {
388		spin_lock_irqsave(&cm.lock, flags);
389		ret = idr_get_new_above(&cm.local_id_table, cm_id_priv,
390					next_id, &id);
391		if (!ret)
392			next_id = ((unsigned) id + 1) & MAX_ID_MASK;
393		spin_unlock_irqrestore(&cm.lock, flags);
394	} while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
395
396	cm_id_priv->id.local_id = (__force __be32) (id ^ cm.random_id_operand);
397	return ret;
398}
399
400static void cm_free_id(__be32 local_id)
401{
402	spin_lock_irq(&cm.lock);
403	idr_remove(&cm.local_id_table,
404		   (__force int) (local_id ^ cm.random_id_operand));
405	spin_unlock_irq(&cm.lock);
406}
407
408static struct cm_id_private * cm_get_id(__be32 local_id, __be32 remote_id)
409{
410	struct cm_id_private *cm_id_priv;
411
412	cm_id_priv = idr_find(&cm.local_id_table,
413			      (__force int) (local_id ^ cm.random_id_operand));
414	if (cm_id_priv) {
415		if (cm_id_priv->id.remote_id == remote_id)
416			atomic_inc(&cm_id_priv->refcount);
417		else
418			cm_id_priv = NULL;
419	}
420
421	return cm_id_priv;
422}
423
424static struct cm_id_private * cm_acquire_id(__be32 local_id, __be32 remote_id)
425{
426	struct cm_id_private *cm_id_priv;
427
428	spin_lock_irq(&cm.lock);
429	cm_id_priv = cm_get_id(local_id, remote_id);
430	spin_unlock_irq(&cm.lock);
431
432	return cm_id_priv;
433}
434
435static void cm_mask_copy(u8 *dst, u8 *src, u8 *mask)
436{
437	int i;
438
439	for (i = 0; i < IB_CM_COMPARE_SIZE / sizeof(unsigned long); i++)
440		((unsigned long *) dst)[i] = ((unsigned long *) src)[i] &
441					     ((unsigned long *) mask)[i];
442}
443
444static int cm_compare_data(struct ib_cm_compare_data *src_data,
445			   struct ib_cm_compare_data *dst_data)
446{
447	u8 src[IB_CM_COMPARE_SIZE];
448	u8 dst[IB_CM_COMPARE_SIZE];
449
450	if (!src_data || !dst_data)
451		return 0;
452
453	cm_mask_copy(src, src_data->data, dst_data->mask);
454	cm_mask_copy(dst, dst_data->data, src_data->mask);
455	return memcmp(src, dst, IB_CM_COMPARE_SIZE);
456}
457
458static int cm_compare_private_data(u8 *private_data,
459				   struct ib_cm_compare_data *dst_data)
460{
461	u8 src[IB_CM_COMPARE_SIZE];
462
463	if (!dst_data)
464		return 0;
465
466	cm_mask_copy(src, private_data, dst_data->mask);
467	return memcmp(src, dst_data->data, IB_CM_COMPARE_SIZE);
468}
469
470static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
471{
472	struct rb_node **link = &cm.listen_service_table.rb_node;
473	struct rb_node *parent = NULL;
474	struct cm_id_private *cur_cm_id_priv;
475	__be64 service_id = cm_id_priv->id.service_id;
476	__be64 service_mask = cm_id_priv->id.service_mask;
477	int data_cmp;
478
479	while (*link) {
480		parent = *link;
481		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
482					  service_node);
483		data_cmp = cm_compare_data(cm_id_priv->compare_data,
484					   cur_cm_id_priv->compare_data);
485		if ((cur_cm_id_priv->id.service_mask & service_id) ==
486		    (service_mask & cur_cm_id_priv->id.service_id) &&
487		    (cm_id_priv->id.device == cur_cm_id_priv->id.device) &&
488		    !data_cmp)
489			return cur_cm_id_priv;
490
491		if (cm_id_priv->id.device < cur_cm_id_priv->id.device)
492			link = &(*link)->rb_left;
493		else if (cm_id_priv->id.device > cur_cm_id_priv->id.device)
494			link = &(*link)->rb_right;
495		else if (service_id < cur_cm_id_priv->id.service_id)
496			link = &(*link)->rb_left;
497		else if (service_id > cur_cm_id_priv->id.service_id)
498			link = &(*link)->rb_right;
499		else if (data_cmp < 0)
500			link = &(*link)->rb_left;
501		else
502			link = &(*link)->rb_right;
503	}
504	rb_link_node(&cm_id_priv->service_node, parent, link);
505	rb_insert_color(&cm_id_priv->service_node, &cm.listen_service_table);
506	return NULL;
507}
508
509static struct cm_id_private * cm_find_listen(struct ib_device *device,
510					     __be64 service_id,
511					     u8 *private_data)
512{
513	struct rb_node *node = cm.listen_service_table.rb_node;
514	struct cm_id_private *cm_id_priv;
515	int data_cmp;
516
517	while (node) {
518		cm_id_priv = rb_entry(node, struct cm_id_private, service_node);
519		data_cmp = cm_compare_private_data(private_data,
520						   cm_id_priv->compare_data);
521		if ((cm_id_priv->id.service_mask & service_id) ==
522		     cm_id_priv->id.service_id &&
523		    (cm_id_priv->id.device == device) && !data_cmp)
524			return cm_id_priv;
525
526		if (device < cm_id_priv->id.device)
527			node = node->rb_left;
528		else if (device > cm_id_priv->id.device)
529			node = node->rb_right;
530		else if (service_id < cm_id_priv->id.service_id)
531			node = node->rb_left;
532		else if (service_id > cm_id_priv->id.service_id)
533			node = node->rb_right;
534		else if (data_cmp < 0)
535			node = node->rb_left;
536		else
537			node = node->rb_right;
538	}
539	return NULL;
540}
541
542static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
543						     *timewait_info)
544{
545	struct rb_node **link = &cm.remote_id_table.rb_node;
546	struct rb_node *parent = NULL;
547	struct cm_timewait_info *cur_timewait_info;
548	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
549	__be32 remote_id = timewait_info->work.remote_id;
550
551	while (*link) {
552		parent = *link;
553		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
554					     remote_id_node);
555		if (remote_id < cur_timewait_info->work.remote_id)
556			link = &(*link)->rb_left;
557		else if (remote_id > cur_timewait_info->work.remote_id)
558			link = &(*link)->rb_right;
559		else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
560			link = &(*link)->rb_left;
561		else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
562			link = &(*link)->rb_right;
563		else
564			return cur_timewait_info;
565	}
566	timewait_info->inserted_remote_id = 1;
567	rb_link_node(&timewait_info->remote_id_node, parent, link);
568	rb_insert_color(&timewait_info->remote_id_node, &cm.remote_id_table);
569	return NULL;
570}
571
572static struct cm_timewait_info * cm_find_remote_id(__be64 remote_ca_guid,
573						   __be32 remote_id)
574{
575	struct rb_node *node = cm.remote_id_table.rb_node;
576	struct cm_timewait_info *timewait_info;
577
578	while (node) {
579		timewait_info = rb_entry(node, struct cm_timewait_info,
580					 remote_id_node);
581		if (remote_id < timewait_info->work.remote_id)
582			node = node->rb_left;
583		else if (remote_id > timewait_info->work.remote_id)
584			node = node->rb_right;
585		else if (remote_ca_guid < timewait_info->remote_ca_guid)
586			node = node->rb_left;
587		else if (remote_ca_guid > timewait_info->remote_ca_guid)
588			node = node->rb_right;
589		else
590			return timewait_info;
591	}
592	return NULL;
593}
594
595static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
596						      *timewait_info)
597{
598	struct rb_node **link = &cm.remote_qp_table.rb_node;
599	struct rb_node *parent = NULL;
600	struct cm_timewait_info *cur_timewait_info;
601	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
602	__be32 remote_qpn = timewait_info->remote_qpn;
603
604	while (*link) {
605		parent = *link;
606		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
607					     remote_qp_node);
608		if (remote_qpn < cur_timewait_info->remote_qpn)
609			link = &(*link)->rb_left;
610		else if (remote_qpn > cur_timewait_info->remote_qpn)
611			link = &(*link)->rb_right;
612		else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
613			link = &(*link)->rb_left;
614		else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
615			link = &(*link)->rb_right;
616		else
617			return cur_timewait_info;
618	}
619	timewait_info->inserted_remote_qp = 1;
620	rb_link_node(&timewait_info->remote_qp_node, parent, link);
621	rb_insert_color(&timewait_info->remote_qp_node, &cm.remote_qp_table);
622	return NULL;
623}
624
625static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
626						    *cm_id_priv)
627{
628	struct rb_node **link = &cm.remote_sidr_table.rb_node;
629	struct rb_node *parent = NULL;
630	struct cm_id_private *cur_cm_id_priv;
631	union ib_gid *port_gid = &cm_id_priv->av.dgid;
632	__be32 remote_id = cm_id_priv->id.remote_id;
633
634	while (*link) {
635		parent = *link;
636		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
637					  sidr_id_node);
638		if (remote_id < cur_cm_id_priv->id.remote_id)
639			link = &(*link)->rb_left;
640		else if (remote_id > cur_cm_id_priv->id.remote_id)
641			link = &(*link)->rb_right;
642		else {
643			int cmp;
644			cmp = memcmp(port_gid, &cur_cm_id_priv->av.dgid,
645				     sizeof *port_gid);
646			if (cmp < 0)
647				link = &(*link)->rb_left;
648			else if (cmp > 0)
649				link = &(*link)->rb_right;
650			else
651				return cur_cm_id_priv;
652		}
653	}
654	rb_link_node(&cm_id_priv->sidr_id_node, parent, link);
655	rb_insert_color(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
656	return NULL;
657}
658
659static void cm_reject_sidr_req(struct cm_id_private *cm_id_priv,
660			       enum ib_cm_sidr_status status)
661{
662	struct ib_cm_sidr_rep_param param;
663
664	memset(&param, 0, sizeof param);
665	param.status = status;
666	ib_send_cm_sidr_rep(&cm_id_priv->id, &param);
667}
668
669struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
670				 ib_cm_handler cm_handler,
671				 void *context)
672{
673	struct cm_id_private *cm_id_priv;
674	int ret;
675
676	cm_id_priv = kzalloc(sizeof *cm_id_priv, GFP_KERNEL);
677	if (!cm_id_priv)
678		return ERR_PTR(-ENOMEM);
679
680	cm_id_priv->id.state = IB_CM_IDLE;
681	cm_id_priv->id.device = device;
682	cm_id_priv->id.cm_handler = cm_handler;
683	cm_id_priv->id.context = context;
684	cm_id_priv->id.remote_cm_qpn = 1;
685	ret = cm_alloc_id(cm_id_priv);
686	if (ret)
687		goto error;
688
689	spin_lock_init(&cm_id_priv->lock);
690	init_completion(&cm_id_priv->comp);
691	INIT_LIST_HEAD(&cm_id_priv->work_list);
692	atomic_set(&cm_id_priv->work_count, -1);
693	atomic_set(&cm_id_priv->refcount, 1);
694	return &cm_id_priv->id;
695
696error:
697	kfree(cm_id_priv);
698	return ERR_PTR(-ENOMEM);
699}
700EXPORT_SYMBOL(ib_create_cm_id);
701
702static struct cm_work * cm_dequeue_work(struct cm_id_private *cm_id_priv)
703{
704	struct cm_work *work;
705
706	if (list_empty(&cm_id_priv->work_list))
707		return NULL;
708
709	work = list_entry(cm_id_priv->work_list.next, struct cm_work, list);
710	list_del(&work->list);
711	return work;
712}
713
714static void cm_free_work(struct cm_work *work)
715{
716	if (work->mad_recv_wc)
717		ib_free_recv_mad(work->mad_recv_wc);
718	kfree(work);
719}
720
721static inline int cm_convert_to_ms(int iba_time)
722{
723	/* approximate conversion to ms from 4.096us x 2^iba_time */
724	return 1 << max(iba_time - 8, 0);
725}
726
727/*
728 * calculate: 4.096x2^ack_timeout = 4.096x2^ack_delay + 2x4.096x2^life_time
729 * Because of how ack_timeout is stored, adding one doubles the timeout.
730 * To avoid large timeouts, select the max(ack_delay, life_time + 1), and
731 * increment it (round up) only if the other is within 50%.
732 */
733static u8 cm_ack_timeout(u8 ca_ack_delay, u8 packet_life_time)
734{
735	int ack_timeout = packet_life_time + 1;
736
737	if (ack_timeout >= ca_ack_delay)
738		ack_timeout += (ca_ack_delay >= (ack_timeout - 1));
739	else
740		ack_timeout = ca_ack_delay +
741			      (ack_timeout >= (ca_ack_delay - 1));
742
743	return min(31, ack_timeout);
744}
745
746static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
747{
748	if (timewait_info->inserted_remote_id) {
749		rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
750		timewait_info->inserted_remote_id = 0;
751	}
752
753	if (timewait_info->inserted_remote_qp) {
754		rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
755		timewait_info->inserted_remote_qp = 0;
756	}
757}
758
759static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
760{
761	struct cm_timewait_info *timewait_info;
762
763	timewait_info = kzalloc(sizeof *timewait_info, GFP_KERNEL);
764	if (!timewait_info)
765		return ERR_PTR(-ENOMEM);
766
767	timewait_info->work.local_id = local_id;
768	INIT_DELAYED_WORK(&timewait_info->work.work, cm_work_handler);
769	timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
770	return timewait_info;
771}
772
773static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
774{
775	int wait_time;
776	unsigned long flags;
777
778	spin_lock_irqsave(&cm.lock, flags);
779	cm_cleanup_timewait(cm_id_priv->timewait_info);
780	list_add_tail(&cm_id_priv->timewait_info->list, &cm.timewait_list);
781	spin_unlock_irqrestore(&cm.lock, flags);
782
783	/*
784	 * The cm_id could be destroyed by the user before we exit timewait.
785	 * To protect against this, we search for the cm_id after exiting
786	 * timewait before notifying the user that we've exited timewait.
787	 */
788	cm_id_priv->id.state = IB_CM_TIMEWAIT;
789	wait_time = cm_convert_to_ms(cm_id_priv->av.timeout);
790	queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
791			   msecs_to_jiffies(wait_time));
792	cm_id_priv->timewait_info = NULL;
793}
794
795static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
796{
797	unsigned long flags;
798
799	cm_id_priv->id.state = IB_CM_IDLE;
800	if (cm_id_priv->timewait_info) {
801		spin_lock_irqsave(&cm.lock, flags);
802		cm_cleanup_timewait(cm_id_priv->timewait_info);
803		spin_unlock_irqrestore(&cm.lock, flags);
804		kfree(cm_id_priv->timewait_info);
805		cm_id_priv->timewait_info = NULL;
806	}
807}
808
809static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
810{
811	struct cm_id_private *cm_id_priv;
812	struct cm_work *work;
813
814	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
815retest:
816	spin_lock_irq(&cm_id_priv->lock);
817	switch (cm_id->state) {
818	case IB_CM_LISTEN:
819		cm_id->state = IB_CM_IDLE;
820		spin_unlock_irq(&cm_id_priv->lock);
821		spin_lock_irq(&cm.lock);
822		rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);
823		spin_unlock_irq(&cm.lock);
824		break;
825	case IB_CM_SIDR_REQ_SENT:
826		cm_id->state = IB_CM_IDLE;
827		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
828		spin_unlock_irq(&cm_id_priv->lock);
829		break;
830	case IB_CM_SIDR_REQ_RCVD:
831		spin_unlock_irq(&cm_id_priv->lock);
832		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
833		break;
834	case IB_CM_REQ_SENT:
835		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
836		spin_unlock_irq(&cm_id_priv->lock);
837		ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,
838			       &cm_id_priv->id.device->node_guid,
839			       sizeof cm_id_priv->id.device->node_guid,
840			       NULL, 0);
841		break;
842	case IB_CM_REQ_RCVD:
843		if (err == -ENOMEM) {
844			/* Do not reject to allow future retries. */
845			cm_reset_to_idle(cm_id_priv);
846			spin_unlock_irq(&cm_id_priv->lock);
847		} else {
848			spin_unlock_irq(&cm_id_priv->lock);
849			ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
850				       NULL, 0, NULL, 0);
851		}
852		break;
853	case IB_CM_MRA_REQ_RCVD:
854	case IB_CM_REP_SENT:
855	case IB_CM_MRA_REP_RCVD:
856		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
857		/* Fall through */
858	case IB_CM_MRA_REQ_SENT:
859	case IB_CM_REP_RCVD:
860	case IB_CM_MRA_REP_SENT:
861		spin_unlock_irq(&cm_id_priv->lock);
862		ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
863			       NULL, 0, NULL, 0);
864		break;
865	case IB_CM_ESTABLISHED:
866		spin_unlock_irq(&cm_id_priv->lock);
867		ib_send_cm_dreq(cm_id, NULL, 0);
868		goto retest;
869	case IB_CM_DREQ_SENT:
870		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
871		cm_enter_timewait(cm_id_priv);
872		spin_unlock_irq(&cm_id_priv->lock);
873		break;
874	case IB_CM_DREQ_RCVD:
875		spin_unlock_irq(&cm_id_priv->lock);
876		ib_send_cm_drep(cm_id, NULL, 0);
877		break;
878	default:
879		spin_unlock_irq(&cm_id_priv->lock);
880		break;
881	}
882
883	cm_free_id(cm_id->local_id);
884	cm_deref_id(cm_id_priv);
885	wait_for_completion(&cm_id_priv->comp);
886	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
887		cm_free_work(work);
888	kfree(cm_id_priv->compare_data);
889	kfree(cm_id_priv->private_data);
890	kfree(cm_id_priv);
891}
892
893void ib_destroy_cm_id(struct ib_cm_id *cm_id)
894{
895	cm_destroy_id(cm_id, 0);
896}
897EXPORT_SYMBOL(ib_destroy_cm_id);
898
899int ib_cm_listen(struct ib_cm_id *cm_id, __be64 service_id, __be64 service_mask,
900		 struct ib_cm_compare_data *compare_data)
901{
902	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
903	unsigned long flags;
904	int ret = 0;
905
906	service_mask = service_mask ? service_mask :
907		       __constant_cpu_to_be64(~0ULL);
908	service_id &= service_mask;
909	if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
910	    (service_id != IB_CM_ASSIGN_SERVICE_ID))
911		return -EINVAL;
912
913	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
914	if (cm_id->state != IB_CM_IDLE)
915		return -EINVAL;
916
917	if (compare_data) {
918		cm_id_priv->compare_data = kzalloc(sizeof *compare_data,
919						   GFP_KERNEL);
920		if (!cm_id_priv->compare_data)
921			return -ENOMEM;
922		cm_mask_copy(cm_id_priv->compare_data->data,
923			     compare_data->data, compare_data->mask);
924		memcpy(cm_id_priv->compare_data->mask, compare_data->mask,
925		       IB_CM_COMPARE_SIZE);
926	}
927
928	cm_id->state = IB_CM_LISTEN;
929
930	spin_lock_irqsave(&cm.lock, flags);
931	if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
932		cm_id->service_id = cpu_to_be64(cm.listen_service_id++);
933		cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
934	} else {
935		cm_id->service_id = service_id;
936		cm_id->service_mask = service_mask;
937	}
938	cur_cm_id_priv = cm_insert_listen(cm_id_priv);
939	spin_unlock_irqrestore(&cm.lock, flags);
940
941	if (cur_cm_id_priv) {
942		cm_id->state = IB_CM_IDLE;
943		kfree(cm_id_priv->compare_data);
944		cm_id_priv->compare_data = NULL;
945		ret = -EBUSY;
946	}
947	return ret;
948}
949EXPORT_SYMBOL(ib_cm_listen);
950
951static __be64 cm_form_tid(struct cm_id_private *cm_id_priv,
952			  enum cm_msg_sequence msg_seq)
953{
954	u64 hi_tid, low_tid;
955
956	hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
957	low_tid  = (u64) ((__force u32)cm_id_priv->id.local_id |
958			  (msg_seq << 30));
959	return cpu_to_be64(hi_tid | low_tid);
960}
961
962static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
963			      __be16 attr_id, __be64 tid)
964{
965	hdr->base_version  = IB_MGMT_BASE_VERSION;
966	hdr->mgmt_class	   = IB_MGMT_CLASS_CM;
967	hdr->class_version = IB_CM_CLASS_VERSION;
968	hdr->method	   = IB_MGMT_METHOD_SEND;
969	hdr->attr_id	   = attr_id;
970	hdr->tid	   = tid;
971}
972
973static void cm_format_req(struct cm_req_msg *req_msg,
974			  struct cm_id_private *cm_id_priv,
975			  struct ib_cm_req_param *param)
976{
977	struct ib_sa_path_rec *pri_path = param->primary_path;
978	struct ib_sa_path_rec *alt_path = param->alternate_path;
979
980	cm_format_mad_hdr(&req_msg->hdr, CM_REQ_ATTR_ID,
981			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_REQ));
982
983	req_msg->local_comm_id = cm_id_priv->id.local_id;
984	req_msg->service_id = param->service_id;
985	req_msg->local_ca_guid = cm_id_priv->id.device->node_guid;
986	cm_req_set_local_qpn(req_msg, cpu_to_be32(param->qp_num));
987	cm_req_set_resp_res(req_msg, param->responder_resources);
988	cm_req_set_init_depth(req_msg, param->initiator_depth);
989	cm_req_set_remote_resp_timeout(req_msg,
990				       param->remote_cm_response_timeout);
991	cm_req_set_qp_type(req_msg, param->qp_type);
992	cm_req_set_flow_ctrl(req_msg, param->flow_control);
993	cm_req_set_starting_psn(req_msg, cpu_to_be32(param->starting_psn));
994	cm_req_set_local_resp_timeout(req_msg,
995				      param->local_cm_response_timeout);
996	cm_req_set_retry_count(req_msg, param->retry_count);
997	req_msg->pkey = param->primary_path->pkey;
998	cm_req_set_path_mtu(req_msg, param->primary_path->mtu);
999	cm_req_set_rnr_retry_count(req_msg, param->rnr_retry_count);
1000	cm_req_set_max_cm_retries(req_msg, param->max_cm_retries);
1001	cm_req_set_srq(req_msg, param->srq);
1002
1003	if (pri_path->hop_limit <= 1) {
1004		req_msg->primary_local_lid = pri_path->slid;
1005		req_msg->primary_remote_lid = pri_path->dlid;
1006	} else {
1007		/* Work-around until there's a way to obtain remote LID info */
1008		req_msg->primary_local_lid = IB_LID_PERMISSIVE;
1009		req_msg->primary_remote_lid = IB_LID_PERMISSIVE;
1010	}
1011	req_msg->primary_local_gid = pri_path->sgid;
1012	req_msg->primary_remote_gid = pri_path->dgid;
1013	cm_req_set_primary_flow_label(req_msg, pri_path->flow_label);
1014	cm_req_set_primary_packet_rate(req_msg, pri_path->rate);
1015	req_msg->primary_traffic_class = pri_path->traffic_class;
1016	req_msg->primary_hop_limit = pri_path->hop_limit;
1017	cm_req_set_primary_sl(req_msg, pri_path->sl);
1018	cm_req_set_primary_subnet_local(req_msg, (pri_path->hop_limit <= 1));
1019	cm_req_set_primary_local_ack_timeout(req_msg,
1020		cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
1021			       pri_path->packet_life_time));
1022
1023	if (alt_path) {
1024		if (alt_path->hop_limit <= 1) {
1025			req_msg->alt_local_lid = alt_path->slid;
1026			req_msg->alt_remote_lid = alt_path->dlid;
1027		} else {
1028			req_msg->alt_local_lid = IB_LID_PERMISSIVE;
1029			req_msg->alt_remote_lid = IB_LID_PERMISSIVE;
1030		}
1031		req_msg->alt_local_gid = alt_path->sgid;
1032		req_msg->alt_remote_gid = alt_path->dgid;
1033		cm_req_set_alt_flow_label(req_msg,
1034					  alt_path->flow_label);
1035		cm_req_set_alt_packet_rate(req_msg, alt_path->rate);
1036		req_msg->alt_traffic_class = alt_path->traffic_class;
1037		req_msg->alt_hop_limit = alt_path->hop_limit;
1038		cm_req_set_alt_sl(req_msg, alt_path->sl);
1039		cm_req_set_alt_subnet_local(req_msg, (alt_path->hop_limit <= 1));
1040		cm_req_set_alt_local_ack_timeout(req_msg,
1041			cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
1042				       alt_path->packet_life_time));
1043	}
1044
1045	if (param->private_data && param->private_data_len)
1046		memcpy(req_msg->private_data, param->private_data,
1047		       param->private_data_len);
1048}
1049
1050static int cm_validate_req_param(struct ib_cm_req_param *param)
1051{
1052	/* peer-to-peer not supported */
1053	if (param->peer_to_peer)
1054		return -EINVAL;
1055
1056	if (!param->primary_path)
1057		return -EINVAL;
1058
1059	if (param->qp_type != IB_QPT_RC && param->qp_type != IB_QPT_UC)
1060		return -EINVAL;
1061
1062	if (param->private_data &&
1063	    param->private_data_len > IB_CM_REQ_PRIVATE_DATA_SIZE)
1064		return -EINVAL;
1065
1066	if (param->alternate_path &&
1067	    (param->alternate_path->pkey != param->primary_path->pkey ||
1068	     param->alternate_path->mtu != param->primary_path->mtu))
1069		return -EINVAL;
1070
1071	return 0;
1072}
1073
1074int ib_send_cm_req(struct ib_cm_id *cm_id,
1075		   struct ib_cm_req_param *param)
1076{
1077	struct cm_id_private *cm_id_priv;
1078	struct cm_req_msg *req_msg;
1079	unsigned long flags;
1080	int ret;
1081
1082	ret = cm_validate_req_param(param);
1083	if (ret)
1084		return ret;
1085
1086	/* Verify that we're not in timewait. */
1087	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1088	spin_lock_irqsave(&cm_id_priv->lock, flags);
1089	if (cm_id->state != IB_CM_IDLE) {
1090		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1091		ret = -EINVAL;
1092		goto out;
1093	}
1094	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1095
1096	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1097							    id.local_id);
1098	if (IS_ERR(cm_id_priv->timewait_info)) {
1099		ret = PTR_ERR(cm_id_priv->timewait_info);
1100		goto out;
1101	}
1102
1103	ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
1104	if (ret)
1105		goto error1;
1106	if (param->alternate_path) {
1107		ret = cm_init_av_by_path(param->alternate_path,
1108					 &cm_id_priv->alt_av);
1109		if (ret)
1110			goto error1;
1111	}
1112	cm_id->service_id = param->service_id;
1113	cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
1114	cm_id_priv->timeout_ms = cm_convert_to_ms(
1115				    param->primary_path->packet_life_time) * 2 +
1116				 cm_convert_to_ms(
1117				    param->remote_cm_response_timeout);
1118	cm_id_priv->max_cm_retries = param->max_cm_retries;
1119	cm_id_priv->initiator_depth = param->initiator_depth;
1120	cm_id_priv->responder_resources = param->responder_resources;
1121	cm_id_priv->retry_count = param->retry_count;
1122	cm_id_priv->path_mtu = param->primary_path->mtu;
1123	cm_id_priv->pkey = param->primary_path->pkey;
1124	cm_id_priv->qp_type = param->qp_type;
1125
1126	ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
1127	if (ret)
1128		goto error1;
1129
1130	req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
1131	cm_format_req(req_msg, cm_id_priv, param);
1132	cm_id_priv->tid = req_msg->hdr.tid;
1133	cm_id_priv->msg->timeout_ms = cm_id_priv->timeout_ms;
1134	cm_id_priv->msg->context[1] = (void *) (unsigned long) IB_CM_REQ_SENT;
1135
1136	cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
1137	cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
1138
1139	spin_lock_irqsave(&cm_id_priv->lock, flags);
1140	ret = ib_post_send_mad(cm_id_priv->msg, NULL);
1141	if (ret) {
1142		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1143		goto error2;
1144	}
1145	BUG_ON(cm_id->state != IB_CM_IDLE);
1146	cm_id->state = IB_CM_REQ_SENT;
1147	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1148	return 0;
1149
1150error2:	cm_free_msg(cm_id_priv->msg);
1151error1:	kfree(cm_id_priv->timewait_info);
1152out:	return ret;
1153}
1154EXPORT_SYMBOL(ib_send_cm_req);
1155
1156static int cm_issue_rej(struct cm_port *port,
1157			struct ib_mad_recv_wc *mad_recv_wc,
1158			enum ib_cm_rej_reason reason,
1159			enum cm_msg_response msg_rejected,
1160			void *ari, u8 ari_length)
1161{
1162	struct ib_mad_send_buf *msg = NULL;
1163	struct cm_rej_msg *rej_msg, *rcv_msg;
1164	int ret;
1165
1166	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
1167	if (ret)
1168		return ret;
1169
1170	/* We just need common CM header information.  Cast to any message. */
1171	rcv_msg = (struct cm_rej_msg *) mad_recv_wc->recv_buf.mad;
1172	rej_msg = (struct cm_rej_msg *) msg->mad;
1173
1174	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, rcv_msg->hdr.tid);
1175	rej_msg->remote_comm_id = rcv_msg->local_comm_id;
1176	rej_msg->local_comm_id = rcv_msg->remote_comm_id;
1177	cm_rej_set_msg_rejected(rej_msg, msg_rejected);
1178	rej_msg->reason = cpu_to_be16(reason);
1179
1180	if (ari && ari_length) {
1181		cm_rej_set_reject_info_len(rej_msg, ari_length);
1182		memcpy(rej_msg->ari, ari, ari_length);
1183	}
1184
1185	ret = ib_post_send_mad(msg, NULL);
1186	if (ret)
1187		cm_free_msg(msg);
1188
1189	return ret;
1190}
1191
1192static inline int cm_is_active_peer(__be64 local_ca_guid, __be64 remote_ca_guid,
1193				    __be32 local_qpn, __be32 remote_qpn)
1194{
1195	return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
1196		((local_ca_guid == remote_ca_guid) &&
1197		 (be32_to_cpu(local_qpn) > be32_to_cpu(remote_qpn))));
1198}
1199
1200static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
1201					    struct ib_sa_path_rec *primary_path,
1202					    struct ib_sa_path_rec *alt_path)
1203{
1204	memset(primary_path, 0, sizeof *primary_path);
1205	primary_path->dgid = req_msg->primary_local_gid;
1206	primary_path->sgid = req_msg->primary_remote_gid;
1207	primary_path->dlid = req_msg->primary_local_lid;
1208	primary_path->slid = req_msg->primary_remote_lid;
1209	primary_path->flow_label = cm_req_get_primary_flow_label(req_msg);
1210	primary_path->hop_limit = req_msg->primary_hop_limit;
1211	primary_path->traffic_class = req_msg->primary_traffic_class;
1212	primary_path->reversible = 1;
1213	primary_path->pkey = req_msg->pkey;
1214	primary_path->sl = cm_req_get_primary_sl(req_msg);
1215	primary_path->mtu_selector = IB_SA_EQ;
1216	primary_path->mtu = cm_req_get_path_mtu(req_msg);
1217	primary_path->rate_selector = IB_SA_EQ;
1218	primary_path->rate = cm_req_get_primary_packet_rate(req_msg);
1219	primary_path->packet_life_time_selector = IB_SA_EQ;
1220	primary_path->packet_life_time =
1221		cm_req_get_primary_local_ack_timeout(req_msg);
1222	primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
1223
1224	if (req_msg->alt_local_lid) {
1225		memset(alt_path, 0, sizeof *alt_path);
1226		alt_path->dgid = req_msg->alt_local_gid;
1227		alt_path->sgid = req_msg->alt_remote_gid;
1228		alt_path->dlid = req_msg->alt_local_lid;
1229		alt_path->slid = req_msg->alt_remote_lid;
1230		alt_path->flow_label = cm_req_get_alt_flow_label(req_msg);
1231		alt_path->hop_limit = req_msg->alt_hop_limit;
1232		alt_path->traffic_class = req_msg->alt_traffic_class;
1233		alt_path->reversible = 1;
1234		alt_path->pkey = req_msg->pkey;
1235		alt_path->sl = cm_req_get_alt_sl(req_msg);
1236		alt_path->mtu_selector = IB_SA_EQ;
1237		alt_path->mtu = cm_req_get_path_mtu(req_msg);
1238		alt_path->rate_selector = IB_SA_EQ;
1239		alt_path->rate = cm_req_get_alt_packet_rate(req_msg);
1240		alt_path->packet_life_time_selector = IB_SA_EQ;
1241		alt_path->packet_life_time =
1242			cm_req_get_alt_local_ack_timeout(req_msg);
1243		alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
1244	}
1245}
1246
1247static void cm_format_req_event(struct cm_work *work,
1248				struct cm_id_private *cm_id_priv,
1249				struct ib_cm_id *listen_id)
1250{
1251	struct cm_req_msg *req_msg;
1252	struct ib_cm_req_event_param *param;
1253
1254	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1255	param = &work->cm_event.param.req_rcvd;
1256	param->listen_id = listen_id;
1257	param->port = cm_id_priv->av.port->port_num;
1258	param->primary_path = &work->path[0];
1259	if (req_msg->alt_local_lid)
1260		param->alternate_path = &work->path[1];
1261	else
1262		param->alternate_path = NULL;
1263	param->remote_ca_guid = req_msg->local_ca_guid;
1264	param->remote_qkey = be32_to_cpu(req_msg->local_qkey);
1265	param->remote_qpn = be32_to_cpu(cm_req_get_local_qpn(req_msg));
1266	param->qp_type = cm_req_get_qp_type(req_msg);
1267	param->starting_psn = be32_to_cpu(cm_req_get_starting_psn(req_msg));
1268	param->responder_resources = cm_req_get_init_depth(req_msg);
1269	param->initiator_depth = cm_req_get_resp_res(req_msg);
1270	param->local_cm_response_timeout =
1271					cm_req_get_remote_resp_timeout(req_msg);
1272	param->flow_control = cm_req_get_flow_ctrl(req_msg);
1273	param->remote_cm_response_timeout =
1274					cm_req_get_local_resp_timeout(req_msg);
1275	param->retry_count = cm_req_get_retry_count(req_msg);
1276	param->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1277	param->srq = cm_req_get_srq(req_msg);
1278	work->cm_event.private_data = &req_msg->private_data;
1279}
1280
1281static void cm_process_work(struct cm_id_private *cm_id_priv,
1282			    struct cm_work *work)
1283{
1284	int ret;
1285
1286	/* We will typically only have the current event to report. */
1287	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &work->cm_event);
1288	cm_free_work(work);
1289
1290	while (!ret && !atomic_add_negative(-1, &cm_id_priv->work_count)) {
1291		spin_lock_irq(&cm_id_priv->lock);
1292		work = cm_dequeue_work(cm_id_priv);
1293		spin_unlock_irq(&cm_id_priv->lock);
1294		BUG_ON(!work);
1295		ret = cm_id_priv->id.cm_handler(&cm_id_priv->id,
1296						&work->cm_event);
1297		cm_free_work(work);
1298	}
1299	cm_deref_id(cm_id_priv);
1300	if (ret)
1301		cm_destroy_id(&cm_id_priv->id, ret);
1302}
1303
1304static void cm_format_mra(struct cm_mra_msg *mra_msg,
1305			  struct cm_id_private *cm_id_priv,
1306			  enum cm_msg_response msg_mraed, u8 service_timeout,
1307			  const void *private_data, u8 private_data_len)
1308{
1309	cm_format_mad_hdr(&mra_msg->hdr, CM_MRA_ATTR_ID, cm_id_priv->tid);
1310	cm_mra_set_msg_mraed(mra_msg, msg_mraed);
1311	mra_msg->local_comm_id = cm_id_priv->id.local_id;
1312	mra_msg->remote_comm_id = cm_id_priv->id.remote_id;
1313	cm_mra_set_service_timeout(mra_msg, service_timeout);
1314
1315	if (private_data && private_data_len)
1316		memcpy(mra_msg->private_data, private_data, private_data_len);
1317}
1318
1319static void cm_format_rej(struct cm_rej_msg *rej_msg,
1320			  struct cm_id_private *cm_id_priv,
1321			  enum ib_cm_rej_reason reason,
1322			  void *ari,
1323			  u8 ari_length,
1324			  const void *private_data,
1325			  u8 private_data_len)
1326{
1327	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, cm_id_priv->tid);
1328	rej_msg->remote_comm_id = cm_id_priv->id.remote_id;
1329
1330	switch(cm_id_priv->id.state) {
1331	case IB_CM_REQ_RCVD:
1332		rej_msg->local_comm_id = 0;
1333		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1334		break;
1335	case IB_CM_MRA_REQ_SENT:
1336		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1337		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1338		break;
1339	case IB_CM_REP_RCVD:
1340	case IB_CM_MRA_REP_SENT:
1341		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1342		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REP);
1343		break;
1344	default:
1345		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1346		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_OTHER);
1347		break;
1348	}
1349
1350	rej_msg->reason = cpu_to_be16(reason);
1351	if (ari && ari_length) {
1352		cm_rej_set_reject_info_len(rej_msg, ari_length);
1353		memcpy(rej_msg->ari, ari, ari_length);
1354	}
1355
1356	if (private_data && private_data_len)
1357		memcpy(rej_msg->private_data, private_data, private_data_len);
1358}
1359
1360static void cm_dup_req_handler(struct cm_work *work,
1361			       struct cm_id_private *cm_id_priv)
1362{
1363	struct ib_mad_send_buf *msg = NULL;
1364	int ret;
1365
1366	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1367			counter[CM_REQ_COUNTER]);
1368
1369	/* Quick state check to discard duplicate REQs. */
1370	if (cm_id_priv->id.state == IB_CM_REQ_RCVD)
1371		return;
1372
1373	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1374	if (ret)
1375		return;
1376
1377	spin_lock_irq(&cm_id_priv->lock);
1378	switch (cm_id_priv->id.state) {
1379	case IB_CM_MRA_REQ_SENT:
1380		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1381			      CM_MSG_RESPONSE_REQ, cm_id_priv->service_timeout,
1382			      cm_id_priv->private_data,
1383			      cm_id_priv->private_data_len);
1384		break;
1385	case IB_CM_TIMEWAIT:
1386		cm_format_rej((struct cm_rej_msg *) msg->mad, cm_id_priv,
1387			      IB_CM_REJ_STALE_CONN, NULL, 0, NULL, 0);
1388		break;
1389	default:
1390		goto unlock;
1391	}
1392	spin_unlock_irq(&cm_id_priv->lock);
1393
1394	ret = ib_post_send_mad(msg, NULL);
1395	if (ret)
1396		goto free;
1397	return;
1398
1399unlock:	spin_unlock_irq(&cm_id_priv->lock);
1400free:	cm_free_msg(msg);
1401}
1402
1403static struct cm_id_private * cm_match_req(struct cm_work *work,
1404					   struct cm_id_private *cm_id_priv)
1405{
1406	struct cm_id_private *listen_cm_id_priv, *cur_cm_id_priv;
1407	struct cm_timewait_info *timewait_info;
1408	struct cm_req_msg *req_msg;
1409
1410	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1411
1412	/* Check for possible duplicate REQ. */
1413	spin_lock_irq(&cm.lock);
1414	timewait_info = cm_insert_remote_id(cm_id_priv->timewait_info);
1415	if (timewait_info) {
1416		cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
1417					   timewait_info->work.remote_id);
1418		spin_unlock_irq(&cm.lock);
1419		if (cur_cm_id_priv) {
1420			cm_dup_req_handler(work, cur_cm_id_priv);
1421			cm_deref_id(cur_cm_id_priv);
1422		}
1423		return NULL;
1424	}
1425
1426	/* Check for stale connections. */
1427	timewait_info = cm_insert_remote_qpn(cm_id_priv->timewait_info);
1428	if (timewait_info) {
1429		cm_cleanup_timewait(cm_id_priv->timewait_info);
1430		spin_unlock_irq(&cm.lock);
1431		cm_issue_rej(work->port, work->mad_recv_wc,
1432			     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
1433			     NULL, 0);
1434		return NULL;
1435	}
1436
1437	/* Find matching listen request. */
1438	listen_cm_id_priv = cm_find_listen(cm_id_priv->id.device,
1439					   req_msg->service_id,
1440					   req_msg->private_data);
1441	if (!listen_cm_id_priv) {
1442		cm_cleanup_timewait(cm_id_priv->timewait_info);
1443		spin_unlock_irq(&cm.lock);
1444		cm_issue_rej(work->port, work->mad_recv_wc,
1445			     IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
1446			     NULL, 0);
1447		goto out;
1448	}
1449	atomic_inc(&listen_cm_id_priv->refcount);
1450	atomic_inc(&cm_id_priv->refcount);
1451	cm_id_priv->id.state = IB_CM_REQ_RCVD;
1452	atomic_inc(&cm_id_priv->work_count);
1453	spin_unlock_irq(&cm.lock);
1454out:
1455	return listen_cm_id_priv;
1456}
1457
1458/*
1459 * Work-around for inter-subnet connections.  If the LIDs are permissive,
1460 * we need to override the LID/SL data in the REQ with the LID information
1461 * in the work completion.
1462 */
1463static void cm_process_routed_req(struct cm_req_msg *req_msg, struct ib_wc *wc)
1464{
1465	if (!cm_req_get_primary_subnet_local(req_msg)) {
1466		if (req_msg->primary_local_lid == IB_LID_PERMISSIVE) {
1467			req_msg->primary_local_lid = cpu_to_be16(wc->slid);
1468			cm_req_set_primary_sl(req_msg, wc->sl);
1469		}
1470
1471		if (req_msg->primary_remote_lid == IB_LID_PERMISSIVE)
1472			req_msg->primary_remote_lid = cpu_to_be16(wc->dlid_path_bits);
1473	}
1474
1475	if (!cm_req_get_alt_subnet_local(req_msg)) {
1476		if (req_msg->alt_local_lid == IB_LID_PERMISSIVE) {
1477			req_msg->alt_local_lid = cpu_to_be16(wc->slid);
1478			cm_req_set_alt_sl(req_msg, wc->sl);
1479		}
1480
1481		if (req_msg->alt_remote_lid == IB_LID_PERMISSIVE)
1482			req_msg->alt_remote_lid = cpu_to_be16(wc->dlid_path_bits);
1483	}
1484}
1485
1486static int cm_req_handler(struct cm_work *work)
1487{
1488	struct ib_cm_id *cm_id;
1489	struct cm_id_private *cm_id_priv, *listen_cm_id_priv;
1490	struct cm_req_msg *req_msg;
1491	int ret;
1492
1493	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1494
1495	cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
1496	if (IS_ERR(cm_id))
1497		return PTR_ERR(cm_id);
1498
1499	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1500	cm_id_priv->id.remote_id = req_msg->local_comm_id;
1501	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
1502				work->mad_recv_wc->recv_buf.grh,
1503				&cm_id_priv->av);
1504	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1505							    id.local_id);
1506	if (IS_ERR(cm_id_priv->timewait_info)) {
1507		ret = PTR_ERR(cm_id_priv->timewait_info);
1508		goto destroy;
1509	}
1510	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
1511	cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;
1512	cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);
1513
1514	listen_cm_id_priv = cm_match_req(work, cm_id_priv);
1515	if (!listen_cm_id_priv) {
1516		ret = -EINVAL;
1517		kfree(cm_id_priv->timewait_info);
1518		goto destroy;
1519	}
1520
1521	cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
1522	cm_id_priv->id.context = listen_cm_id_priv->id.context;
1523	cm_id_priv->id.service_id = req_msg->service_id;
1524	cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
1525
1526	cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
1527	cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
1528	ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
1529	if (ret) {
1530		ib_get_cached_gid(work->port->cm_dev->device,
1531				  work->port->port_num, 0, &work->path[0].sgid);
1532		ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_GID,
1533			       &work->path[0].sgid, sizeof work->path[0].sgid,
1534			       NULL, 0);
1535		goto rejected;
1536	}
1537	if (req_msg->alt_local_lid) {
1538		ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
1539		if (ret) {
1540			ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID,
1541				       &work->path[0].sgid,
1542				       sizeof work->path[0].sgid, NULL, 0);
1543			goto rejected;
1544		}
1545	}
1546	cm_id_priv->tid = req_msg->hdr.tid;
1547	cm_id_priv->timeout_ms = cm_convert_to_ms(
1548					cm_req_get_local_resp_timeout(req_msg));
1549	cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);
1550	cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);
1551	cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
1552	cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
1553	cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
1554	cm_id_priv->pkey = req_msg->pkey;
1555	cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
1556	cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
1557	cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1558	cm_id_priv->qp_type = cm_req_get_qp_type(req_msg);
1559
1560	cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);
1561	cm_process_work(cm_id_priv, work);
1562	cm_deref_id(listen_cm_id_priv);
1563	return 0;
1564
1565rejected:
1566	atomic_dec(&cm_id_priv->refcount);
1567	cm_deref_id(listen_cm_id_priv);
1568destroy:
1569	ib_destroy_cm_id(cm_id);
1570	return ret;
1571}
1572
1573static void cm_format_rep(struct cm_rep_msg *rep_msg,
1574			  struct cm_id_private *cm_id_priv,
1575			  struct ib_cm_rep_param *param)
1576{
1577	cm_format_mad_hdr(&rep_msg->hdr, CM_REP_ATTR_ID, cm_id_priv->tid);
1578	rep_msg->local_comm_id = cm_id_priv->id.local_id;
1579	rep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1580	cm_rep_set_local_qpn(rep_msg, cpu_to_be32(param->qp_num));
1581	cm_rep_set_starting_psn(rep_msg, cpu_to_be32(param->starting_psn));
1582	rep_msg->resp_resources = param->responder_resources;
1583	rep_msg->initiator_depth = param->initiator_depth;
1584	cm_rep_set_target_ack_delay(rep_msg,
1585				    cm_id_priv->av.port->cm_dev->ack_delay);
1586	cm_rep_set_failover(rep_msg, param->failover_accepted);
1587	cm_rep_set_flow_ctrl(rep_msg, param->flow_control);
1588	cm_rep_set_rnr_retry_count(rep_msg, param->rnr_retry_count);
1589	cm_rep_set_srq(rep_msg, param->srq);
1590	rep_msg->local_ca_guid = cm_id_priv->id.device->node_guid;
1591
1592	if (param->private_data && param->private_data_len)
1593		memcpy(rep_msg->private_data, param->private_data,
1594		       param->private_data_len);
1595}
1596
1597int ib_send_cm_rep(struct ib_cm_id *cm_id,
1598		   struct ib_cm_rep_param *param)
1599{
1600	struct cm_id_private *cm_id_priv;
1601	struct ib_mad_send_buf *msg;
1602	struct cm_rep_msg *rep_msg;
1603	unsigned long flags;
1604	int ret;
1605
1606	if (param->private_data &&
1607	    param->private_data_len > IB_CM_REP_PRIVATE_DATA_SIZE)
1608		return -EINVAL;
1609
1610	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1611	spin_lock_irqsave(&cm_id_priv->lock, flags);
1612	if (cm_id->state != IB_CM_REQ_RCVD &&
1613	    cm_id->state != IB_CM_MRA_REQ_SENT) {
1614		ret = -EINVAL;
1615		goto out;
1616	}
1617
1618	ret = cm_alloc_msg(cm_id_priv, &msg);
1619	if (ret)
1620		goto out;
1621
1622	rep_msg = (struct cm_rep_msg *) msg->mad;
1623	cm_format_rep(rep_msg, cm_id_priv, param);
1624	msg->timeout_ms = cm_id_priv->timeout_ms;
1625	msg->context[1] = (void *) (unsigned long) IB_CM_REP_SENT;
1626
1627	ret = ib_post_send_mad(msg, NULL);
1628	if (ret) {
1629		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1630		cm_free_msg(msg);
1631		return ret;
1632	}
1633
1634	cm_id->state = IB_CM_REP_SENT;
1635	cm_id_priv->msg = msg;
1636	cm_id_priv->initiator_depth = param->initiator_depth;
1637	cm_id_priv->responder_resources = param->responder_resources;
1638	cm_id_priv->rq_psn = cm_rep_get_starting_psn(rep_msg);
1639	cm_id_priv->local_qpn = cm_rep_get_local_qpn(rep_msg);
1640
1641out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1642	return ret;
1643}
1644EXPORT_SYMBOL(ib_send_cm_rep);
1645
1646static void cm_format_rtu(struct cm_rtu_msg *rtu_msg,
1647			  struct cm_id_private *cm_id_priv,
1648			  const void *private_data,
1649			  u8 private_data_len)
1650{
1651	cm_format_mad_hdr(&rtu_msg->hdr, CM_RTU_ATTR_ID, cm_id_priv->tid);
1652	rtu_msg->local_comm_id = cm_id_priv->id.local_id;
1653	rtu_msg->remote_comm_id = cm_id_priv->id.remote_id;
1654
1655	if (private_data && private_data_len)
1656		memcpy(rtu_msg->private_data, private_data, private_data_len);
1657}
1658
1659int ib_send_cm_rtu(struct ib_cm_id *cm_id,
1660		   const void *private_data,
1661		   u8 private_data_len)
1662{
1663	struct cm_id_private *cm_id_priv;
1664	struct ib_mad_send_buf *msg;
1665	unsigned long flags;
1666	void *data;
1667	int ret;
1668
1669	if (private_data && private_data_len > IB_CM_RTU_PRIVATE_DATA_SIZE)
1670		return -EINVAL;
1671
1672	data = cm_copy_private_data(private_data, private_data_len);
1673	if (IS_ERR(data))
1674		return PTR_ERR(data);
1675
1676	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1677	spin_lock_irqsave(&cm_id_priv->lock, flags);
1678	if (cm_id->state != IB_CM_REP_RCVD &&
1679	    cm_id->state != IB_CM_MRA_REP_SENT) {
1680		ret = -EINVAL;
1681		goto error;
1682	}
1683
1684	ret = cm_alloc_msg(cm_id_priv, &msg);
1685	if (ret)
1686		goto error;
1687
1688	cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1689		      private_data, private_data_len);
1690
1691	ret = ib_post_send_mad(msg, NULL);
1692	if (ret) {
1693		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1694		cm_free_msg(msg);
1695		kfree(data);
1696		return ret;
1697	}
1698
1699	cm_id->state = IB_CM_ESTABLISHED;
1700	cm_set_private_data(cm_id_priv, data, private_data_len);
1701	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1702	return 0;
1703
1704error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1705	kfree(data);
1706	return ret;
1707}
1708EXPORT_SYMBOL(ib_send_cm_rtu);
1709
1710static void cm_format_rep_event(struct cm_work *work)
1711{
1712	struct cm_rep_msg *rep_msg;
1713	struct ib_cm_rep_event_param *param;
1714
1715	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1716	param = &work->cm_event.param.rep_rcvd;
1717	param->remote_ca_guid = rep_msg->local_ca_guid;
1718	param->remote_qkey = be32_to_cpu(rep_msg->local_qkey);
1719	param->remote_qpn = be32_to_cpu(cm_rep_get_local_qpn(rep_msg));
1720	param->starting_psn = be32_to_cpu(cm_rep_get_starting_psn(rep_msg));
1721	param->responder_resources = rep_msg->initiator_depth;
1722	param->initiator_depth = rep_msg->resp_resources;
1723	param->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1724	param->failover_accepted = cm_rep_get_failover(rep_msg);
1725	param->flow_control = cm_rep_get_flow_ctrl(rep_msg);
1726	param->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1727	param->srq = cm_rep_get_srq(rep_msg);
1728	work->cm_event.private_data = &rep_msg->private_data;
1729}
1730
1731static void cm_dup_rep_handler(struct cm_work *work)
1732{
1733	struct cm_id_private *cm_id_priv;
1734	struct cm_rep_msg *rep_msg;
1735	struct ib_mad_send_buf *msg = NULL;
1736	int ret;
1737
1738	rep_msg = (struct cm_rep_msg *) work->mad_recv_wc->recv_buf.mad;
1739	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id,
1740				   rep_msg->local_comm_id);
1741	if (!cm_id_priv)
1742		return;
1743
1744	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1745			counter[CM_REP_COUNTER]);
1746	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1747	if (ret)
1748		goto deref;
1749
1750	spin_lock_irq(&cm_id_priv->lock);
1751	if (cm_id_priv->id.state == IB_CM_ESTABLISHED)
1752		cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1753			      cm_id_priv->private_data,
1754			      cm_id_priv->private_data_len);
1755	else if (cm_id_priv->id.state == IB_CM_MRA_REP_SENT)
1756		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1757			      CM_MSG_RESPONSE_REP, cm_id_priv->service_timeout,
1758			      cm_id_priv->private_data,
1759			      cm_id_priv->private_data_len);
1760	else
1761		goto unlock;
1762	spin_unlock_irq(&cm_id_priv->lock);
1763
1764	ret = ib_post_send_mad(msg, NULL);
1765	if (ret)
1766		goto free;
1767	goto deref;
1768
1769unlock:	spin_unlock_irq(&cm_id_priv->lock);
1770free:	cm_free_msg(msg);
1771deref:	cm_deref_id(cm_id_priv);
1772}
1773
1774static int cm_rep_handler(struct cm_work *work)
1775{
1776	struct cm_id_private *cm_id_priv;
1777	struct cm_rep_msg *rep_msg;
1778	int ret;
1779
1780	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1781	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id, 0);
1782	if (!cm_id_priv) {
1783		cm_dup_rep_handler(work);
1784		return -EINVAL;
1785	}
1786
1787	cm_format_rep_event(work);
1788
1789	spin_lock_irq(&cm_id_priv->lock);
1790	switch (cm_id_priv->id.state) {
1791	case IB_CM_REQ_SENT:
1792	case IB_CM_MRA_REQ_RCVD:
1793		break;
1794	default:
1795		spin_unlock_irq(&cm_id_priv->lock);
1796		ret = -EINVAL;
1797		goto error;
1798	}
1799
1800	cm_id_priv->timewait_info->work.remote_id = rep_msg->local_comm_id;
1801	cm_id_priv->timewait_info->remote_ca_guid = rep_msg->local_ca_guid;
1802	cm_id_priv->timewait_info->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1803
1804	spin_lock(&cm.lock);
1805	/* Check for duplicate REP. */
1806	if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
1807		spin_unlock(&cm.lock);
1808		spin_unlock_irq(&cm_id_priv->lock);
1809		ret = -EINVAL;
1810		goto error;
1811	}
1812	/* Check for a stale connection. */
1813	if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
1814		rb_erase(&cm_id_priv->timewait_info->remote_id_node,
1815			 &cm.remote_id_table);
1816		cm_id_priv->timewait_info->inserted_remote_id = 0;
1817		spin_unlock(&cm.lock);
1818		spin_unlock_irq(&cm_id_priv->lock);
1819		cm_issue_rej(work->port, work->mad_recv_wc,
1820			     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REP,
1821			     NULL, 0);
1822		ret = -EINVAL;
1823		goto error;
1824	}
1825	spin_unlock(&cm.lock);
1826
1827	cm_id_priv->id.state = IB_CM_REP_RCVD;
1828	cm_id_priv->id.remote_id = rep_msg->local_comm_id;
1829	cm_id_priv->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1830	cm_id_priv->initiator_depth = rep_msg->resp_resources;
1831	cm_id_priv->responder_resources = rep_msg->initiator_depth;
1832	cm_id_priv->sq_psn = cm_rep_get_starting_psn(rep_msg);
1833	cm_id_priv->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1834	cm_id_priv->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1835	cm_id_priv->av.timeout =
1836			cm_ack_timeout(cm_id_priv->target_ack_delay,
1837				       cm_id_priv->av.timeout - 1);
1838	cm_id_priv->alt_av.timeout =
1839			cm_ack_timeout(cm_id_priv->target_ack_delay,
1840				       cm_id_priv->alt_av.timeout - 1);
1841
1842	/* todo: handle peer_to_peer */
1843
1844	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1845	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1846	if (!ret)
1847		list_add_tail(&work->list, &cm_id_priv->work_list);
1848	spin_unlock_irq(&cm_id_priv->lock);
1849
1850	if (ret)
1851		cm_process_work(cm_id_priv, work);
1852	else
1853		cm_deref_id(cm_id_priv);
1854	return 0;
1855
1856error:
1857	cm_deref_id(cm_id_priv);
1858	return ret;
1859}
1860
1861static int cm_establish_handler(struct cm_work *work)
1862{
1863	struct cm_id_private *cm_id_priv;
1864	int ret;
1865
1866	/* See comment in cm_establish about lookup. */
1867	cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
1868	if (!cm_id_priv)
1869		return -EINVAL;
1870
1871	spin_lock_irq(&cm_id_priv->lock);
1872	if (cm_id_priv->id.state != IB_CM_ESTABLISHED) {
1873		spin_unlock_irq(&cm_id_priv->lock);
1874		goto out;
1875	}
1876
1877	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1878	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1879	if (!ret)
1880		list_add_tail(&work->list, &cm_id_priv->work_list);
1881	spin_unlock_irq(&cm_id_priv->lock);
1882
1883	if (ret)
1884		cm_process_work(cm_id_priv, work);
1885	else
1886		cm_deref_id(cm_id_priv);
1887	return 0;
1888out:
1889	cm_deref_id(cm_id_priv);
1890	return -EINVAL;
1891}
1892
1893static int cm_rtu_handler(struct cm_work *work)
1894{
1895	struct cm_id_private *cm_id_priv;
1896	struct cm_rtu_msg *rtu_msg;
1897	int ret;
1898
1899	rtu_msg = (struct cm_rtu_msg *)work->mad_recv_wc->recv_buf.mad;
1900	cm_id_priv = cm_acquire_id(rtu_msg->remote_comm_id,
1901				   rtu_msg->local_comm_id);
1902	if (!cm_id_priv)
1903		return -EINVAL;
1904
1905	work->cm_event.private_data = &rtu_msg->private_data;
1906
1907	spin_lock_irq(&cm_id_priv->lock);
1908	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
1909	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
1910		spin_unlock_irq(&cm_id_priv->lock);
1911		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
1912				counter[CM_RTU_COUNTER]);
1913		goto out;
1914	}
1915	cm_id_priv->id.state = IB_CM_ESTABLISHED;
1916
1917	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1918	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1919	if (!ret)
1920		list_add_tail(&work->list, &cm_id_priv->work_list);
1921	spin_unlock_irq(&cm_id_priv->lock);
1922
1923	if (ret)
1924		cm_process_work(cm_id_priv, work);
1925	else
1926		cm_deref_id(cm_id_priv);
1927	return 0;
1928out:
1929	cm_deref_id(cm_id_priv);
1930	return -EINVAL;
1931}
1932
1933static void cm_format_dreq(struct cm_dreq_msg *dreq_msg,
1934			  struct cm_id_private *cm_id_priv,
1935			  const void *private_data,
1936			  u8 private_data_len)
1937{
1938	cm_format_mad_hdr(&dreq_msg->hdr, CM_DREQ_ATTR_ID,
1939			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_DREQ));
1940	dreq_msg->local_comm_id = cm_id_priv->id.local_id;
1941	dreq_msg->remote_comm_id = cm_id_priv->id.remote_id;
1942	cm_dreq_set_remote_qpn(dreq_msg, cm_id_priv->remote_qpn);
1943
1944	if (private_data && private_data_len)
1945		memcpy(dreq_msg->private_data, private_data, private_data_len);
1946}
1947
1948int ib_send_cm_dreq(struct ib_cm_id *cm_id,
1949		    const void *private_data,
1950		    u8 private_data_len)
1951{
1952	struct cm_id_private *cm_id_priv;
1953	struct ib_mad_send_buf *msg;
1954	unsigned long flags;
1955	int ret;
1956
1957	if (private_data && private_data_len > IB_CM_DREQ_PRIVATE_DATA_SIZE)
1958		return -EINVAL;
1959
1960	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1961	spin_lock_irqsave(&cm_id_priv->lock, flags);
1962	if (cm_id->state != IB_CM_ESTABLISHED) {
1963		ret = -EINVAL;
1964		goto out;
1965	}
1966
1967	ret = cm_alloc_msg(cm_id_priv, &msg);
1968	if (ret) {
1969		cm_enter_timewait(cm_id_priv);
1970		goto out;
1971	}
1972
1973	cm_format_dreq((struct cm_dreq_msg *) msg->mad, cm_id_priv,
1974		       private_data, private_data_len);
1975	msg->timeout_ms = cm_id_priv->timeout_ms;
1976	msg->context[1] = (void *) (unsigned long) IB_CM_DREQ_SENT;
1977
1978	ret = ib_post_send_mad(msg, NULL);
1979	if (ret) {
1980		cm_enter_timewait(cm_id_priv);
1981		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1982		cm_free_msg(msg);
1983		return ret;
1984	}
1985
1986	cm_id->state = IB_CM_DREQ_SENT;
1987	cm_id_priv->msg = msg;
1988out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1989	return ret;
1990}
1991EXPORT_SYMBOL(ib_send_cm_dreq);
1992
1993static void cm_format_drep(struct cm_drep_msg *drep_msg,
1994			  struct cm_id_private *cm_id_priv,
1995			  const void *private_data,
1996			  u8 private_data_len)
1997{
1998	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, cm_id_priv->tid);
1999	drep_msg->local_comm_id = cm_id_priv->id.local_id;
2000	drep_msg->remote_comm_id = cm_id_priv->id.remote_id;
2001
2002	if (private_data && private_data_len)
2003		memcpy(drep_msg->private_data, private_data, private_data_len);
2004}
2005
2006int ib_send_cm_drep(struct ib_cm_id *cm_id,
2007		    const void *private_data,
2008		    u8 private_data_len)
2009{
2010	struct cm_id_private *cm_id_priv;
2011	struct ib_mad_send_buf *msg;
2012	unsigned long flags;
2013	void *data;
2014	int ret;
2015
2016	if (private_data && private_data_len > IB_CM_DREP_PRIVATE_DATA_SIZE)
2017		return -EINVAL;
2018
2019	data = cm_copy_private_data(private_data, private_data_len);
2020	if (IS_ERR(data))
2021		return PTR_ERR(data);
2022
2023	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2024	spin_lock_irqsave(&cm_id_priv->lock, flags);
2025	if (cm_id->state != IB_CM_DREQ_RCVD) {
2026		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2027		kfree(data);
2028		return -EINVAL;
2029	}
2030
2031	cm_set_private_data(cm_id_priv, data, private_data_len);
2032	cm_enter_timewait(cm_id_priv);
2033
2034	ret = cm_alloc_msg(cm_id_priv, &msg);
2035	if (ret)
2036		goto out;
2037
2038	cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
2039		       private_data, private_data_len);
2040
2041	ret = ib_post_send_mad(msg, NULL);
2042	if (ret) {
2043		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2044		cm_free_msg(msg);
2045		return ret;
2046	}
2047
2048out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2049	return ret;
2050}
2051EXPORT_SYMBOL(ib_send_cm_drep);
2052
2053static int cm_issue_drep(struct cm_port *port,
2054			 struct ib_mad_recv_wc *mad_recv_wc)
2055{
2056	struct ib_mad_send_buf *msg = NULL;
2057	struct cm_dreq_msg *dreq_msg;
2058	struct cm_drep_msg *drep_msg;
2059	int ret;
2060
2061	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
2062	if (ret)
2063		return ret;
2064
2065	dreq_msg = (struct cm_dreq_msg *) mad_recv_wc->recv_buf.mad;
2066	drep_msg = (struct cm_drep_msg *) msg->mad;
2067
2068	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, dreq_msg->hdr.tid);
2069	drep_msg->remote_comm_id = dreq_msg->local_comm_id;
2070	drep_msg->local_comm_id = dreq_msg->remote_comm_id;
2071
2072	ret = ib_post_send_mad(msg, NULL);
2073	if (ret)
2074		cm_free_msg(msg);
2075
2076	return ret;
2077}
2078
2079static int cm_dreq_handler(struct cm_work *work)
2080{
2081	struct cm_id_private *cm_id_priv;
2082	struct cm_dreq_msg *dreq_msg;
2083	struct ib_mad_send_buf *msg = NULL;
2084	int ret;
2085
2086	dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
2087	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
2088				   dreq_msg->local_comm_id);
2089	if (!cm_id_priv) {
2090		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2091				counter[CM_DREQ_COUNTER]);
2092		cm_issue_drep(work->port, work->mad_recv_wc);
2093		return -EINVAL;
2094	}
2095
2096	work->cm_event.private_data = &dreq_msg->private_data;
2097
2098	spin_lock_irq(&cm_id_priv->lock);
2099	if (cm_id_priv->local_qpn != cm_dreq_get_remote_qpn(dreq_msg))
2100		goto unlock;
2101
2102	switch (cm_id_priv->id.state) {
2103	case IB_CM_REP_SENT:
2104	case IB_CM_DREQ_SENT:
2105		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2106		break;
2107	case IB_CM_ESTABLISHED:
2108	case IB_CM_MRA_REP_RCVD:
2109		break;
2110	case IB_CM_TIMEWAIT:
2111		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2112				counter[CM_DREQ_COUNTER]);
2113		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2114			goto unlock;
2115
2116		cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
2117			       cm_id_priv->private_data,
2118			       cm_id_priv->private_data_len);
2119		spin_unlock_irq(&cm_id_priv->lock);
2120
2121		if (ib_post_send_mad(msg, NULL))
2122			cm_free_msg(msg);
2123		goto deref;
2124	case IB_CM_DREQ_RCVD:
2125		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2126				counter[CM_DREQ_COUNTER]);
2127		goto unlock;
2128	default:
2129		goto unlock;
2130	}
2131	cm_id_priv->id.state = IB_CM_DREQ_RCVD;
2132	cm_id_priv->tid = dreq_msg->hdr.tid;
2133	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2134	if (!ret)
2135		list_add_tail(&work->list, &cm_id_priv->work_list);
2136	spin_unlock_irq(&cm_id_priv->lock);
2137
2138	if (ret)
2139		cm_process_work(cm_id_priv, work);
2140	else
2141		cm_deref_id(cm_id_priv);
2142	return 0;
2143
2144unlock:	spin_unlock_irq(&cm_id_priv->lock);
2145deref:	cm_deref_id(cm_id_priv);
2146	return -EINVAL;
2147}
2148
2149static int cm_drep_handler(struct cm_work *work)
2150{
2151	struct cm_id_private *cm_id_priv;
2152	struct cm_drep_msg *drep_msg;
2153	int ret;
2154
2155	drep_msg = (struct cm_drep_msg *)work->mad_recv_wc->recv_buf.mad;
2156	cm_id_priv = cm_acquire_id(drep_msg->remote_comm_id,
2157				   drep_msg->local_comm_id);
2158	if (!cm_id_priv)
2159		return -EINVAL;
2160
2161	work->cm_event.private_data = &drep_msg->private_data;
2162
2163	spin_lock_irq(&cm_id_priv->lock);
2164	if (cm_id_priv->id.state != IB_CM_DREQ_SENT &&
2165	    cm_id_priv->id.state != IB_CM_DREQ_RCVD) {
2166		spin_unlock_irq(&cm_id_priv->lock);
2167		goto out;
2168	}
2169	cm_enter_timewait(cm_id_priv);
2170
2171	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2172	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2173	if (!ret)
2174		list_add_tail(&work->list, &cm_id_priv->work_list);
2175	spin_unlock_irq(&cm_id_priv->lock);
2176
2177	if (ret)
2178		cm_process_work(cm_id_priv, work);
2179	else
2180		cm_deref_id(cm_id_priv);
2181	return 0;
2182out:
2183	cm_deref_id(cm_id_priv);
2184	return -EINVAL;
2185}
2186
2187int ib_send_cm_rej(struct ib_cm_id *cm_id,
2188		   enum ib_cm_rej_reason reason,
2189		   void *ari,
2190		   u8 ari_length,
2191		   const void *private_data,
2192		   u8 private_data_len)
2193{
2194	struct cm_id_private *cm_id_priv;
2195	struct ib_mad_send_buf *msg;
2196	unsigned long flags;
2197	int ret;
2198
2199	if ((private_data && private_data_len > IB_CM_REJ_PRIVATE_DATA_SIZE) ||
2200	    (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
2201		return -EINVAL;
2202
2203	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2204
2205	spin_lock_irqsave(&cm_id_priv->lock, flags);
2206	switch (cm_id->state) {
2207	case IB_CM_REQ_SENT:
2208	case IB_CM_MRA_REQ_RCVD:
2209	case IB_CM_REQ_RCVD:
2210	case IB_CM_MRA_REQ_SENT:
2211	case IB_CM_REP_RCVD:
2212	case IB_CM_MRA_REP_SENT:
2213		ret = cm_alloc_msg(cm_id_priv, &msg);
2214		if (!ret)
2215			cm_format_rej((struct cm_rej_msg *) msg->mad,
2216				      cm_id_priv, reason, ari, ari_length,
2217				      private_data, private_data_len);
2218
2219		cm_reset_to_idle(cm_id_priv);
2220		break;
2221	case IB_CM_REP_SENT:
2222	case IB_CM_MRA_REP_RCVD:
2223		ret = cm_alloc_msg(cm_id_priv, &msg);
2224		if (!ret)
2225			cm_format_rej((struct cm_rej_msg *) msg->mad,
2226				      cm_id_priv, reason, ari, ari_length,
2227				      private_data, private_data_len);
2228
2229		cm_enter_timewait(cm_id_priv);
2230		break;
2231	default:
2232		ret = -EINVAL;
2233		goto out;
2234	}
2235
2236	if (ret)
2237		goto out;
2238
2239	ret = ib_post_send_mad(msg, NULL);
2240	if (ret)
2241		cm_free_msg(msg);
2242
2243out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2244	return ret;
2245}
2246EXPORT_SYMBOL(ib_send_cm_rej);
2247
2248static void cm_format_rej_event(struct cm_work *work)
2249{
2250	struct cm_rej_msg *rej_msg;
2251	struct ib_cm_rej_event_param *param;
2252
2253	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2254	param = &work->cm_event.param.rej_rcvd;
2255	param->ari = rej_msg->ari;
2256	param->ari_length = cm_rej_get_reject_info_len(rej_msg);
2257	param->reason = __be16_to_cpu(rej_msg->reason);
2258	work->cm_event.private_data = &rej_msg->private_data;
2259}
2260
2261static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
2262{
2263	struct cm_timewait_info *timewait_info;
2264	struct cm_id_private *cm_id_priv;
2265	__be32 remote_id;
2266
2267	remote_id = rej_msg->local_comm_id;
2268
2269	if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_TIMEOUT) {
2270		spin_lock_irq(&cm.lock);
2271		timewait_info = cm_find_remote_id( *((__be64 *) rej_msg->ari),
2272						  remote_id);
2273		if (!timewait_info) {
2274			spin_unlock_irq(&cm.lock);
2275			return NULL;
2276		}
2277		cm_id_priv = idr_find(&cm.local_id_table, (__force int)
2278				      (timewait_info->work.local_id ^
2279				       cm.random_id_operand));
2280		if (cm_id_priv) {
2281			if (cm_id_priv->id.remote_id == remote_id)
2282				atomic_inc(&cm_id_priv->refcount);
2283			else
2284				cm_id_priv = NULL;
2285		}
2286		spin_unlock_irq(&cm.lock);
2287	} else if (cm_rej_get_msg_rejected(rej_msg) == CM_MSG_RESPONSE_REQ)
2288		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, 0);
2289	else
2290		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, remote_id);
2291
2292	return cm_id_priv;
2293}
2294
2295static int cm_rej_handler(struct cm_work *work)
2296{
2297	struct cm_id_private *cm_id_priv;
2298	struct cm_rej_msg *rej_msg;
2299	int ret;
2300
2301	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2302	cm_id_priv = cm_acquire_rejected_id(rej_msg);
2303	if (!cm_id_priv)
2304		return -EINVAL;
2305
2306	cm_format_rej_event(work);
2307
2308	spin_lock_irq(&cm_id_priv->lock);
2309	switch (cm_id_priv->id.state) {
2310	case IB_CM_REQ_SENT:
2311	case IB_CM_MRA_REQ_RCVD:
2312	case IB_CM_REP_SENT:
2313	case IB_CM_MRA_REP_RCVD:
2314		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2315		/* fall through */
2316	case IB_CM_REQ_RCVD:
2317	case IB_CM_MRA_REQ_SENT:
2318		if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_STALE_CONN)
2319			cm_enter_timewait(cm_id_priv);
2320		else
2321			cm_reset_to_idle(cm_id_priv);
2322		break;
2323	case IB_CM_DREQ_SENT:
2324		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2325		/* fall through */
2326	case IB_CM_REP_RCVD:
2327	case IB_CM_MRA_REP_SENT:
2328	case IB_CM_ESTABLISHED:
2329		cm_enter_timewait(cm_id_priv);
2330		break;
2331	default:
2332		spin_unlock_irq(&cm_id_priv->lock);
2333		ret = -EINVAL;
2334		goto out;
2335	}
2336
2337	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2338	if (!ret)
2339		list_add_tail(&work->list, &cm_id_priv->work_list);
2340	spin_unlock_irq(&cm_id_priv->lock);
2341
2342	if (ret)
2343		cm_process_work(cm_id_priv, work);
2344	else
2345		cm_deref_id(cm_id_priv);
2346	return 0;
2347out:
2348	cm_deref_id(cm_id_priv);
2349	return -EINVAL;
2350}
2351
2352int ib_send_cm_mra(struct ib_cm_id *cm_id,
2353		   u8 service_timeout,
2354		   const void *private_data,
2355		   u8 private_data_len)
2356{
2357	struct cm_id_private *cm_id_priv;
2358	struct ib_mad_send_buf *msg;
2359	enum ib_cm_state cm_state;
2360	enum ib_cm_lap_state lap_state;
2361	enum cm_msg_response msg_response;
2362	void *data;
2363	unsigned long flags;
2364	int ret;
2365
2366	if (private_data && private_data_len > IB_CM_MRA_PRIVATE_DATA_SIZE)
2367		return -EINVAL;
2368
2369	data = cm_copy_private_data(private_data, private_data_len);
2370	if (IS_ERR(data))
2371		return PTR_ERR(data);
2372
2373	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2374
2375	spin_lock_irqsave(&cm_id_priv->lock, flags);
2376	switch(cm_id_priv->id.state) {
2377	case IB_CM_REQ_RCVD:
2378		cm_state = IB_CM_MRA_REQ_SENT;
2379		lap_state = cm_id->lap_state;
2380		msg_response = CM_MSG_RESPONSE_REQ;
2381		break;
2382	case IB_CM_REP_RCVD:
2383		cm_state = IB_CM_MRA_REP_SENT;
2384		lap_state = cm_id->lap_state;
2385		msg_response = CM_MSG_RESPONSE_REP;
2386		break;
2387	case IB_CM_ESTABLISHED:
2388		cm_state = cm_id->state;
2389		lap_state = IB_CM_MRA_LAP_SENT;
2390		msg_response = CM_MSG_RESPONSE_OTHER;
2391		break;
2392	default:
2393		ret = -EINVAL;
2394		goto error1;
2395	}
2396
2397	if (!(service_timeout & IB_CM_MRA_FLAG_DELAY)) {
2398		ret = cm_alloc_msg(cm_id_priv, &msg);
2399		if (ret)
2400			goto error1;
2401
2402		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2403			      msg_response, service_timeout,
2404			      private_data, private_data_len);
2405		ret = ib_post_send_mad(msg, NULL);
2406		if (ret)
2407			goto error2;
2408	}
2409
2410	cm_id->state = cm_state;
2411	cm_id->lap_state = lap_state;
2412	cm_id_priv->service_timeout = service_timeout;
2413	cm_set_private_data(cm_id_priv, data, private_data_len);
2414	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2415	return 0;
2416
2417error1:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2418	kfree(data);
2419	return ret;
2420
2421error2:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2422	kfree(data);
2423	cm_free_msg(msg);
2424	return ret;
2425}
2426EXPORT_SYMBOL(ib_send_cm_mra);
2427
2428static struct cm_id_private * cm_acquire_mraed_id(struct cm_mra_msg *mra_msg)
2429{
2430	switch (cm_mra_get_msg_mraed(mra_msg)) {
2431	case CM_MSG_RESPONSE_REQ:
2432		return cm_acquire_id(mra_msg->remote_comm_id, 0);
2433	case CM_MSG_RESPONSE_REP:
2434	case CM_MSG_RESPONSE_OTHER:
2435		return cm_acquire_id(mra_msg->remote_comm_id,
2436				     mra_msg->local_comm_id);
2437	default:
2438		return NULL;
2439	}
2440}
2441
2442static int cm_mra_handler(struct cm_work *work)
2443{
2444	struct cm_id_private *cm_id_priv;
2445	struct cm_mra_msg *mra_msg;
2446	int timeout, ret;
2447
2448	mra_msg = (struct cm_mra_msg *)work->mad_recv_wc->recv_buf.mad;
2449	cm_id_priv = cm_acquire_mraed_id(mra_msg);
2450	if (!cm_id_priv)
2451		return -EINVAL;
2452
2453	work->cm_event.private_data = &mra_msg->private_data;
2454	work->cm_event.param.mra_rcvd.service_timeout =
2455					cm_mra_get_service_timeout(mra_msg);
2456	timeout = cm_convert_to_ms(cm_mra_get_service_timeout(mra_msg)) +
2457		  cm_convert_to_ms(cm_id_priv->av.timeout);
2458
2459	spin_lock_irq(&cm_id_priv->lock);
2460	switch (cm_id_priv->id.state) {
2461	case IB_CM_REQ_SENT:
2462		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REQ ||
2463		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2464				  cm_id_priv->msg, timeout))
2465			goto out;
2466		cm_id_priv->id.state = IB_CM_MRA_REQ_RCVD;
2467		break;
2468	case IB_CM_REP_SENT:
2469		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REP ||
2470		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2471				  cm_id_priv->msg, timeout))
2472			goto out;
2473		cm_id_priv->id.state = IB_CM_MRA_REP_RCVD;
2474		break;
2475	case IB_CM_ESTABLISHED:
2476		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_OTHER ||
2477		    cm_id_priv->id.lap_state != IB_CM_LAP_SENT ||
2478		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2479				  cm_id_priv->msg, timeout)) {
2480			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
2481				atomic_long_inc(&work->port->
2482						counter_group[CM_RECV_DUPLICATES].
2483						counter[CM_MRA_COUNTER]);
2484			goto out;
2485		}
2486		cm_id_priv->id.lap_state = IB_CM_MRA_LAP_RCVD;
2487		break;
2488	case IB_CM_MRA_REQ_RCVD:
2489	case IB_CM_MRA_REP_RCVD:
2490		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2491				counter[CM_MRA_COUNTER]);
2492		/* fall through */
2493	default:
2494		goto out;
2495	}
2496
2497	cm_id_priv->msg->context[1] = (void *) (unsigned long)
2498				      cm_id_priv->id.state;
2499	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2500	if (!ret)
2501		list_add_tail(&work->list, &cm_id_priv->work_list);
2502	spin_unlock_irq(&cm_id_priv->lock);
2503
2504	if (ret)
2505		cm_process_work(cm_id_priv, work);
2506	else
2507		cm_deref_id(cm_id_priv);
2508	return 0;
2509out:
2510	spin_unlock_irq(&cm_id_priv->lock);
2511	cm_deref_id(cm_id_priv);
2512	return -EINVAL;
2513}
2514
2515static void cm_format_lap(struct cm_lap_msg *lap_msg,
2516			  struct cm_id_private *cm_id_priv,
2517			  struct ib_sa_path_rec *alternate_path,
2518			  const void *private_data,
2519			  u8 private_data_len)
2520{
2521	cm_format_mad_hdr(&lap_msg->hdr, CM_LAP_ATTR_ID,
2522			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_LAP));
2523	lap_msg->local_comm_id = cm_id_priv->id.local_id;
2524	lap_msg->remote_comm_id = cm_id_priv->id.remote_id;
2525	cm_lap_set_remote_qpn(lap_msg, cm_id_priv->remote_qpn);
2526	/* todo: need remote CM response timeout */
2527	cm_lap_set_remote_resp_timeout(lap_msg, 0x1F);
2528	lap_msg->alt_local_lid = alternate_path->slid;
2529	lap_msg->alt_remote_lid = alternate_path->dlid;
2530	lap_msg->alt_local_gid = alternate_path->sgid;
2531	lap_msg->alt_remote_gid = alternate_path->dgid;
2532	cm_lap_set_flow_label(lap_msg, alternate_path->flow_label);
2533	cm_lap_set_traffic_class(lap_msg, alternate_path->traffic_class);
2534	lap_msg->alt_hop_limit = alternate_path->hop_limit;
2535	cm_lap_set_packet_rate(lap_msg, alternate_path->rate);
2536	cm_lap_set_sl(lap_msg, alternate_path->sl);
2537	cm_lap_set_subnet_local(lap_msg, 1); /* local only... */
2538	cm_lap_set_local_ack_timeout(lap_msg,
2539		cm_ack_timeout(cm_id_priv->av.port->cm_dev->ack_delay,
2540			       alternate_path->packet_life_time));
2541
2542	if (private_data && private_data_len)
2543		memcpy(lap_msg->private_data, private_data, private_data_len);
2544}
2545
2546int ib_send_cm_lap(struct ib_cm_id *cm_id,
2547		   struct ib_sa_path_rec *alternate_path,
2548		   const void *private_data,
2549		   u8 private_data_len)
2550{
2551	struct cm_id_private *cm_id_priv;
2552	struct ib_mad_send_buf *msg;
2553	unsigned long flags;
2554	int ret;
2555
2556	if (private_data && private_data_len > IB_CM_LAP_PRIVATE_DATA_SIZE)
2557		return -EINVAL;
2558
2559	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2560	spin_lock_irqsave(&cm_id_priv->lock, flags);
2561	if (cm_id->state != IB_CM_ESTABLISHED ||
2562	    (cm_id->lap_state != IB_CM_LAP_UNINIT &&
2563	     cm_id->lap_state != IB_CM_LAP_IDLE)) {
2564		ret = -EINVAL;
2565		goto out;
2566	}
2567
2568	ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
2569	if (ret)
2570		goto out;
2571	cm_id_priv->alt_av.timeout =
2572			cm_ack_timeout(cm_id_priv->target_ack_delay,
2573				       cm_id_priv->alt_av.timeout - 1);
2574
2575	ret = cm_alloc_msg(cm_id_priv, &msg);
2576	if (ret)
2577		goto out;
2578
2579	cm_format_lap((struct cm_lap_msg *) msg->mad, cm_id_priv,
2580		      alternate_path, private_data, private_data_len);
2581	msg->timeout_ms = cm_id_priv->timeout_ms;
2582	msg->context[1] = (void *) (unsigned long) IB_CM_ESTABLISHED;
2583
2584	ret = ib_post_send_mad(msg, NULL);
2585	if (ret) {
2586		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2587		cm_free_msg(msg);
2588		return ret;
2589	}
2590
2591	cm_id->lap_state = IB_CM_LAP_SENT;
2592	cm_id_priv->msg = msg;
2593
2594out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2595	return ret;
2596}
2597EXPORT_SYMBOL(ib_send_cm_lap);
2598
2599static void cm_format_path_from_lap(struct cm_id_private *cm_id_priv,
2600				    struct ib_sa_path_rec *path,
2601				    struct cm_lap_msg *lap_msg)
2602{
2603	memset(path, 0, sizeof *path);
2604	path->dgid = lap_msg->alt_local_gid;
2605	path->sgid = lap_msg->alt_remote_gid;
2606	path->dlid = lap_msg->alt_local_lid;
2607	path->slid = lap_msg->alt_remote_lid;
2608	path->flow_label = cm_lap_get_flow_label(lap_msg);
2609	path->hop_limit = lap_msg->alt_hop_limit;
2610	path->traffic_class = cm_lap_get_traffic_class(lap_msg);
2611	path->reversible = 1;
2612	path->pkey = cm_id_priv->pkey;
2613	path->sl = cm_lap_get_sl(lap_msg);
2614	path->mtu_selector = IB_SA_EQ;
2615	path->mtu = cm_id_priv->path_mtu;
2616	path->rate_selector = IB_SA_EQ;
2617	path->rate = cm_lap_get_packet_rate(lap_msg);
2618	path->packet_life_time_selector = IB_SA_EQ;
2619	path->packet_life_time = cm_lap_get_local_ack_timeout(lap_msg);
2620	path->packet_life_time -= (path->packet_life_time > 0);
2621}
2622
2623static int cm_lap_handler(struct cm_work *work)
2624{
2625	struct cm_id_private *cm_id_priv;
2626	struct cm_lap_msg *lap_msg;
2627	struct ib_cm_lap_event_param *param;
2628	struct ib_mad_send_buf *msg = NULL;
2629	int ret;
2630
2631	/* todo: verify LAP request and send reject APR if invalid. */
2632	lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;
2633	cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,
2634				   lap_msg->local_comm_id);
2635	if (!cm_id_priv)
2636		return -EINVAL;
2637
2638	param = &work->cm_event.param.lap_rcvd;
2639	param->alternate_path = &work->path[0];
2640	cm_format_path_from_lap(cm_id_priv, param->alternate_path, lap_msg);
2641	work->cm_event.private_data = &lap_msg->private_data;
2642
2643	spin_lock_irq(&cm_id_priv->lock);
2644	if (cm_id_priv->id.state != IB_CM_ESTABLISHED)
2645		goto unlock;
2646
2647	switch (cm_id_priv->id.lap_state) {
2648	case IB_CM_LAP_UNINIT:
2649	case IB_CM_LAP_IDLE:
2650		break;
2651	case IB_CM_MRA_LAP_SENT:
2652		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2653				counter[CM_LAP_COUNTER]);
2654		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2655			goto unlock;
2656
2657		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2658			      CM_MSG_RESPONSE_OTHER,
2659			      cm_id_priv->service_timeout,
2660			      cm_id_priv->private_data,
2661			      cm_id_priv->private_data_len);
2662		spin_unlock_irq(&cm_id_priv->lock);
2663
2664		if (ib_post_send_mad(msg, NULL))
2665			cm_free_msg(msg);
2666		goto deref;
2667	case IB_CM_LAP_RCVD:
2668		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2669				counter[CM_LAP_COUNTER]);
2670		goto unlock;
2671	default:
2672		goto unlock;
2673	}
2674
2675	cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
2676	cm_id_priv->tid = lap_msg->hdr.tid;
2677	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
2678				work->mad_recv_wc->recv_buf.grh,
2679				&cm_id_priv->av);
2680	cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
2681	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2682	if (!ret)
2683		list_add_tail(&work->list, &cm_id_priv->work_list);
2684	spin_unlock_irq(&cm_id_priv->lock);
2685
2686	if (ret)
2687		cm_process_work(cm_id_priv, work);
2688	else
2689		cm_deref_id(cm_id_priv);
2690	return 0;
2691
2692unlock:	spin_unlock_irq(&cm_id_priv->lock);
2693deref:	cm_deref_id(cm_id_priv);
2694	return -EINVAL;
2695}
2696
2697static void cm_format_apr(struct cm_apr_msg *apr_msg,
2698			  struct cm_id_private *cm_id_priv,
2699			  enum ib_cm_apr_status status,
2700			  void *info,
2701			  u8 info_length,
2702			  const void *private_data,
2703			  u8 private_data_len)
2704{
2705	cm_format_mad_hdr(&apr_msg->hdr, CM_APR_ATTR_ID, cm_id_priv->tid);
2706	apr_msg->local_comm_id = cm_id_priv->id.local_id;
2707	apr_msg->remote_comm_id = cm_id_priv->id.remote_id;
2708	apr_msg->ap_status = (u8) status;
2709
2710	if (info && info_length) {
2711		apr_msg->info_length = info_length;
2712		memcpy(apr_msg->info, info, info_length);
2713	}
2714
2715	if (private_data && private_data_len)
2716		memcpy(apr_msg->private_data, private_data, private_data_len);
2717}
2718
2719int ib_send_cm_apr(struct ib_cm_id *cm_id,
2720		   enum ib_cm_apr_status status,
2721		   void *info,
2722		   u8 info_length,
2723		   const void *private_data,
2724		   u8 private_data_len)
2725{
2726	struct cm_id_private *cm_id_priv;
2727	struct ib_mad_send_buf *msg;
2728	unsigned long flags;
2729	int ret;
2730
2731	if ((private_data && private_data_len > IB_CM_APR_PRIVATE_DATA_SIZE) ||
2732	    (info && info_length > IB_CM_APR_INFO_LENGTH))
2733		return -EINVAL;
2734
2735	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2736	spin_lock_irqsave(&cm_id_priv->lock, flags);
2737	if (cm_id->state != IB_CM_ESTABLISHED ||
2738	    (cm_id->lap_state != IB_CM_LAP_RCVD &&
2739	     cm_id->lap_state != IB_CM_MRA_LAP_SENT)) {
2740		ret = -EINVAL;
2741		goto out;
2742	}
2743
2744	ret = cm_alloc_msg(cm_id_priv, &msg);
2745	if (ret)
2746		goto out;
2747
2748	cm_format_apr((struct cm_apr_msg *) msg->mad, cm_id_priv, status,
2749		      info, info_length, private_data, private_data_len);
2750	ret = ib_post_send_mad(msg, NULL);
2751	if (ret) {
2752		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2753		cm_free_msg(msg);
2754		return ret;
2755	}
2756
2757	cm_id->lap_state = IB_CM_LAP_IDLE;
2758out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2759	return ret;
2760}
2761EXPORT_SYMBOL(ib_send_cm_apr);
2762
2763static int cm_apr_handler(struct cm_work *work)
2764{
2765	struct cm_id_private *cm_id_priv;
2766	struct cm_apr_msg *apr_msg;
2767	int ret;
2768
2769	apr_msg = (struct cm_apr_msg *)work->mad_recv_wc->recv_buf.mad;
2770	cm_id_priv = cm_acquire_id(apr_msg->remote_comm_id,
2771				   apr_msg->local_comm_id);
2772	if (!cm_id_priv)
2773		return -EINVAL; /* Unmatched reply. */
2774
2775	work->cm_event.param.apr_rcvd.ap_status = apr_msg->ap_status;
2776	work->cm_event.param.apr_rcvd.apr_info = &apr_msg->info;
2777	work->cm_event.param.apr_rcvd.info_len = apr_msg->info_length;
2778	work->cm_event.private_data = &apr_msg->private_data;
2779
2780	spin_lock_irq(&cm_id_priv->lock);
2781	if (cm_id_priv->id.state != IB_CM_ESTABLISHED ||
2782	    (cm_id_priv->id.lap_state != IB_CM_LAP_SENT &&
2783	     cm_id_priv->id.lap_state != IB_CM_MRA_LAP_RCVD)) {
2784		spin_unlock_irq(&cm_id_priv->lock);
2785		goto out;
2786	}
2787	cm_id_priv->id.lap_state = IB_CM_LAP_IDLE;
2788	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2789	cm_id_priv->msg = NULL;
2790
2791	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2792	if (!ret)
2793		list_add_tail(&work->list, &cm_id_priv->work_list);
2794	spin_unlock_irq(&cm_id_priv->lock);
2795
2796	if (ret)
2797		cm_process_work(cm_id_priv, work);
2798	else
2799		cm_deref_id(cm_id_priv);
2800	return 0;
2801out:
2802	cm_deref_id(cm_id_priv);
2803	return -EINVAL;
2804}
2805
2806static int cm_timewait_handler(struct cm_work *work)
2807{
2808	struct cm_timewait_info *timewait_info;
2809	struct cm_id_private *cm_id_priv;
2810	int ret;
2811
2812	timewait_info = (struct cm_timewait_info *)work;
2813	spin_lock_irq(&cm.lock);
2814	list_del(&timewait_info->list);
2815	spin_unlock_irq(&cm.lock);
2816
2817	cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
2818				   timewait_info->work.remote_id);
2819	if (!cm_id_priv)
2820		return -EINVAL;
2821
2822	spin_lock_irq(&cm_id_priv->lock);
2823	if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
2824	    cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
2825		spin_unlock_irq(&cm_id_priv->lock);
2826		goto out;
2827	}
2828	cm_id_priv->id.state = IB_CM_IDLE;
2829	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2830	if (!ret)
2831		list_add_tail(&work->list, &cm_id_priv->work_list);
2832	spin_unlock_irq(&cm_id_priv->lock);
2833
2834	if (ret)
2835		cm_process_work(cm_id_priv, work);
2836	else
2837		cm_deref_id(cm_id_priv);
2838	return 0;
2839out:
2840	cm_deref_id(cm_id_priv);
2841	return -EINVAL;
2842}
2843
2844static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
2845			       struct cm_id_private *cm_id_priv,
2846			       struct ib_cm_sidr_req_param *param)
2847{
2848	cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
2849			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
2850	sidr_req_msg->request_id = cm_id_priv->id.local_id;
2851	sidr_req_msg->pkey = cpu_to_be16(param->path->pkey);
2852	sidr_req_msg->service_id = param->service_id;
2853
2854	if (param->private_data && param->private_data_len)
2855		memcpy(sidr_req_msg->private_data, param->private_data,
2856		       param->private_data_len);
2857}
2858
2859int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
2860			struct ib_cm_sidr_req_param *param)
2861{
2862	struct cm_id_private *cm_id_priv;
2863	struct ib_mad_send_buf *msg;
2864	unsigned long flags;
2865	int ret;
2866
2867	if (!param->path || (param->private_data &&
2868	     param->private_data_len > IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE))
2869		return -EINVAL;
2870
2871	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2872	ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
2873	if (ret)
2874		goto out;
2875
2876	cm_id->service_id = param->service_id;
2877	cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
2878	cm_id_priv->timeout_ms = param->timeout_ms;
2879	cm_id_priv->max_cm_retries = param->max_cm_retries;
2880	ret = cm_alloc_msg(cm_id_priv, &msg);
2881	if (ret)
2882		goto out;
2883
2884	cm_format_sidr_req((struct cm_sidr_req_msg *) msg->mad, cm_id_priv,
2885			   param);
2886	msg->timeout_ms = cm_id_priv->timeout_ms;
2887	msg->context[1] = (void *) (unsigned long) IB_CM_SIDR_REQ_SENT;
2888
2889	spin_lock_irqsave(&cm_id_priv->lock, flags);
2890	if (cm_id->state == IB_CM_IDLE)
2891		ret = ib_post_send_mad(msg, NULL);
2892	else
2893		ret = -EINVAL;
2894
2895	if (ret) {
2896		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2897		cm_free_msg(msg);
2898		goto out;
2899	}
2900	cm_id->state = IB_CM_SIDR_REQ_SENT;
2901	cm_id_priv->msg = msg;
2902	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2903out:
2904	return ret;
2905}
2906EXPORT_SYMBOL(ib_send_cm_sidr_req);
2907
2908static void cm_format_sidr_req_event(struct cm_work *work,
2909				     struct ib_cm_id *listen_id)
2910{
2911	struct cm_sidr_req_msg *sidr_req_msg;
2912	struct ib_cm_sidr_req_event_param *param;
2913
2914	sidr_req_msg = (struct cm_sidr_req_msg *)
2915				work->mad_recv_wc->recv_buf.mad;
2916	param = &work->cm_event.param.sidr_req_rcvd;
2917	param->pkey = __be16_to_cpu(sidr_req_msg->pkey);
2918	param->listen_id = listen_id;
2919	param->port = work->port->port_num;
2920	work->cm_event.private_data = &sidr_req_msg->private_data;
2921}
2922
2923static int cm_sidr_req_handler(struct cm_work *work)
2924{
2925	struct ib_cm_id *cm_id;
2926	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
2927	struct cm_sidr_req_msg *sidr_req_msg;
2928	struct ib_wc *wc;
2929
2930	cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
2931	if (IS_ERR(cm_id))
2932		return PTR_ERR(cm_id);
2933	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2934
2935	/* Record SGID/SLID and request ID for lookup. */
2936	sidr_req_msg = (struct cm_sidr_req_msg *)
2937				work->mad_recv_wc->recv_buf.mad;
2938	wc = work->mad_recv_wc->wc;
2939	cm_id_priv->av.dgid.global.subnet_prefix = cpu_to_be64(wc->slid);
2940	cm_id_priv->av.dgid.global.interface_id = 0;
2941	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
2942				work->mad_recv_wc->recv_buf.grh,
2943				&cm_id_priv->av);
2944	cm_id_priv->id.remote_id = sidr_req_msg->request_id;
2945	cm_id_priv->tid = sidr_req_msg->hdr.tid;
2946	atomic_inc(&cm_id_priv->work_count);
2947
2948	spin_lock_irq(&cm.lock);
2949	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
2950	if (cur_cm_id_priv) {
2951		spin_unlock_irq(&cm.lock);
2952		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
2953				counter[CM_SIDR_REQ_COUNTER]);
2954		goto out; /* Duplicate message. */
2955	}
2956	cm_id_priv->id.state = IB_CM_SIDR_REQ_RCVD;
2957	cur_cm_id_priv = cm_find_listen(cm_id->device,
2958					sidr_req_msg->service_id,
2959					sidr_req_msg->private_data);
2960	if (!cur_cm_id_priv) {
2961		spin_unlock_irq(&cm.lock);
2962		cm_reject_sidr_req(cm_id_priv, IB_SIDR_UNSUPPORTED);
2963		goto out; /* No match. */
2964	}
2965	atomic_inc(&cur_cm_id_priv->refcount);
2966	spin_unlock_irq(&cm.lock);
2967
2968	cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
2969	cm_id_priv->id.context = cur_cm_id_priv->id.context;
2970	cm_id_priv->id.service_id = sidr_req_msg->service_id;
2971	cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
2972
2973	cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
2974	cm_process_work(cm_id_priv, work);
2975	cm_deref_id(cur_cm_id_priv);
2976	return 0;
2977out:
2978	ib_destroy_cm_id(&cm_id_priv->id);
2979	return -EINVAL;
2980}
2981
2982static void cm_format_sidr_rep(struct cm_sidr_rep_msg *sidr_rep_msg,
2983			       struct cm_id_private *cm_id_priv,
2984			       struct ib_cm_sidr_rep_param *param)
2985{
2986	cm_format_mad_hdr(&sidr_rep_msg->hdr, CM_SIDR_REP_ATTR_ID,
2987			  cm_id_priv->tid);
2988	sidr_rep_msg->request_id = cm_id_priv->id.remote_id;
2989	sidr_rep_msg->status = param->status;
2990	cm_sidr_rep_set_qpn(sidr_rep_msg, cpu_to_be32(param->qp_num));
2991	sidr_rep_msg->service_id = cm_id_priv->id.service_id;
2992	sidr_rep_msg->qkey = cpu_to_be32(param->qkey);
2993
2994	if (param->info && param->info_length)
2995		memcpy(sidr_rep_msg->info, param->info, param->info_length);
2996
2997	if (param->private_data && param->private_data_len)
2998		memcpy(sidr_rep_msg->private_data, param->private_data,
2999		       param->private_data_len);
3000}
3001
3002int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
3003			struct ib_cm_sidr_rep_param *param)
3004{
3005	struct cm_id_private *cm_id_priv;
3006	struct ib_mad_send_buf *msg;
3007	unsigned long flags;
3008	int ret;
3009
3010	if ((param->info && param->info_length > IB_CM_SIDR_REP_INFO_LENGTH) ||
3011	    (param->private_data &&
3012	     param->private_data_len > IB_CM_SIDR_REP_PRIVATE_DATA_SIZE))
3013		return -EINVAL;
3014
3015	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3016	spin_lock_irqsave(&cm_id_priv->lock, flags);
3017	if (cm_id->state != IB_CM_SIDR_REQ_RCVD) {
3018		ret = -EINVAL;
3019		goto error;
3020	}
3021
3022	ret = cm_alloc_msg(cm_id_priv, &msg);
3023	if (ret)
3024		goto error;
3025
3026	cm_format_sidr_rep((struct cm_sidr_rep_msg *) msg->mad, cm_id_priv,
3027			   param);
3028	ret = ib_post_send_mad(msg, NULL);
3029	if (ret) {
3030		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3031		cm_free_msg(msg);
3032		return ret;
3033	}
3034	cm_id->state = IB_CM_IDLE;
3035	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3036
3037	spin_lock_irqsave(&cm.lock, flags);
3038	rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
3039	spin_unlock_irqrestore(&cm.lock, flags);
3040	return 0;
3041
3042error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3043	return ret;
3044}
3045EXPORT_SYMBOL(ib_send_cm_sidr_rep);
3046
3047static void cm_format_sidr_rep_event(struct cm_work *work)
3048{
3049	struct cm_sidr_rep_msg *sidr_rep_msg;
3050	struct ib_cm_sidr_rep_event_param *param;
3051
3052	sidr_rep_msg = (struct cm_sidr_rep_msg *)
3053				work->mad_recv_wc->recv_buf.mad;
3054	param = &work->cm_event.param.sidr_rep_rcvd;
3055	param->status = sidr_rep_msg->status;
3056	param->qkey = be32_to_cpu(sidr_rep_msg->qkey);
3057	param->qpn = be32_to_cpu(cm_sidr_rep_get_qpn(sidr_rep_msg));
3058	param->info = &sidr_rep_msg->info;
3059	param->info_len = sidr_rep_msg->info_length;
3060	work->cm_event.private_data = &sidr_rep_msg->private_data;
3061}
3062
3063static int cm_sidr_rep_handler(struct cm_work *work)
3064{
3065	struct cm_sidr_rep_msg *sidr_rep_msg;
3066	struct cm_id_private *cm_id_priv;
3067
3068	sidr_rep_msg = (struct cm_sidr_rep_msg *)
3069				work->mad_recv_wc->recv_buf.mad;
3070	cm_id_priv = cm_acquire_id(sidr_rep_msg->request_id, 0);
3071	if (!cm_id_priv)
3072		return -EINVAL; /* Unmatched reply. */
3073
3074	spin_lock_irq(&cm_id_priv->lock);
3075	if (cm_id_priv->id.state != IB_CM_SIDR_REQ_SENT) {
3076		spin_unlock_irq(&cm_id_priv->lock);
3077		goto out;
3078	}
3079	cm_id_priv->id.state = IB_CM_IDLE;
3080	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
3081	spin_unlock_irq(&cm_id_priv->lock);
3082
3083	cm_format_sidr_rep_event(work);
3084	cm_process_work(cm_id_priv, work);
3085	return 0;
3086out:
3087	cm_deref_id(cm_id_priv);
3088	return -EINVAL;
3089}
3090
3091static void cm_process_send_error(struct ib_mad_send_buf *msg,
3092				  enum ib_wc_status wc_status)
3093{
3094	struct cm_id_private *cm_id_priv;
3095	struct ib_cm_event cm_event;
3096	enum ib_cm_state state;
3097	int ret;
3098
3099	memset(&cm_event, 0, sizeof cm_event);
3100	cm_id_priv = msg->context[0];
3101
3102	/* Discard old sends or ones without a response. */
3103	spin_lock_irq(&cm_id_priv->lock);
3104	state = (enum ib_cm_state) (unsigned long) msg->context[1];
3105	if (msg != cm_id_priv->msg || state != cm_id_priv->id.state)
3106		goto discard;
3107
3108	switch (state) {
3109	case IB_CM_REQ_SENT:
3110	case IB_CM_MRA_REQ_RCVD:
3111		cm_reset_to_idle(cm_id_priv);
3112		cm_event.event = IB_CM_REQ_ERROR;
3113		break;
3114	case IB_CM_REP_SENT:
3115	case IB_CM_MRA_REP_RCVD:
3116		cm_reset_to_idle(cm_id_priv);
3117		cm_event.event = IB_CM_REP_ERROR;
3118		break;
3119	case IB_CM_DREQ_SENT:
3120		cm_enter_timewait(cm_id_priv);
3121		cm_event.event = IB_CM_DREQ_ERROR;
3122		break;
3123	case IB_CM_SIDR_REQ_SENT:
3124		cm_id_priv->id.state = IB_CM_IDLE;
3125		cm_event.event = IB_CM_SIDR_REQ_ERROR;
3126		break;
3127	default:
3128		goto discard;
3129	}
3130	spin_unlock_irq(&cm_id_priv->lock);
3131	cm_event.param.send_status = wc_status;
3132
3133	/* No other events can occur on the cm_id at this point. */
3134	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &cm_event);
3135	cm_free_msg(msg);
3136	if (ret)
3137		ib_destroy_cm_id(&cm_id_priv->id);
3138	return;
3139discard:
3140	spin_unlock_irq(&cm_id_priv->lock);
3141	cm_free_msg(msg);
3142}
3143
3144static void cm_send_handler(struct ib_mad_agent *mad_agent,
3145			    struct ib_mad_send_wc *mad_send_wc)
3146{
3147	struct ib_mad_send_buf *msg = mad_send_wc->send_buf;
3148	struct cm_port *port;
3149	u16 attr_index;
3150
3151	port = mad_agent->context;
3152	attr_index = be16_to_cpu(((struct ib_mad_hdr *)
3153				  msg->mad)->attr_id) - CM_ATTR_ID_OFFSET;
3154
3155	/*
3156	 * If the send was in response to a received message (context[0] is not
3157	 * set to a cm_id), and is not a REJ, then it is a send that was
3158	 * manually retried.
3159	 */
3160	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
3161		msg->retries = 1;
3162
3163	atomic_long_add(1 + msg->retries,
3164			&port->counter_group[CM_XMIT].counter[attr_index]);
3165	if (msg->retries)
3166		atomic_long_add(msg->retries,
3167				&port->counter_group[CM_XMIT_RETRIES].
3168				counter[attr_index]);
3169
3170	switch (mad_send_wc->status) {
3171	case IB_WC_SUCCESS:
3172	case IB_WC_WR_FLUSH_ERR:
3173		cm_free_msg(msg);
3174		break;
3175	default:
3176		if (msg->context[0] && msg->context[1])
3177			cm_process_send_error(msg, mad_send_wc->status);
3178		else
3179			cm_free_msg(msg);
3180		break;
3181	}
3182}
3183
3184static void cm_work_handler(struct work_struct *_work)
3185{
3186	struct cm_work *work = container_of(_work, struct cm_work, work.work);
3187	int ret;
3188
3189	switch (work->cm_event.event) {
3190	case IB_CM_REQ_RECEIVED:
3191		ret = cm_req_handler(work);
3192		break;
3193	case IB_CM_MRA_RECEIVED:
3194		ret = cm_mra_handler(work);
3195		break;
3196	case IB_CM_REJ_RECEIVED:
3197		ret = cm_rej_handler(work);
3198		break;
3199	case IB_CM_REP_RECEIVED:
3200		ret = cm_rep_handler(work);
3201		break;
3202	case IB_CM_RTU_RECEIVED:
3203		ret = cm_rtu_handler(work);
3204		break;
3205	case IB_CM_USER_ESTABLISHED:
3206		ret = cm_establish_handler(work);
3207		break;
3208	case IB_CM_DREQ_RECEIVED:
3209		ret = cm_dreq_handler(work);
3210		break;
3211	case IB_CM_DREP_RECEIVED:
3212		ret = cm_drep_handler(work);
3213		break;
3214	case IB_CM_SIDR_REQ_RECEIVED:
3215		ret = cm_sidr_req_handler(work);
3216		break;
3217	case IB_CM_SIDR_REP_RECEIVED:
3218		ret = cm_sidr_rep_handler(work);
3219		break;
3220	case IB_CM_LAP_RECEIVED:
3221		ret = cm_lap_handler(work);
3222		break;
3223	case IB_CM_APR_RECEIVED:
3224		ret = cm_apr_handler(work);
3225		break;
3226	case IB_CM_TIMEWAIT_EXIT:
3227		ret = cm_timewait_handler(work);
3228		break;
3229	default:
3230		ret = -EINVAL;
3231		break;
3232	}
3233	if (ret)
3234		cm_free_work(work);
3235}
3236
3237static int cm_establish(struct ib_cm_id *cm_id)
3238{
3239	struct cm_id_private *cm_id_priv;
3240	struct cm_work *work;
3241	unsigned long flags;
3242	int ret = 0;
3243
3244	work = kmalloc(sizeof *work, GFP_ATOMIC);
3245	if (!work)
3246		return -ENOMEM;
3247
3248	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3249	spin_lock_irqsave(&cm_id_priv->lock, flags);
3250	switch (cm_id->state)
3251	{
3252	case IB_CM_REP_SENT:
3253	case IB_CM_MRA_REP_RCVD:
3254		cm_id->state = IB_CM_ESTABLISHED;
3255		break;
3256	case IB_CM_ESTABLISHED:
3257		ret = -EISCONN;
3258		break;
3259	default:
3260		ret = -EINVAL;
3261		break;
3262	}
3263	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3264
3265	if (ret) {
3266		kfree(work);
3267		goto out;
3268	}
3269
3270	/*
3271	 * The CM worker thread may try to destroy the cm_id before it
3272	 * can execute this work item.  To prevent potential deadlock,
3273	 * we need to find the cm_id once we're in the context of the
3274	 * worker thread, rather than holding a reference on it.
3275	 */
3276	INIT_DELAYED_WORK(&work->work, cm_work_handler);
3277	work->local_id = cm_id->local_id;
3278	work->remote_id = cm_id->remote_id;
3279	work->mad_recv_wc = NULL;
3280	work->cm_event.event = IB_CM_USER_ESTABLISHED;
3281	queue_delayed_work(cm.wq, &work->work, 0);
3282out:
3283	return ret;
3284}
3285
3286static int cm_migrate(struct ib_cm_id *cm_id)
3287{
3288	struct cm_id_private *cm_id_priv;
3289	unsigned long flags;
3290	int ret = 0;
3291
3292	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3293	spin_lock_irqsave(&cm_id_priv->lock, flags);
3294	if (cm_id->state == IB_CM_ESTABLISHED &&
3295	    (cm_id->lap_state == IB_CM_LAP_UNINIT ||
3296	     cm_id->lap_state == IB_CM_LAP_IDLE)) {
3297		cm_id->lap_state = IB_CM_LAP_IDLE;
3298		cm_id_priv->av = cm_id_priv->alt_av;
3299	} else
3300		ret = -EINVAL;
3301	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3302
3303	return ret;
3304}
3305
3306int ib_cm_notify(struct ib_cm_id *cm_id, enum ib_event_type event)
3307{
3308	int ret;
3309
3310	switch (event) {
3311	case IB_EVENT_COMM_EST:
3312		ret = cm_establish(cm_id);
3313		break;
3314	case IB_EVENT_PATH_MIG:
3315		ret = cm_migrate(cm_id);
3316		break;
3317	default:
3318		ret = -EINVAL;
3319	}
3320	return ret;
3321}
3322EXPORT_SYMBOL(ib_cm_notify);
3323
3324static void cm_recv_handler(struct ib_mad_agent *mad_agent,
3325			    struct ib_mad_recv_wc *mad_recv_wc)
3326{
3327	struct cm_port *port = mad_agent->context;
3328	struct cm_work *work;
3329	enum ib_cm_event_type event;
3330	u16 attr_id;
3331	int paths = 0;
3332
3333	switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
3334	case CM_REQ_ATTR_ID:
3335		paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
3336						    alt_local_lid != 0);
3337		event = IB_CM_REQ_RECEIVED;
3338		break;
3339	case CM_MRA_ATTR_ID:
3340		event = IB_CM_MRA_RECEIVED;
3341		break;
3342	case CM_REJ_ATTR_ID:
3343		event = IB_CM_REJ_RECEIVED;
3344		break;
3345	case CM_REP_ATTR_ID:
3346		event = IB_CM_REP_RECEIVED;
3347		break;
3348	case CM_RTU_ATTR_ID:
3349		event = IB_CM_RTU_RECEIVED;
3350		break;
3351	case CM_DREQ_ATTR_ID:
3352		event = IB_CM_DREQ_RECEIVED;
3353		break;
3354	case CM_DREP_ATTR_ID:
3355		event = IB_CM_DREP_RECEIVED;
3356		break;
3357	case CM_SIDR_REQ_ATTR_ID:
3358		event = IB_CM_SIDR_REQ_RECEIVED;
3359		break;
3360	case CM_SIDR_REP_ATTR_ID:
3361		event = IB_CM_SIDR_REP_RECEIVED;
3362		break;
3363	case CM_LAP_ATTR_ID:
3364		paths = 1;
3365		event = IB_CM_LAP_RECEIVED;
3366		break;
3367	case CM_APR_ATTR_ID:
3368		event = IB_CM_APR_RECEIVED;
3369		break;
3370	default:
3371		ib_free_recv_mad(mad_recv_wc);
3372		return;
3373	}
3374
3375	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
3376	atomic_long_inc(&port->counter_group[CM_RECV].
3377			counter[attr_id - CM_ATTR_ID_OFFSET]);
3378
3379	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
3380		       GFP_KERNEL);
3381	if (!work) {
3382		ib_free_recv_mad(mad_recv_wc);
3383		return;
3384	}
3385
3386	INIT_DELAYED_WORK(&work->work, cm_work_handler);
3387	work->cm_event.event = event;
3388	work->mad_recv_wc = mad_recv_wc;
3389	work->port = port;
3390	queue_delayed_work(cm.wq, &work->work, 0);
3391}
3392
3393static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
3394				struct ib_qp_attr *qp_attr,
3395				int *qp_attr_mask)
3396{
3397	unsigned long flags;
3398	int ret;
3399
3400	spin_lock_irqsave(&cm_id_priv->lock, flags);
3401	switch (cm_id_priv->id.state) {
3402	case IB_CM_REQ_SENT:
3403	case IB_CM_MRA_REQ_RCVD:
3404	case IB_CM_REQ_RCVD:
3405	case IB_CM_MRA_REQ_SENT:
3406	case IB_CM_REP_RCVD:
3407	case IB_CM_MRA_REP_SENT:
3408	case IB_CM_REP_SENT:
3409	case IB_CM_MRA_REP_RCVD:
3410	case IB_CM_ESTABLISHED:
3411		*qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
3412				IB_QP_PKEY_INDEX | IB_QP_PORT;
3413		qp_attr->qp_access_flags = IB_ACCESS_REMOTE_WRITE;
3414		if (cm_id_priv->responder_resources)
3415			qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_READ |
3416						    IB_ACCESS_REMOTE_ATOMIC;
3417		qp_attr->pkey_index = cm_id_priv->av.pkey_index;
3418		qp_attr->port_num = cm_id_priv->av.port->port_num;
3419		ret = 0;
3420		break;
3421	default:
3422		ret = -EINVAL;
3423		break;
3424	}
3425	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3426	return ret;
3427}
3428
3429static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
3430			       struct ib_qp_attr *qp_attr,
3431			       int *qp_attr_mask)
3432{
3433	unsigned long flags;
3434	int ret;
3435
3436	spin_lock_irqsave(&cm_id_priv->lock, flags);
3437	switch (cm_id_priv->id.state) {
3438	case IB_CM_REQ_RCVD:
3439	case IB_CM_MRA_REQ_SENT:
3440	case IB_CM_REP_RCVD:
3441	case IB_CM_MRA_REP_SENT:
3442	case IB_CM_REP_SENT:
3443	case IB_CM_MRA_REP_RCVD:
3444	case IB_CM_ESTABLISHED:
3445		*qp_attr_mask = IB_QP_STATE | IB_QP_AV | IB_QP_PATH_MTU |
3446				IB_QP_DEST_QPN | IB_QP_RQ_PSN;
3447		qp_attr->ah_attr = cm_id_priv->av.ah_attr;
3448		qp_attr->path_mtu = cm_id_priv->path_mtu;
3449		qp_attr->dest_qp_num = be32_to_cpu(cm_id_priv->remote_qpn);
3450		qp_attr->rq_psn = be32_to_cpu(cm_id_priv->rq_psn);
3451		if (cm_id_priv->qp_type == IB_QPT_RC) {
3452			*qp_attr_mask |= IB_QP_MAX_DEST_RD_ATOMIC |
3453					 IB_QP_MIN_RNR_TIMER;
3454			qp_attr->max_dest_rd_atomic =
3455					cm_id_priv->responder_resources;
3456			qp_attr->min_rnr_timer = 0;
3457		}
3458		if (cm_id_priv->alt_av.ah_attr.dlid) {
3459			*qp_attr_mask |= IB_QP_ALT_PATH;
3460			qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3461			qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
3462			qp_attr->alt_timeout = cm_id_priv->alt_av.timeout;
3463			qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3464		}
3465		ret = 0;
3466		break;
3467	default:
3468		ret = -EINVAL;
3469		break;
3470	}
3471	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3472	return ret;
3473}
3474
3475static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
3476			       struct ib_qp_attr *qp_attr,
3477			       int *qp_attr_mask)
3478{
3479	unsigned long flags;
3480	int ret;
3481
3482	spin_lock_irqsave(&cm_id_priv->lock, flags);
3483	switch (cm_id_priv->id.state) {
3484	/* Allow transition to RTS before sending REP */
3485	case IB_CM_REQ_RCVD:
3486	case IB_CM_MRA_REQ_SENT:
3487
3488	case IB_CM_REP_RCVD:
3489	case IB_CM_MRA_REP_SENT:
3490	case IB_CM_REP_SENT:
3491	case IB_CM_MRA_REP_RCVD:
3492	case IB_CM_ESTABLISHED:
3493		if (cm_id_priv->id.lap_state == IB_CM_LAP_UNINIT) {
3494			*qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
3495			qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
3496			if (cm_id_priv->qp_type == IB_QPT_RC) {
3497				*qp_attr_mask |= IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
3498						 IB_QP_RNR_RETRY |
3499						 IB_QP_MAX_QP_RD_ATOMIC;
3500				qp_attr->timeout = cm_id_priv->av.timeout;
3501				qp_attr->retry_cnt = cm_id_priv->retry_count;
3502				qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
3503				qp_attr->max_rd_atomic =
3504					cm_id_priv->initiator_depth;
3505			}
3506			if (cm_id_priv->alt_av.ah_attr.dlid) {
3507				*qp_attr_mask |= IB_QP_PATH_MIG_STATE;
3508				qp_attr->path_mig_state = IB_MIG_REARM;
3509			}
3510		} else {
3511			*qp_attr_mask = IB_QP_ALT_PATH | IB_QP_PATH_MIG_STATE;
3512			qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3513			qp_attr->alt_pkey_index = cm_id_priv->alt_av.pkey_index;
3514			qp_attr->alt_timeout = cm_id_priv->alt_av.timeout;
3515			qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3516			qp_attr->path_mig_state = IB_MIG_REARM;
3517		}
3518		ret = 0;
3519		break;
3520	default:
3521		ret = -EINVAL;
3522		break;
3523	}
3524	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3525	return ret;
3526}
3527
3528int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
3529		       struct ib_qp_attr *qp_attr,
3530		       int *qp_attr_mask)
3531{
3532	struct cm_id_private *cm_id_priv;
3533	int ret;
3534
3535	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3536	switch (qp_attr->qp_state) {
3537	case IB_QPS_INIT:
3538		ret = cm_init_qp_init_attr(cm_id_priv, qp_attr, qp_attr_mask);
3539		break;
3540	case IB_QPS_RTR:
3541		ret = cm_init_qp_rtr_attr(cm_id_priv, qp_attr, qp_attr_mask);
3542		break;
3543	case IB_QPS_RTS:
3544		ret = cm_init_qp_rts_attr(cm_id_priv, qp_attr, qp_attr_mask);
3545		break;
3546	default:
3547		ret = -EINVAL;
3548		break;
3549	}
3550	return ret;
3551}
3552EXPORT_SYMBOL(ib_cm_init_qp_attr);
3553
3554static void cm_get_ack_delay(struct cm_device *cm_dev)
3555{
3556	struct ib_device_attr attr;
3557
3558	if (ib_query_device(cm_dev->device, &attr))
3559		cm_dev->ack_delay = 0; /* acks will rely on packet life time */
3560	else
3561		cm_dev->ack_delay = attr.local_ca_ack_delay;
3562}
3563
3564static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
3565			       char *buf)
3566{
3567	struct cm_counter_group *group;
3568	struct cm_counter_attribute *cm_attr;
3569
3570	group = container_of(obj, struct cm_counter_group, obj);
3571	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
3572
3573	return sprintf(buf, "%ld\n",
3574		       atomic_long_read(&group->counter[cm_attr->index]));
3575}
3576
3577static struct sysfs_ops cm_counter_ops = {
3578	.show = cm_show_counter
3579};
3580
3581static struct kobj_type cm_counter_obj_type = {
3582	.sysfs_ops = &cm_counter_ops,
3583	.default_attrs = cm_counter_default_attrs
3584};
3585
3586static void cm_release_port_obj(struct kobject *obj)
3587{
3588	struct cm_port *cm_port;
3589
3590	printk(KERN_ERR "free cm port\n");
3591
3592	cm_port = container_of(obj, struct cm_port, port_obj);
3593	kfree(cm_port);
3594}
3595
3596static struct kobj_type cm_port_obj_type = {
3597	.release = cm_release_port_obj
3598};
3599
3600static void cm_release_dev_obj(struct kobject *obj)
3601{
3602	struct cm_device *cm_dev;
3603
3604	printk(KERN_ERR "free cm dev\n");
3605
3606	cm_dev = container_of(obj, struct cm_device, dev_obj);
3607	kfree(cm_dev);
3608}
3609
3610static struct kobj_type cm_dev_obj_type = {
3611	.release = cm_release_dev_obj
3612};
3613
3614struct class cm_class = {
3615	.name    = "infiniband_cm",
3616};
3617EXPORT_SYMBOL(cm_class);
3618
3619static void cm_remove_fs_obj(struct kobject *obj)
3620{
3621	kobject_put(obj->parent);
3622	kobject_put(obj);
3623}
3624
3625static int cm_create_port_fs(struct cm_port *port)
3626{
3627	int i, ret;
3628
3629	ret = kobject_init_and_add(&port->port_obj, &cm_port_obj_type,
3630				   kobject_get(&port->cm_dev->dev_obj),
3631				   "%d", port->port_num);
3632	if (ret) {
3633		kfree(port);
3634		return ret;
3635	}
3636
3637	for (i = 0; i < CM_COUNTER_GROUPS; i++) {
3638		ret = kobject_init_and_add(&port->counter_group[i].obj,
3639					   &cm_counter_obj_type,
3640					   kobject_get(&port->port_obj),
3641					   "%s", counter_group_names[i]);
3642		if (ret)
3643			goto error;
3644	}
3645
3646	return 0;
3647
3648error:
3649	while (i--)
3650		cm_remove_fs_obj(&port->counter_group[i].obj);
3651	cm_remove_fs_obj(&port->port_obj);
3652	return ret;
3653
3654}
3655
3656static void cm_remove_port_fs(struct cm_port *port)
3657{
3658	int i;
3659
3660	for (i = 0; i < CM_COUNTER_GROUPS; i++)
3661		cm_remove_fs_obj(&port->counter_group[i].obj);
3662
3663	cm_remove_fs_obj(&port->port_obj);
3664}
3665
3666static void cm_add_one(struct ib_device *device)
3667{
3668	struct cm_device *cm_dev;
3669	struct cm_port *port;
3670	struct ib_mad_reg_req reg_req = {
3671		.mgmt_class = IB_MGMT_CLASS_CM,
3672		.mgmt_class_version = IB_CM_CLASS_VERSION
3673	};
3674	struct ib_port_modify port_modify = {
3675		.set_port_cap_mask = IB_PORT_CM_SUP
3676	};
3677	unsigned long flags;
3678	int ret;
3679	u8 i;
3680
3681	if (rdma_node_get_transport(device->node_type) != RDMA_TRANSPORT_IB)
3682		return;
3683
3684	cm_dev = kzalloc(sizeof(*cm_dev) + sizeof(*port) *
3685			 device->phys_port_cnt, GFP_KERNEL);
3686	if (!cm_dev)
3687		return;
3688
3689	cm_dev->device = device;
3690	cm_get_ack_delay(cm_dev);
3691
3692	ret = kobject_init_and_add(&cm_dev->dev_obj, &cm_dev_obj_type,
3693				   &cm_class.subsys.kobj, "%s", device->name);
3694	if (ret) {
3695		kfree(cm_dev);
3696		return;
3697	}
3698
3699	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
3700	for (i = 1; i <= device->phys_port_cnt; i++) {
3701		port = kzalloc(sizeof *port, GFP_KERNEL);
3702		if (!port)
3703			goto error1;
3704
3705		cm_dev->port[i-1] = port;
3706		port->cm_dev = cm_dev;
3707		port->port_num = i;
3708
3709		ret = cm_create_port_fs(port);
3710		if (ret)
3711			goto error1;
3712
3713		port->mad_agent = ib_register_mad_agent(device, i,
3714							IB_QPT_GSI,
3715							&reg_req,
3716							0,
3717							cm_send_handler,
3718							cm_recv_handler,
3719							port);
3720		if (IS_ERR(port->mad_agent))
3721			goto error2;
3722
3723		ret = ib_modify_port(device, i, 0, &port_modify);
3724		if (ret)
3725			goto error3;
3726	}
3727	ib_set_client_data(device, &cm_client, cm_dev);
3728
3729	write_lock_irqsave(&cm.device_lock, flags);
3730	list_add_tail(&cm_dev->list, &cm.device_list);
3731	write_unlock_irqrestore(&cm.device_lock, flags);
3732	return;
3733
3734error3:
3735	ib_unregister_mad_agent(port->mad_agent);
3736error2:
3737	cm_remove_port_fs(port);
3738error1:
3739	port_modify.set_port_cap_mask = 0;
3740	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
3741	while (--i) {
3742		port = cm_dev->port[i-1];
3743		ib_modify_port(device, port->port_num, 0, &port_modify);
3744		ib_unregister_mad_agent(port->mad_agent);
3745		cm_remove_port_fs(port);
3746	}
3747	cm_remove_fs_obj(&cm_dev->dev_obj);
3748}
3749
3750static void cm_remove_one(struct ib_device *device)
3751{
3752	struct cm_device *cm_dev;
3753	struct cm_port *port;
3754	struct ib_port_modify port_modify = {
3755		.clr_port_cap_mask = IB_PORT_CM_SUP
3756	};
3757	unsigned long flags;
3758	int i;
3759
3760	cm_dev = ib_get_client_data(device, &cm_client);
3761	if (!cm_dev)
3762		return;
3763
3764	write_lock_irqsave(&cm.device_lock, flags);
3765	list_del(&cm_dev->list);
3766	write_unlock_irqrestore(&cm.device_lock, flags);
3767
3768	for (i = 1; i <= device->phys_port_cnt; i++) {
3769		port = cm_dev->port[i-1];
3770		ib_modify_port(device, port->port_num, 0, &port_modify);
3771		ib_unregister_mad_agent(port->mad_agent);
3772		cm_remove_port_fs(port);
3773	}
3774	cm_remove_fs_obj(&cm_dev->dev_obj);
3775}
3776
3777static int __init ib_cm_init(void)
3778{
3779	int ret;
3780
3781	memset(&cm, 0, sizeof cm);
3782	INIT_LIST_HEAD(&cm.device_list);
3783	rwlock_init(&cm.device_lock);
3784	spin_lock_init(&cm.lock);
3785	cm.listen_service_table = RB_ROOT;
3786	cm.listen_service_id = __constant_be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
3787	cm.remote_id_table = RB_ROOT;
3788	cm.remote_qp_table = RB_ROOT;
3789	cm.remote_sidr_table = RB_ROOT;
3790	idr_init(&cm.local_id_table);
3791	get_random_bytes(&cm.random_id_operand, sizeof cm.random_id_operand);
3792	idr_pre_get(&cm.local_id_table, GFP_KERNEL);
3793	INIT_LIST_HEAD(&cm.timewait_list);
3794
3795	ret = class_register(&cm_class);
3796	if (ret)
3797		return -ENOMEM;
3798
3799	cm.wq = create_workqueue("ib_cm");
3800	if (!cm.wq) {
3801		ret = -ENOMEM;
3802		goto error1;
3803	}
3804
3805	ret = ib_register_client(&cm_client);
3806	if (ret)
3807		goto error2;
3808
3809	return 0;
3810error2:
3811	destroy_workqueue(cm.wq);
3812error1:
3813	class_unregister(&cm_class);
3814	return ret;
3815}
3816
3817static void __exit ib_cm_cleanup(void)
3818{
3819	struct cm_timewait_info *timewait_info, *tmp;
3820
3821	spin_lock_irq(&cm.lock);
3822	list_for_each_entry(timewait_info, &cm.timewait_list, list)
3823		cancel_delayed_work(&timewait_info->work.work);
3824	spin_unlock_irq(&cm.lock);
3825
3826	destroy_workqueue(cm.wq);
3827
3828	list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
3829		list_del(&timewait_info->list);
3830		kfree(timewait_info);
3831	}
3832
3833	ib_unregister_client(&cm_client);
3834	class_unregister(&cm_class);
3835	idr_destroy(&cm.local_id_table);
3836}
3837
3838module_init(ib_cm_init);
3839module_exit(ib_cm_cleanup);
3840
3841