[PATCH] IB/cm: drop REQ when out of memory
[linux-2.6.git] / drivers / infiniband / core / cm.c
1 /*
2  * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
3  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
4  * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
5  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
6  *
7  * This software is available to you under a choice of one of two
8  * licenses.  You may choose to be licensed under the terms of the GNU
9  * General Public License (GPL) Version 2, available from the file
10  * COPYING in the main directory of this source tree, or the
11  * OpenIB.org BSD license below:
12  *
13  *     Redistribution and use in source and binary forms, with or
14  *     without modification, are permitted provided that the following
15  *     conditions are met:
16  *
17  *      - Redistributions of source code must retain the above
18  *        copyright notice, this list of conditions and the following
19  *        disclaimer.
20  *
21  *      - Redistributions in binary form must reproduce the above
22  *        copyright notice, this list of conditions and the following
23  *        disclaimer in the documentation and/or other materials
24  *        provided with the distribution.
25  *
26  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33  * SOFTWARE.
34  *
35  * $Id: cm.c 4311 2005-12-05 18:42:01Z sean.hefty $
36  */
37
38 #include <linux/completion.h>
39 #include <linux/dma-mapping.h>
40 #include <linux/err.h>
41 #include <linux/idr.h>
42 #include <linux/interrupt.h>
43 #include <linux/pci.h>
44 #include <linux/rbtree.h>
45 #include <linux/spinlock.h>
46 #include <linux/workqueue.h>
47
48 #include <rdma/ib_cache.h>
49 #include <rdma/ib_cm.h>
50 #include "cm_msgs.h"
51
52 MODULE_AUTHOR("Sean Hefty");
53 MODULE_DESCRIPTION("InfiniBand CM");
54 MODULE_LICENSE("Dual BSD/GPL");
55
56 static void cm_add_one(struct ib_device *device);
57 static void cm_remove_one(struct ib_device *device);
58
59 static struct ib_client cm_client = {
60         .name   = "cm",
61         .add    = cm_add_one,
62         .remove = cm_remove_one
63 };
64
65 static struct ib_cm {
66         spinlock_t lock;
67         struct list_head device_list;
68         rwlock_t device_lock;
69         struct rb_root listen_service_table;
70         u64 listen_service_id;
71         /* struct rb_root peer_service_table; todo: fix peer to peer */
72         struct rb_root remote_qp_table;
73         struct rb_root remote_id_table;
74         struct rb_root remote_sidr_table;
75         struct idr local_id_table;
76         struct workqueue_struct *wq;
77 } cm;
78
79 struct cm_port {
80         struct cm_device *cm_dev;
81         struct ib_mad_agent *mad_agent;
82         u8 port_num;
83 };
84
85 struct cm_device {
86         struct list_head list;
87         struct ib_device *device;
88         __be64 ca_guid;
89         struct cm_port port[0];
90 };
91
92 struct cm_av {
93         struct cm_port *port;
94         union ib_gid dgid;
95         struct ib_ah_attr ah_attr;
96         u16 pkey_index;
97         u8 packet_life_time;
98 };
99
100 struct cm_work {
101         struct work_struct work;
102         struct list_head list;
103         struct cm_port *port;
104         struct ib_mad_recv_wc *mad_recv_wc;     /* Received MADs */
105         __be32 local_id;                        /* Established / timewait */
106         __be32 remote_id;
107         struct ib_cm_event cm_event;
108         struct ib_sa_path_rec path[0];
109 };
110
111 struct cm_timewait_info {
112         struct cm_work work;                    /* Must be first. */
113         struct rb_node remote_qp_node;
114         struct rb_node remote_id_node;
115         __be64 remote_ca_guid;
116         __be32 remote_qpn;
117         u8 inserted_remote_qp;
118         u8 inserted_remote_id;
119 };
120
121 struct cm_id_private {
122         struct ib_cm_id id;
123
124         struct rb_node service_node;
125         struct rb_node sidr_id_node;
126         spinlock_t lock;        /* Do not acquire inside cm.lock */
127         struct completion comp;
128         atomic_t refcount;
129
130         struct ib_mad_send_buf *msg;
131         struct cm_timewait_info *timewait_info;
132         /* todo: use alternate port on send failure */
133         struct cm_av av;
134         struct cm_av alt_av;
135         struct ib_cm_compare_data *compare_data;
136
137         void *private_data;
138         __be64 tid;
139         __be32 local_qpn;
140         __be32 remote_qpn;
141         enum ib_qp_type qp_type;
142         __be32 sq_psn;
143         __be32 rq_psn;
144         int timeout_ms;
145         enum ib_mtu path_mtu;
146         u8 private_data_len;
147         u8 max_cm_retries;
148         u8 peer_to_peer;
149         u8 responder_resources;
150         u8 initiator_depth;
151         u8 local_ack_timeout;
152         u8 retry_count;
153         u8 rnr_retry_count;
154         u8 service_timeout;
155
156         struct list_head work_list;
157         atomic_t work_count;
158 };
159
160 static void cm_work_handler(void *data);
161
162 static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
163 {
164         if (atomic_dec_and_test(&cm_id_priv->refcount))
165                 complete(&cm_id_priv->comp);
166 }
167
168 static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
169                         struct ib_mad_send_buf **msg)
170 {
171         struct ib_mad_agent *mad_agent;
172         struct ib_mad_send_buf *m;
173         struct ib_ah *ah;
174
175         mad_agent = cm_id_priv->av.port->mad_agent;
176         ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
177         if (IS_ERR(ah))
178                 return PTR_ERR(ah);
179
180         m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn, 
181                                cm_id_priv->av.pkey_index,
182                                0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
183                                GFP_ATOMIC);
184         if (IS_ERR(m)) {
185                 ib_destroy_ah(ah);
186                 return PTR_ERR(m);
187         }
188
189         /* Timeout set by caller if response is expected. */
190         m->ah = ah;
191         m->retries = cm_id_priv->max_cm_retries;
192
193         atomic_inc(&cm_id_priv->refcount);
194         m->context[0] = cm_id_priv;
195         *msg = m;
196         return 0;
197 }
198
199 static int cm_alloc_response_msg(struct cm_port *port,
200                                  struct ib_mad_recv_wc *mad_recv_wc,
201                                  struct ib_mad_send_buf **msg)
202 {
203         struct ib_mad_send_buf *m;
204         struct ib_ah *ah;
205
206         ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
207                                   mad_recv_wc->recv_buf.grh, port->port_num);
208         if (IS_ERR(ah))
209                 return PTR_ERR(ah);
210
211         m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,
212                                0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
213                                GFP_ATOMIC);
214         if (IS_ERR(m)) {
215                 ib_destroy_ah(ah);
216                 return PTR_ERR(m);
217         }
218         m->ah = ah;
219         *msg = m;
220         return 0;
221 }
222
223 static void cm_free_msg(struct ib_mad_send_buf *msg)
224 {
225         ib_destroy_ah(msg->ah);
226         if (msg->context[0])
227                 cm_deref_id(msg->context[0]);
228         ib_free_send_mad(msg);
229 }
230
231 static void * cm_copy_private_data(const void *private_data,
232                                    u8 private_data_len)
233 {
234         void *data;
235
236         if (!private_data || !private_data_len)
237                 return NULL;
238
239         data = kmalloc(private_data_len, GFP_KERNEL);
240         if (!data)
241                 return ERR_PTR(-ENOMEM);
242
243         memcpy(data, private_data, private_data_len);
244         return data;
245 }
246
247 static void cm_set_private_data(struct cm_id_private *cm_id_priv,
248                                  void *private_data, u8 private_data_len)
249 {
250         if (cm_id_priv->private_data && cm_id_priv->private_data_len)
251                 kfree(cm_id_priv->private_data);
252
253         cm_id_priv->private_data = private_data;
254         cm_id_priv->private_data_len = private_data_len;
255 }
256
257 static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
258                                     struct ib_grh *grh, struct cm_av *av)
259 {
260         av->port = port;
261         av->pkey_index = wc->pkey_index;
262         ib_init_ah_from_wc(port->cm_dev->device, port->port_num, wc,
263                            grh, &av->ah_attr);
264 }
265
266 static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
267 {
268         struct cm_device *cm_dev;
269         struct cm_port *port = NULL;
270         unsigned long flags;
271         int ret;
272         u8 p;
273
274         read_lock_irqsave(&cm.device_lock, flags);
275         list_for_each_entry(cm_dev, &cm.device_list, list) {
276                 if (!ib_find_cached_gid(cm_dev->device, &path->sgid,
277                                         &p, NULL)) {
278                         port = &cm_dev->port[p-1];
279                         break;
280                 }
281         }
282         read_unlock_irqrestore(&cm.device_lock, flags);
283
284         if (!port)
285                 return -EINVAL;
286
287         ret = ib_find_cached_pkey(cm_dev->device, port->port_num,
288                                   be16_to_cpu(path->pkey), &av->pkey_index);
289         if (ret)
290                 return ret;
291
292         av->port = port;
293         ib_init_ah_from_path(cm_dev->device, port->port_num, path,
294                              &av->ah_attr);
295         av->packet_life_time = path->packet_life_time;
296         return 0;
297 }
298
299 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
300 {
301         unsigned long flags;
302         int ret;
303         static int next_id;
304
305         do {
306                 spin_lock_irqsave(&cm.lock, flags);
307                 ret = idr_get_new_above(&cm.local_id_table, cm_id_priv, next_id++,
308                                         (__force int *) &cm_id_priv->id.local_id);
309                 spin_unlock_irqrestore(&cm.lock, flags);
310         } while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
311         return ret;
312 }
313
314 static void cm_free_id(__be32 local_id)
315 {
316         unsigned long flags;
317
318         spin_lock_irqsave(&cm.lock, flags);
319         idr_remove(&cm.local_id_table, (__force int) local_id);
320         spin_unlock_irqrestore(&cm.lock, flags);
321 }
322
323 static struct cm_id_private * cm_get_id(__be32 local_id, __be32 remote_id)
324 {
325         struct cm_id_private *cm_id_priv;
326
327         cm_id_priv = idr_find(&cm.local_id_table, (__force int) local_id);
328         if (cm_id_priv) {
329                 if (cm_id_priv->id.remote_id == remote_id)
330                         atomic_inc(&cm_id_priv->refcount);
331                 else
332                         cm_id_priv = NULL;
333         }
334
335         return cm_id_priv;
336 }
337
338 static struct cm_id_private * cm_acquire_id(__be32 local_id, __be32 remote_id)
339 {
340         struct cm_id_private *cm_id_priv;
341         unsigned long flags;
342
343         spin_lock_irqsave(&cm.lock, flags);
344         cm_id_priv = cm_get_id(local_id, remote_id);
345         spin_unlock_irqrestore(&cm.lock, flags);
346
347         return cm_id_priv;
348 }
349
350 static void cm_mask_copy(u8 *dst, u8 *src, u8 *mask)
351 {
352         int i;
353
354         for (i = 0; i < IB_CM_COMPARE_SIZE / sizeof(unsigned long); i++)
355                 ((unsigned long *) dst)[i] = ((unsigned long *) src)[i] &
356                                              ((unsigned long *) mask)[i];
357 }
358
359 static int cm_compare_data(struct ib_cm_compare_data *src_data,
360                            struct ib_cm_compare_data *dst_data)
361 {
362         u8 src[IB_CM_COMPARE_SIZE];
363         u8 dst[IB_CM_COMPARE_SIZE];
364
365         if (!src_data || !dst_data)
366                 return 0;
367
368         cm_mask_copy(src, src_data->data, dst_data->mask);
369         cm_mask_copy(dst, dst_data->data, src_data->mask);
370         return memcmp(src, dst, IB_CM_COMPARE_SIZE);
371 }
372
373 static int cm_compare_private_data(u8 *private_data,
374                                    struct ib_cm_compare_data *dst_data)
375 {
376         u8 src[IB_CM_COMPARE_SIZE];
377
378         if (!dst_data)
379                 return 0;
380
381         cm_mask_copy(src, private_data, dst_data->mask);
382         return memcmp(src, dst_data->data, IB_CM_COMPARE_SIZE);
383 }
384
385 static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
386 {
387         struct rb_node **link = &cm.listen_service_table.rb_node;
388         struct rb_node *parent = NULL;
389         struct cm_id_private *cur_cm_id_priv;
390         __be64 service_id = cm_id_priv->id.service_id;
391         __be64 service_mask = cm_id_priv->id.service_mask;
392         int data_cmp;
393
394         while (*link) {
395                 parent = *link;
396                 cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
397                                           service_node);
398                 data_cmp = cm_compare_data(cm_id_priv->compare_data,
399                                            cur_cm_id_priv->compare_data);
400                 if ((cur_cm_id_priv->id.service_mask & service_id) ==
401                     (service_mask & cur_cm_id_priv->id.service_id) &&
402                     (cm_id_priv->id.device == cur_cm_id_priv->id.device) &&
403                     !data_cmp)
404                         return cur_cm_id_priv;
405
406                 if (cm_id_priv->id.device < cur_cm_id_priv->id.device)
407                         link = &(*link)->rb_left;
408                 else if (cm_id_priv->id.device > cur_cm_id_priv->id.device)
409                         link = &(*link)->rb_right;
410                 else if (service_id < cur_cm_id_priv->id.service_id)
411                         link = &(*link)->rb_left;
412                 else if (service_id > cur_cm_id_priv->id.service_id)
413                         link = &(*link)->rb_right;
414                 else if (data_cmp < 0)
415                         link = &(*link)->rb_left;
416                 else
417                         link = &(*link)->rb_right;
418         }
419         rb_link_node(&cm_id_priv->service_node, parent, link);
420         rb_insert_color(&cm_id_priv->service_node, &cm.listen_service_table);
421         return NULL;
422 }
423
424 static struct cm_id_private * cm_find_listen(struct ib_device *device,
425                                              __be64 service_id,
426                                              u8 *private_data)
427 {
428         struct rb_node *node = cm.listen_service_table.rb_node;
429         struct cm_id_private *cm_id_priv;
430         int data_cmp;
431
432         while (node) {
433                 cm_id_priv = rb_entry(node, struct cm_id_private, service_node);
434                 data_cmp = cm_compare_private_data(private_data,
435                                                    cm_id_priv->compare_data);
436                 if ((cm_id_priv->id.service_mask & service_id) ==
437                      cm_id_priv->id.service_id &&
438                     (cm_id_priv->id.device == device) && !data_cmp)
439                         return cm_id_priv;
440
441                 if (device < cm_id_priv->id.device)
442                         node = node->rb_left;
443                 else if (device > cm_id_priv->id.device)
444                         node = node->rb_right;
445                 else if (service_id < cm_id_priv->id.service_id)
446                         node = node->rb_left;
447                 else if (service_id > cm_id_priv->id.service_id)
448                         node = node->rb_right;
449                 else if (data_cmp < 0)
450                         node = node->rb_left;
451                 else
452                         node = node->rb_right;
453         }
454         return NULL;
455 }
456
457 static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
458                                                      *timewait_info)
459 {
460         struct rb_node **link = &cm.remote_id_table.rb_node;
461         struct rb_node *parent = NULL;
462         struct cm_timewait_info *cur_timewait_info;
463         __be64 remote_ca_guid = timewait_info->remote_ca_guid;
464         __be32 remote_id = timewait_info->work.remote_id;
465
466         while (*link) {
467                 parent = *link;
468                 cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
469                                              remote_id_node);
470                 if (remote_id < cur_timewait_info->work.remote_id)
471                         link = &(*link)->rb_left;
472                 else if (remote_id > cur_timewait_info->work.remote_id)
473                         link = &(*link)->rb_right;
474                 else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
475                         link = &(*link)->rb_left;
476                 else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
477                         link = &(*link)->rb_right;
478                 else
479                         return cur_timewait_info;
480         }
481         timewait_info->inserted_remote_id = 1;
482         rb_link_node(&timewait_info->remote_id_node, parent, link);
483         rb_insert_color(&timewait_info->remote_id_node, &cm.remote_id_table);
484         return NULL;
485 }
486
487 static struct cm_timewait_info * cm_find_remote_id(__be64 remote_ca_guid,
488                                                    __be32 remote_id)
489 {
490         struct rb_node *node = cm.remote_id_table.rb_node;
491         struct cm_timewait_info *timewait_info;
492
493         while (node) {
494                 timewait_info = rb_entry(node, struct cm_timewait_info,
495                                          remote_id_node);
496                 if (remote_id < timewait_info->work.remote_id)
497                         node = node->rb_left;
498                 else if (remote_id > timewait_info->work.remote_id)
499                         node = node->rb_right;
500                 else if (remote_ca_guid < timewait_info->remote_ca_guid)
501                         node = node->rb_left;
502                 else if (remote_ca_guid > timewait_info->remote_ca_guid)
503                         node = node->rb_right;
504                 else
505                         return timewait_info;
506         }
507         return NULL;
508 }
509
510 static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
511                                                       *timewait_info)
512 {
513         struct rb_node **link = &cm.remote_qp_table.rb_node;
514         struct rb_node *parent = NULL;
515         struct cm_timewait_info *cur_timewait_info;
516         __be64 remote_ca_guid = timewait_info->remote_ca_guid;
517         __be32 remote_qpn = timewait_info->remote_qpn;
518
519         while (*link) {
520                 parent = *link;
521                 cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
522                                              remote_qp_node);
523                 if (remote_qpn < cur_timewait_info->remote_qpn)
524                         link = &(*link)->rb_left;
525                 else if (remote_qpn > cur_timewait_info->remote_qpn)
526                         link = &(*link)->rb_right;
527                 else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
528                         link = &(*link)->rb_left;
529                 else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
530                         link = &(*link)->rb_right;
531                 else
532                         return cur_timewait_info;
533         }
534         timewait_info->inserted_remote_qp = 1;
535         rb_link_node(&timewait_info->remote_qp_node, parent, link);
536         rb_insert_color(&timewait_info->remote_qp_node, &cm.remote_qp_table);
537         return NULL;
538 }
539
540 static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
541                                                     *cm_id_priv)
542 {
543         struct rb_node **link = &cm.remote_sidr_table.rb_node;
544         struct rb_node *parent = NULL;
545         struct cm_id_private *cur_cm_id_priv;
546         union ib_gid *port_gid = &cm_id_priv->av.dgid;
547         __be32 remote_id = cm_id_priv->id.remote_id;
548
549         while (*link) {
550                 parent = *link;
551                 cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
552                                           sidr_id_node);
553                 if (remote_id < cur_cm_id_priv->id.remote_id)
554                         link = &(*link)->rb_left;
555                 else if (remote_id > cur_cm_id_priv->id.remote_id)
556                         link = &(*link)->rb_right;
557                 else {
558                         int cmp;
559                         cmp = memcmp(port_gid, &cur_cm_id_priv->av.dgid,
560                                      sizeof *port_gid);
561                         if (cmp < 0)
562                                 link = &(*link)->rb_left;
563                         else if (cmp > 0)
564                                 link = &(*link)->rb_right;
565                         else
566                                 return cur_cm_id_priv;
567                 }
568         }
569         rb_link_node(&cm_id_priv->sidr_id_node, parent, link);
570         rb_insert_color(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
571         return NULL;
572 }
573
574 static void cm_reject_sidr_req(struct cm_id_private *cm_id_priv,
575                                enum ib_cm_sidr_status status)
576 {
577         struct ib_cm_sidr_rep_param param;
578
579         memset(&param, 0, sizeof param);
580         param.status = status;
581         ib_send_cm_sidr_rep(&cm_id_priv->id, &param);
582 }
583
584 struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
585                                  ib_cm_handler cm_handler,
586                                  void *context)
587 {
588         struct cm_id_private *cm_id_priv;
589         int ret;
590
591         cm_id_priv = kzalloc(sizeof *cm_id_priv, GFP_KERNEL);
592         if (!cm_id_priv)
593                 return ERR_PTR(-ENOMEM);
594
595         cm_id_priv->id.state = IB_CM_IDLE;
596         cm_id_priv->id.device = device;
597         cm_id_priv->id.cm_handler = cm_handler;
598         cm_id_priv->id.context = context;
599         cm_id_priv->id.remote_cm_qpn = 1;
600         ret = cm_alloc_id(cm_id_priv);
601         if (ret)
602                 goto error;
603
604         spin_lock_init(&cm_id_priv->lock);
605         init_completion(&cm_id_priv->comp);
606         INIT_LIST_HEAD(&cm_id_priv->work_list);
607         atomic_set(&cm_id_priv->work_count, -1);
608         atomic_set(&cm_id_priv->refcount, 1);
609         return &cm_id_priv->id;
610
611 error:
612         kfree(cm_id_priv);
613         return ERR_PTR(-ENOMEM);
614 }
615 EXPORT_SYMBOL(ib_create_cm_id);
616
617 static struct cm_work * cm_dequeue_work(struct cm_id_private *cm_id_priv)
618 {
619         struct cm_work *work;
620
621         if (list_empty(&cm_id_priv->work_list))
622                 return NULL;
623
624         work = list_entry(cm_id_priv->work_list.next, struct cm_work, list);
625         list_del(&work->list);
626         return work;
627 }
628
629 static void cm_free_work(struct cm_work *work)
630 {
631         if (work->mad_recv_wc)
632                 ib_free_recv_mad(work->mad_recv_wc);
633         kfree(work);
634 }
635
636 static inline int cm_convert_to_ms(int iba_time)
637 {
638         /* approximate conversion to ms from 4.096us x 2^iba_time */
639         return 1 << max(iba_time - 8, 0);
640 }
641
642 static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
643 {
644         unsigned long flags;
645
646         if (!timewait_info->inserted_remote_id &&
647             !timewait_info->inserted_remote_qp)
648             return;
649
650         spin_lock_irqsave(&cm.lock, flags);
651         if (timewait_info->inserted_remote_id) {
652                 rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
653                 timewait_info->inserted_remote_id = 0;
654         }
655
656         if (timewait_info->inserted_remote_qp) {
657                 rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
658                 timewait_info->inserted_remote_qp = 0;
659         }
660         spin_unlock_irqrestore(&cm.lock, flags);
661 }
662
663 static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
664 {
665         struct cm_timewait_info *timewait_info;
666
667         timewait_info = kzalloc(sizeof *timewait_info, GFP_KERNEL);
668         if (!timewait_info)
669                 return ERR_PTR(-ENOMEM);
670
671         timewait_info->work.local_id = local_id;
672         INIT_WORK(&timewait_info->work.work, cm_work_handler,
673                   &timewait_info->work);
674         timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
675         return timewait_info;
676 }
677
678 static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
679 {
680         int wait_time;
681
682         /*
683          * The cm_id could be destroyed by the user before we exit timewait.
684          * To protect against this, we search for the cm_id after exiting
685          * timewait before notifying the user that we've exited timewait.
686          */
687         cm_id_priv->id.state = IB_CM_TIMEWAIT;
688         wait_time = cm_convert_to_ms(cm_id_priv->local_ack_timeout);
689         queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
690                            msecs_to_jiffies(wait_time));
691         cm_id_priv->timewait_info = NULL;
692 }
693
694 static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
695 {
696         cm_id_priv->id.state = IB_CM_IDLE;
697         if (cm_id_priv->timewait_info) {
698                 cm_cleanup_timewait(cm_id_priv->timewait_info);
699                 kfree(cm_id_priv->timewait_info);
700                 cm_id_priv->timewait_info = NULL;
701         }
702 }
703
704 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
705 {
706         struct cm_id_private *cm_id_priv;
707         struct cm_work *work;
708         unsigned long flags;
709
710         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
711 retest:
712         spin_lock_irqsave(&cm_id_priv->lock, flags);
713         switch (cm_id->state) {
714         case IB_CM_LISTEN:
715                 cm_id->state = IB_CM_IDLE;
716                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
717                 spin_lock_irqsave(&cm.lock, flags);
718                 rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);
719                 spin_unlock_irqrestore(&cm.lock, flags);
720                 break;
721         case IB_CM_SIDR_REQ_SENT:
722                 cm_id->state = IB_CM_IDLE;
723                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
724                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
725                 break;
726         case IB_CM_SIDR_REQ_RCVD:
727                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
728                 cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
729                 break;
730         case IB_CM_REQ_SENT:
731                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
732                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
733                 ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,
734                                &cm_id_priv->av.port->cm_dev->ca_guid,
735                                sizeof cm_id_priv->av.port->cm_dev->ca_guid,
736                                NULL, 0);
737                 break;
738         case IB_CM_REQ_RCVD:
739                 if (err == -ENOMEM) {
740                         /* Do not reject to allow future retries. */
741                         cm_reset_to_idle(cm_id_priv);
742                         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
743                 } else {
744                         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
745                         ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
746                                        NULL, 0, NULL, 0);
747                 }
748                 break;
749         case IB_CM_MRA_REQ_RCVD:
750         case IB_CM_REP_SENT:
751         case IB_CM_MRA_REP_RCVD:
752                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
753                 /* Fall through */
754         case IB_CM_MRA_REQ_SENT:
755         case IB_CM_REP_RCVD:
756         case IB_CM_MRA_REP_SENT:
757                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
758                 ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
759                                NULL, 0, NULL, 0);
760                 break;
761         case IB_CM_ESTABLISHED:
762                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
763                 ib_send_cm_dreq(cm_id, NULL, 0);
764                 goto retest;
765         case IB_CM_DREQ_SENT:
766                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
767                 cm_enter_timewait(cm_id_priv);
768                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
769                 break;
770         case IB_CM_DREQ_RCVD:
771                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
772                 ib_send_cm_drep(cm_id, NULL, 0);
773                 break;
774         default:
775                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
776                 break;
777         }
778
779         cm_free_id(cm_id->local_id);
780         cm_deref_id(cm_id_priv);
781         wait_for_completion(&cm_id_priv->comp);
782         while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
783                 cm_free_work(work);
784         kfree(cm_id_priv->compare_data);
785         kfree(cm_id_priv->private_data);
786         kfree(cm_id_priv);
787 }
788
789 void ib_destroy_cm_id(struct ib_cm_id *cm_id)
790 {
791         cm_destroy_id(cm_id, 0);
792 }
793 EXPORT_SYMBOL(ib_destroy_cm_id);
794
795 int ib_cm_listen(struct ib_cm_id *cm_id, __be64 service_id, __be64 service_mask,
796                  struct ib_cm_compare_data *compare_data)
797 {
798         struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
799         unsigned long flags;
800         int ret = 0;
801
802         service_mask = service_mask ? service_mask :
803                        __constant_cpu_to_be64(~0ULL);
804         service_id &= service_mask;
805         if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
806             (service_id != IB_CM_ASSIGN_SERVICE_ID))
807                 return -EINVAL;
808
809         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
810         if (cm_id->state != IB_CM_IDLE)
811                 return -EINVAL;
812
813         if (compare_data) {
814                 cm_id_priv->compare_data = kzalloc(sizeof *compare_data,
815                                                    GFP_KERNEL);
816                 if (!cm_id_priv->compare_data)
817                         return -ENOMEM;
818                 cm_mask_copy(cm_id_priv->compare_data->data,
819                              compare_data->data, compare_data->mask);
820                 memcpy(cm_id_priv->compare_data->mask, compare_data->mask,
821                        IB_CM_COMPARE_SIZE);
822         }
823
824         cm_id->state = IB_CM_LISTEN;
825
826         spin_lock_irqsave(&cm.lock, flags);
827         if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
828                 cm_id->service_id = cpu_to_be64(cm.listen_service_id++);
829                 cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
830         } else {
831                 cm_id->service_id = service_id;
832                 cm_id->service_mask = service_mask;
833         }
834         cur_cm_id_priv = cm_insert_listen(cm_id_priv);
835         spin_unlock_irqrestore(&cm.lock, flags);
836
837         if (cur_cm_id_priv) {
838                 cm_id->state = IB_CM_IDLE;
839                 kfree(cm_id_priv->compare_data);
840                 cm_id_priv->compare_data = NULL;
841                 ret = -EBUSY;
842         }
843         return ret;
844 }
845 EXPORT_SYMBOL(ib_cm_listen);
846
847 static __be64 cm_form_tid(struct cm_id_private *cm_id_priv,
848                           enum cm_msg_sequence msg_seq)
849 {
850         u64 hi_tid, low_tid;
851
852         hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
853         low_tid  = (u64) ((__force u32)cm_id_priv->id.local_id |
854                           (msg_seq << 30));
855         return cpu_to_be64(hi_tid | low_tid);
856 }
857
858 static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
859                               __be16 attr_id, __be64 tid)
860 {
861         hdr->base_version  = IB_MGMT_BASE_VERSION;
862         hdr->mgmt_class    = IB_MGMT_CLASS_CM;
863         hdr->class_version = IB_CM_CLASS_VERSION;
864         hdr->method        = IB_MGMT_METHOD_SEND;
865         hdr->attr_id       = attr_id;
866         hdr->tid           = tid;
867 }
868
869 static void cm_format_req(struct cm_req_msg *req_msg,
870                           struct cm_id_private *cm_id_priv,
871                           struct ib_cm_req_param *param)
872 {
873         cm_format_mad_hdr(&req_msg->hdr, CM_REQ_ATTR_ID,
874                           cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_REQ));
875
876         req_msg->local_comm_id = cm_id_priv->id.local_id;
877         req_msg->service_id = param->service_id;
878         req_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
879         cm_req_set_local_qpn(req_msg, cpu_to_be32(param->qp_num));
880         cm_req_set_resp_res(req_msg, param->responder_resources);
881         cm_req_set_init_depth(req_msg, param->initiator_depth);
882         cm_req_set_remote_resp_timeout(req_msg,
883                                        param->remote_cm_response_timeout);
884         cm_req_set_qp_type(req_msg, param->qp_type);
885         cm_req_set_flow_ctrl(req_msg, param->flow_control);
886         cm_req_set_starting_psn(req_msg, cpu_to_be32(param->starting_psn));
887         cm_req_set_local_resp_timeout(req_msg,
888                                       param->local_cm_response_timeout);
889         cm_req_set_retry_count(req_msg, param->retry_count);
890         req_msg->pkey = param->primary_path->pkey;
891         cm_req_set_path_mtu(req_msg, param->primary_path->mtu);
892         cm_req_set_rnr_retry_count(req_msg, param->rnr_retry_count);
893         cm_req_set_max_cm_retries(req_msg, param->max_cm_retries);
894         cm_req_set_srq(req_msg, param->srq);
895
896         req_msg->primary_local_lid = param->primary_path->slid;
897         req_msg->primary_remote_lid = param->primary_path->dlid;
898         req_msg->primary_local_gid = param->primary_path->sgid;
899         req_msg->primary_remote_gid = param->primary_path->dgid;
900         cm_req_set_primary_flow_label(req_msg, param->primary_path->flow_label);
901         cm_req_set_primary_packet_rate(req_msg, param->primary_path->rate);
902         req_msg->primary_traffic_class = param->primary_path->traffic_class;
903         req_msg->primary_hop_limit = param->primary_path->hop_limit;
904         cm_req_set_primary_sl(req_msg, param->primary_path->sl);
905         cm_req_set_primary_subnet_local(req_msg, 1); /* local only... */
906         cm_req_set_primary_local_ack_timeout(req_msg,
907                 min(31, param->primary_path->packet_life_time + 1));
908
909         if (param->alternate_path) {
910                 req_msg->alt_local_lid = param->alternate_path->slid;
911                 req_msg->alt_remote_lid = param->alternate_path->dlid;
912                 req_msg->alt_local_gid = param->alternate_path->sgid;
913                 req_msg->alt_remote_gid = param->alternate_path->dgid;
914                 cm_req_set_alt_flow_label(req_msg,
915                                           param->alternate_path->flow_label);
916                 cm_req_set_alt_packet_rate(req_msg, param->alternate_path->rate);
917                 req_msg->alt_traffic_class = param->alternate_path->traffic_class;
918                 req_msg->alt_hop_limit = param->alternate_path->hop_limit;
919                 cm_req_set_alt_sl(req_msg, param->alternate_path->sl);
920                 cm_req_set_alt_subnet_local(req_msg, 1); /* local only... */
921                 cm_req_set_alt_local_ack_timeout(req_msg,
922                         min(31, param->alternate_path->packet_life_time + 1));
923         }
924
925         if (param->private_data && param->private_data_len)
926                 memcpy(req_msg->private_data, param->private_data,
927                        param->private_data_len);
928 }
929
930 static int cm_validate_req_param(struct ib_cm_req_param *param)
931 {
932         /* peer-to-peer not supported */
933         if (param->peer_to_peer)
934                 return -EINVAL;
935
936         if (!param->primary_path)
937                 return -EINVAL;
938
939         if (param->qp_type != IB_QPT_RC && param->qp_type != IB_QPT_UC)
940                 return -EINVAL;
941
942         if (param->private_data &&
943             param->private_data_len > IB_CM_REQ_PRIVATE_DATA_SIZE)
944                 return -EINVAL;
945
946         if (param->alternate_path &&
947             (param->alternate_path->pkey != param->primary_path->pkey ||
948              param->alternate_path->mtu != param->primary_path->mtu))
949                 return -EINVAL;
950
951         return 0;
952 }
953
954 int ib_send_cm_req(struct ib_cm_id *cm_id,
955                    struct ib_cm_req_param *param)
956 {
957         struct cm_id_private *cm_id_priv;
958         struct cm_req_msg *req_msg;
959         unsigned long flags;
960         int ret;
961
962         ret = cm_validate_req_param(param);
963         if (ret)
964                 return ret;
965
966         /* Verify that we're not in timewait. */
967         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
968         spin_lock_irqsave(&cm_id_priv->lock, flags);
969         if (cm_id->state != IB_CM_IDLE) {
970                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
971                 ret = -EINVAL;
972                 goto out;
973         }
974         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
975
976         cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
977                                                             id.local_id);
978         if (IS_ERR(cm_id_priv->timewait_info))
979                 goto out;
980
981         ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
982         if (ret)
983                 goto error1;
984         if (param->alternate_path) {
985                 ret = cm_init_av_by_path(param->alternate_path,
986                                          &cm_id_priv->alt_av);
987                 if (ret)
988                         goto error1;
989         }
990         cm_id->service_id = param->service_id;
991         cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
992         cm_id_priv->timeout_ms = cm_convert_to_ms(
993                                     param->primary_path->packet_life_time) * 2 +
994                                  cm_convert_to_ms(
995                                     param->remote_cm_response_timeout);
996         cm_id_priv->max_cm_retries = param->max_cm_retries;
997         cm_id_priv->initiator_depth = param->initiator_depth;
998         cm_id_priv->responder_resources = param->responder_resources;
999         cm_id_priv->retry_count = param->retry_count;
1000         cm_id_priv->path_mtu = param->primary_path->mtu;
1001         cm_id_priv->qp_type = param->qp_type;
1002
1003         ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
1004         if (ret)
1005                 goto error1;
1006
1007         req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
1008         cm_format_req(req_msg, cm_id_priv, param);
1009         cm_id_priv->tid = req_msg->hdr.tid;
1010         cm_id_priv->msg->timeout_ms = cm_id_priv->timeout_ms;
1011         cm_id_priv->msg->context[1] = (void *) (unsigned long) IB_CM_REQ_SENT;
1012
1013         cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
1014         cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
1015         cm_id_priv->local_ack_timeout =
1016                                 cm_req_get_primary_local_ack_timeout(req_msg);
1017
1018         spin_lock_irqsave(&cm_id_priv->lock, flags);
1019         ret = ib_post_send_mad(cm_id_priv->msg, NULL);
1020         if (ret) {
1021                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1022                 goto error2;
1023         }
1024         BUG_ON(cm_id->state != IB_CM_IDLE);
1025         cm_id->state = IB_CM_REQ_SENT;
1026         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1027         return 0;
1028
1029 error2: cm_free_msg(cm_id_priv->msg);
1030 error1: kfree(cm_id_priv->timewait_info);
1031 out:    return ret;
1032 }
1033 EXPORT_SYMBOL(ib_send_cm_req);
1034
1035 static int cm_issue_rej(struct cm_port *port,
1036                         struct ib_mad_recv_wc *mad_recv_wc,
1037                         enum ib_cm_rej_reason reason,
1038                         enum cm_msg_response msg_rejected,
1039                         void *ari, u8 ari_length)
1040 {
1041         struct ib_mad_send_buf *msg = NULL;
1042         struct cm_rej_msg *rej_msg, *rcv_msg;
1043         int ret;
1044
1045         ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
1046         if (ret)
1047                 return ret;
1048
1049         /* We just need common CM header information.  Cast to any message. */
1050         rcv_msg = (struct cm_rej_msg *) mad_recv_wc->recv_buf.mad;
1051         rej_msg = (struct cm_rej_msg *) msg->mad;
1052
1053         cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, rcv_msg->hdr.tid);
1054         rej_msg->remote_comm_id = rcv_msg->local_comm_id;
1055         rej_msg->local_comm_id = rcv_msg->remote_comm_id;
1056         cm_rej_set_msg_rejected(rej_msg, msg_rejected);
1057         rej_msg->reason = cpu_to_be16(reason);
1058
1059         if (ari && ari_length) {
1060                 cm_rej_set_reject_info_len(rej_msg, ari_length);
1061                 memcpy(rej_msg->ari, ari, ari_length);
1062         }
1063
1064         ret = ib_post_send_mad(msg, NULL);
1065         if (ret)
1066                 cm_free_msg(msg);
1067
1068         return ret;
1069 }
1070
1071 static inline int cm_is_active_peer(__be64 local_ca_guid, __be64 remote_ca_guid,
1072                                     __be32 local_qpn, __be32 remote_qpn)
1073 {
1074         return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
1075                 ((local_ca_guid == remote_ca_guid) &&
1076                  (be32_to_cpu(local_qpn) > be32_to_cpu(remote_qpn))));
1077 }
1078
1079 static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
1080                                             struct ib_sa_path_rec *primary_path,
1081                                             struct ib_sa_path_rec *alt_path)
1082 {
1083         memset(primary_path, 0, sizeof *primary_path);
1084         primary_path->dgid = req_msg->primary_local_gid;
1085         primary_path->sgid = req_msg->primary_remote_gid;
1086         primary_path->dlid = req_msg->primary_local_lid;
1087         primary_path->slid = req_msg->primary_remote_lid;
1088         primary_path->flow_label = cm_req_get_primary_flow_label(req_msg);
1089         primary_path->hop_limit = req_msg->primary_hop_limit;
1090         primary_path->traffic_class = req_msg->primary_traffic_class;
1091         primary_path->reversible = 1;
1092         primary_path->pkey = req_msg->pkey;
1093         primary_path->sl = cm_req_get_primary_sl(req_msg);
1094         primary_path->mtu_selector = IB_SA_EQ;
1095         primary_path->mtu = cm_req_get_path_mtu(req_msg);
1096         primary_path->rate_selector = IB_SA_EQ;
1097         primary_path->rate = cm_req_get_primary_packet_rate(req_msg);
1098         primary_path->packet_life_time_selector = IB_SA_EQ;
1099         primary_path->packet_life_time =
1100                 cm_req_get_primary_local_ack_timeout(req_msg);
1101         primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
1102
1103         if (req_msg->alt_local_lid) {
1104                 memset(alt_path, 0, sizeof *alt_path);
1105                 alt_path->dgid = req_msg->alt_local_gid;
1106                 alt_path->sgid = req_msg->alt_remote_gid;
1107                 alt_path->dlid = req_msg->alt_local_lid;
1108                 alt_path->slid = req_msg->alt_remote_lid;
1109                 alt_path->flow_label = cm_req_get_alt_flow_label(req_msg);
1110                 alt_path->hop_limit = req_msg->alt_hop_limit;
1111                 alt_path->traffic_class = req_msg->alt_traffic_class;
1112                 alt_path->reversible = 1;
1113                 alt_path->pkey = req_msg->pkey;
1114                 alt_path->sl = cm_req_get_alt_sl(req_msg);
1115                 alt_path->mtu_selector = IB_SA_EQ;
1116                 alt_path->mtu = cm_req_get_path_mtu(req_msg);
1117                 alt_path->rate_selector = IB_SA_EQ;
1118                 alt_path->rate = cm_req_get_alt_packet_rate(req_msg);
1119                 alt_path->packet_life_time_selector = IB_SA_EQ;
1120                 alt_path->packet_life_time =
1121                         cm_req_get_alt_local_ack_timeout(req_msg);
1122                 alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
1123         }
1124 }
1125
1126 static void cm_format_req_event(struct cm_work *work,
1127                                 struct cm_id_private *cm_id_priv,
1128                                 struct ib_cm_id *listen_id)
1129 {
1130         struct cm_req_msg *req_msg;
1131         struct ib_cm_req_event_param *param;
1132
1133         req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1134         param = &work->cm_event.param.req_rcvd;
1135         param->listen_id = listen_id;
1136         param->port = cm_id_priv->av.port->port_num;
1137         param->primary_path = &work->path[0];
1138         if (req_msg->alt_local_lid)
1139                 param->alternate_path = &work->path[1];
1140         else
1141                 param->alternate_path = NULL;
1142         param->remote_ca_guid = req_msg->local_ca_guid;
1143         param->remote_qkey = be32_to_cpu(req_msg->local_qkey);
1144         param->remote_qpn = be32_to_cpu(cm_req_get_local_qpn(req_msg));
1145         param->qp_type = cm_req_get_qp_type(req_msg);
1146         param->starting_psn = be32_to_cpu(cm_req_get_starting_psn(req_msg));
1147         param->responder_resources = cm_req_get_init_depth(req_msg);
1148         param->initiator_depth = cm_req_get_resp_res(req_msg);
1149         param->local_cm_response_timeout =
1150                                         cm_req_get_remote_resp_timeout(req_msg);
1151         param->flow_control = cm_req_get_flow_ctrl(req_msg);
1152         param->remote_cm_response_timeout =
1153                                         cm_req_get_local_resp_timeout(req_msg);
1154         param->retry_count = cm_req_get_retry_count(req_msg);
1155         param->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1156         param->srq = cm_req_get_srq(req_msg);
1157         work->cm_event.private_data = &req_msg->private_data;
1158 }
1159
1160 static void cm_process_work(struct cm_id_private *cm_id_priv,
1161                             struct cm_work *work)
1162 {
1163         unsigned long flags;
1164         int ret;
1165
1166         /* We will typically only have the current event to report. */
1167         ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &work->cm_event);
1168         cm_free_work(work);
1169
1170         while (!ret && !atomic_add_negative(-1, &cm_id_priv->work_count)) {
1171                 spin_lock_irqsave(&cm_id_priv->lock, flags);
1172                 work = cm_dequeue_work(cm_id_priv);
1173                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1174                 BUG_ON(!work);
1175                 ret = cm_id_priv->id.cm_handler(&cm_id_priv->id,
1176                                                 &work->cm_event);
1177                 cm_free_work(work);
1178         }
1179         cm_deref_id(cm_id_priv);
1180         if (ret)
1181                 cm_destroy_id(&cm_id_priv->id, ret);
1182 }
1183
1184 static void cm_format_mra(struct cm_mra_msg *mra_msg,
1185                           struct cm_id_private *cm_id_priv,
1186                           enum cm_msg_response msg_mraed, u8 service_timeout,
1187                           const void *private_data, u8 private_data_len)
1188 {
1189         cm_format_mad_hdr(&mra_msg->hdr, CM_MRA_ATTR_ID, cm_id_priv->tid);
1190         cm_mra_set_msg_mraed(mra_msg, msg_mraed);
1191         mra_msg->local_comm_id = cm_id_priv->id.local_id;
1192         mra_msg->remote_comm_id = cm_id_priv->id.remote_id;
1193         cm_mra_set_service_timeout(mra_msg, service_timeout);
1194
1195         if (private_data && private_data_len)
1196                 memcpy(mra_msg->private_data, private_data, private_data_len);
1197 }
1198
1199 static void cm_format_rej(struct cm_rej_msg *rej_msg,
1200                           struct cm_id_private *cm_id_priv,
1201                           enum ib_cm_rej_reason reason,
1202                           void *ari,
1203                           u8 ari_length,
1204                           const void *private_data,
1205                           u8 private_data_len)
1206 {
1207         cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, cm_id_priv->tid);
1208         rej_msg->remote_comm_id = cm_id_priv->id.remote_id;
1209
1210         switch(cm_id_priv->id.state) {
1211         case IB_CM_REQ_RCVD:
1212                 rej_msg->local_comm_id = 0;
1213                 cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1214                 break;
1215         case IB_CM_MRA_REQ_SENT:
1216                 rej_msg->local_comm_id = cm_id_priv->id.local_id;
1217                 cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1218                 break;
1219         case IB_CM_REP_RCVD:
1220         case IB_CM_MRA_REP_SENT:
1221                 rej_msg->local_comm_id = cm_id_priv->id.local_id;
1222                 cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REP);
1223                 break;
1224         default:
1225                 rej_msg->local_comm_id = cm_id_priv->id.local_id;
1226                 cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_OTHER);
1227                 break;
1228         }
1229
1230         rej_msg->reason = cpu_to_be16(reason);
1231         if (ari && ari_length) {
1232                 cm_rej_set_reject_info_len(rej_msg, ari_length);
1233                 memcpy(rej_msg->ari, ari, ari_length);
1234         }
1235
1236         if (private_data && private_data_len)
1237                 memcpy(rej_msg->private_data, private_data, private_data_len);
1238 }
1239
1240 static void cm_dup_req_handler(struct cm_work *work,
1241                                struct cm_id_private *cm_id_priv)
1242 {
1243         struct ib_mad_send_buf *msg = NULL;
1244         unsigned long flags;
1245         int ret;
1246
1247         /* Quick state check to discard duplicate REQs. */
1248         if (cm_id_priv->id.state == IB_CM_REQ_RCVD)
1249                 return;
1250
1251         ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1252         if (ret)
1253                 return;
1254
1255         spin_lock_irqsave(&cm_id_priv->lock, flags);
1256         switch (cm_id_priv->id.state) {
1257         case IB_CM_MRA_REQ_SENT:
1258                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1259                               CM_MSG_RESPONSE_REQ, cm_id_priv->service_timeout,
1260                               cm_id_priv->private_data,
1261                               cm_id_priv->private_data_len);
1262                 break;
1263         case IB_CM_TIMEWAIT:
1264                 cm_format_rej((struct cm_rej_msg *) msg->mad, cm_id_priv,
1265                               IB_CM_REJ_STALE_CONN, NULL, 0, NULL, 0);
1266                 break;
1267         default:
1268                 goto unlock;
1269         }
1270         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1271
1272         ret = ib_post_send_mad(msg, NULL);
1273         if (ret)
1274                 goto free;
1275         return;
1276
1277 unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1278 free:   cm_free_msg(msg);
1279 }
1280
1281 static struct cm_id_private * cm_match_req(struct cm_work *work,
1282                                            struct cm_id_private *cm_id_priv)
1283 {
1284         struct cm_id_private *listen_cm_id_priv, *cur_cm_id_priv;
1285         struct cm_timewait_info *timewait_info;
1286         struct cm_req_msg *req_msg;
1287         unsigned long flags;
1288
1289         req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1290
1291         /* Check for duplicate REQ and stale connections. */
1292         spin_lock_irqsave(&cm.lock, flags);
1293         timewait_info = cm_insert_remote_id(cm_id_priv->timewait_info);
1294         if (!timewait_info)
1295                 timewait_info = cm_insert_remote_qpn(cm_id_priv->timewait_info);
1296
1297         if (timewait_info) {
1298                 cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
1299                                            timewait_info->work.remote_id);
1300                 spin_unlock_irqrestore(&cm.lock, flags);
1301                 if (cur_cm_id_priv) {
1302                         cm_dup_req_handler(work, cur_cm_id_priv);
1303                         cm_deref_id(cur_cm_id_priv);
1304                 } else
1305                         cm_issue_rej(work->port, work->mad_recv_wc,
1306                                      IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
1307                                      NULL, 0);
1308                 goto error;
1309         }
1310
1311         /* Find matching listen request. */
1312         listen_cm_id_priv = cm_find_listen(cm_id_priv->id.device,
1313                                            req_msg->service_id,
1314                                            req_msg->private_data);
1315         if (!listen_cm_id_priv) {
1316                 spin_unlock_irqrestore(&cm.lock, flags);
1317                 cm_issue_rej(work->port, work->mad_recv_wc,
1318                              IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
1319                              NULL, 0);
1320                 goto error;
1321         }
1322         atomic_inc(&listen_cm_id_priv->refcount);
1323         atomic_inc(&cm_id_priv->refcount);
1324         cm_id_priv->id.state = IB_CM_REQ_RCVD;
1325         atomic_inc(&cm_id_priv->work_count);
1326         spin_unlock_irqrestore(&cm.lock, flags);
1327         return listen_cm_id_priv;
1328
1329 error:  cm_cleanup_timewait(cm_id_priv->timewait_info);
1330         return NULL;
1331 }
1332
1333 static int cm_req_handler(struct cm_work *work)
1334 {
1335         struct ib_cm_id *cm_id;
1336         struct cm_id_private *cm_id_priv, *listen_cm_id_priv;
1337         struct cm_req_msg *req_msg;
1338         int ret;
1339
1340         req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1341
1342         cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
1343         if (IS_ERR(cm_id))
1344                 return PTR_ERR(cm_id);
1345
1346         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1347         cm_id_priv->id.remote_id = req_msg->local_comm_id;
1348         cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
1349                                 work->mad_recv_wc->recv_buf.grh,
1350                                 &cm_id_priv->av);
1351         cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1352                                                             id.local_id);
1353         if (IS_ERR(cm_id_priv->timewait_info)) {
1354                 ret = PTR_ERR(cm_id_priv->timewait_info);
1355                 goto error1;
1356         }
1357         cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
1358         cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;
1359         cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);
1360
1361         listen_cm_id_priv = cm_match_req(work, cm_id_priv);
1362         if (!listen_cm_id_priv) {
1363                 ret = -EINVAL;
1364                 goto error2;
1365         }
1366
1367         cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
1368         cm_id_priv->id.context = listen_cm_id_priv->id.context;
1369         cm_id_priv->id.service_id = req_msg->service_id;
1370         cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
1371
1372         cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
1373         ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
1374         if (ret)
1375                 goto error3;
1376         if (req_msg->alt_local_lid) {
1377                 ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
1378                 if (ret)
1379                         goto error3;
1380         }
1381         cm_id_priv->tid = req_msg->hdr.tid;
1382         cm_id_priv->timeout_ms = cm_convert_to_ms(
1383                                         cm_req_get_local_resp_timeout(req_msg));
1384         cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);
1385         cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);
1386         cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
1387         cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
1388         cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
1389         cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
1390         cm_id_priv->local_ack_timeout =
1391                                 cm_req_get_primary_local_ack_timeout(req_msg);
1392         cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
1393         cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1394         cm_id_priv->qp_type = cm_req_get_qp_type(req_msg);
1395
1396         cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);
1397         cm_process_work(cm_id_priv, work);
1398         cm_deref_id(listen_cm_id_priv);
1399         return 0;
1400
1401 error3: atomic_dec(&cm_id_priv->refcount);
1402         cm_deref_id(listen_cm_id_priv);
1403         cm_cleanup_timewait(cm_id_priv->timewait_info);
1404 error2: kfree(cm_id_priv->timewait_info);
1405         cm_id_priv->timewait_info = NULL;
1406 error1: ib_destroy_cm_id(&cm_id_priv->id);
1407         return ret;
1408 }
1409
1410 static void cm_format_rep(struct cm_rep_msg *rep_msg,
1411                           struct cm_id_private *cm_id_priv,
1412                           struct ib_cm_rep_param *param)
1413 {
1414         cm_format_mad_hdr(&rep_msg->hdr, CM_REP_ATTR_ID, cm_id_priv->tid);
1415         rep_msg->local_comm_id = cm_id_priv->id.local_id;
1416         rep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1417         cm_rep_set_local_qpn(rep_msg, cpu_to_be32(param->qp_num));
1418         cm_rep_set_starting_psn(rep_msg, cpu_to_be32(param->starting_psn));
1419         rep_msg->resp_resources = param->responder_resources;
1420         rep_msg->initiator_depth = param->initiator_depth;
1421         cm_rep_set_target_ack_delay(rep_msg, param->target_ack_delay);
1422         cm_rep_set_failover(rep_msg, param->failover_accepted);
1423         cm_rep_set_flow_ctrl(rep_msg, param->flow_control);
1424         cm_rep_set_rnr_retry_count(rep_msg, param->rnr_retry_count);
1425         cm_rep_set_srq(rep_msg, param->srq);
1426         rep_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
1427
1428         if (param->private_data && param->private_data_len)
1429                 memcpy(rep_msg->private_data, param->private_data,
1430                        param->private_data_len);
1431 }
1432
1433 int ib_send_cm_rep(struct ib_cm_id *cm_id,
1434                    struct ib_cm_rep_param *param)
1435 {
1436         struct cm_id_private *cm_id_priv;
1437         struct ib_mad_send_buf *msg;
1438         struct cm_rep_msg *rep_msg;
1439         unsigned long flags;
1440         int ret;
1441
1442         if (param->private_data &&
1443             param->private_data_len > IB_CM_REP_PRIVATE_DATA_SIZE)
1444                 return -EINVAL;
1445
1446         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1447         spin_lock_irqsave(&cm_id_priv->lock, flags);
1448         if (cm_id->state != IB_CM_REQ_RCVD &&
1449             cm_id->state != IB_CM_MRA_REQ_SENT) {
1450                 ret = -EINVAL;
1451                 goto out;
1452         }
1453
1454         ret = cm_alloc_msg(cm_id_priv, &msg);
1455         if (ret)
1456                 goto out;
1457
1458         rep_msg = (struct cm_rep_msg *) msg->mad;
1459         cm_format_rep(rep_msg, cm_id_priv, param);
1460         msg->timeout_ms = cm_id_priv->timeout_ms;
1461         msg->context[1] = (void *) (unsigned long) IB_CM_REP_SENT;
1462
1463         ret = ib_post_send_mad(msg, NULL);
1464         if (ret) {
1465                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1466                 cm_free_msg(msg);
1467                 return ret;
1468         }
1469
1470         cm_id->state = IB_CM_REP_SENT;
1471         cm_id_priv->msg = msg;
1472         cm_id_priv->initiator_depth = param->initiator_depth;
1473         cm_id_priv->responder_resources = param->responder_resources;
1474         cm_id_priv->rq_psn = cm_rep_get_starting_psn(rep_msg);
1475         cm_id_priv->local_qpn = cm_rep_get_local_qpn(rep_msg);
1476
1477 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1478         return ret;
1479 }
1480 EXPORT_SYMBOL(ib_send_cm_rep);
1481
1482 static void cm_format_rtu(struct cm_rtu_msg *rtu_msg,
1483                           struct cm_id_private *cm_id_priv,
1484                           const void *private_data,
1485                           u8 private_data_len)
1486 {
1487         cm_format_mad_hdr(&rtu_msg->hdr, CM_RTU_ATTR_ID, cm_id_priv->tid);
1488         rtu_msg->local_comm_id = cm_id_priv->id.local_id;
1489         rtu_msg->remote_comm_id = cm_id_priv->id.remote_id;
1490
1491         if (private_data && private_data_len)
1492                 memcpy(rtu_msg->private_data, private_data, private_data_len);
1493 }
1494
1495 int ib_send_cm_rtu(struct ib_cm_id *cm_id,
1496                    const void *private_data,
1497                    u8 private_data_len)
1498 {
1499         struct cm_id_private *cm_id_priv;
1500         struct ib_mad_send_buf *msg;
1501         unsigned long flags;
1502         void *data;
1503         int ret;
1504
1505         if (private_data && private_data_len > IB_CM_RTU_PRIVATE_DATA_SIZE)
1506                 return -EINVAL;
1507
1508         data = cm_copy_private_data(private_data, private_data_len);
1509         if (IS_ERR(data))
1510                 return PTR_ERR(data);
1511
1512         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1513         spin_lock_irqsave(&cm_id_priv->lock, flags);
1514         if (cm_id->state != IB_CM_REP_RCVD &&
1515             cm_id->state != IB_CM_MRA_REP_SENT) {
1516                 ret = -EINVAL;
1517                 goto error;
1518         }
1519
1520         ret = cm_alloc_msg(cm_id_priv, &msg);
1521         if (ret)
1522                 goto error;
1523
1524         cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1525                       private_data, private_data_len);
1526
1527         ret = ib_post_send_mad(msg, NULL);
1528         if (ret) {
1529                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1530                 cm_free_msg(msg);
1531                 kfree(data);
1532                 return ret;
1533         }
1534
1535         cm_id->state = IB_CM_ESTABLISHED;
1536         cm_set_private_data(cm_id_priv, data, private_data_len);
1537         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1538         return 0;
1539
1540 error:  spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1541         kfree(data);
1542         return ret;
1543 }
1544 EXPORT_SYMBOL(ib_send_cm_rtu);
1545
1546 static void cm_format_rep_event(struct cm_work *work)
1547 {
1548         struct cm_rep_msg *rep_msg;
1549         struct ib_cm_rep_event_param *param;
1550
1551         rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1552         param = &work->cm_event.param.rep_rcvd;
1553         param->remote_ca_guid = rep_msg->local_ca_guid;
1554         param->remote_qkey = be32_to_cpu(rep_msg->local_qkey);
1555         param->remote_qpn = be32_to_cpu(cm_rep_get_local_qpn(rep_msg));
1556         param->starting_psn = be32_to_cpu(cm_rep_get_starting_psn(rep_msg));
1557         param->responder_resources = rep_msg->initiator_depth;
1558         param->initiator_depth = rep_msg->resp_resources;
1559         param->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1560         param->failover_accepted = cm_rep_get_failover(rep_msg);
1561         param->flow_control = cm_rep_get_flow_ctrl(rep_msg);
1562         param->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1563         param->srq = cm_rep_get_srq(rep_msg);
1564         work->cm_event.private_data = &rep_msg->private_data;
1565 }
1566
1567 static void cm_dup_rep_handler(struct cm_work *work)
1568 {
1569         struct cm_id_private *cm_id_priv;
1570         struct cm_rep_msg *rep_msg;
1571         struct ib_mad_send_buf *msg = NULL;
1572         unsigned long flags;
1573         int ret;
1574
1575         rep_msg = (struct cm_rep_msg *) work->mad_recv_wc->recv_buf.mad;
1576         cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id,
1577                                    rep_msg->local_comm_id);
1578         if (!cm_id_priv)
1579                 return;
1580
1581         ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1582         if (ret)
1583                 goto deref;
1584
1585         spin_lock_irqsave(&cm_id_priv->lock, flags);
1586         if (cm_id_priv->id.state == IB_CM_ESTABLISHED)
1587                 cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1588                               cm_id_priv->private_data,
1589                               cm_id_priv->private_data_len);
1590         else if (cm_id_priv->id.state == IB_CM_MRA_REP_SENT)
1591                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1592                               CM_MSG_RESPONSE_REP, cm_id_priv->service_timeout,
1593                               cm_id_priv->private_data,
1594                               cm_id_priv->private_data_len);
1595         else
1596                 goto unlock;
1597         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1598
1599         ret = ib_post_send_mad(msg, NULL);
1600         if (ret)
1601                 goto free;
1602         goto deref;
1603
1604 unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1605 free:   cm_free_msg(msg);
1606 deref:  cm_deref_id(cm_id_priv);
1607 }
1608
1609 static int cm_rep_handler(struct cm_work *work)
1610 {
1611         struct cm_id_private *cm_id_priv;
1612         struct cm_rep_msg *rep_msg;
1613         unsigned long flags;
1614         int ret;
1615
1616         rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1617         cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id, 0);
1618         if (!cm_id_priv) {
1619                 cm_dup_rep_handler(work);
1620                 return -EINVAL;
1621         }
1622
1623         cm_format_rep_event(work);
1624
1625         spin_lock_irqsave(&cm_id_priv->lock, flags);
1626         switch (cm_id_priv->id.state) {
1627         case IB_CM_REQ_SENT:
1628         case IB_CM_MRA_REQ_RCVD:
1629                 break;
1630         default:
1631                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1632                 ret = -EINVAL;
1633                 goto error;
1634         }
1635
1636         cm_id_priv->timewait_info->work.remote_id = rep_msg->local_comm_id;
1637         cm_id_priv->timewait_info->remote_ca_guid = rep_msg->local_ca_guid;
1638         cm_id_priv->timewait_info->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1639
1640         spin_lock(&cm.lock);
1641         /* Check for duplicate REP. */
1642         if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
1643                 spin_unlock(&cm.lock);
1644                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1645                 ret = -EINVAL;
1646                 goto error;
1647         }
1648         /* Check for a stale connection. */
1649         if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
1650                 rb_erase(&cm_id_priv->timewait_info->remote_id_node,
1651                          &cm.remote_id_table);
1652                 cm_id_priv->timewait_info->inserted_remote_id = 0;
1653                 spin_unlock(&cm.lock);
1654                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1655                 cm_issue_rej(work->port, work->mad_recv_wc,
1656                              IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REP,
1657                              NULL, 0);
1658                 ret = -EINVAL;
1659                 goto error;
1660         }
1661         spin_unlock(&cm.lock);
1662
1663         cm_id_priv->id.state = IB_CM_REP_RCVD;
1664         cm_id_priv->id.remote_id = rep_msg->local_comm_id;
1665         cm_id_priv->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1666         cm_id_priv->initiator_depth = rep_msg->resp_resources;
1667         cm_id_priv->responder_resources = rep_msg->initiator_depth;
1668         cm_id_priv->sq_psn = cm_rep_get_starting_psn(rep_msg);
1669         cm_id_priv->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1670
1671         /* todo: handle peer_to_peer */
1672
1673         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1674         ret = atomic_inc_and_test(&cm_id_priv->work_count);
1675         if (!ret)
1676                 list_add_tail(&work->list, &cm_id_priv->work_list);
1677         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1678
1679         if (ret)
1680                 cm_process_work(cm_id_priv, work);
1681         else
1682                 cm_deref_id(cm_id_priv);
1683         return 0;
1684
1685 error:
1686         cm_deref_id(cm_id_priv);
1687         return ret;
1688 }
1689
1690 static int cm_establish_handler(struct cm_work *work)
1691 {
1692         struct cm_id_private *cm_id_priv;
1693         unsigned long flags;
1694         int ret;
1695
1696         /* See comment in ib_cm_establish about lookup. */
1697         cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
1698         if (!cm_id_priv)
1699                 return -EINVAL;
1700
1701         spin_lock_irqsave(&cm_id_priv->lock, flags);
1702         if (cm_id_priv->id.state != IB_CM_ESTABLISHED) {
1703                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1704                 goto out;
1705         }
1706
1707         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1708         ret = atomic_inc_and_test(&cm_id_priv->work_count);
1709         if (!ret)
1710                 list_add_tail(&work->list, &cm_id_priv->work_list);
1711         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1712
1713         if (ret)
1714                 cm_process_work(cm_id_priv, work);
1715         else
1716                 cm_deref_id(cm_id_priv);
1717         return 0;
1718 out:
1719         cm_deref_id(cm_id_priv);
1720         return -EINVAL;
1721 }
1722
1723 static int cm_rtu_handler(struct cm_work *work)
1724 {
1725         struct cm_id_private *cm_id_priv;
1726         struct cm_rtu_msg *rtu_msg;
1727         unsigned long flags;
1728         int ret;
1729
1730         rtu_msg = (struct cm_rtu_msg *)work->mad_recv_wc->recv_buf.mad;
1731         cm_id_priv = cm_acquire_id(rtu_msg->remote_comm_id,
1732                                    rtu_msg->local_comm_id);
1733         if (!cm_id_priv)
1734                 return -EINVAL;
1735
1736         work->cm_event.private_data = &rtu_msg->private_data;
1737
1738         spin_lock_irqsave(&cm_id_priv->lock, flags);
1739         if (cm_id_priv->id.state != IB_CM_REP_SENT &&
1740             cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
1741                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1742                 goto out;
1743         }
1744         cm_id_priv->id.state = IB_CM_ESTABLISHED;
1745
1746         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1747         ret = atomic_inc_and_test(&cm_id_priv->work_count);
1748         if (!ret)
1749                 list_add_tail(&work->list, &cm_id_priv->work_list);
1750         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1751
1752         if (ret)
1753                 cm_process_work(cm_id_priv, work);
1754         else
1755                 cm_deref_id(cm_id_priv);
1756         return 0;
1757 out:
1758         cm_deref_id(cm_id_priv);
1759         return -EINVAL;
1760 }
1761
1762 static void cm_format_dreq(struct cm_dreq_msg *dreq_msg,
1763                           struct cm_id_private *cm_id_priv,
1764                           const void *private_data,
1765                           u8 private_data_len)
1766 {
1767         cm_format_mad_hdr(&dreq_msg->hdr, CM_DREQ_ATTR_ID,
1768                           cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_DREQ));
1769         dreq_msg->local_comm_id = cm_id_priv->id.local_id;
1770         dreq_msg->remote_comm_id = cm_id_priv->id.remote_id;
1771         cm_dreq_set_remote_qpn(dreq_msg, cm_id_priv->remote_qpn);
1772
1773         if (private_data && private_data_len)
1774                 memcpy(dreq_msg->private_data, private_data, private_data_len);
1775 }
1776
1777 int ib_send_cm_dreq(struct ib_cm_id *cm_id,
1778                     const void *private_data,
1779                     u8 private_data_len)
1780 {
1781         struct cm_id_private *cm_id_priv;
1782         struct ib_mad_send_buf *msg;
1783         unsigned long flags;
1784         int ret;
1785
1786         if (private_data && private_data_len > IB_CM_DREQ_PRIVATE_DATA_SIZE)
1787                 return -EINVAL;
1788
1789         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1790         spin_lock_irqsave(&cm_id_priv->lock, flags);
1791         if (cm_id->state != IB_CM_ESTABLISHED) {
1792                 ret = -EINVAL;
1793                 goto out;
1794         }
1795
1796         ret = cm_alloc_msg(cm_id_priv, &msg);
1797         if (ret) {
1798                 cm_enter_timewait(cm_id_priv);
1799                 goto out;
1800         }
1801
1802         cm_format_dreq((struct cm_dreq_msg *) msg->mad, cm_id_priv,
1803                        private_data, private_data_len);
1804         msg->timeout_ms = cm_id_priv->timeout_ms;
1805         msg->context[1] = (void *) (unsigned long) IB_CM_DREQ_SENT;
1806
1807         ret = ib_post_send_mad(msg, NULL);
1808         if (ret) {
1809                 cm_enter_timewait(cm_id_priv);
1810                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1811                 cm_free_msg(msg);
1812                 return ret;
1813         }
1814
1815         cm_id->state = IB_CM_DREQ_SENT;
1816         cm_id_priv->msg = msg;
1817 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1818         return ret;
1819 }
1820 EXPORT_SYMBOL(ib_send_cm_dreq);
1821
1822 static void cm_format_drep(struct cm_drep_msg *drep_msg,
1823                           struct cm_id_private *cm_id_priv,
1824                           const void *private_data,
1825                           u8 private_data_len)
1826 {
1827         cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, cm_id_priv->tid);
1828         drep_msg->local_comm_id = cm_id_priv->id.local_id;
1829         drep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1830
1831         if (private_data && private_data_len)
1832                 memcpy(drep_msg->private_data, private_data, private_data_len);
1833 }
1834
1835 int ib_send_cm_drep(struct ib_cm_id *cm_id,
1836                     const void *private_data,
1837                     u8 private_data_len)
1838 {
1839         struct cm_id_private *cm_id_priv;
1840         struct ib_mad_send_buf *msg;
1841         unsigned long flags;
1842         void *data;
1843         int ret;
1844
1845         if (private_data && private_data_len > IB_CM_DREP_PRIVATE_DATA_SIZE)
1846                 return -EINVAL;
1847
1848         data = cm_copy_private_data(private_data, private_data_len);
1849         if (IS_ERR(data))
1850                 return PTR_ERR(data);
1851
1852         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1853         spin_lock_irqsave(&cm_id_priv->lock, flags);
1854         if (cm_id->state != IB_CM_DREQ_RCVD) {
1855                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1856                 kfree(data);
1857                 return -EINVAL;
1858         }
1859
1860         cm_set_private_data(cm_id_priv, data, private_data_len);
1861         cm_enter_timewait(cm_id_priv);
1862
1863         ret = cm_alloc_msg(cm_id_priv, &msg);
1864         if (ret)
1865                 goto out;
1866
1867         cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
1868                        private_data, private_data_len);
1869
1870         ret = ib_post_send_mad(msg, NULL);
1871         if (ret) {
1872                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1873                 cm_free_msg(msg);
1874                 return ret;
1875         }
1876
1877 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1878         return ret;
1879 }
1880 EXPORT_SYMBOL(ib_send_cm_drep);
1881
1882 static int cm_dreq_handler(struct cm_work *work)
1883 {
1884         struct cm_id_private *cm_id_priv;
1885         struct cm_dreq_msg *dreq_msg;
1886         struct ib_mad_send_buf *msg = NULL;
1887         unsigned long flags;
1888         int ret;
1889
1890         dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
1891         cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
1892                                    dreq_msg->local_comm_id);
1893         if (!cm_id_priv)
1894                 return -EINVAL;
1895
1896         work->cm_event.private_data = &dreq_msg->private_data;
1897
1898         spin_lock_irqsave(&cm_id_priv->lock, flags);
1899         if (cm_id_priv->local_qpn != cm_dreq_get_remote_qpn(dreq_msg))
1900                 goto unlock;
1901
1902         switch (cm_id_priv->id.state) {
1903         case IB_CM_REP_SENT:
1904         case IB_CM_DREQ_SENT:
1905                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1906                 break;
1907         case IB_CM_ESTABLISHED:
1908         case IB_CM_MRA_REP_RCVD:
1909                 break;
1910         case IB_CM_TIMEWAIT:
1911                 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
1912                         goto unlock;
1913
1914                 cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
1915                                cm_id_priv->private_data,
1916                                cm_id_priv->private_data_len);
1917                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1918
1919                 if (ib_post_send_mad(msg, NULL))
1920                         cm_free_msg(msg);
1921                 goto deref;
1922         default:
1923                 goto unlock;
1924         }
1925         cm_id_priv->id.state = IB_CM_DREQ_RCVD;
1926         cm_id_priv->tid = dreq_msg->hdr.tid;
1927         ret = atomic_inc_and_test(&cm_id_priv->work_count);
1928         if (!ret)
1929                 list_add_tail(&work->list, &cm_id_priv->work_list);
1930         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1931
1932         if (ret)
1933                 cm_process_work(cm_id_priv, work);
1934         else
1935                 cm_deref_id(cm_id_priv);
1936         return 0;
1937
1938 unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1939 deref:  cm_deref_id(cm_id_priv);
1940         return -EINVAL;
1941 }
1942
1943 static int cm_drep_handler(struct cm_work *work)
1944 {
1945         struct cm_id_private *cm_id_priv;
1946         struct cm_drep_msg *drep_msg;
1947         unsigned long flags;
1948         int ret;
1949
1950         drep_msg = (struct cm_drep_msg *)work->mad_recv_wc->recv_buf.mad;
1951         cm_id_priv = cm_acquire_id(drep_msg->remote_comm_id,
1952                                    drep_msg->local_comm_id);
1953         if (!cm_id_priv)
1954                 return -EINVAL;
1955
1956         work->cm_event.private_data = &drep_msg->private_data;
1957
1958         spin_lock_irqsave(&cm_id_priv->lock, flags);
1959         if (cm_id_priv->id.state != IB_CM_DREQ_SENT &&
1960             cm_id_priv->id.state != IB_CM_DREQ_RCVD) {
1961                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1962                 goto out;
1963         }
1964         cm_enter_timewait(cm_id_priv);
1965
1966         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1967         ret = atomic_inc_and_test(&cm_id_priv->work_count);
1968         if (!ret)
1969                 list_add_tail(&work->list, &cm_id_priv->work_list);
1970         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1971
1972         if (ret)
1973                 cm_process_work(cm_id_priv, work);
1974         else
1975                 cm_deref_id(cm_id_priv);
1976         return 0;
1977 out:
1978         cm_deref_id(cm_id_priv);
1979         return -EINVAL;
1980 }
1981
1982 int ib_send_cm_rej(struct ib_cm_id *cm_id,
1983                    enum ib_cm_rej_reason reason,
1984                    void *ari,
1985                    u8 ari_length,
1986                    const void *private_data,
1987                    u8 private_data_len)
1988 {
1989         struct cm_id_private *cm_id_priv;
1990         struct ib_mad_send_buf *msg;
1991         unsigned long flags;
1992         int ret;
1993
1994         if ((private_data && private_data_len > IB_CM_REJ_PRIVATE_DATA_SIZE) ||
1995             (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
1996                 return -EINVAL;
1997
1998         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1999
2000         spin_lock_irqsave(&cm_id_priv->lock, flags);
2001         switch (cm_id->state) {
2002         case IB_CM_REQ_SENT:
2003         case IB_CM_MRA_REQ_RCVD:
2004         case IB_CM_REQ_RCVD:
2005         case IB_CM_MRA_REQ_SENT:
2006         case IB_CM_REP_RCVD:
2007         case IB_CM_MRA_REP_SENT:
2008                 ret = cm_alloc_msg(cm_id_priv, &msg);
2009                 if (!ret)
2010                         cm_format_rej((struct cm_rej_msg *) msg->mad,
2011                                       cm_id_priv, reason, ari, ari_length,
2012                                       private_data, private_data_len);
2013
2014                 cm_reset_to_idle(cm_id_priv);
2015                 break;
2016         case IB_CM_REP_SENT:
2017         case IB_CM_MRA_REP_RCVD:
2018                 ret = cm_alloc_msg(cm_id_priv, &msg);
2019                 if (!ret)
2020                         cm_format_rej((struct cm_rej_msg *) msg->mad,
2021                                       cm_id_priv, reason, ari, ari_length,
2022                                       private_data, private_data_len);
2023
2024                 cm_enter_timewait(cm_id_priv);
2025                 break;
2026         default:
2027                 ret = -EINVAL;
2028                 goto out;
2029         }
2030
2031         if (ret)
2032                 goto out;
2033
2034         ret = ib_post_send_mad(msg, NULL);
2035         if (ret)
2036                 cm_free_msg(msg);
2037
2038 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2039         return ret;
2040 }
2041 EXPORT_SYMBOL(ib_send_cm_rej);
2042
2043 static void cm_format_rej_event(struct cm_work *work)
2044 {
2045         struct cm_rej_msg *rej_msg;
2046         struct ib_cm_rej_event_param *param;
2047
2048         rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2049         param = &work->cm_event.param.rej_rcvd;
2050         param->ari = rej_msg->ari;
2051         param->ari_length = cm_rej_get_reject_info_len(rej_msg);
2052         param->reason = __be16_to_cpu(rej_msg->reason);
2053         work->cm_event.private_data = &rej_msg->private_data;
2054 }
2055
2056 static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
2057 {
2058         struct cm_timewait_info *timewait_info;
2059         struct cm_id_private *cm_id_priv;
2060         unsigned long flags;
2061         __be32 remote_id;
2062
2063         remote_id = rej_msg->local_comm_id;
2064
2065         if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_TIMEOUT) {
2066                 spin_lock_irqsave(&cm.lock, flags);
2067                 timewait_info = cm_find_remote_id( *((__be64 *) rej_msg->ari),
2068                                                   remote_id);
2069                 if (!timewait_info) {
2070                         spin_unlock_irqrestore(&cm.lock, flags);
2071                         return NULL;
2072                 }
2073                 cm_id_priv = idr_find(&cm.local_id_table,
2074                                       (__force int) timewait_info->work.local_id);
2075                 if (cm_id_priv) {
2076                         if (cm_id_priv->id.remote_id == remote_id)
2077                                 atomic_inc(&cm_id_priv->refcount);
2078                         else
2079                                 cm_id_priv = NULL;
2080                 }
2081                 spin_unlock_irqrestore(&cm.lock, flags);
2082         } else if (cm_rej_get_msg_rejected(rej_msg) == CM_MSG_RESPONSE_REQ)
2083                 cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, 0);
2084         else
2085                 cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, remote_id);
2086
2087         return cm_id_priv;
2088 }
2089
2090 static int cm_rej_handler(struct cm_work *work)
2091 {
2092         struct cm_id_private *cm_id_priv;
2093         struct cm_rej_msg *rej_msg;
2094         unsigned long flags;
2095         int ret;
2096
2097         rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2098         cm_id_priv = cm_acquire_rejected_id(rej_msg);
2099         if (!cm_id_priv)
2100                 return -EINVAL;
2101
2102         cm_format_rej_event(work);
2103
2104         spin_lock_irqsave(&cm_id_priv->lock, flags);
2105         switch (cm_id_priv->id.state) {
2106         case IB_CM_REQ_SENT:
2107         case IB_CM_MRA_REQ_RCVD:
2108         case IB_CM_REP_SENT:
2109         case IB_CM_MRA_REP_RCVD:
2110                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2111                 /* fall through */
2112         case IB_CM_REQ_RCVD:
2113         case IB_CM_MRA_REQ_SENT:
2114                 if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_STALE_CONN)
2115                         cm_enter_timewait(cm_id_priv);
2116                 else
2117                         cm_reset_to_idle(cm_id_priv);
2118                 break;
2119         case IB_CM_DREQ_SENT:
2120                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2121                 /* fall through */
2122         case IB_CM_REP_RCVD:
2123         case IB_CM_MRA_REP_SENT:
2124         case IB_CM_ESTABLISHED:
2125                 cm_enter_timewait(cm_id_priv);
2126                 break;
2127         default:
2128                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2129                 ret = -EINVAL;
2130                 goto out;
2131         }
2132
2133         ret = atomic_inc_and_test(&cm_id_priv->work_count);
2134         if (!ret)
2135                 list_add_tail(&work->list, &cm_id_priv->work_list);
2136         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2137
2138         if (ret)
2139                 cm_process_work(cm_id_priv, work);
2140         else
2141                 cm_deref_id(cm_id_priv);
2142         return 0;
2143 out:
2144         cm_deref_id(cm_id_priv);
2145         return -EINVAL;
2146 }
2147
2148 int ib_send_cm_mra(struct ib_cm_id *cm_id,
2149                    u8 service_timeout,
2150                    const void *private_data,
2151                    u8 private_data_len)
2152 {
2153         struct cm_id_private *cm_id_priv;
2154         struct ib_mad_send_buf *msg;
2155         void *data;
2156         unsigned long flags;
2157         int ret;
2158
2159         if (private_data && private_data_len > IB_CM_MRA_PRIVATE_DATA_SIZE)
2160                 return -EINVAL;
2161
2162         data = cm_copy_private_data(private_data, private_data_len);
2163         if (IS_ERR(data))
2164                 return PTR_ERR(data);
2165
2166         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2167
2168         spin_lock_irqsave(&cm_id_priv->lock, flags);
2169         switch(cm_id_priv->id.state) {
2170         case IB_CM_REQ_RCVD:
2171                 ret = cm_alloc_msg(cm_id_priv, &msg);
2172                 if (ret)
2173                         goto error1;
2174
2175                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2176                               CM_MSG_RESPONSE_REQ, service_timeout,
2177                               private_data, private_data_len);
2178                 ret = ib_post_send_mad(msg, NULL);
2179                 if (ret)
2180                         goto error2;
2181                 cm_id->state = IB_CM_MRA_REQ_SENT;
2182                 break;
2183         case IB_CM_REP_RCVD:
2184                 ret = cm_alloc_msg(cm_id_priv, &msg);
2185                 if (ret)
2186                         goto error1;
2187
2188                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2189                               CM_MSG_RESPONSE_REP, service_timeout,
2190                               private_data, private_data_len);
2191                 ret = ib_post_send_mad(msg, NULL);
2192                 if (ret)
2193                         goto error2;
2194                 cm_id->state = IB_CM_MRA_REP_SENT;
2195                 break;
2196         case IB_CM_ESTABLISHED:
2197                 ret = cm_alloc_msg(cm_id_priv, &msg);
2198                 if (ret)
2199                         goto error1;
2200
2201                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2202                               CM_MSG_RESPONSE_OTHER, service_timeout,
2203                               private_data, private_data_len);
2204                 ret = ib_post_send_mad(msg, NULL);
2205                 if (ret)
2206                         goto error2;
2207                 cm_id->lap_state = IB_CM_MRA_LAP_SENT;
2208                 break;
2209         default:
2210                 ret = -EINVAL;
2211                 goto error1;
2212         }
2213         cm_id_priv->service_timeout = service_timeout;
2214         cm_set_private_data(cm_id_priv, data, private_data_len);
2215         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2216         return 0;
2217
2218 error1: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2219         kfree(data);
2220         return ret;
2221
2222 error2: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2223         kfree(data);
2224         cm_free_msg(msg);
2225         return ret;
2226 }
2227 EXPORT_SYMBOL(ib_send_cm_mra);
2228
2229 static struct cm_id_private * cm_acquire_mraed_id(struct cm_mra_msg *mra_msg)
2230 {
2231         switch (cm_mra_get_msg_mraed(mra_msg)) {
2232         case CM_MSG_RESPONSE_REQ:
2233                 return cm_acquire_id(mra_msg->remote_comm_id, 0);
2234         case CM_MSG_RESPONSE_REP:
2235         case CM_MSG_RESPONSE_OTHER:
2236                 return cm_acquire_id(mra_msg->remote_comm_id,
2237                                      mra_msg->local_comm_id);
2238         default:
2239                 return NULL;
2240         }
2241 }
2242
2243 static int cm_mra_handler(struct cm_work *work)
2244 {
2245         struct cm_id_private *cm_id_priv;
2246         struct cm_mra_msg *mra_msg;
2247         unsigned long flags;
2248         int timeout, ret;
2249
2250         mra_msg = (struct cm_mra_msg *)work->mad_recv_wc->recv_buf.mad;
2251         cm_id_priv = cm_acquire_mraed_id(mra_msg);
2252         if (!cm_id_priv)
2253                 return -EINVAL;
2254
2255         work->cm_event.private_data = &mra_msg->private_data;
2256         work->cm_event.param.mra_rcvd.service_timeout =
2257                                         cm_mra_get_service_timeout(mra_msg);
2258         timeout = cm_convert_to_ms(cm_mra_get_service_timeout(mra_msg)) +
2259                   cm_convert_to_ms(cm_id_priv->av.packet_life_time);
2260
2261         spin_lock_irqsave(&cm_id_priv->lock, flags);
2262         switch (cm_id_priv->id.state) {
2263         case IB_CM_REQ_SENT:
2264                 if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REQ ||
2265                     ib_modify_mad(cm_id_priv->av.port->mad_agent,
2266                                   cm_id_priv->msg, timeout))
2267                         goto out;
2268                 cm_id_priv->id.state = IB_CM_MRA_REQ_RCVD;
2269                 break;
2270         case IB_CM_REP_SENT:
2271                 if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REP ||
2272                     ib_modify_mad(cm_id_priv->av.port->mad_agent,
2273                                   cm_id_priv->msg, timeout))
2274                         goto out;
2275                 cm_id_priv->id.state = IB_CM_MRA_REP_RCVD;
2276                 break;
2277         case IB_CM_ESTABLISHED:
2278                 if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_OTHER ||
2279                     cm_id_priv->id.lap_state != IB_CM_LAP_SENT ||
2280                     ib_modify_mad(cm_id_priv->av.port->mad_agent,
2281                                   cm_id_priv->msg, timeout))
2282                         goto out;
2283                 cm_id_priv->id.lap_state = IB_CM_MRA_LAP_RCVD;
2284                 break;
2285         default:
2286                 goto out;
2287         }
2288
2289         cm_id_priv->msg->context[1] = (void *) (unsigned long)
2290                                       cm_id_priv->id.state;
2291         ret = atomic_inc_and_test(&cm_id_priv->work_count);
2292         if (!ret)
2293                 list_add_tail(&work->list, &cm_id_priv->work_list);
2294         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2295
2296         if (ret)
2297                 cm_process_work(cm_id_priv, work);
2298         else
2299                 cm_deref_id(cm_id_priv);
2300         return 0;
2301 out:
2302         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2303         cm_deref_id(cm_id_priv);
2304         return -EINVAL;
2305 }
2306
2307 static void cm_format_lap(struct cm_lap_msg *lap_msg,
2308                           struct cm_id_private *cm_id_priv,
2309                           struct ib_sa_path_rec *alternate_path,
2310                           const void *private_data,
2311                           u8 private_data_len)
2312 {
2313         cm_format_mad_hdr(&lap_msg->hdr, CM_LAP_ATTR_ID,
2314                           cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_LAP));
2315         lap_msg->local_comm_id = cm_id_priv->id.local_id;
2316         lap_msg->remote_comm_id = cm_id_priv->id.remote_id;
2317         cm_lap_set_remote_qpn(lap_msg, cm_id_priv->remote_qpn);
2318         /* todo: need remote CM response timeout */
2319         cm_lap_set_remote_resp_timeout(lap_msg, 0x1F);
2320         lap_msg->alt_local_lid = alternate_path->slid;
2321         lap_msg->alt_remote_lid = alternate_path->dlid;
2322         lap_msg->alt_local_gid = alternate_path->sgid;
2323         lap_msg->alt_remote_gid = alternate_path->dgid;
2324         cm_lap_set_flow_label(lap_msg, alternate_path->flow_label);
2325         cm_lap_set_traffic_class(lap_msg, alternate_path->traffic_class);
2326         lap_msg->alt_hop_limit = alternate_path->hop_limit;
2327         cm_lap_set_packet_rate(lap_msg, alternate_path->rate);
2328         cm_lap_set_sl(lap_msg, alternate_path->sl);
2329         cm_lap_set_subnet_local(lap_msg, 1); /* local only... */
2330         cm_lap_set_local_ack_timeout(lap_msg,
2331                 min(31, alternate_path->packet_life_time + 1));
2332
2333         if (private_data && private_data_len)
2334                 memcpy(lap_msg->private_data, private_data, private_data_len);
2335 }
2336
2337 int ib_send_cm_lap(struct ib_cm_id *cm_id,
2338                    struct ib_sa_path_rec *alternate_path,
2339                    const void *private_data,
2340                    u8 private_data_len)
2341 {
2342         struct cm_id_private *cm_id_priv;
2343         struct ib_mad_send_buf *msg;
2344         unsigned long flags;
2345         int ret;
2346
2347         if (private_data && private_data_len > IB_CM_LAP_PRIVATE_DATA_SIZE)
2348                 return -EINVAL;
2349
2350         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2351         spin_lock_irqsave(&cm_id_priv->lock, flags);
2352         if (cm_id->state != IB_CM_ESTABLISHED ||
2353             cm_id->lap_state != IB_CM_LAP_IDLE) {
2354                 ret = -EINVAL;
2355                 goto out;
2356         }
2357
2358         ret = cm_alloc_msg(cm_id_priv, &msg);
2359         if (ret)
2360                 goto out;
2361
2362         cm_format_lap((struct cm_lap_msg *) msg->mad, cm_id_priv,
2363                       alternate_path, private_data, private_data_len);
2364         msg->timeout_ms = cm_id_priv->timeout_ms;
2365         msg->context[1] = (void *) (unsigned long) IB_CM_ESTABLISHED;
2366
2367         ret = ib_post_send_mad(msg, NULL);
2368         if (ret) {
2369                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2370                 cm_free_msg(msg);
2371                 return ret;
2372         }
2373
2374         cm_id->lap_state = IB_CM_LAP_SENT;
2375         cm_id_priv->msg = msg;
2376
2377 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2378         return ret;
2379 }
2380 EXPORT_SYMBOL(ib_send_cm_lap);
2381
2382 static void cm_format_path_from_lap(struct ib_sa_path_rec *path,
2383                                     struct cm_lap_msg *lap_msg)
2384 {
2385         memset(path, 0, sizeof *path);
2386         path->dgid = lap_msg->alt_local_gid;
2387         path->sgid = lap_msg->alt_remote_gid;
2388         path->dlid = lap_msg->alt_local_lid;
2389         path->slid = lap_msg->alt_remote_lid;
2390         path->flow_label = cm_lap_get_flow_label(lap_msg);
2391         path->hop_limit = lap_msg->alt_hop_limit;
2392         path->traffic_class = cm_lap_get_traffic_class(lap_msg);
2393         path->reversible = 1;
2394         /* pkey is same as in REQ */
2395         path->sl = cm_lap_get_sl(lap_msg);
2396         path->mtu_selector = IB_SA_EQ;
2397         /* mtu is same as in REQ */
2398         path->rate_selector = IB_SA_EQ;
2399         path->rate = cm_lap_get_packet_rate(lap_msg);
2400         path->packet_life_time_selector = IB_SA_EQ;
2401         path->packet_life_time = cm_lap_get_local_ack_timeout(lap_msg);
2402         path->packet_life_time -= (path->packet_life_time > 0);
2403 }
2404
2405 static int cm_lap_handler(struct cm_work *work)
2406 {
2407         struct cm_id_private *cm_id_priv;
2408         struct cm_lap_msg *lap_msg;
2409         struct ib_cm_lap_event_param *param;
2410         struct ib_mad_send_buf *msg = NULL;
2411         unsigned long flags;
2412         int ret;
2413
2414         /* todo: verify LAP request and send reject APR if invalid. */
2415         lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;
2416         cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,
2417                                    lap_msg->local_comm_id);
2418         if (!cm_id_priv)
2419                 return -EINVAL;
2420
2421         param = &work->cm_event.param.lap_rcvd;
2422         param->alternate_path = &work->path[0];
2423         cm_format_path_from_lap(param->alternate_path, lap_msg);
2424         work->cm_event.private_data = &lap_msg->private_data;
2425
2426         spin_lock_irqsave(&cm_id_priv->lock, flags);
2427         if (cm_id_priv->id.state != IB_CM_ESTABLISHED)
2428                 goto unlock;
2429
2430         switch (cm_id_priv->id.lap_state) {
2431         case IB_CM_LAP_IDLE:
2432                 break;
2433         case IB_CM_MRA_LAP_SENT:
2434                 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2435                         goto unlock;
2436
2437                 cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2438                               CM_MSG_RESPONSE_OTHER,
2439                               cm_id_priv->service_timeout,
2440                               cm_id_priv->private_data,
2441                               cm_id_priv->private_data_len);
2442                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2443
2444                 if (ib_post_send_mad(msg, NULL))
2445                         cm_free_msg(msg);
2446                 goto deref;
2447         default:
2448                 goto unlock;
2449         }
2450
2451         cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
2452         cm_id_priv->tid = lap_msg->hdr.tid;
2453         ret = atomic_inc_and_test(&cm_id_priv->work_count);
2454         if (!ret)
2455                 list_add_tail(&work->list, &cm_id_priv->work_list);
2456         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2457
2458         if (ret)
2459                 cm_process_work(cm_id_priv, work);
2460         else
2461                 cm_deref_id(cm_id_priv);
2462         return 0;
2463
2464 unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2465 deref:  cm_deref_id(cm_id_priv);
2466         return -EINVAL;
2467 }
2468
2469 static void cm_format_apr(struct cm_apr_msg *apr_msg,
2470                           struct cm_id_private *cm_id_priv,
2471                           enum ib_cm_apr_status status,
2472                           void *info,
2473                           u8 info_length,
2474                           const void *private_data,
2475                           u8 private_data_len)
2476 {
2477         cm_format_mad_hdr(&apr_msg->hdr, CM_APR_ATTR_ID, cm_id_priv->tid);
2478         apr_msg->local_comm_id = cm_id_priv->id.local_id;
2479         apr_msg->remote_comm_id = cm_id_priv->id.remote_id;
2480         apr_msg->ap_status = (u8) status;
2481
2482         if (info && info_length) {
2483                 apr_msg->info_length = info_length;
2484                 memcpy(apr_msg->info, info, info_length);
2485         }
2486
2487         if (private_data && private_data_len)
2488                 memcpy(apr_msg->private_data, private_data, private_data_len);
2489 }
2490
2491 int ib_send_cm_apr(struct ib_cm_id *cm_id,
2492                    enum ib_cm_apr_status status,
2493                    void *info,
2494                    u8 info_length,
2495                    const void *private_data,
2496                    u8 private_data_len)
2497 {
2498         struct cm_id_private *cm_id_priv;
2499         struct ib_mad_send_buf *msg;
2500         unsigned long flags;
2501         int ret;
2502
2503         if ((private_data && private_data_len > IB_CM_APR_PRIVATE_DATA_SIZE) ||
2504             (info && info_length > IB_CM_APR_INFO_LENGTH))
2505                 return -EINVAL;
2506
2507         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2508         spin_lock_irqsave(&cm_id_priv->lock, flags);
2509         if (cm_id->state != IB_CM_ESTABLISHED ||
2510             (cm_id->lap_state != IB_CM_LAP_RCVD &&
2511              cm_id->lap_state != IB_CM_MRA_LAP_SENT)) {
2512                 ret = -EINVAL;
2513                 goto out;
2514         }
2515
2516         ret = cm_alloc_msg(cm_id_priv, &msg);
2517         if (ret)
2518                 goto out;
2519
2520         cm_format_apr((struct cm_apr_msg *) msg->mad, cm_id_priv, status,
2521                       info, info_length, private_data, private_data_len);
2522         ret = ib_post_send_mad(msg, NULL);
2523         if (ret) {
2524                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2525                 cm_free_msg(msg);
2526                 return ret;
2527         }
2528
2529         cm_id->lap_state = IB_CM_LAP_IDLE;
2530 out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2531         return ret;
2532 }
2533 EXPORT_SYMBOL(ib_send_cm_apr);
2534
2535 static int cm_apr_handler(struct cm_work *work)
2536 {
2537         struct cm_id_private *cm_id_priv;
2538         struct cm_apr_msg *apr_msg;
2539         unsigned long flags;
2540         int ret;
2541
2542         apr_msg = (struct cm_apr_msg *)work->mad_recv_wc->recv_buf.mad;
2543         cm_id_priv = cm_acquire_id(apr_msg->remote_comm_id,
2544                                    apr_msg->local_comm_id);
2545         if (!cm_id_priv)
2546                 return -EINVAL; /* Unmatched reply. */
2547
2548         work->cm_event.param.apr_rcvd.ap_status = apr_msg->ap_status;
2549         work->cm_event.param.apr_rcvd.apr_info = &apr_msg->info;
2550         work->cm_event.param.apr_rcvd.info_len = apr_msg->info_length;
2551         work->cm_event.private_data = &apr_msg->private_data;
2552
2553         spin_lock_irqsave(&cm_id_priv->lock, flags);
2554         if (cm_id_priv->id.state != IB_CM_ESTABLISHED ||
2555             (cm_id_priv->id.lap_state != IB_CM_LAP_SENT &&
2556              cm_id_priv->id.lap_state != IB_CM_MRA_LAP_RCVD)) {
2557                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2558                 goto out;
2559         }
2560         cm_id_priv->id.lap_state = IB_CM_LAP_IDLE;
2561         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2562         cm_id_priv->msg = NULL;
2563
2564         ret = atomic_inc_and_test(&cm_id_priv->work_count);
2565         if (!ret)
2566                 list_add_tail(&work->list, &cm_id_priv->work_list);
2567         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2568
2569         if (ret)
2570                 cm_process_work(cm_id_priv, work);
2571         else
2572                 cm_deref_id(cm_id_priv);
2573         return 0;
2574 out:
2575         cm_deref_id(cm_id_priv);
2576         return -EINVAL;
2577 }
2578
2579 static int cm_timewait_handler(struct cm_work *work)
2580 {
2581         struct cm_timewait_info *timewait_info;
2582         struct cm_id_private *cm_id_priv;
2583         unsigned long flags;
2584         int ret;
2585
2586         timewait_info = (struct cm_timewait_info *)work;
2587         cm_cleanup_timewait(timewait_info);
2588
2589         cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
2590                                    timewait_info->work.remote_id);
2591         if (!cm_id_priv)
2592                 return -EINVAL;
2593
2594         spin_lock_irqsave(&cm_id_priv->lock, flags);
2595         if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
2596             cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
2597                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2598                 goto out;
2599         }
2600         cm_id_priv->id.state = IB_CM_IDLE;
2601         ret = atomic_inc_and_test(&cm_id_priv->work_count);
2602         if (!ret)
2603                 list_add_tail(&work->list, &cm_id_priv->work_list);
2604         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2605
2606         if (ret)
2607                 cm_process_work(cm_id_priv, work);
2608         else
2609                 cm_deref_id(cm_id_priv);
2610         return 0;
2611 out:
2612         cm_deref_id(cm_id_priv);
2613         return -EINVAL;
2614 }
2615
2616 static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
2617                                struct cm_id_private *cm_id_priv,
2618                                struct ib_cm_sidr_req_param *param)
2619 {
2620         cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
2621                           cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
2622         sidr_req_msg->request_id = cm_id_priv->id.local_id;
2623         sidr_req_msg->pkey = cpu_to_be16(param->path->pkey);
2624         sidr_req_msg->service_id = param->service_id;
2625
2626         if (param->private_data && param->private_data_len)
2627                 memcpy(sidr_req_msg->private_data, param->private_data,
2628                        param->private_data_len);
2629 }
2630
2631 int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
2632                         struct ib_cm_sidr_req_param *param)
2633 {
2634         struct cm_id_private *cm_id_priv;
2635         struct ib_mad_send_buf *msg;
2636         unsigned long flags;
2637         int ret;
2638
2639         if (!param->path || (param->private_data &&
2640              param->private_data_len > IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE))
2641                 return -EINVAL;
2642
2643         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2644         ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
2645         if (ret)
2646                 goto out;
2647
2648         cm_id->service_id = param->service_id;
2649         cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
2650         cm_id_priv->timeout_ms = param->timeout_ms;
2651         cm_id_priv->max_cm_retries = param->max_cm_retries;
2652         ret = cm_alloc_msg(cm_id_priv, &msg);
2653         if (ret)
2654                 goto out;
2655
2656         cm_format_sidr_req((struct cm_sidr_req_msg *) msg->mad, cm_id_priv,
2657                            param);
2658         msg->timeout_ms = cm_id_priv->timeout_ms;
2659         msg->context[1] = (void *) (unsigned long) IB_CM_SIDR_REQ_SENT;
2660
2661         spin_lock_irqsave(&cm_id_priv->lock, flags);
2662         if (cm_id->state == IB_CM_IDLE)
2663                 ret = ib_post_send_mad(msg, NULL);
2664         else
2665                 ret = -EINVAL;
2666
2667         if (ret) {
2668                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2669                 cm_free_msg(msg);
2670                 goto out;
2671         }
2672         cm_id->state = IB_CM_SIDR_REQ_SENT;
2673         cm_id_priv->msg = msg;
2674         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2675 out:
2676         return ret;
2677 }
2678 EXPORT_SYMBOL(ib_send_cm_sidr_req);
2679
2680 static void cm_format_sidr_req_event(struct cm_work *work,
2681                                      struct ib_cm_id *listen_id)
2682 {
2683         struct cm_sidr_req_msg *sidr_req_msg;
2684         struct ib_cm_sidr_req_event_param *param;
2685
2686         sidr_req_msg = (struct cm_sidr_req_msg *)
2687                                 work->mad_recv_wc->recv_buf.mad;
2688         param = &work->cm_event.param.sidr_req_rcvd;
2689         param->pkey = __be16_to_cpu(sidr_req_msg->pkey);
2690         param->listen_id = listen_id;
2691         param->port = work->port->port_num;
2692         work->cm_event.private_data = &sidr_req_msg->private_data;
2693 }
2694
2695 static int cm_sidr_req_handler(struct cm_work *work)
2696 {
2697         struct ib_cm_id *cm_id;
2698         struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
2699         struct cm_sidr_req_msg *sidr_req_msg;
2700         struct ib_wc *wc;
2701         unsigned long flags;
2702
2703         cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
2704         if (IS_ERR(cm_id))
2705                 return PTR_ERR(cm_id);
2706         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2707
2708         /* Record SGID/SLID and request ID for lookup. */
2709         sidr_req_msg = (struct cm_sidr_req_msg *)
2710                                 work->mad_recv_wc->recv_buf.mad;
2711         wc = work->mad_recv_wc->wc;
2712         cm_id_priv->av.dgid.global.subnet_prefix = cpu_to_be64(wc->slid);
2713         cm_id_priv->av.dgid.global.interface_id = 0;
2714         cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
2715                                 work->mad_recv_wc->recv_buf.grh,
2716                                 &cm_id_priv->av);
2717         cm_id_priv->id.remote_id = sidr_req_msg->request_id;
2718         cm_id_priv->id.state = IB_CM_SIDR_REQ_RCVD;
2719         cm_id_priv->tid = sidr_req_msg->hdr.tid;
2720         atomic_inc(&cm_id_priv->work_count);
2721
2722         spin_lock_irqsave(&cm.lock, flags);
2723         cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
2724         if (cur_cm_id_priv) {
2725                 spin_unlock_irqrestore(&cm.lock, flags);
2726                 goto out; /* Duplicate message. */
2727         }
2728         cur_cm_id_priv = cm_find_listen(cm_id->device,
2729                                         sidr_req_msg->service_id,
2730                                         sidr_req_msg->private_data);
2731         if (!cur_cm_id_priv) {
2732                 rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
2733                 spin_unlock_irqrestore(&cm.lock, flags);
2734                 /* todo: reply with no match */
2735                 goto out; /* No match. */
2736         }
2737         atomic_inc(&cur_cm_id_priv->refcount);
2738         spin_unlock_irqrestore(&cm.lock, flags);
2739
2740         cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
2741         cm_id_priv->id.context = cur_cm_id_priv->id.context;
2742         cm_id_priv->id.service_id = sidr_req_msg->service_id;
2743         cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
2744
2745         cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
2746         cm_process_work(cm_id_priv, work);
2747         cm_deref_id(cur_cm_id_priv);
2748         return 0;
2749 out:
2750         ib_destroy_cm_id(&cm_id_priv->id);
2751         return -EINVAL;
2752 }
2753
2754 static void cm_format_sidr_rep(struct cm_sidr_rep_msg *sidr_rep_msg,
2755                                struct cm_id_private *cm_id_priv,
2756                                struct ib_cm_sidr_rep_param *param)
2757 {
2758         cm_format_mad_hdr(&sidr_rep_msg->hdr, CM_SIDR_REP_ATTR_ID,
2759                           cm_id_priv->tid);
2760         sidr_rep_msg->request_id = cm_id_priv->id.remote_id;
2761         sidr_rep_msg->status = param->status;
2762         cm_sidr_rep_set_qpn(sidr_rep_msg, cpu_to_be32(param->qp_num));
2763         sidr_rep_msg->service_id = cm_id_priv->id.service_id;
2764         sidr_rep_msg->qkey = cpu_to_be32(param->qkey);
2765
2766         if (param->info && param->info_length)
2767                 memcpy(sidr_rep_msg->info, param->info, param->info_length);
2768
2769         if (param->private_data && param->private_data_len)
2770                 memcpy(sidr_rep_msg->private_data, param->private_data,
2771                        param->private_data_len);
2772 }
2773
2774 int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
2775                         struct ib_cm_sidr_rep_param *param)
2776 {
2777         struct cm_id_private *cm_id_priv;
2778         struct ib_mad_send_buf *msg;
2779         unsigned long flags;
2780         int ret;
2781
2782         if ((param->info && param->info_length > IB_CM_SIDR_REP_INFO_LENGTH) ||
2783             (param->private_data &&
2784              param->private_data_len > IB_CM_SIDR_REP_PRIVATE_DATA_SIZE))
2785                 return -EINVAL;
2786
2787         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2788         spin_lock_irqsave(&cm_id_priv->lock, flags);
2789         if (cm_id->state != IB_CM_SIDR_REQ_RCVD) {
2790                 ret = -EINVAL;
2791                 goto error;
2792         }
2793
2794         ret = cm_alloc_msg(cm_id_priv, &msg);
2795         if (ret)
2796                 goto error;
2797
2798         cm_format_sidr_rep((struct cm_sidr_rep_msg *) msg->mad, cm_id_priv,
2799                            param);
2800         ret = ib_post_send_mad(msg, NULL);
2801         if (ret) {
2802                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2803                 cm_free_msg(msg);
2804                 return ret;
2805         }
2806         cm_id->state = IB_CM_IDLE;
2807         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2808
2809         spin_lock_irqsave(&cm.lock, flags);
2810         rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
2811         spin_unlock_irqrestore(&cm.lock, flags);
2812         return 0;
2813
2814 error:  spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2815         return ret;
2816 }
2817 EXPORT_SYMBOL(ib_send_cm_sidr_rep);
2818
2819 static void cm_format_sidr_rep_event(struct cm_work *work)
2820 {
2821         struct cm_sidr_rep_msg *sidr_rep_msg;
2822         struct ib_cm_sidr_rep_event_param *param;
2823
2824         sidr_rep_msg = (struct cm_sidr_rep_msg *)
2825                                 work->mad_recv_wc->recv_buf.mad;
2826         param = &work->cm_event.param.sidr_rep_rcvd;
2827         param->status = sidr_rep_msg->status;
2828         param->qkey = be32_to_cpu(sidr_rep_msg->qkey);
2829         param->qpn = be32_to_cpu(cm_sidr_rep_get_qpn(sidr_rep_msg));
2830         param->info = &sidr_rep_msg->info;
2831         param->info_len = sidr_rep_msg->info_length;
2832         work->cm_event.private_data = &sidr_rep_msg->private_data;
2833 }
2834
2835 static int cm_sidr_rep_handler(struct cm_work *work)
2836 {
2837         struct cm_sidr_rep_msg *sidr_rep_msg;
2838         struct cm_id_private *cm_id_priv;
2839         unsigned long flags;
2840
2841         sidr_rep_msg = (struct cm_sidr_rep_msg *)
2842                                 work->mad_recv_wc->recv_buf.mad;
2843         cm_id_priv = cm_acquire_id(sidr_rep_msg->request_id, 0);
2844         if (!cm_id_priv)
2845                 return -EINVAL; /* Unmatched reply. */
2846
2847         spin_lock_irqsave(&cm_id_priv->lock, flags);
2848         if (cm_id_priv->id.state != IB_CM_SIDR_REQ_SENT) {
2849                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2850                 goto out;
2851         }
2852         cm_id_priv->id.state = IB_CM_IDLE;
2853         ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2854         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2855
2856         cm_format_sidr_rep_event(work);
2857         cm_process_work(cm_id_priv, work);
2858         return 0;
2859 out:
2860         cm_deref_id(cm_id_priv);
2861         return -EINVAL;
2862 }
2863
2864 static void cm_process_send_error(struct ib_mad_send_buf *msg,
2865                                   enum ib_wc_status wc_status)
2866 {
2867         struct cm_id_private *cm_id_priv;
2868         struct ib_cm_event cm_event;
2869         enum ib_cm_state state;
2870         unsigned long flags;
2871         int ret;
2872
2873         memset(&cm_event, 0, sizeof cm_event);
2874         cm_id_priv = msg->context[0];
2875
2876         /* Discard old sends or ones without a response. */
2877         spin_lock_irqsave(&cm_id_priv->lock, flags);
2878         state = (enum ib_cm_state) (unsigned long) msg->context[1];
2879         if (msg != cm_id_priv->msg || state != cm_id_priv->id.state)
2880                 goto discard;
2881
2882         switch (state) {
2883         case IB_CM_REQ_SENT:
2884         case IB_CM_MRA_REQ_RCVD:
2885                 cm_reset_to_idle(cm_id_priv);
2886                 cm_event.event = IB_CM_REQ_ERROR;
2887                 break;
2888         case IB_CM_REP_SENT:
2889         case IB_CM_MRA_REP_RCVD:
2890                 cm_reset_to_idle(cm_id_priv);
2891                 cm_event.event = IB_CM_REP_ERROR;
2892                 break;
2893         case IB_CM_DREQ_SENT:
2894                 cm_enter_timewait(cm_id_priv);
2895                 cm_event.event = IB_CM_DREQ_ERROR;
2896                 break;
2897         case IB_CM_SIDR_REQ_SENT:
2898                 cm_id_priv->id.state = IB_CM_IDLE;
2899                 cm_event.event = IB_CM_SIDR_REQ_ERROR;
2900                 break;
2901         default:
2902                 goto discard;
2903         }
2904         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2905         cm_event.param.send_status = wc_status;
2906
2907         /* No other events can occur on the cm_id at this point. */
2908         ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &cm_event);
2909         cm_free_msg(msg);
2910         if (ret)
2911                 ib_destroy_cm_id(&cm_id_priv->id);
2912         return;
2913 discard:
2914         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2915         cm_free_msg(msg);
2916 }
2917
2918 static void cm_send_handler(struct ib_mad_agent *mad_agent,
2919                             struct ib_mad_send_wc *mad_send_wc)
2920 {
2921         struct ib_mad_send_buf *msg = mad_send_wc->send_buf;
2922
2923         switch (mad_send_wc->status) {
2924         case IB_WC_SUCCESS:
2925         case IB_WC_WR_FLUSH_ERR:
2926                 cm_free_msg(msg);
2927                 break;
2928         default:
2929                 if (msg->context[0] && msg->context[1])
2930                         cm_process_send_error(msg, mad_send_wc->status);
2931                 else
2932                         cm_free_msg(msg);
2933                 break;
2934         }
2935 }
2936
2937 static void cm_work_handler(void *data)
2938 {
2939         struct cm_work *work = data;
2940         int ret;
2941
2942         switch (work->cm_event.event) {
2943         case IB_CM_REQ_RECEIVED:
2944                 ret = cm_req_handler(work);
2945                 break;
2946         case IB_CM_MRA_RECEIVED:
2947                 ret = cm_mra_handler(work);
2948                 break;
2949         case IB_CM_REJ_RECEIVED:
2950                 ret = cm_rej_handler(work);
2951                 break;
2952         case IB_CM_REP_RECEIVED:
2953                 ret = cm_rep_handler(work);
2954                 break;
2955         case IB_CM_RTU_RECEIVED:
2956                 ret = cm_rtu_handler(work);
2957                 break;
2958         case IB_CM_USER_ESTABLISHED:
2959                 ret = cm_establish_handler(work);
2960                 break;
2961         case IB_CM_DREQ_RECEIVED:
2962                 ret = cm_dreq_handler(work);
2963                 break;
2964         case IB_CM_DREP_RECEIVED:
2965                 ret = cm_drep_handler(work);
2966                 break;
2967         case IB_CM_SIDR_REQ_RECEIVED:
2968                 ret = cm_sidr_req_handler(work);
2969                 break;
2970         case IB_CM_SIDR_REP_RECEIVED:
2971                 ret = cm_sidr_rep_handler(work);
2972                 break;
2973         case IB_CM_LAP_RECEIVED:
2974                 ret = cm_lap_handler(work);
2975                 break;
2976         case IB_CM_APR_RECEIVED:
2977                 ret = cm_apr_handler(work);
2978                 break;
2979         case IB_CM_TIMEWAIT_EXIT:
2980                 ret = cm_timewait_handler(work);
2981                 break;
2982         default:
2983                 ret = -EINVAL;
2984                 break;
2985         }
2986         if (ret)
2987                 cm_free_work(work);
2988 }
2989
2990 int ib_cm_establish(struct ib_cm_id *cm_id)
2991 {
2992         struct cm_id_private *cm_id_priv;
2993         struct cm_work *work;
2994         unsigned long flags;
2995         int ret = 0;
2996
2997         work = kmalloc(sizeof *work, GFP_ATOMIC);
2998         if (!work)
2999                 return -ENOMEM;
3000
3001         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3002         spin_lock_irqsave(&cm_id_priv->lock, flags);
3003         switch (cm_id->state)
3004         {
3005         case IB_CM_REP_SENT:
3006         case IB_CM_MRA_REP_RCVD:
3007                 cm_id->state = IB_CM_ESTABLISHED;
3008                 break;
3009         case IB_CM_ESTABLISHED:
3010                 ret = -EISCONN;
3011                 break;
3012         default:
3013                 ret = -EINVAL;
3014                 break;
3015         }
3016         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3017
3018         if (ret) {
3019                 kfree(work);
3020                 goto out;
3021         }
3022
3023         /*
3024          * The CM worker thread may try to destroy the cm_id before it
3025          * can execute this work item.  To prevent potential deadlock,
3026          * we need to find the cm_id once we're in the context of the
3027          * worker thread, rather than holding a reference on it.
3028          */
3029         INIT_WORK(&work->work, cm_work_handler, work);
3030         work->local_id = cm_id->local_id;
3031         work->remote_id = cm_id->remote_id;
3032         work->mad_recv_wc = NULL;
3033         work->cm_event.event = IB_CM_USER_ESTABLISHED;
3034         queue_work(cm.wq, &work->work);
3035 out:
3036         return ret;
3037 }
3038 EXPORT_SYMBOL(ib_cm_establish);
3039
3040 static void cm_recv_handler(struct ib_mad_agent *mad_agent,
3041                             struct ib_mad_recv_wc *mad_recv_wc)
3042 {
3043         struct cm_work *work;
3044         enum ib_cm_event_type event;
3045         int paths = 0;
3046
3047         switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
3048         case CM_REQ_ATTR_ID:
3049                 paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
3050                                                     alt_local_lid != 0);
3051                 event = IB_CM_REQ_RECEIVED;
3052                 break;
3053         case CM_MRA_ATTR_ID:
3054                 event = IB_CM_MRA_RECEIVED;
3055                 break;
3056         case CM_REJ_ATTR_ID:
3057                 event = IB_CM_REJ_RECEIVED;
3058                 break;
3059         case CM_REP_ATTR_ID:
3060                 event = IB_CM_REP_RECEIVED;
3061                 break;
3062         case CM_RTU_ATTR_ID:
3063                 event = IB_CM_RTU_RECEIVED;
3064                 break;
3065         case CM_DREQ_ATTR_ID:
3066                 event = IB_CM_DREQ_RECEIVED;
3067                 break;
3068         case CM_DREP_ATTR_ID:
3069                 event = IB_CM_DREP_RECEIVED;
3070                 break;
3071         case CM_SIDR_REQ_ATTR_ID:
3072                 event = IB_CM_SIDR_REQ_RECEIVED;
3073                 break;
3074         case CM_SIDR_REP_ATTR_ID:
3075                 event = IB_CM_SIDR_REP_RECEIVED;
3076                 break;
3077         case CM_LAP_ATTR_ID:
3078                 paths = 1;
3079                 event = IB_CM_LAP_RECEIVED;
3080                 break;
3081         case CM_APR_ATTR_ID:
3082                 event = IB_CM_APR_RECEIVED;
3083                 break;
3084         default:
3085                 ib_free_recv_mad(mad_recv_wc);
3086                 return;
3087         }
3088
3089         work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
3090                        GFP_KERNEL);
3091         if (!work) {
3092                 ib_free_recv_mad(mad_recv_wc);
3093                 return;
3094         }
3095
3096         INIT_WORK(&work->work, cm_work_handler, work);
3097         work->cm_event.event = event;
3098         work->mad_recv_wc = mad_recv_wc;
3099         work->port = (struct cm_port *)mad_agent->context;
3100         queue_work(cm.wq, &work->work);
3101 }
3102
3103 static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
3104                                 struct ib_qp_attr *qp_attr,
3105                                 int *qp_attr_mask)
3106 {
3107         unsigned long flags;
3108         int ret;
3109
3110         spin_lock_irqsave(&cm_id_priv->lock, flags);
3111         switch (cm_id_priv->id.state) {
3112         case IB_CM_REQ_SENT:
3113         case IB_CM_MRA_REQ_RCVD:
3114         case IB_CM_REQ_RCVD:
3115         case IB_CM_MRA_REQ_SENT:
3116         case IB_CM_REP_RCVD:
3117         case IB_CM_MRA_REP_SENT:
3118         case IB_CM_REP_SENT:
3119         case IB_CM_MRA_REP_RCVD:
3120         case IB_CM_ESTABLISHED:
3121                 *qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
3122                                 IB_QP_PKEY_INDEX | IB_QP_PORT;
3123                 qp_attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE |
3124                                            IB_ACCESS_REMOTE_WRITE;
3125                 if (cm_id_priv->responder_resources)
3126                         qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_READ;
3127                 qp_attr->pkey_index = cm_id_priv->av.pkey_index;
3128                 qp_attr->port_num = cm_id_priv->av.port->port_num;
3129                 ret = 0;
3130                 break;
3131         default:
3132                 ret = -EINVAL;
3133                 break;
3134         }
3135         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3136         return ret;
3137 }
3138
3139 static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
3140                                struct ib_qp_attr *qp_attr,
3141                                int *qp_attr_mask)
3142 {
3143         unsigned long flags;
3144         int ret;
3145
3146         spin_lock_irqsave(&cm_id_priv->lock, flags);
3147         switch (cm_id_priv->id.state) {
3148         case IB_CM_REQ_RCVD:
3149         case IB_CM_MRA_REQ_SENT:
3150         case IB_CM_REP_RCVD:
3151         case IB_CM_MRA_REP_SENT:
3152         case IB_CM_REP_SENT:
3153         case IB_CM_MRA_REP_RCVD:
3154         case IB_CM_ESTABLISHED:
3155                 *qp_attr_mask = IB_QP_STATE | IB_QP_AV | IB_QP_PATH_MTU |
3156                                 IB_QP_DEST_QPN | IB_QP_RQ_PSN;
3157                 qp_attr->ah_attr = cm_id_priv->av.ah_attr;
3158                 qp_attr->path_mtu = cm_id_priv->path_mtu;
3159                 qp_attr->dest_qp_num = be32_to_cpu(cm_id_priv->remote_qpn);
3160                 qp_attr->rq_psn = be32_to_cpu(cm_id_priv->rq_psn);
3161                 if (cm_id_priv->qp_type == IB_QPT_RC) {
3162                         *qp_attr_mask |= IB_QP_MAX_DEST_RD_ATOMIC |
3163                                          IB_QP_MIN_RNR_TIMER;
3164                         qp_attr->max_dest_rd_atomic =
3165                                         cm_id_priv->responder_resources;
3166                         qp_attr->min_rnr_timer = 0;
3167                 }
3168                 if (cm_id_priv->alt_av.ah_attr.dlid) {
3169                         *qp_attr_mask |= IB_QP_ALT_PATH;
3170                         qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3171                         qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3172                 }
3173                 ret = 0;
3174                 break;
3175         default:
3176                 ret = -EINVAL;
3177                 break;
3178         }
3179         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3180         return ret;
3181 }
3182
3183 static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
3184                                struct ib_qp_attr *qp_attr,
3185                                int *qp_attr_mask)
3186 {
3187         unsigned long flags;
3188         int ret;
3189
3190         spin_lock_irqsave(&cm_id_priv->lock, flags);
3191         switch (cm_id_priv->id.state) {
3192         case IB_CM_REP_RCVD:
3193         case IB_CM_MRA_REP_SENT:
3194         case IB_CM_REP_SENT:
3195         case IB_CM_MRA_REP_RCVD:
3196         case IB_CM_ESTABLISHED:
3197                 *qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
3198                 qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
3199                 if (cm_id_priv->qp_type == IB_QPT_RC) {
3200                         *qp_attr_mask |= IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
3201                                          IB_QP_RNR_RETRY |
3202                                          IB_QP_MAX_QP_RD_ATOMIC;
3203                         qp_attr->timeout = cm_id_priv->local_ack_timeout;
3204                         qp_attr->retry_cnt = cm_id_priv->retry_count;
3205                         qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
3206                         qp_attr->max_rd_atomic = cm_id_priv->initiator_depth;
3207                 }
3208                 if (cm_id_priv->alt_av.ah_attr.dlid) {
3209                         *qp_attr_mask |= IB_QP_PATH_MIG_STATE;
3210                         qp_attr->path_mig_state = IB_MIG_REARM;
3211                 }
3212                 ret = 0;
3213                 break;
3214         default:
3215                 ret = -EINVAL;
3216                 break;
3217         }
3218         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3219         return ret;
3220 }
3221
3222 int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
3223                        struct ib_qp_attr *qp_attr,
3224                        int *qp_attr_mask)
3225 {
3226         struct cm_id_private *cm_id_priv;
3227         int ret;
3228
3229         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3230         switch (qp_attr->qp_state) {
3231         case IB_QPS_INIT:
3232                 ret = cm_init_qp_init_attr(cm_id_priv, qp_attr, qp_attr_mask);
3233                 break;
3234         case IB_QPS_RTR:
3235                 ret = cm_init_qp_rtr_attr(cm_id_priv, qp_attr, qp_attr_mask);
3236                 break;
3237         case IB_QPS_RTS:
3238                 ret = cm_init_qp_rts_attr(cm_id_priv, qp_attr, qp_attr_mask);
3239                 break;
3240         default:
3241                 ret = -EINVAL;
3242                 break;
3243         }
3244         return ret;
3245 }
3246 EXPORT_SYMBOL(ib_cm_init_qp_attr);
3247
3248 static void cm_add_one(struct ib_device *device)
3249 {
3250         struct cm_device *cm_dev;
3251         struct cm_port *port;
3252         struct ib_mad_reg_req reg_req = {
3253                 .mgmt_class = IB_MGMT_CLASS_CM,
3254                 .mgmt_class_version = IB_CM_CLASS_VERSION
3255         };
3256         struct ib_port_modify port_modify = {
3257                 .set_port_cap_mask = IB_PORT_CM_SUP
3258         };
3259         unsigned long flags;
3260         int ret;
3261         u8 i;
3262
3263         cm_dev = kmalloc(sizeof(*cm_dev) + sizeof(*port) *