xref: /linux/drivers/infiniband/core/cm.c (revision 6e8331ac6973435b1e7604c30f2ad394035b46e1)
1 /*
2  * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
3  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
4  * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
5  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
6  *
7  * This software is available to you under a choice of one of two
8  * licenses.  You may choose to be licensed under the terms of the GNU
9  * General Public License (GPL) Version 2, available from the file
10  * COPYING in the main directory of this source tree, or the
11  * OpenIB.org BSD license below:
12  *
13  *     Redistribution and use in source and binary forms, with or
14  *     without modification, are permitted provided that the following
15  *     conditions are met:
16  *
17  *      - Redistributions of source code must retain the above
18  *        copyright notice, this list of conditions and the following
19  *        disclaimer.
20  *
21  *      - Redistributions in binary form must reproduce the above
22  *        copyright notice, this list of conditions and the following
23  *        disclaimer in the documentation and/or other materials
24  *        provided with the distribution.
25  *
26  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33  * SOFTWARE.
34  *
35  * $Id: cm.c 4311 2005-12-05 18:42:01Z sean.hefty $
36  */
37 
38 #include <linux/completion.h>
39 #include <linux/dma-mapping.h>
40 #include <linux/err.h>
41 #include <linux/idr.h>
42 #include <linux/interrupt.h>
43 #include <linux/pci.h>
44 #include <linux/rbtree.h>
45 #include <linux/spinlock.h>
46 #include <linux/workqueue.h>
47 
48 #include <rdma/ib_cache.h>
49 #include <rdma/ib_cm.h>
50 #include "cm_msgs.h"
51 
52 MODULE_AUTHOR("Sean Hefty");
53 MODULE_DESCRIPTION("InfiniBand CM");
54 MODULE_LICENSE("Dual BSD/GPL");
55 
56 static void cm_add_one(struct ib_device *device);
57 static void cm_remove_one(struct ib_device *device);
58 
59 static struct ib_client cm_client = {
60 	.name   = "cm",
61 	.add    = cm_add_one,
62 	.remove = cm_remove_one
63 };
64 
65 static struct ib_cm {
66 	spinlock_t lock;
67 	struct list_head device_list;
68 	rwlock_t device_lock;
69 	struct rb_root listen_service_table;
70 	u64 listen_service_id;
71 	/* struct rb_root peer_service_table; todo: fix peer to peer */
72 	struct rb_root remote_qp_table;
73 	struct rb_root remote_id_table;
74 	struct rb_root remote_sidr_table;
75 	struct idr local_id_table;
76 	struct workqueue_struct *wq;
77 } cm;
78 
79 struct cm_port {
80 	struct cm_device *cm_dev;
81 	struct ib_mad_agent *mad_agent;
82 	u8 port_num;
83 };
84 
85 struct cm_device {
86 	struct list_head list;
87 	struct ib_device *device;
88 	__be64 ca_guid;
89 	struct cm_port port[0];
90 };
91 
92 struct cm_av {
93 	struct cm_port *port;
94 	union ib_gid dgid;
95 	struct ib_ah_attr ah_attr;
96 	u16 pkey_index;
97 	u8 packet_life_time;
98 };
99 
100 struct cm_work {
101 	struct work_struct work;
102 	struct list_head list;
103 	struct cm_port *port;
104 	struct ib_mad_recv_wc *mad_recv_wc;	/* Received MADs */
105 	__be32 local_id;			/* Established / timewait */
106 	__be32 remote_id;
107 	struct ib_cm_event cm_event;
108 	struct ib_sa_path_rec path[0];
109 };
110 
111 struct cm_timewait_info {
112 	struct cm_work work;			/* Must be first. */
113 	struct rb_node remote_qp_node;
114 	struct rb_node remote_id_node;
115 	__be64 remote_ca_guid;
116 	__be32 remote_qpn;
117 	u8 inserted_remote_qp;
118 	u8 inserted_remote_id;
119 };
120 
121 struct cm_id_private {
122 	struct ib_cm_id	id;
123 
124 	struct rb_node service_node;
125 	struct rb_node sidr_id_node;
126 	spinlock_t lock;	/* Do not acquire inside cm.lock */
127 	struct completion comp;
128 	atomic_t refcount;
129 
130 	struct ib_mad_send_buf *msg;
131 	struct cm_timewait_info *timewait_info;
132 	/* todo: use alternate port on send failure */
133 	struct cm_av av;
134 	struct cm_av alt_av;
135 	struct ib_cm_compare_data *compare_data;
136 
137 	void *private_data;
138 	__be64 tid;
139 	__be32 local_qpn;
140 	__be32 remote_qpn;
141 	enum ib_qp_type qp_type;
142 	__be32 sq_psn;
143 	__be32 rq_psn;
144 	int timeout_ms;
145 	enum ib_mtu path_mtu;
146 	u8 private_data_len;
147 	u8 max_cm_retries;
148 	u8 peer_to_peer;
149 	u8 responder_resources;
150 	u8 initiator_depth;
151 	u8 local_ack_timeout;
152 	u8 retry_count;
153 	u8 rnr_retry_count;
154 	u8 service_timeout;
155 
156 	struct list_head work_list;
157 	atomic_t work_count;
158 };
159 
160 static void cm_work_handler(void *data);
161 
162 static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
163 {
164 	if (atomic_dec_and_test(&cm_id_priv->refcount))
165 		complete(&cm_id_priv->comp);
166 }
167 
168 static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
169 			struct ib_mad_send_buf **msg)
170 {
171 	struct ib_mad_agent *mad_agent;
172 	struct ib_mad_send_buf *m;
173 	struct ib_ah *ah;
174 
175 	mad_agent = cm_id_priv->av.port->mad_agent;
176 	ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
177 	if (IS_ERR(ah))
178 		return PTR_ERR(ah);
179 
180 	m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
181 			       cm_id_priv->av.pkey_index,
182 			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
183 			       GFP_ATOMIC);
184 	if (IS_ERR(m)) {
185 		ib_destroy_ah(ah);
186 		return PTR_ERR(m);
187 	}
188 
189 	/* Timeout set by caller if response is expected. */
190 	m->ah = ah;
191 	m->retries = cm_id_priv->max_cm_retries;
192 
193 	atomic_inc(&cm_id_priv->refcount);
194 	m->context[0] = cm_id_priv;
195 	*msg = m;
196 	return 0;
197 }
198 
199 static int cm_alloc_response_msg(struct cm_port *port,
200 				 struct ib_mad_recv_wc *mad_recv_wc,
201 				 struct ib_mad_send_buf **msg)
202 {
203 	struct ib_mad_send_buf *m;
204 	struct ib_ah *ah;
205 
206 	ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
207 				  mad_recv_wc->recv_buf.grh, port->port_num);
208 	if (IS_ERR(ah))
209 		return PTR_ERR(ah);
210 
211 	m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,
212 			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
213 			       GFP_ATOMIC);
214 	if (IS_ERR(m)) {
215 		ib_destroy_ah(ah);
216 		return PTR_ERR(m);
217 	}
218 	m->ah = ah;
219 	*msg = m;
220 	return 0;
221 }
222 
223 static void cm_free_msg(struct ib_mad_send_buf *msg)
224 {
225 	ib_destroy_ah(msg->ah);
226 	if (msg->context[0])
227 		cm_deref_id(msg->context[0]);
228 	ib_free_send_mad(msg);
229 }
230 
231 static void * cm_copy_private_data(const void *private_data,
232 				   u8 private_data_len)
233 {
234 	void *data;
235 
236 	if (!private_data || !private_data_len)
237 		return NULL;
238 
239 	data = kmalloc(private_data_len, GFP_KERNEL);
240 	if (!data)
241 		return ERR_PTR(-ENOMEM);
242 
243 	memcpy(data, private_data, private_data_len);
244 	return data;
245 }
246 
247 static void cm_set_private_data(struct cm_id_private *cm_id_priv,
248 				 void *private_data, u8 private_data_len)
249 {
250 	if (cm_id_priv->private_data && cm_id_priv->private_data_len)
251 		kfree(cm_id_priv->private_data);
252 
253 	cm_id_priv->private_data = private_data;
254 	cm_id_priv->private_data_len = private_data_len;
255 }
256 
257 static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
258 				    struct ib_grh *grh, struct cm_av *av)
259 {
260 	av->port = port;
261 	av->pkey_index = wc->pkey_index;
262 	ib_init_ah_from_wc(port->cm_dev->device, port->port_num, wc,
263 			   grh, &av->ah_attr);
264 }
265 
266 static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
267 {
268 	struct cm_device *cm_dev;
269 	struct cm_port *port = NULL;
270 	unsigned long flags;
271 	int ret;
272 	u8 p;
273 
274 	read_lock_irqsave(&cm.device_lock, flags);
275 	list_for_each_entry(cm_dev, &cm.device_list, list) {
276 		if (!ib_find_cached_gid(cm_dev->device, &path->sgid,
277 					&p, NULL)) {
278 			port = &cm_dev->port[p-1];
279 			break;
280 		}
281 	}
282 	read_unlock_irqrestore(&cm.device_lock, flags);
283 
284 	if (!port)
285 		return -EINVAL;
286 
287 	ret = ib_find_cached_pkey(cm_dev->device, port->port_num,
288 				  be16_to_cpu(path->pkey), &av->pkey_index);
289 	if (ret)
290 		return ret;
291 
292 	av->port = port;
293 	ib_init_ah_from_path(cm_dev->device, port->port_num, path,
294 			     &av->ah_attr);
295 	av->packet_life_time = path->packet_life_time;
296 	return 0;
297 }
298 
299 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
300 {
301 	unsigned long flags;
302 	int ret;
303 	static int next_id;
304 
305 	do {
306 		spin_lock_irqsave(&cm.lock, flags);
307 		ret = idr_get_new_above(&cm.local_id_table, cm_id_priv, next_id++,
308 					(__force int *) &cm_id_priv->id.local_id);
309 		spin_unlock_irqrestore(&cm.lock, flags);
310 	} while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
311 	return ret;
312 }
313 
314 static void cm_free_id(__be32 local_id)
315 {
316 	unsigned long flags;
317 
318 	spin_lock_irqsave(&cm.lock, flags);
319 	idr_remove(&cm.local_id_table, (__force int) local_id);
320 	spin_unlock_irqrestore(&cm.lock, flags);
321 }
322 
323 static struct cm_id_private * cm_get_id(__be32 local_id, __be32 remote_id)
324 {
325 	struct cm_id_private *cm_id_priv;
326 
327 	cm_id_priv = idr_find(&cm.local_id_table, (__force int) local_id);
328 	if (cm_id_priv) {
329 		if (cm_id_priv->id.remote_id == remote_id)
330 			atomic_inc(&cm_id_priv->refcount);
331 		else
332 			cm_id_priv = NULL;
333 	}
334 
335 	return cm_id_priv;
336 }
337 
338 static struct cm_id_private * cm_acquire_id(__be32 local_id, __be32 remote_id)
339 {
340 	struct cm_id_private *cm_id_priv;
341 	unsigned long flags;
342 
343 	spin_lock_irqsave(&cm.lock, flags);
344 	cm_id_priv = cm_get_id(local_id, remote_id);
345 	spin_unlock_irqrestore(&cm.lock, flags);
346 
347 	return cm_id_priv;
348 }
349 
350 static void cm_mask_copy(u8 *dst, u8 *src, u8 *mask)
351 {
352 	int i;
353 
354 	for (i = 0; i < IB_CM_COMPARE_SIZE / sizeof(unsigned long); i++)
355 		((unsigned long *) dst)[i] = ((unsigned long *) src)[i] &
356 					     ((unsigned long *) mask)[i];
357 }
358 
359 static int cm_compare_data(struct ib_cm_compare_data *src_data,
360 			   struct ib_cm_compare_data *dst_data)
361 {
362 	u8 src[IB_CM_COMPARE_SIZE];
363 	u8 dst[IB_CM_COMPARE_SIZE];
364 
365 	if (!src_data || !dst_data)
366 		return 0;
367 
368 	cm_mask_copy(src, src_data->data, dst_data->mask);
369 	cm_mask_copy(dst, dst_data->data, src_data->mask);
370 	return memcmp(src, dst, IB_CM_COMPARE_SIZE);
371 }
372 
373 static int cm_compare_private_data(u8 *private_data,
374 				   struct ib_cm_compare_data *dst_data)
375 {
376 	u8 src[IB_CM_COMPARE_SIZE];
377 
378 	if (!dst_data)
379 		return 0;
380 
381 	cm_mask_copy(src, private_data, dst_data->mask);
382 	return memcmp(src, dst_data->data, IB_CM_COMPARE_SIZE);
383 }
384 
385 static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
386 {
387 	struct rb_node **link = &cm.listen_service_table.rb_node;
388 	struct rb_node *parent = NULL;
389 	struct cm_id_private *cur_cm_id_priv;
390 	__be64 service_id = cm_id_priv->id.service_id;
391 	__be64 service_mask = cm_id_priv->id.service_mask;
392 	int data_cmp;
393 
394 	while (*link) {
395 		parent = *link;
396 		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
397 					  service_node);
398 		data_cmp = cm_compare_data(cm_id_priv->compare_data,
399 					   cur_cm_id_priv->compare_data);
400 		if ((cur_cm_id_priv->id.service_mask & service_id) ==
401 		    (service_mask & cur_cm_id_priv->id.service_id) &&
402 		    (cm_id_priv->id.device == cur_cm_id_priv->id.device) &&
403 		    !data_cmp)
404 			return cur_cm_id_priv;
405 
406 		if (cm_id_priv->id.device < cur_cm_id_priv->id.device)
407 			link = &(*link)->rb_left;
408 		else if (cm_id_priv->id.device > cur_cm_id_priv->id.device)
409 			link = &(*link)->rb_right;
410 		else if (service_id < cur_cm_id_priv->id.service_id)
411 			link = &(*link)->rb_left;
412 		else if (service_id > cur_cm_id_priv->id.service_id)
413 			link = &(*link)->rb_right;
414 		else if (data_cmp < 0)
415 			link = &(*link)->rb_left;
416 		else
417 			link = &(*link)->rb_right;
418 	}
419 	rb_link_node(&cm_id_priv->service_node, parent, link);
420 	rb_insert_color(&cm_id_priv->service_node, &cm.listen_service_table);
421 	return NULL;
422 }
423 
424 static struct cm_id_private * cm_find_listen(struct ib_device *device,
425 					     __be64 service_id,
426 					     u8 *private_data)
427 {
428 	struct rb_node *node = cm.listen_service_table.rb_node;
429 	struct cm_id_private *cm_id_priv;
430 	int data_cmp;
431 
432 	while (node) {
433 		cm_id_priv = rb_entry(node, struct cm_id_private, service_node);
434 		data_cmp = cm_compare_private_data(private_data,
435 						   cm_id_priv->compare_data);
436 		if ((cm_id_priv->id.service_mask & service_id) ==
437 		     cm_id_priv->id.service_id &&
438 		    (cm_id_priv->id.device == device) && !data_cmp)
439 			return cm_id_priv;
440 
441 		if (device < cm_id_priv->id.device)
442 			node = node->rb_left;
443 		else if (device > cm_id_priv->id.device)
444 			node = node->rb_right;
445 		else if (service_id < cm_id_priv->id.service_id)
446 			node = node->rb_left;
447 		else if (service_id > cm_id_priv->id.service_id)
448 			node = node->rb_right;
449 		else if (data_cmp < 0)
450 			node = node->rb_left;
451 		else
452 			node = node->rb_right;
453 	}
454 	return NULL;
455 }
456 
457 static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
458 						     *timewait_info)
459 {
460 	struct rb_node **link = &cm.remote_id_table.rb_node;
461 	struct rb_node *parent = NULL;
462 	struct cm_timewait_info *cur_timewait_info;
463 	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
464 	__be32 remote_id = timewait_info->work.remote_id;
465 
466 	while (*link) {
467 		parent = *link;
468 		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
469 					     remote_id_node);
470 		if (remote_id < cur_timewait_info->work.remote_id)
471 			link = &(*link)->rb_left;
472 		else if (remote_id > cur_timewait_info->work.remote_id)
473 			link = &(*link)->rb_right;
474 		else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
475 			link = &(*link)->rb_left;
476 		else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
477 			link = &(*link)->rb_right;
478 		else
479 			return cur_timewait_info;
480 	}
481 	timewait_info->inserted_remote_id = 1;
482 	rb_link_node(&timewait_info->remote_id_node, parent, link);
483 	rb_insert_color(&timewait_info->remote_id_node, &cm.remote_id_table);
484 	return NULL;
485 }
486 
487 static struct cm_timewait_info * cm_find_remote_id(__be64 remote_ca_guid,
488 						   __be32 remote_id)
489 {
490 	struct rb_node *node = cm.remote_id_table.rb_node;
491 	struct cm_timewait_info *timewait_info;
492 
493 	while (node) {
494 		timewait_info = rb_entry(node, struct cm_timewait_info,
495 					 remote_id_node);
496 		if (remote_id < timewait_info->work.remote_id)
497 			node = node->rb_left;
498 		else if (remote_id > timewait_info->work.remote_id)
499 			node = node->rb_right;
500 		else if (remote_ca_guid < timewait_info->remote_ca_guid)
501 			node = node->rb_left;
502 		else if (remote_ca_guid > timewait_info->remote_ca_guid)
503 			node = node->rb_right;
504 		else
505 			return timewait_info;
506 	}
507 	return NULL;
508 }
509 
510 static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
511 						      *timewait_info)
512 {
513 	struct rb_node **link = &cm.remote_qp_table.rb_node;
514 	struct rb_node *parent = NULL;
515 	struct cm_timewait_info *cur_timewait_info;
516 	__be64 remote_ca_guid = timewait_info->remote_ca_guid;
517 	__be32 remote_qpn = timewait_info->remote_qpn;
518 
519 	while (*link) {
520 		parent = *link;
521 		cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
522 					     remote_qp_node);
523 		if (remote_qpn < cur_timewait_info->remote_qpn)
524 			link = &(*link)->rb_left;
525 		else if (remote_qpn > cur_timewait_info->remote_qpn)
526 			link = &(*link)->rb_right;
527 		else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
528 			link = &(*link)->rb_left;
529 		else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
530 			link = &(*link)->rb_right;
531 		else
532 			return cur_timewait_info;
533 	}
534 	timewait_info->inserted_remote_qp = 1;
535 	rb_link_node(&timewait_info->remote_qp_node, parent, link);
536 	rb_insert_color(&timewait_info->remote_qp_node, &cm.remote_qp_table);
537 	return NULL;
538 }
539 
540 static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
541 						    *cm_id_priv)
542 {
543 	struct rb_node **link = &cm.remote_sidr_table.rb_node;
544 	struct rb_node *parent = NULL;
545 	struct cm_id_private *cur_cm_id_priv;
546 	union ib_gid *port_gid = &cm_id_priv->av.dgid;
547 	__be32 remote_id = cm_id_priv->id.remote_id;
548 
549 	while (*link) {
550 		parent = *link;
551 		cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
552 					  sidr_id_node);
553 		if (remote_id < cur_cm_id_priv->id.remote_id)
554 			link = &(*link)->rb_left;
555 		else if (remote_id > cur_cm_id_priv->id.remote_id)
556 			link = &(*link)->rb_right;
557 		else {
558 			int cmp;
559 			cmp = memcmp(port_gid, &cur_cm_id_priv->av.dgid,
560 				     sizeof *port_gid);
561 			if (cmp < 0)
562 				link = &(*link)->rb_left;
563 			else if (cmp > 0)
564 				link = &(*link)->rb_right;
565 			else
566 				return cur_cm_id_priv;
567 		}
568 	}
569 	rb_link_node(&cm_id_priv->sidr_id_node, parent, link);
570 	rb_insert_color(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
571 	return NULL;
572 }
573 
574 static void cm_reject_sidr_req(struct cm_id_private *cm_id_priv,
575 			       enum ib_cm_sidr_status status)
576 {
577 	struct ib_cm_sidr_rep_param param;
578 
579 	memset(&param, 0, sizeof param);
580 	param.status = status;
581 	ib_send_cm_sidr_rep(&cm_id_priv->id, &param);
582 }
583 
584 struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
585 				 ib_cm_handler cm_handler,
586 				 void *context)
587 {
588 	struct cm_id_private *cm_id_priv;
589 	int ret;
590 
591 	cm_id_priv = kzalloc(sizeof *cm_id_priv, GFP_KERNEL);
592 	if (!cm_id_priv)
593 		return ERR_PTR(-ENOMEM);
594 
595 	cm_id_priv->id.state = IB_CM_IDLE;
596 	cm_id_priv->id.device = device;
597 	cm_id_priv->id.cm_handler = cm_handler;
598 	cm_id_priv->id.context = context;
599 	cm_id_priv->id.remote_cm_qpn = 1;
600 	ret = cm_alloc_id(cm_id_priv);
601 	if (ret)
602 		goto error;
603 
604 	spin_lock_init(&cm_id_priv->lock);
605 	init_completion(&cm_id_priv->comp);
606 	INIT_LIST_HEAD(&cm_id_priv->work_list);
607 	atomic_set(&cm_id_priv->work_count, -1);
608 	atomic_set(&cm_id_priv->refcount, 1);
609 	return &cm_id_priv->id;
610 
611 error:
612 	kfree(cm_id_priv);
613 	return ERR_PTR(-ENOMEM);
614 }
615 EXPORT_SYMBOL(ib_create_cm_id);
616 
617 static struct cm_work * cm_dequeue_work(struct cm_id_private *cm_id_priv)
618 {
619 	struct cm_work *work;
620 
621 	if (list_empty(&cm_id_priv->work_list))
622 		return NULL;
623 
624 	work = list_entry(cm_id_priv->work_list.next, struct cm_work, list);
625 	list_del(&work->list);
626 	return work;
627 }
628 
629 static void cm_free_work(struct cm_work *work)
630 {
631 	if (work->mad_recv_wc)
632 		ib_free_recv_mad(work->mad_recv_wc);
633 	kfree(work);
634 }
635 
636 static inline int cm_convert_to_ms(int iba_time)
637 {
638 	/* approximate conversion to ms from 4.096us x 2^iba_time */
639 	return 1 << max(iba_time - 8, 0);
640 }
641 
642 static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
643 {
644 	unsigned long flags;
645 
646 	if (!timewait_info->inserted_remote_id &&
647 	    !timewait_info->inserted_remote_qp)
648 	    return;
649 
650 	spin_lock_irqsave(&cm.lock, flags);
651 	if (timewait_info->inserted_remote_id) {
652 		rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
653 		timewait_info->inserted_remote_id = 0;
654 	}
655 
656 	if (timewait_info->inserted_remote_qp) {
657 		rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
658 		timewait_info->inserted_remote_qp = 0;
659 	}
660 	spin_unlock_irqrestore(&cm.lock, flags);
661 }
662 
663 static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
664 {
665 	struct cm_timewait_info *timewait_info;
666 
667 	timewait_info = kzalloc(sizeof *timewait_info, GFP_KERNEL);
668 	if (!timewait_info)
669 		return ERR_PTR(-ENOMEM);
670 
671 	timewait_info->work.local_id = local_id;
672 	INIT_WORK(&timewait_info->work.work, cm_work_handler,
673 		  &timewait_info->work);
674 	timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
675 	return timewait_info;
676 }
677 
678 static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
679 {
680 	int wait_time;
681 
682 	/*
683 	 * The cm_id could be destroyed by the user before we exit timewait.
684 	 * To protect against this, we search for the cm_id after exiting
685 	 * timewait before notifying the user that we've exited timewait.
686 	 */
687 	cm_id_priv->id.state = IB_CM_TIMEWAIT;
688 	wait_time = cm_convert_to_ms(cm_id_priv->local_ack_timeout);
689 	queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
690 			   msecs_to_jiffies(wait_time));
691 	cm_id_priv->timewait_info = NULL;
692 }
693 
694 static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
695 {
696 	cm_id_priv->id.state = IB_CM_IDLE;
697 	if (cm_id_priv->timewait_info) {
698 		cm_cleanup_timewait(cm_id_priv->timewait_info);
699 		kfree(cm_id_priv->timewait_info);
700 		cm_id_priv->timewait_info = NULL;
701 	}
702 }
703 
704 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
705 {
706 	struct cm_id_private *cm_id_priv;
707 	struct cm_work *work;
708 	unsigned long flags;
709 
710 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
711 retest:
712 	spin_lock_irqsave(&cm_id_priv->lock, flags);
713 	switch (cm_id->state) {
714 	case IB_CM_LISTEN:
715 		cm_id->state = IB_CM_IDLE;
716 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
717 		spin_lock_irqsave(&cm.lock, flags);
718 		rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);
719 		spin_unlock_irqrestore(&cm.lock, flags);
720 		break;
721 	case IB_CM_SIDR_REQ_SENT:
722 		cm_id->state = IB_CM_IDLE;
723 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
724 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
725 		break;
726 	case IB_CM_SIDR_REQ_RCVD:
727 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
728 		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
729 		break;
730 	case IB_CM_REQ_SENT:
731 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
732 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
733 		ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,
734 			       &cm_id_priv->av.port->cm_dev->ca_guid,
735 			       sizeof cm_id_priv->av.port->cm_dev->ca_guid,
736 			       NULL, 0);
737 		break;
738 	case IB_CM_REQ_RCVD:
739 		if (err == -ENOMEM) {
740 			/* Do not reject to allow future retries. */
741 			cm_reset_to_idle(cm_id_priv);
742 			spin_unlock_irqrestore(&cm_id_priv->lock, flags);
743 		} else {
744 			spin_unlock_irqrestore(&cm_id_priv->lock, flags);
745 			ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
746 				       NULL, 0, NULL, 0);
747 		}
748 		break;
749 	case IB_CM_MRA_REQ_RCVD:
750 	case IB_CM_REP_SENT:
751 	case IB_CM_MRA_REP_RCVD:
752 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
753 		/* Fall through */
754 	case IB_CM_MRA_REQ_SENT:
755 	case IB_CM_REP_RCVD:
756 	case IB_CM_MRA_REP_SENT:
757 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
758 		ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
759 			       NULL, 0, NULL, 0);
760 		break;
761 	case IB_CM_ESTABLISHED:
762 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
763 		ib_send_cm_dreq(cm_id, NULL, 0);
764 		goto retest;
765 	case IB_CM_DREQ_SENT:
766 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
767 		cm_enter_timewait(cm_id_priv);
768 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
769 		break;
770 	case IB_CM_DREQ_RCVD:
771 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
772 		ib_send_cm_drep(cm_id, NULL, 0);
773 		break;
774 	default:
775 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
776 		break;
777 	}
778 
779 	cm_free_id(cm_id->local_id);
780 	cm_deref_id(cm_id_priv);
781 	wait_for_completion(&cm_id_priv->comp);
782 	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
783 		cm_free_work(work);
784 	kfree(cm_id_priv->compare_data);
785 	kfree(cm_id_priv->private_data);
786 	kfree(cm_id_priv);
787 }
788 
789 void ib_destroy_cm_id(struct ib_cm_id *cm_id)
790 {
791 	cm_destroy_id(cm_id, 0);
792 }
793 EXPORT_SYMBOL(ib_destroy_cm_id);
794 
795 int ib_cm_listen(struct ib_cm_id *cm_id, __be64 service_id, __be64 service_mask,
796 		 struct ib_cm_compare_data *compare_data)
797 {
798 	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
799 	unsigned long flags;
800 	int ret = 0;
801 
802 	service_mask = service_mask ? service_mask :
803 		       __constant_cpu_to_be64(~0ULL);
804 	service_id &= service_mask;
805 	if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
806 	    (service_id != IB_CM_ASSIGN_SERVICE_ID))
807 		return -EINVAL;
808 
809 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
810 	if (cm_id->state != IB_CM_IDLE)
811 		return -EINVAL;
812 
813 	if (compare_data) {
814 		cm_id_priv->compare_data = kzalloc(sizeof *compare_data,
815 						   GFP_KERNEL);
816 		if (!cm_id_priv->compare_data)
817 			return -ENOMEM;
818 		cm_mask_copy(cm_id_priv->compare_data->data,
819 			     compare_data->data, compare_data->mask);
820 		memcpy(cm_id_priv->compare_data->mask, compare_data->mask,
821 		       IB_CM_COMPARE_SIZE);
822 	}
823 
824 	cm_id->state = IB_CM_LISTEN;
825 
826 	spin_lock_irqsave(&cm.lock, flags);
827 	if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
828 		cm_id->service_id = cpu_to_be64(cm.listen_service_id++);
829 		cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
830 	} else {
831 		cm_id->service_id = service_id;
832 		cm_id->service_mask = service_mask;
833 	}
834 	cur_cm_id_priv = cm_insert_listen(cm_id_priv);
835 	spin_unlock_irqrestore(&cm.lock, flags);
836 
837 	if (cur_cm_id_priv) {
838 		cm_id->state = IB_CM_IDLE;
839 		kfree(cm_id_priv->compare_data);
840 		cm_id_priv->compare_data = NULL;
841 		ret = -EBUSY;
842 	}
843 	return ret;
844 }
845 EXPORT_SYMBOL(ib_cm_listen);
846 
847 static __be64 cm_form_tid(struct cm_id_private *cm_id_priv,
848 			  enum cm_msg_sequence msg_seq)
849 {
850 	u64 hi_tid, low_tid;
851 
852 	hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
853 	low_tid  = (u64) ((__force u32)cm_id_priv->id.local_id |
854 			  (msg_seq << 30));
855 	return cpu_to_be64(hi_tid | low_tid);
856 }
857 
858 static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
859 			      __be16 attr_id, __be64 tid)
860 {
861 	hdr->base_version  = IB_MGMT_BASE_VERSION;
862 	hdr->mgmt_class	   = IB_MGMT_CLASS_CM;
863 	hdr->class_version = IB_CM_CLASS_VERSION;
864 	hdr->method	   = IB_MGMT_METHOD_SEND;
865 	hdr->attr_id	   = attr_id;
866 	hdr->tid	   = tid;
867 }
868 
869 static void cm_format_req(struct cm_req_msg *req_msg,
870 			  struct cm_id_private *cm_id_priv,
871 			  struct ib_cm_req_param *param)
872 {
873 	cm_format_mad_hdr(&req_msg->hdr, CM_REQ_ATTR_ID,
874 			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_REQ));
875 
876 	req_msg->local_comm_id = cm_id_priv->id.local_id;
877 	req_msg->service_id = param->service_id;
878 	req_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
879 	cm_req_set_local_qpn(req_msg, cpu_to_be32(param->qp_num));
880 	cm_req_set_resp_res(req_msg, param->responder_resources);
881 	cm_req_set_init_depth(req_msg, param->initiator_depth);
882 	cm_req_set_remote_resp_timeout(req_msg,
883 				       param->remote_cm_response_timeout);
884 	cm_req_set_qp_type(req_msg, param->qp_type);
885 	cm_req_set_flow_ctrl(req_msg, param->flow_control);
886 	cm_req_set_starting_psn(req_msg, cpu_to_be32(param->starting_psn));
887 	cm_req_set_local_resp_timeout(req_msg,
888 				      param->local_cm_response_timeout);
889 	cm_req_set_retry_count(req_msg, param->retry_count);
890 	req_msg->pkey = param->primary_path->pkey;
891 	cm_req_set_path_mtu(req_msg, param->primary_path->mtu);
892 	cm_req_set_rnr_retry_count(req_msg, param->rnr_retry_count);
893 	cm_req_set_max_cm_retries(req_msg, param->max_cm_retries);
894 	cm_req_set_srq(req_msg, param->srq);
895 
896 	req_msg->primary_local_lid = param->primary_path->slid;
897 	req_msg->primary_remote_lid = param->primary_path->dlid;
898 	req_msg->primary_local_gid = param->primary_path->sgid;
899 	req_msg->primary_remote_gid = param->primary_path->dgid;
900 	cm_req_set_primary_flow_label(req_msg, param->primary_path->flow_label);
901 	cm_req_set_primary_packet_rate(req_msg, param->primary_path->rate);
902 	req_msg->primary_traffic_class = param->primary_path->traffic_class;
903 	req_msg->primary_hop_limit = param->primary_path->hop_limit;
904 	cm_req_set_primary_sl(req_msg, param->primary_path->sl);
905 	cm_req_set_primary_subnet_local(req_msg, 1); /* local only... */
906 	cm_req_set_primary_local_ack_timeout(req_msg,
907 		min(31, param->primary_path->packet_life_time + 1));
908 
909 	if (param->alternate_path) {
910 		req_msg->alt_local_lid = param->alternate_path->slid;
911 		req_msg->alt_remote_lid = param->alternate_path->dlid;
912 		req_msg->alt_local_gid = param->alternate_path->sgid;
913 		req_msg->alt_remote_gid = param->alternate_path->dgid;
914 		cm_req_set_alt_flow_label(req_msg,
915 					  param->alternate_path->flow_label);
916 		cm_req_set_alt_packet_rate(req_msg, param->alternate_path->rate);
917 		req_msg->alt_traffic_class = param->alternate_path->traffic_class;
918 		req_msg->alt_hop_limit = param->alternate_path->hop_limit;
919 		cm_req_set_alt_sl(req_msg, param->alternate_path->sl);
920 		cm_req_set_alt_subnet_local(req_msg, 1); /* local only... */
921 		cm_req_set_alt_local_ack_timeout(req_msg,
922 			min(31, param->alternate_path->packet_life_time + 1));
923 	}
924 
925 	if (param->private_data && param->private_data_len)
926 		memcpy(req_msg->private_data, param->private_data,
927 		       param->private_data_len);
928 }
929 
930 static int cm_validate_req_param(struct ib_cm_req_param *param)
931 {
932 	/* peer-to-peer not supported */
933 	if (param->peer_to_peer)
934 		return -EINVAL;
935 
936 	if (!param->primary_path)
937 		return -EINVAL;
938 
939 	if (param->qp_type != IB_QPT_RC && param->qp_type != IB_QPT_UC)
940 		return -EINVAL;
941 
942 	if (param->private_data &&
943 	    param->private_data_len > IB_CM_REQ_PRIVATE_DATA_SIZE)
944 		return -EINVAL;
945 
946 	if (param->alternate_path &&
947 	    (param->alternate_path->pkey != param->primary_path->pkey ||
948 	     param->alternate_path->mtu != param->primary_path->mtu))
949 		return -EINVAL;
950 
951 	return 0;
952 }
953 
954 int ib_send_cm_req(struct ib_cm_id *cm_id,
955 		   struct ib_cm_req_param *param)
956 {
957 	struct cm_id_private *cm_id_priv;
958 	struct cm_req_msg *req_msg;
959 	unsigned long flags;
960 	int ret;
961 
962 	ret = cm_validate_req_param(param);
963 	if (ret)
964 		return ret;
965 
966 	/* Verify that we're not in timewait. */
967 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
968 	spin_lock_irqsave(&cm_id_priv->lock, flags);
969 	if (cm_id->state != IB_CM_IDLE) {
970 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
971 		ret = -EINVAL;
972 		goto out;
973 	}
974 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
975 
976 	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
977 							    id.local_id);
978 	if (IS_ERR(cm_id_priv->timewait_info))
979 		goto out;
980 
981 	ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
982 	if (ret)
983 		goto error1;
984 	if (param->alternate_path) {
985 		ret = cm_init_av_by_path(param->alternate_path,
986 					 &cm_id_priv->alt_av);
987 		if (ret)
988 			goto error1;
989 	}
990 	cm_id->service_id = param->service_id;
991 	cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
992 	cm_id_priv->timeout_ms = cm_convert_to_ms(
993 				    param->primary_path->packet_life_time) * 2 +
994 				 cm_convert_to_ms(
995 				    param->remote_cm_response_timeout);
996 	cm_id_priv->max_cm_retries = param->max_cm_retries;
997 	cm_id_priv->initiator_depth = param->initiator_depth;
998 	cm_id_priv->responder_resources = param->responder_resources;
999 	cm_id_priv->retry_count = param->retry_count;
1000 	cm_id_priv->path_mtu = param->primary_path->mtu;
1001 	cm_id_priv->qp_type = param->qp_type;
1002 
1003 	ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
1004 	if (ret)
1005 		goto error1;
1006 
1007 	req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
1008 	cm_format_req(req_msg, cm_id_priv, param);
1009 	cm_id_priv->tid = req_msg->hdr.tid;
1010 	cm_id_priv->msg->timeout_ms = cm_id_priv->timeout_ms;
1011 	cm_id_priv->msg->context[1] = (void *) (unsigned long) IB_CM_REQ_SENT;
1012 
1013 	cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
1014 	cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
1015 	cm_id_priv->local_ack_timeout =
1016 				cm_req_get_primary_local_ack_timeout(req_msg);
1017 
1018 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1019 	ret = ib_post_send_mad(cm_id_priv->msg, NULL);
1020 	if (ret) {
1021 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1022 		goto error2;
1023 	}
1024 	BUG_ON(cm_id->state != IB_CM_IDLE);
1025 	cm_id->state = IB_CM_REQ_SENT;
1026 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1027 	return 0;
1028 
1029 error2:	cm_free_msg(cm_id_priv->msg);
1030 error1:	kfree(cm_id_priv->timewait_info);
1031 out:	return ret;
1032 }
1033 EXPORT_SYMBOL(ib_send_cm_req);
1034 
1035 static int cm_issue_rej(struct cm_port *port,
1036 			struct ib_mad_recv_wc *mad_recv_wc,
1037 			enum ib_cm_rej_reason reason,
1038 			enum cm_msg_response msg_rejected,
1039 			void *ari, u8 ari_length)
1040 {
1041 	struct ib_mad_send_buf *msg = NULL;
1042 	struct cm_rej_msg *rej_msg, *rcv_msg;
1043 	int ret;
1044 
1045 	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
1046 	if (ret)
1047 		return ret;
1048 
1049 	/* We just need common CM header information.  Cast to any message. */
1050 	rcv_msg = (struct cm_rej_msg *) mad_recv_wc->recv_buf.mad;
1051 	rej_msg = (struct cm_rej_msg *) msg->mad;
1052 
1053 	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, rcv_msg->hdr.tid);
1054 	rej_msg->remote_comm_id = rcv_msg->local_comm_id;
1055 	rej_msg->local_comm_id = rcv_msg->remote_comm_id;
1056 	cm_rej_set_msg_rejected(rej_msg, msg_rejected);
1057 	rej_msg->reason = cpu_to_be16(reason);
1058 
1059 	if (ari && ari_length) {
1060 		cm_rej_set_reject_info_len(rej_msg, ari_length);
1061 		memcpy(rej_msg->ari, ari, ari_length);
1062 	}
1063 
1064 	ret = ib_post_send_mad(msg, NULL);
1065 	if (ret)
1066 		cm_free_msg(msg);
1067 
1068 	return ret;
1069 }
1070 
1071 static inline int cm_is_active_peer(__be64 local_ca_guid, __be64 remote_ca_guid,
1072 				    __be32 local_qpn, __be32 remote_qpn)
1073 {
1074 	return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
1075 		((local_ca_guid == remote_ca_guid) &&
1076 		 (be32_to_cpu(local_qpn) > be32_to_cpu(remote_qpn))));
1077 }
1078 
1079 static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
1080 					    struct ib_sa_path_rec *primary_path,
1081 					    struct ib_sa_path_rec *alt_path)
1082 {
1083 	memset(primary_path, 0, sizeof *primary_path);
1084 	primary_path->dgid = req_msg->primary_local_gid;
1085 	primary_path->sgid = req_msg->primary_remote_gid;
1086 	primary_path->dlid = req_msg->primary_local_lid;
1087 	primary_path->slid = req_msg->primary_remote_lid;
1088 	primary_path->flow_label = cm_req_get_primary_flow_label(req_msg);
1089 	primary_path->hop_limit = req_msg->primary_hop_limit;
1090 	primary_path->traffic_class = req_msg->primary_traffic_class;
1091 	primary_path->reversible = 1;
1092 	primary_path->pkey = req_msg->pkey;
1093 	primary_path->sl = cm_req_get_primary_sl(req_msg);
1094 	primary_path->mtu_selector = IB_SA_EQ;
1095 	primary_path->mtu = cm_req_get_path_mtu(req_msg);
1096 	primary_path->rate_selector = IB_SA_EQ;
1097 	primary_path->rate = cm_req_get_primary_packet_rate(req_msg);
1098 	primary_path->packet_life_time_selector = IB_SA_EQ;
1099 	primary_path->packet_life_time =
1100 		cm_req_get_primary_local_ack_timeout(req_msg);
1101 	primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
1102 
1103 	if (req_msg->alt_local_lid) {
1104 		memset(alt_path, 0, sizeof *alt_path);
1105 		alt_path->dgid = req_msg->alt_local_gid;
1106 		alt_path->sgid = req_msg->alt_remote_gid;
1107 		alt_path->dlid = req_msg->alt_local_lid;
1108 		alt_path->slid = req_msg->alt_remote_lid;
1109 		alt_path->flow_label = cm_req_get_alt_flow_label(req_msg);
1110 		alt_path->hop_limit = req_msg->alt_hop_limit;
1111 		alt_path->traffic_class = req_msg->alt_traffic_class;
1112 		alt_path->reversible = 1;
1113 		alt_path->pkey = req_msg->pkey;
1114 		alt_path->sl = cm_req_get_alt_sl(req_msg);
1115 		alt_path->mtu_selector = IB_SA_EQ;
1116 		alt_path->mtu = cm_req_get_path_mtu(req_msg);
1117 		alt_path->rate_selector = IB_SA_EQ;
1118 		alt_path->rate = cm_req_get_alt_packet_rate(req_msg);
1119 		alt_path->packet_life_time_selector = IB_SA_EQ;
1120 		alt_path->packet_life_time =
1121 			cm_req_get_alt_local_ack_timeout(req_msg);
1122 		alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
1123 	}
1124 }
1125 
1126 static void cm_format_req_event(struct cm_work *work,
1127 				struct cm_id_private *cm_id_priv,
1128 				struct ib_cm_id *listen_id)
1129 {
1130 	struct cm_req_msg *req_msg;
1131 	struct ib_cm_req_event_param *param;
1132 
1133 	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1134 	param = &work->cm_event.param.req_rcvd;
1135 	param->listen_id = listen_id;
1136 	param->port = cm_id_priv->av.port->port_num;
1137 	param->primary_path = &work->path[0];
1138 	if (req_msg->alt_local_lid)
1139 		param->alternate_path = &work->path[1];
1140 	else
1141 		param->alternate_path = NULL;
1142 	param->remote_ca_guid = req_msg->local_ca_guid;
1143 	param->remote_qkey = be32_to_cpu(req_msg->local_qkey);
1144 	param->remote_qpn = be32_to_cpu(cm_req_get_local_qpn(req_msg));
1145 	param->qp_type = cm_req_get_qp_type(req_msg);
1146 	param->starting_psn = be32_to_cpu(cm_req_get_starting_psn(req_msg));
1147 	param->responder_resources = cm_req_get_init_depth(req_msg);
1148 	param->initiator_depth = cm_req_get_resp_res(req_msg);
1149 	param->local_cm_response_timeout =
1150 					cm_req_get_remote_resp_timeout(req_msg);
1151 	param->flow_control = cm_req_get_flow_ctrl(req_msg);
1152 	param->remote_cm_response_timeout =
1153 					cm_req_get_local_resp_timeout(req_msg);
1154 	param->retry_count = cm_req_get_retry_count(req_msg);
1155 	param->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1156 	param->srq = cm_req_get_srq(req_msg);
1157 	work->cm_event.private_data = &req_msg->private_data;
1158 }
1159 
1160 static void cm_process_work(struct cm_id_private *cm_id_priv,
1161 			    struct cm_work *work)
1162 {
1163 	unsigned long flags;
1164 	int ret;
1165 
1166 	/* We will typically only have the current event to report. */
1167 	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &work->cm_event);
1168 	cm_free_work(work);
1169 
1170 	while (!ret && !atomic_add_negative(-1, &cm_id_priv->work_count)) {
1171 		spin_lock_irqsave(&cm_id_priv->lock, flags);
1172 		work = cm_dequeue_work(cm_id_priv);
1173 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1174 		BUG_ON(!work);
1175 		ret = cm_id_priv->id.cm_handler(&cm_id_priv->id,
1176 						&work->cm_event);
1177 		cm_free_work(work);
1178 	}
1179 	cm_deref_id(cm_id_priv);
1180 	if (ret)
1181 		cm_destroy_id(&cm_id_priv->id, ret);
1182 }
1183 
1184 static void cm_format_mra(struct cm_mra_msg *mra_msg,
1185 			  struct cm_id_private *cm_id_priv,
1186 			  enum cm_msg_response msg_mraed, u8 service_timeout,
1187 			  const void *private_data, u8 private_data_len)
1188 {
1189 	cm_format_mad_hdr(&mra_msg->hdr, CM_MRA_ATTR_ID, cm_id_priv->tid);
1190 	cm_mra_set_msg_mraed(mra_msg, msg_mraed);
1191 	mra_msg->local_comm_id = cm_id_priv->id.local_id;
1192 	mra_msg->remote_comm_id = cm_id_priv->id.remote_id;
1193 	cm_mra_set_service_timeout(mra_msg, service_timeout);
1194 
1195 	if (private_data && private_data_len)
1196 		memcpy(mra_msg->private_data, private_data, private_data_len);
1197 }
1198 
1199 static void cm_format_rej(struct cm_rej_msg *rej_msg,
1200 			  struct cm_id_private *cm_id_priv,
1201 			  enum ib_cm_rej_reason reason,
1202 			  void *ari,
1203 			  u8 ari_length,
1204 			  const void *private_data,
1205 			  u8 private_data_len)
1206 {
1207 	cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, cm_id_priv->tid);
1208 	rej_msg->remote_comm_id = cm_id_priv->id.remote_id;
1209 
1210 	switch(cm_id_priv->id.state) {
1211 	case IB_CM_REQ_RCVD:
1212 		rej_msg->local_comm_id = 0;
1213 		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1214 		break;
1215 	case IB_CM_MRA_REQ_SENT:
1216 		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1217 		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
1218 		break;
1219 	case IB_CM_REP_RCVD:
1220 	case IB_CM_MRA_REP_SENT:
1221 		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1222 		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REP);
1223 		break;
1224 	default:
1225 		rej_msg->local_comm_id = cm_id_priv->id.local_id;
1226 		cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_OTHER);
1227 		break;
1228 	}
1229 
1230 	rej_msg->reason = cpu_to_be16(reason);
1231 	if (ari && ari_length) {
1232 		cm_rej_set_reject_info_len(rej_msg, ari_length);
1233 		memcpy(rej_msg->ari, ari, ari_length);
1234 	}
1235 
1236 	if (private_data && private_data_len)
1237 		memcpy(rej_msg->private_data, private_data, private_data_len);
1238 }
1239 
1240 static void cm_dup_req_handler(struct cm_work *work,
1241 			       struct cm_id_private *cm_id_priv)
1242 {
1243 	struct ib_mad_send_buf *msg = NULL;
1244 	unsigned long flags;
1245 	int ret;
1246 
1247 	/* Quick state check to discard duplicate REQs. */
1248 	if (cm_id_priv->id.state == IB_CM_REQ_RCVD)
1249 		return;
1250 
1251 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1252 	if (ret)
1253 		return;
1254 
1255 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1256 	switch (cm_id_priv->id.state) {
1257 	case IB_CM_MRA_REQ_SENT:
1258 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1259 			      CM_MSG_RESPONSE_REQ, cm_id_priv->service_timeout,
1260 			      cm_id_priv->private_data,
1261 			      cm_id_priv->private_data_len);
1262 		break;
1263 	case IB_CM_TIMEWAIT:
1264 		cm_format_rej((struct cm_rej_msg *) msg->mad, cm_id_priv,
1265 			      IB_CM_REJ_STALE_CONN, NULL, 0, NULL, 0);
1266 		break;
1267 	default:
1268 		goto unlock;
1269 	}
1270 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1271 
1272 	ret = ib_post_send_mad(msg, NULL);
1273 	if (ret)
1274 		goto free;
1275 	return;
1276 
1277 unlock:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1278 free:	cm_free_msg(msg);
1279 }
1280 
1281 static struct cm_id_private * cm_match_req(struct cm_work *work,
1282 					   struct cm_id_private *cm_id_priv)
1283 {
1284 	struct cm_id_private *listen_cm_id_priv, *cur_cm_id_priv;
1285 	struct cm_timewait_info *timewait_info;
1286 	struct cm_req_msg *req_msg;
1287 	unsigned long flags;
1288 
1289 	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1290 
1291 	/* Check for duplicate REQ and stale connections. */
1292 	spin_lock_irqsave(&cm.lock, flags);
1293 	timewait_info = cm_insert_remote_id(cm_id_priv->timewait_info);
1294 	if (!timewait_info)
1295 		timewait_info = cm_insert_remote_qpn(cm_id_priv->timewait_info);
1296 
1297 	if (timewait_info) {
1298 		cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
1299 					   timewait_info->work.remote_id);
1300 		spin_unlock_irqrestore(&cm.lock, flags);
1301 		if (cur_cm_id_priv) {
1302 			cm_dup_req_handler(work, cur_cm_id_priv);
1303 			cm_deref_id(cur_cm_id_priv);
1304 		} else
1305 			cm_issue_rej(work->port, work->mad_recv_wc,
1306 				     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
1307 				     NULL, 0);
1308 		goto error;
1309 	}
1310 
1311 	/* Find matching listen request. */
1312 	listen_cm_id_priv = cm_find_listen(cm_id_priv->id.device,
1313 					   req_msg->service_id,
1314 					   req_msg->private_data);
1315 	if (!listen_cm_id_priv) {
1316 		spin_unlock_irqrestore(&cm.lock, flags);
1317 		cm_issue_rej(work->port, work->mad_recv_wc,
1318 			     IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
1319 			     NULL, 0);
1320 		goto error;
1321 	}
1322 	atomic_inc(&listen_cm_id_priv->refcount);
1323 	atomic_inc(&cm_id_priv->refcount);
1324 	cm_id_priv->id.state = IB_CM_REQ_RCVD;
1325 	atomic_inc(&cm_id_priv->work_count);
1326 	spin_unlock_irqrestore(&cm.lock, flags);
1327 	return listen_cm_id_priv;
1328 
1329 error:	cm_cleanup_timewait(cm_id_priv->timewait_info);
1330 	return NULL;
1331 }
1332 
1333 static int cm_req_handler(struct cm_work *work)
1334 {
1335 	struct ib_cm_id *cm_id;
1336 	struct cm_id_private *cm_id_priv, *listen_cm_id_priv;
1337 	struct cm_req_msg *req_msg;
1338 	int ret;
1339 
1340 	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
1341 
1342 	cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
1343 	if (IS_ERR(cm_id))
1344 		return PTR_ERR(cm_id);
1345 
1346 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1347 	cm_id_priv->id.remote_id = req_msg->local_comm_id;
1348 	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
1349 				work->mad_recv_wc->recv_buf.grh,
1350 				&cm_id_priv->av);
1351 	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
1352 							    id.local_id);
1353 	if (IS_ERR(cm_id_priv->timewait_info)) {
1354 		ret = PTR_ERR(cm_id_priv->timewait_info);
1355 		goto error1;
1356 	}
1357 	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
1358 	cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;
1359 	cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);
1360 
1361 	listen_cm_id_priv = cm_match_req(work, cm_id_priv);
1362 	if (!listen_cm_id_priv) {
1363 		ret = -EINVAL;
1364 		goto error2;
1365 	}
1366 
1367 	cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
1368 	cm_id_priv->id.context = listen_cm_id_priv->id.context;
1369 	cm_id_priv->id.service_id = req_msg->service_id;
1370 	cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
1371 
1372 	cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
1373 	ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
1374 	if (ret)
1375 		goto error3;
1376 	if (req_msg->alt_local_lid) {
1377 		ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
1378 		if (ret)
1379 			goto error3;
1380 	}
1381 	cm_id_priv->tid = req_msg->hdr.tid;
1382 	cm_id_priv->timeout_ms = cm_convert_to_ms(
1383 					cm_req_get_local_resp_timeout(req_msg));
1384 	cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);
1385 	cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);
1386 	cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
1387 	cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
1388 	cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
1389 	cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
1390 	cm_id_priv->local_ack_timeout =
1391 				cm_req_get_primary_local_ack_timeout(req_msg);
1392 	cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
1393 	cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
1394 	cm_id_priv->qp_type = cm_req_get_qp_type(req_msg);
1395 
1396 	cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);
1397 	cm_process_work(cm_id_priv, work);
1398 	cm_deref_id(listen_cm_id_priv);
1399 	return 0;
1400 
1401 error3:	atomic_dec(&cm_id_priv->refcount);
1402 	cm_deref_id(listen_cm_id_priv);
1403 	cm_cleanup_timewait(cm_id_priv->timewait_info);
1404 error2:	kfree(cm_id_priv->timewait_info);
1405 	cm_id_priv->timewait_info = NULL;
1406 error1:	ib_destroy_cm_id(&cm_id_priv->id);
1407 	return ret;
1408 }
1409 
1410 static void cm_format_rep(struct cm_rep_msg *rep_msg,
1411 			  struct cm_id_private *cm_id_priv,
1412 			  struct ib_cm_rep_param *param)
1413 {
1414 	cm_format_mad_hdr(&rep_msg->hdr, CM_REP_ATTR_ID, cm_id_priv->tid);
1415 	rep_msg->local_comm_id = cm_id_priv->id.local_id;
1416 	rep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1417 	cm_rep_set_local_qpn(rep_msg, cpu_to_be32(param->qp_num));
1418 	cm_rep_set_starting_psn(rep_msg, cpu_to_be32(param->starting_psn));
1419 	rep_msg->resp_resources = param->responder_resources;
1420 	rep_msg->initiator_depth = param->initiator_depth;
1421 	cm_rep_set_target_ack_delay(rep_msg, param->target_ack_delay);
1422 	cm_rep_set_failover(rep_msg, param->failover_accepted);
1423 	cm_rep_set_flow_ctrl(rep_msg, param->flow_control);
1424 	cm_rep_set_rnr_retry_count(rep_msg, param->rnr_retry_count);
1425 	cm_rep_set_srq(rep_msg, param->srq);
1426 	rep_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
1427 
1428 	if (param->private_data && param->private_data_len)
1429 		memcpy(rep_msg->private_data, param->private_data,
1430 		       param->private_data_len);
1431 }
1432 
1433 int ib_send_cm_rep(struct ib_cm_id *cm_id,
1434 		   struct ib_cm_rep_param *param)
1435 {
1436 	struct cm_id_private *cm_id_priv;
1437 	struct ib_mad_send_buf *msg;
1438 	struct cm_rep_msg *rep_msg;
1439 	unsigned long flags;
1440 	int ret;
1441 
1442 	if (param->private_data &&
1443 	    param->private_data_len > IB_CM_REP_PRIVATE_DATA_SIZE)
1444 		return -EINVAL;
1445 
1446 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1447 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1448 	if (cm_id->state != IB_CM_REQ_RCVD &&
1449 	    cm_id->state != IB_CM_MRA_REQ_SENT) {
1450 		ret = -EINVAL;
1451 		goto out;
1452 	}
1453 
1454 	ret = cm_alloc_msg(cm_id_priv, &msg);
1455 	if (ret)
1456 		goto out;
1457 
1458 	rep_msg = (struct cm_rep_msg *) msg->mad;
1459 	cm_format_rep(rep_msg, cm_id_priv, param);
1460 	msg->timeout_ms = cm_id_priv->timeout_ms;
1461 	msg->context[1] = (void *) (unsigned long) IB_CM_REP_SENT;
1462 
1463 	ret = ib_post_send_mad(msg, NULL);
1464 	if (ret) {
1465 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1466 		cm_free_msg(msg);
1467 		return ret;
1468 	}
1469 
1470 	cm_id->state = IB_CM_REP_SENT;
1471 	cm_id_priv->msg = msg;
1472 	cm_id_priv->initiator_depth = param->initiator_depth;
1473 	cm_id_priv->responder_resources = param->responder_resources;
1474 	cm_id_priv->rq_psn = cm_rep_get_starting_psn(rep_msg);
1475 	cm_id_priv->local_qpn = cm_rep_get_local_qpn(rep_msg);
1476 
1477 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1478 	return ret;
1479 }
1480 EXPORT_SYMBOL(ib_send_cm_rep);
1481 
1482 static void cm_format_rtu(struct cm_rtu_msg *rtu_msg,
1483 			  struct cm_id_private *cm_id_priv,
1484 			  const void *private_data,
1485 			  u8 private_data_len)
1486 {
1487 	cm_format_mad_hdr(&rtu_msg->hdr, CM_RTU_ATTR_ID, cm_id_priv->tid);
1488 	rtu_msg->local_comm_id = cm_id_priv->id.local_id;
1489 	rtu_msg->remote_comm_id = cm_id_priv->id.remote_id;
1490 
1491 	if (private_data && private_data_len)
1492 		memcpy(rtu_msg->private_data, private_data, private_data_len);
1493 }
1494 
1495 int ib_send_cm_rtu(struct ib_cm_id *cm_id,
1496 		   const void *private_data,
1497 		   u8 private_data_len)
1498 {
1499 	struct cm_id_private *cm_id_priv;
1500 	struct ib_mad_send_buf *msg;
1501 	unsigned long flags;
1502 	void *data;
1503 	int ret;
1504 
1505 	if (private_data && private_data_len > IB_CM_RTU_PRIVATE_DATA_SIZE)
1506 		return -EINVAL;
1507 
1508 	data = cm_copy_private_data(private_data, private_data_len);
1509 	if (IS_ERR(data))
1510 		return PTR_ERR(data);
1511 
1512 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1513 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1514 	if (cm_id->state != IB_CM_REP_RCVD &&
1515 	    cm_id->state != IB_CM_MRA_REP_SENT) {
1516 		ret = -EINVAL;
1517 		goto error;
1518 	}
1519 
1520 	ret = cm_alloc_msg(cm_id_priv, &msg);
1521 	if (ret)
1522 		goto error;
1523 
1524 	cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1525 		      private_data, private_data_len);
1526 
1527 	ret = ib_post_send_mad(msg, NULL);
1528 	if (ret) {
1529 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1530 		cm_free_msg(msg);
1531 		kfree(data);
1532 		return ret;
1533 	}
1534 
1535 	cm_id->state = IB_CM_ESTABLISHED;
1536 	cm_set_private_data(cm_id_priv, data, private_data_len);
1537 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1538 	return 0;
1539 
1540 error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1541 	kfree(data);
1542 	return ret;
1543 }
1544 EXPORT_SYMBOL(ib_send_cm_rtu);
1545 
1546 static void cm_format_rep_event(struct cm_work *work)
1547 {
1548 	struct cm_rep_msg *rep_msg;
1549 	struct ib_cm_rep_event_param *param;
1550 
1551 	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1552 	param = &work->cm_event.param.rep_rcvd;
1553 	param->remote_ca_guid = rep_msg->local_ca_guid;
1554 	param->remote_qkey = be32_to_cpu(rep_msg->local_qkey);
1555 	param->remote_qpn = be32_to_cpu(cm_rep_get_local_qpn(rep_msg));
1556 	param->starting_psn = be32_to_cpu(cm_rep_get_starting_psn(rep_msg));
1557 	param->responder_resources = rep_msg->initiator_depth;
1558 	param->initiator_depth = rep_msg->resp_resources;
1559 	param->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
1560 	param->failover_accepted = cm_rep_get_failover(rep_msg);
1561 	param->flow_control = cm_rep_get_flow_ctrl(rep_msg);
1562 	param->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1563 	param->srq = cm_rep_get_srq(rep_msg);
1564 	work->cm_event.private_data = &rep_msg->private_data;
1565 }
1566 
1567 static void cm_dup_rep_handler(struct cm_work *work)
1568 {
1569 	struct cm_id_private *cm_id_priv;
1570 	struct cm_rep_msg *rep_msg;
1571 	struct ib_mad_send_buf *msg = NULL;
1572 	unsigned long flags;
1573 	int ret;
1574 
1575 	rep_msg = (struct cm_rep_msg *) work->mad_recv_wc->recv_buf.mad;
1576 	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id,
1577 				   rep_msg->local_comm_id);
1578 	if (!cm_id_priv)
1579 		return;
1580 
1581 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
1582 	if (ret)
1583 		goto deref;
1584 
1585 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1586 	if (cm_id_priv->id.state == IB_CM_ESTABLISHED)
1587 		cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
1588 			      cm_id_priv->private_data,
1589 			      cm_id_priv->private_data_len);
1590 	else if (cm_id_priv->id.state == IB_CM_MRA_REP_SENT)
1591 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
1592 			      CM_MSG_RESPONSE_REP, cm_id_priv->service_timeout,
1593 			      cm_id_priv->private_data,
1594 			      cm_id_priv->private_data_len);
1595 	else
1596 		goto unlock;
1597 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1598 
1599 	ret = ib_post_send_mad(msg, NULL);
1600 	if (ret)
1601 		goto free;
1602 	goto deref;
1603 
1604 unlock:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1605 free:	cm_free_msg(msg);
1606 deref:	cm_deref_id(cm_id_priv);
1607 }
1608 
1609 static int cm_rep_handler(struct cm_work *work)
1610 {
1611 	struct cm_id_private *cm_id_priv;
1612 	struct cm_rep_msg *rep_msg;
1613 	unsigned long flags;
1614 	int ret;
1615 
1616 	rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
1617 	cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id, 0);
1618 	if (!cm_id_priv) {
1619 		cm_dup_rep_handler(work);
1620 		return -EINVAL;
1621 	}
1622 
1623 	cm_format_rep_event(work);
1624 
1625 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1626 	switch (cm_id_priv->id.state) {
1627 	case IB_CM_REQ_SENT:
1628 	case IB_CM_MRA_REQ_RCVD:
1629 		break;
1630 	default:
1631 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1632 		ret = -EINVAL;
1633 		goto error;
1634 	}
1635 
1636 	cm_id_priv->timewait_info->work.remote_id = rep_msg->local_comm_id;
1637 	cm_id_priv->timewait_info->remote_ca_guid = rep_msg->local_ca_guid;
1638 	cm_id_priv->timewait_info->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1639 
1640 	spin_lock(&cm.lock);
1641 	/* Check for duplicate REP. */
1642 	if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
1643 		spin_unlock(&cm.lock);
1644 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1645 		ret = -EINVAL;
1646 		goto error;
1647 	}
1648 	/* Check for a stale connection. */
1649 	if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
1650 		rb_erase(&cm_id_priv->timewait_info->remote_id_node,
1651 			 &cm.remote_id_table);
1652 		cm_id_priv->timewait_info->inserted_remote_id = 0;
1653 		spin_unlock(&cm.lock);
1654 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1655 		cm_issue_rej(work->port, work->mad_recv_wc,
1656 			     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REP,
1657 			     NULL, 0);
1658 		ret = -EINVAL;
1659 		goto error;
1660 	}
1661 	spin_unlock(&cm.lock);
1662 
1663 	cm_id_priv->id.state = IB_CM_REP_RCVD;
1664 	cm_id_priv->id.remote_id = rep_msg->local_comm_id;
1665 	cm_id_priv->remote_qpn = cm_rep_get_local_qpn(rep_msg);
1666 	cm_id_priv->initiator_depth = rep_msg->resp_resources;
1667 	cm_id_priv->responder_resources = rep_msg->initiator_depth;
1668 	cm_id_priv->sq_psn = cm_rep_get_starting_psn(rep_msg);
1669 	cm_id_priv->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
1670 
1671 	/* todo: handle peer_to_peer */
1672 
1673 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1674 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1675 	if (!ret)
1676 		list_add_tail(&work->list, &cm_id_priv->work_list);
1677 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1678 
1679 	if (ret)
1680 		cm_process_work(cm_id_priv, work);
1681 	else
1682 		cm_deref_id(cm_id_priv);
1683 	return 0;
1684 
1685 error:
1686 	cm_deref_id(cm_id_priv);
1687 	return ret;
1688 }
1689 
1690 static int cm_establish_handler(struct cm_work *work)
1691 {
1692 	struct cm_id_private *cm_id_priv;
1693 	unsigned long flags;
1694 	int ret;
1695 
1696 	/* See comment in ib_cm_establish about lookup. */
1697 	cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
1698 	if (!cm_id_priv)
1699 		return -EINVAL;
1700 
1701 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1702 	if (cm_id_priv->id.state != IB_CM_ESTABLISHED) {
1703 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1704 		goto out;
1705 	}
1706 
1707 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1708 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1709 	if (!ret)
1710 		list_add_tail(&work->list, &cm_id_priv->work_list);
1711 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1712 
1713 	if (ret)
1714 		cm_process_work(cm_id_priv, work);
1715 	else
1716 		cm_deref_id(cm_id_priv);
1717 	return 0;
1718 out:
1719 	cm_deref_id(cm_id_priv);
1720 	return -EINVAL;
1721 }
1722 
1723 static int cm_rtu_handler(struct cm_work *work)
1724 {
1725 	struct cm_id_private *cm_id_priv;
1726 	struct cm_rtu_msg *rtu_msg;
1727 	unsigned long flags;
1728 	int ret;
1729 
1730 	rtu_msg = (struct cm_rtu_msg *)work->mad_recv_wc->recv_buf.mad;
1731 	cm_id_priv = cm_acquire_id(rtu_msg->remote_comm_id,
1732 				   rtu_msg->local_comm_id);
1733 	if (!cm_id_priv)
1734 		return -EINVAL;
1735 
1736 	work->cm_event.private_data = &rtu_msg->private_data;
1737 
1738 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1739 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
1740 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
1741 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1742 		goto out;
1743 	}
1744 	cm_id_priv->id.state = IB_CM_ESTABLISHED;
1745 
1746 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1747 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1748 	if (!ret)
1749 		list_add_tail(&work->list, &cm_id_priv->work_list);
1750 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1751 
1752 	if (ret)
1753 		cm_process_work(cm_id_priv, work);
1754 	else
1755 		cm_deref_id(cm_id_priv);
1756 	return 0;
1757 out:
1758 	cm_deref_id(cm_id_priv);
1759 	return -EINVAL;
1760 }
1761 
1762 static void cm_format_dreq(struct cm_dreq_msg *dreq_msg,
1763 			  struct cm_id_private *cm_id_priv,
1764 			  const void *private_data,
1765 			  u8 private_data_len)
1766 {
1767 	cm_format_mad_hdr(&dreq_msg->hdr, CM_DREQ_ATTR_ID,
1768 			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_DREQ));
1769 	dreq_msg->local_comm_id = cm_id_priv->id.local_id;
1770 	dreq_msg->remote_comm_id = cm_id_priv->id.remote_id;
1771 	cm_dreq_set_remote_qpn(dreq_msg, cm_id_priv->remote_qpn);
1772 
1773 	if (private_data && private_data_len)
1774 		memcpy(dreq_msg->private_data, private_data, private_data_len);
1775 }
1776 
1777 int ib_send_cm_dreq(struct ib_cm_id *cm_id,
1778 		    const void *private_data,
1779 		    u8 private_data_len)
1780 {
1781 	struct cm_id_private *cm_id_priv;
1782 	struct ib_mad_send_buf *msg;
1783 	unsigned long flags;
1784 	int ret;
1785 
1786 	if (private_data && private_data_len > IB_CM_DREQ_PRIVATE_DATA_SIZE)
1787 		return -EINVAL;
1788 
1789 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1790 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1791 	if (cm_id->state != IB_CM_ESTABLISHED) {
1792 		ret = -EINVAL;
1793 		goto out;
1794 	}
1795 
1796 	ret = cm_alloc_msg(cm_id_priv, &msg);
1797 	if (ret) {
1798 		cm_enter_timewait(cm_id_priv);
1799 		goto out;
1800 	}
1801 
1802 	cm_format_dreq((struct cm_dreq_msg *) msg->mad, cm_id_priv,
1803 		       private_data, private_data_len);
1804 	msg->timeout_ms = cm_id_priv->timeout_ms;
1805 	msg->context[1] = (void *) (unsigned long) IB_CM_DREQ_SENT;
1806 
1807 	ret = ib_post_send_mad(msg, NULL);
1808 	if (ret) {
1809 		cm_enter_timewait(cm_id_priv);
1810 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1811 		cm_free_msg(msg);
1812 		return ret;
1813 	}
1814 
1815 	cm_id->state = IB_CM_DREQ_SENT;
1816 	cm_id_priv->msg = msg;
1817 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1818 	return ret;
1819 }
1820 EXPORT_SYMBOL(ib_send_cm_dreq);
1821 
1822 static void cm_format_drep(struct cm_drep_msg *drep_msg,
1823 			  struct cm_id_private *cm_id_priv,
1824 			  const void *private_data,
1825 			  u8 private_data_len)
1826 {
1827 	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, cm_id_priv->tid);
1828 	drep_msg->local_comm_id = cm_id_priv->id.local_id;
1829 	drep_msg->remote_comm_id = cm_id_priv->id.remote_id;
1830 
1831 	if (private_data && private_data_len)
1832 		memcpy(drep_msg->private_data, private_data, private_data_len);
1833 }
1834 
1835 int ib_send_cm_drep(struct ib_cm_id *cm_id,
1836 		    const void *private_data,
1837 		    u8 private_data_len)
1838 {
1839 	struct cm_id_private *cm_id_priv;
1840 	struct ib_mad_send_buf *msg;
1841 	unsigned long flags;
1842 	void *data;
1843 	int ret;
1844 
1845 	if (private_data && private_data_len > IB_CM_DREP_PRIVATE_DATA_SIZE)
1846 		return -EINVAL;
1847 
1848 	data = cm_copy_private_data(private_data, private_data_len);
1849 	if (IS_ERR(data))
1850 		return PTR_ERR(data);
1851 
1852 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1853 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1854 	if (cm_id->state != IB_CM_DREQ_RCVD) {
1855 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1856 		kfree(data);
1857 		return -EINVAL;
1858 	}
1859 
1860 	cm_set_private_data(cm_id_priv, data, private_data_len);
1861 	cm_enter_timewait(cm_id_priv);
1862 
1863 	ret = cm_alloc_msg(cm_id_priv, &msg);
1864 	if (ret)
1865 		goto out;
1866 
1867 	cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
1868 		       private_data, private_data_len);
1869 
1870 	ret = ib_post_send_mad(msg, NULL);
1871 	if (ret) {
1872 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1873 		cm_free_msg(msg);
1874 		return ret;
1875 	}
1876 
1877 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1878 	return ret;
1879 }
1880 EXPORT_SYMBOL(ib_send_cm_drep);
1881 
1882 static int cm_dreq_handler(struct cm_work *work)
1883 {
1884 	struct cm_id_private *cm_id_priv;
1885 	struct cm_dreq_msg *dreq_msg;
1886 	struct ib_mad_send_buf *msg = NULL;
1887 	unsigned long flags;
1888 	int ret;
1889 
1890 	dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
1891 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
1892 				   dreq_msg->local_comm_id);
1893 	if (!cm_id_priv)
1894 		return -EINVAL;
1895 
1896 	work->cm_event.private_data = &dreq_msg->private_data;
1897 
1898 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1899 	if (cm_id_priv->local_qpn != cm_dreq_get_remote_qpn(dreq_msg))
1900 		goto unlock;
1901 
1902 	switch (cm_id_priv->id.state) {
1903 	case IB_CM_REP_SENT:
1904 	case IB_CM_DREQ_SENT:
1905 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1906 		break;
1907 	case IB_CM_ESTABLISHED:
1908 	case IB_CM_MRA_REP_RCVD:
1909 		break;
1910 	case IB_CM_TIMEWAIT:
1911 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
1912 			goto unlock;
1913 
1914 		cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
1915 			       cm_id_priv->private_data,
1916 			       cm_id_priv->private_data_len);
1917 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1918 
1919 		if (ib_post_send_mad(msg, NULL))
1920 			cm_free_msg(msg);
1921 		goto deref;
1922 	default:
1923 		goto unlock;
1924 	}
1925 	cm_id_priv->id.state = IB_CM_DREQ_RCVD;
1926 	cm_id_priv->tid = dreq_msg->hdr.tid;
1927 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1928 	if (!ret)
1929 		list_add_tail(&work->list, &cm_id_priv->work_list);
1930 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1931 
1932 	if (ret)
1933 		cm_process_work(cm_id_priv, work);
1934 	else
1935 		cm_deref_id(cm_id_priv);
1936 	return 0;
1937 
1938 unlock:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1939 deref:	cm_deref_id(cm_id_priv);
1940 	return -EINVAL;
1941 }
1942 
1943 static int cm_drep_handler(struct cm_work *work)
1944 {
1945 	struct cm_id_private *cm_id_priv;
1946 	struct cm_drep_msg *drep_msg;
1947 	unsigned long flags;
1948 	int ret;
1949 
1950 	drep_msg = (struct cm_drep_msg *)work->mad_recv_wc->recv_buf.mad;
1951 	cm_id_priv = cm_acquire_id(drep_msg->remote_comm_id,
1952 				   drep_msg->local_comm_id);
1953 	if (!cm_id_priv)
1954 		return -EINVAL;
1955 
1956 	work->cm_event.private_data = &drep_msg->private_data;
1957 
1958 	spin_lock_irqsave(&cm_id_priv->lock, flags);
1959 	if (cm_id_priv->id.state != IB_CM_DREQ_SENT &&
1960 	    cm_id_priv->id.state != IB_CM_DREQ_RCVD) {
1961 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1962 		goto out;
1963 	}
1964 	cm_enter_timewait(cm_id_priv);
1965 
1966 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
1967 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
1968 	if (!ret)
1969 		list_add_tail(&work->list, &cm_id_priv->work_list);
1970 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1971 
1972 	if (ret)
1973 		cm_process_work(cm_id_priv, work);
1974 	else
1975 		cm_deref_id(cm_id_priv);
1976 	return 0;
1977 out:
1978 	cm_deref_id(cm_id_priv);
1979 	return -EINVAL;
1980 }
1981 
1982 int ib_send_cm_rej(struct ib_cm_id *cm_id,
1983 		   enum ib_cm_rej_reason reason,
1984 		   void *ari,
1985 		   u8 ari_length,
1986 		   const void *private_data,
1987 		   u8 private_data_len)
1988 {
1989 	struct cm_id_private *cm_id_priv;
1990 	struct ib_mad_send_buf *msg;
1991 	unsigned long flags;
1992 	int ret;
1993 
1994 	if ((private_data && private_data_len > IB_CM_REJ_PRIVATE_DATA_SIZE) ||
1995 	    (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
1996 		return -EINVAL;
1997 
1998 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
1999 
2000 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2001 	switch (cm_id->state) {
2002 	case IB_CM_REQ_SENT:
2003 	case IB_CM_MRA_REQ_RCVD:
2004 	case IB_CM_REQ_RCVD:
2005 	case IB_CM_MRA_REQ_SENT:
2006 	case IB_CM_REP_RCVD:
2007 	case IB_CM_MRA_REP_SENT:
2008 		ret = cm_alloc_msg(cm_id_priv, &msg);
2009 		if (!ret)
2010 			cm_format_rej((struct cm_rej_msg *) msg->mad,
2011 				      cm_id_priv, reason, ari, ari_length,
2012 				      private_data, private_data_len);
2013 
2014 		cm_reset_to_idle(cm_id_priv);
2015 		break;
2016 	case IB_CM_REP_SENT:
2017 	case IB_CM_MRA_REP_RCVD:
2018 		ret = cm_alloc_msg(cm_id_priv, &msg);
2019 		if (!ret)
2020 			cm_format_rej((struct cm_rej_msg *) msg->mad,
2021 				      cm_id_priv, reason, ari, ari_length,
2022 				      private_data, private_data_len);
2023 
2024 		cm_enter_timewait(cm_id_priv);
2025 		break;
2026 	default:
2027 		ret = -EINVAL;
2028 		goto out;
2029 	}
2030 
2031 	if (ret)
2032 		goto out;
2033 
2034 	ret = ib_post_send_mad(msg, NULL);
2035 	if (ret)
2036 		cm_free_msg(msg);
2037 
2038 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2039 	return ret;
2040 }
2041 EXPORT_SYMBOL(ib_send_cm_rej);
2042 
2043 static void cm_format_rej_event(struct cm_work *work)
2044 {
2045 	struct cm_rej_msg *rej_msg;
2046 	struct ib_cm_rej_event_param *param;
2047 
2048 	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2049 	param = &work->cm_event.param.rej_rcvd;
2050 	param->ari = rej_msg->ari;
2051 	param->ari_length = cm_rej_get_reject_info_len(rej_msg);
2052 	param->reason = __be16_to_cpu(rej_msg->reason);
2053 	work->cm_event.private_data = &rej_msg->private_data;
2054 }
2055 
2056 static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
2057 {
2058 	struct cm_timewait_info *timewait_info;
2059 	struct cm_id_private *cm_id_priv;
2060 	unsigned long flags;
2061 	__be32 remote_id;
2062 
2063 	remote_id = rej_msg->local_comm_id;
2064 
2065 	if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_TIMEOUT) {
2066 		spin_lock_irqsave(&cm.lock, flags);
2067 		timewait_info = cm_find_remote_id( *((__be64 *) rej_msg->ari),
2068 						  remote_id);
2069 		if (!timewait_info) {
2070 			spin_unlock_irqrestore(&cm.lock, flags);
2071 			return NULL;
2072 		}
2073 		cm_id_priv = idr_find(&cm.local_id_table,
2074 				      (__force int) timewait_info->work.local_id);
2075 		if (cm_id_priv) {
2076 			if (cm_id_priv->id.remote_id == remote_id)
2077 				atomic_inc(&cm_id_priv->refcount);
2078 			else
2079 				cm_id_priv = NULL;
2080 		}
2081 		spin_unlock_irqrestore(&cm.lock, flags);
2082 	} else if (cm_rej_get_msg_rejected(rej_msg) == CM_MSG_RESPONSE_REQ)
2083 		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, 0);
2084 	else
2085 		cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, remote_id);
2086 
2087 	return cm_id_priv;
2088 }
2089 
2090 static int cm_rej_handler(struct cm_work *work)
2091 {
2092 	struct cm_id_private *cm_id_priv;
2093 	struct cm_rej_msg *rej_msg;
2094 	unsigned long flags;
2095 	int ret;
2096 
2097 	rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
2098 	cm_id_priv = cm_acquire_rejected_id(rej_msg);
2099 	if (!cm_id_priv)
2100 		return -EINVAL;
2101 
2102 	cm_format_rej_event(work);
2103 
2104 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2105 	switch (cm_id_priv->id.state) {
2106 	case IB_CM_REQ_SENT:
2107 	case IB_CM_MRA_REQ_RCVD:
2108 	case IB_CM_REP_SENT:
2109 	case IB_CM_MRA_REP_RCVD:
2110 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2111 		/* fall through */
2112 	case IB_CM_REQ_RCVD:
2113 	case IB_CM_MRA_REQ_SENT:
2114 		if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_STALE_CONN)
2115 			cm_enter_timewait(cm_id_priv);
2116 		else
2117 			cm_reset_to_idle(cm_id_priv);
2118 		break;
2119 	case IB_CM_DREQ_SENT:
2120 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2121 		/* fall through */
2122 	case IB_CM_REP_RCVD:
2123 	case IB_CM_MRA_REP_SENT:
2124 	case IB_CM_ESTABLISHED:
2125 		cm_enter_timewait(cm_id_priv);
2126 		break;
2127 	default:
2128 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2129 		ret = -EINVAL;
2130 		goto out;
2131 	}
2132 
2133 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2134 	if (!ret)
2135 		list_add_tail(&work->list, &cm_id_priv->work_list);
2136 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2137 
2138 	if (ret)
2139 		cm_process_work(cm_id_priv, work);
2140 	else
2141 		cm_deref_id(cm_id_priv);
2142 	return 0;
2143 out:
2144 	cm_deref_id(cm_id_priv);
2145 	return -EINVAL;
2146 }
2147 
2148 int ib_send_cm_mra(struct ib_cm_id *cm_id,
2149 		   u8 service_timeout,
2150 		   const void *private_data,
2151 		   u8 private_data_len)
2152 {
2153 	struct cm_id_private *cm_id_priv;
2154 	struct ib_mad_send_buf *msg;
2155 	void *data;
2156 	unsigned long flags;
2157 	int ret;
2158 
2159 	if (private_data && private_data_len > IB_CM_MRA_PRIVATE_DATA_SIZE)
2160 		return -EINVAL;
2161 
2162 	data = cm_copy_private_data(private_data, private_data_len);
2163 	if (IS_ERR(data))
2164 		return PTR_ERR(data);
2165 
2166 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2167 
2168 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2169 	switch(cm_id_priv->id.state) {
2170 	case IB_CM_REQ_RCVD:
2171 		ret = cm_alloc_msg(cm_id_priv, &msg);
2172 		if (ret)
2173 			goto error1;
2174 
2175 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2176 			      CM_MSG_RESPONSE_REQ, service_timeout,
2177 			      private_data, private_data_len);
2178 		ret = ib_post_send_mad(msg, NULL);
2179 		if (ret)
2180 			goto error2;
2181 		cm_id->state = IB_CM_MRA_REQ_SENT;
2182 		break;
2183 	case IB_CM_REP_RCVD:
2184 		ret = cm_alloc_msg(cm_id_priv, &msg);
2185 		if (ret)
2186 			goto error1;
2187 
2188 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2189 			      CM_MSG_RESPONSE_REP, service_timeout,
2190 			      private_data, private_data_len);
2191 		ret = ib_post_send_mad(msg, NULL);
2192 		if (ret)
2193 			goto error2;
2194 		cm_id->state = IB_CM_MRA_REP_SENT;
2195 		break;
2196 	case IB_CM_ESTABLISHED:
2197 		ret = cm_alloc_msg(cm_id_priv, &msg);
2198 		if (ret)
2199 			goto error1;
2200 
2201 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2202 			      CM_MSG_RESPONSE_OTHER, service_timeout,
2203 			      private_data, private_data_len);
2204 		ret = ib_post_send_mad(msg, NULL);
2205 		if (ret)
2206 			goto error2;
2207 		cm_id->lap_state = IB_CM_MRA_LAP_SENT;
2208 		break;
2209 	default:
2210 		ret = -EINVAL;
2211 		goto error1;
2212 	}
2213 	cm_id_priv->service_timeout = service_timeout;
2214 	cm_set_private_data(cm_id_priv, data, private_data_len);
2215 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2216 	return 0;
2217 
2218 error1:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2219 	kfree(data);
2220 	return ret;
2221 
2222 error2:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2223 	kfree(data);
2224 	cm_free_msg(msg);
2225 	return ret;
2226 }
2227 EXPORT_SYMBOL(ib_send_cm_mra);
2228 
2229 static struct cm_id_private * cm_acquire_mraed_id(struct cm_mra_msg *mra_msg)
2230 {
2231 	switch (cm_mra_get_msg_mraed(mra_msg)) {
2232 	case CM_MSG_RESPONSE_REQ:
2233 		return cm_acquire_id(mra_msg->remote_comm_id, 0);
2234 	case CM_MSG_RESPONSE_REP:
2235 	case CM_MSG_RESPONSE_OTHER:
2236 		return cm_acquire_id(mra_msg->remote_comm_id,
2237 				     mra_msg->local_comm_id);
2238 	default:
2239 		return NULL;
2240 	}
2241 }
2242 
2243 static int cm_mra_handler(struct cm_work *work)
2244 {
2245 	struct cm_id_private *cm_id_priv;
2246 	struct cm_mra_msg *mra_msg;
2247 	unsigned long flags;
2248 	int timeout, ret;
2249 
2250 	mra_msg = (struct cm_mra_msg *)work->mad_recv_wc->recv_buf.mad;
2251 	cm_id_priv = cm_acquire_mraed_id(mra_msg);
2252 	if (!cm_id_priv)
2253 		return -EINVAL;
2254 
2255 	work->cm_event.private_data = &mra_msg->private_data;
2256 	work->cm_event.param.mra_rcvd.service_timeout =
2257 					cm_mra_get_service_timeout(mra_msg);
2258 	timeout = cm_convert_to_ms(cm_mra_get_service_timeout(mra_msg)) +
2259 		  cm_convert_to_ms(cm_id_priv->av.packet_life_time);
2260 
2261 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2262 	switch (cm_id_priv->id.state) {
2263 	case IB_CM_REQ_SENT:
2264 		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REQ ||
2265 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2266 				  cm_id_priv->msg, timeout))
2267 			goto out;
2268 		cm_id_priv->id.state = IB_CM_MRA_REQ_RCVD;
2269 		break;
2270 	case IB_CM_REP_SENT:
2271 		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REP ||
2272 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2273 				  cm_id_priv->msg, timeout))
2274 			goto out;
2275 		cm_id_priv->id.state = IB_CM_MRA_REP_RCVD;
2276 		break;
2277 	case IB_CM_ESTABLISHED:
2278 		if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_OTHER ||
2279 		    cm_id_priv->id.lap_state != IB_CM_LAP_SENT ||
2280 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
2281 				  cm_id_priv->msg, timeout))
2282 			goto out;
2283 		cm_id_priv->id.lap_state = IB_CM_MRA_LAP_RCVD;
2284 		break;
2285 	default:
2286 		goto out;
2287 	}
2288 
2289 	cm_id_priv->msg->context[1] = (void *) (unsigned long)
2290 				      cm_id_priv->id.state;
2291 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2292 	if (!ret)
2293 		list_add_tail(&work->list, &cm_id_priv->work_list);
2294 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2295 
2296 	if (ret)
2297 		cm_process_work(cm_id_priv, work);
2298 	else
2299 		cm_deref_id(cm_id_priv);
2300 	return 0;
2301 out:
2302 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2303 	cm_deref_id(cm_id_priv);
2304 	return -EINVAL;
2305 }
2306 
2307 static void cm_format_lap(struct cm_lap_msg *lap_msg,
2308 			  struct cm_id_private *cm_id_priv,
2309 			  struct ib_sa_path_rec *alternate_path,
2310 			  const void *private_data,
2311 			  u8 private_data_len)
2312 {
2313 	cm_format_mad_hdr(&lap_msg->hdr, CM_LAP_ATTR_ID,
2314 			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_LAP));
2315 	lap_msg->local_comm_id = cm_id_priv->id.local_id;
2316 	lap_msg->remote_comm_id = cm_id_priv->id.remote_id;
2317 	cm_lap_set_remote_qpn(lap_msg, cm_id_priv->remote_qpn);
2318 	/* todo: need remote CM response timeout */
2319 	cm_lap_set_remote_resp_timeout(lap_msg, 0x1F);
2320 	lap_msg->alt_local_lid = alternate_path->slid;
2321 	lap_msg->alt_remote_lid = alternate_path->dlid;
2322 	lap_msg->alt_local_gid = alternate_path->sgid;
2323 	lap_msg->alt_remote_gid = alternate_path->dgid;
2324 	cm_lap_set_flow_label(lap_msg, alternate_path->flow_label);
2325 	cm_lap_set_traffic_class(lap_msg, alternate_path->traffic_class);
2326 	lap_msg->alt_hop_limit = alternate_path->hop_limit;
2327 	cm_lap_set_packet_rate(lap_msg, alternate_path->rate);
2328 	cm_lap_set_sl(lap_msg, alternate_path->sl);
2329 	cm_lap_set_subnet_local(lap_msg, 1); /* local only... */
2330 	cm_lap_set_local_ack_timeout(lap_msg,
2331 		min(31, alternate_path->packet_life_time + 1));
2332 
2333 	if (private_data && private_data_len)
2334 		memcpy(lap_msg->private_data, private_data, private_data_len);
2335 }
2336 
2337 int ib_send_cm_lap(struct ib_cm_id *cm_id,
2338 		   struct ib_sa_path_rec *alternate_path,
2339 		   const void *private_data,
2340 		   u8 private_data_len)
2341 {
2342 	struct cm_id_private *cm_id_priv;
2343 	struct ib_mad_send_buf *msg;
2344 	unsigned long flags;
2345 	int ret;
2346 
2347 	if (private_data && private_data_len > IB_CM_LAP_PRIVATE_DATA_SIZE)
2348 		return -EINVAL;
2349 
2350 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2351 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2352 	if (cm_id->state != IB_CM_ESTABLISHED ||
2353 	    cm_id->lap_state != IB_CM_LAP_IDLE) {
2354 		ret = -EINVAL;
2355 		goto out;
2356 	}
2357 
2358 	ret = cm_alloc_msg(cm_id_priv, &msg);
2359 	if (ret)
2360 		goto out;
2361 
2362 	cm_format_lap((struct cm_lap_msg *) msg->mad, cm_id_priv,
2363 		      alternate_path, private_data, private_data_len);
2364 	msg->timeout_ms = cm_id_priv->timeout_ms;
2365 	msg->context[1] = (void *) (unsigned long) IB_CM_ESTABLISHED;
2366 
2367 	ret = ib_post_send_mad(msg, NULL);
2368 	if (ret) {
2369 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2370 		cm_free_msg(msg);
2371 		return ret;
2372 	}
2373 
2374 	cm_id->lap_state = IB_CM_LAP_SENT;
2375 	cm_id_priv->msg = msg;
2376 
2377 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2378 	return ret;
2379 }
2380 EXPORT_SYMBOL(ib_send_cm_lap);
2381 
2382 static void cm_format_path_from_lap(struct ib_sa_path_rec *path,
2383 				    struct cm_lap_msg *lap_msg)
2384 {
2385 	memset(path, 0, sizeof *path);
2386 	path->dgid = lap_msg->alt_local_gid;
2387 	path->sgid = lap_msg->alt_remote_gid;
2388 	path->dlid = lap_msg->alt_local_lid;
2389 	path->slid = lap_msg->alt_remote_lid;
2390 	path->flow_label = cm_lap_get_flow_label(lap_msg);
2391 	path->hop_limit = lap_msg->alt_hop_limit;
2392 	path->traffic_class = cm_lap_get_traffic_class(lap_msg);
2393 	path->reversible = 1;
2394 	/* pkey is same as in REQ */
2395 	path->sl = cm_lap_get_sl(lap_msg);
2396 	path->mtu_selector = IB_SA_EQ;
2397 	/* mtu is same as in REQ */
2398 	path->rate_selector = IB_SA_EQ;
2399 	path->rate = cm_lap_get_packet_rate(lap_msg);
2400 	path->packet_life_time_selector = IB_SA_EQ;
2401 	path->packet_life_time = cm_lap_get_local_ack_timeout(lap_msg);
2402 	path->packet_life_time -= (path->packet_life_time > 0);
2403 }
2404 
2405 static int cm_lap_handler(struct cm_work *work)
2406 {
2407 	struct cm_id_private *cm_id_priv;
2408 	struct cm_lap_msg *lap_msg;
2409 	struct ib_cm_lap_event_param *param;
2410 	struct ib_mad_send_buf *msg = NULL;
2411 	unsigned long flags;
2412 	int ret;
2413 
2414 	/* todo: verify LAP request and send reject APR if invalid. */
2415 	lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;
2416 	cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,
2417 				   lap_msg->local_comm_id);
2418 	if (!cm_id_priv)
2419 		return -EINVAL;
2420 
2421 	param = &work->cm_event.param.lap_rcvd;
2422 	param->alternate_path = &work->path[0];
2423 	cm_format_path_from_lap(param->alternate_path, lap_msg);
2424 	work->cm_event.private_data = &lap_msg->private_data;
2425 
2426 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2427 	if (cm_id_priv->id.state != IB_CM_ESTABLISHED)
2428 		goto unlock;
2429 
2430 	switch (cm_id_priv->id.lap_state) {
2431 	case IB_CM_LAP_IDLE:
2432 		break;
2433 	case IB_CM_MRA_LAP_SENT:
2434 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
2435 			goto unlock;
2436 
2437 		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
2438 			      CM_MSG_RESPONSE_OTHER,
2439 			      cm_id_priv->service_timeout,
2440 			      cm_id_priv->private_data,
2441 			      cm_id_priv->private_data_len);
2442 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2443 
2444 		if (ib_post_send_mad(msg, NULL))
2445 			cm_free_msg(msg);
2446 		goto deref;
2447 	default:
2448 		goto unlock;
2449 	}
2450 
2451 	cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
2452 	cm_id_priv->tid = lap_msg->hdr.tid;
2453 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2454 	if (!ret)
2455 		list_add_tail(&work->list, &cm_id_priv->work_list);
2456 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2457 
2458 	if (ret)
2459 		cm_process_work(cm_id_priv, work);
2460 	else
2461 		cm_deref_id(cm_id_priv);
2462 	return 0;
2463 
2464 unlock:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2465 deref:	cm_deref_id(cm_id_priv);
2466 	return -EINVAL;
2467 }
2468 
2469 static void cm_format_apr(struct cm_apr_msg *apr_msg,
2470 			  struct cm_id_private *cm_id_priv,
2471 			  enum ib_cm_apr_status status,
2472 			  void *info,
2473 			  u8 info_length,
2474 			  const void *private_data,
2475 			  u8 private_data_len)
2476 {
2477 	cm_format_mad_hdr(&apr_msg->hdr, CM_APR_ATTR_ID, cm_id_priv->tid);
2478 	apr_msg->local_comm_id = cm_id_priv->id.local_id;
2479 	apr_msg->remote_comm_id = cm_id_priv->id.remote_id;
2480 	apr_msg->ap_status = (u8) status;
2481 
2482 	if (info && info_length) {
2483 		apr_msg->info_length = info_length;
2484 		memcpy(apr_msg->info, info, info_length);
2485 	}
2486 
2487 	if (private_data && private_data_len)
2488 		memcpy(apr_msg->private_data, private_data, private_data_len);
2489 }
2490 
2491 int ib_send_cm_apr(struct ib_cm_id *cm_id,
2492 		   enum ib_cm_apr_status status,
2493 		   void *info,
2494 		   u8 info_length,
2495 		   const void *private_data,
2496 		   u8 private_data_len)
2497 {
2498 	struct cm_id_private *cm_id_priv;
2499 	struct ib_mad_send_buf *msg;
2500 	unsigned long flags;
2501 	int ret;
2502 
2503 	if ((private_data && private_data_len > IB_CM_APR_PRIVATE_DATA_SIZE) ||
2504 	    (info && info_length > IB_CM_APR_INFO_LENGTH))
2505 		return -EINVAL;
2506 
2507 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2508 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2509 	if (cm_id->state != IB_CM_ESTABLISHED ||
2510 	    (cm_id->lap_state != IB_CM_LAP_RCVD &&
2511 	     cm_id->lap_state != IB_CM_MRA_LAP_SENT)) {
2512 		ret = -EINVAL;
2513 		goto out;
2514 	}
2515 
2516 	ret = cm_alloc_msg(cm_id_priv, &msg);
2517 	if (ret)
2518 		goto out;
2519 
2520 	cm_format_apr((struct cm_apr_msg *) msg->mad, cm_id_priv, status,
2521 		      info, info_length, private_data, private_data_len);
2522 	ret = ib_post_send_mad(msg, NULL);
2523 	if (ret) {
2524 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2525 		cm_free_msg(msg);
2526 		return ret;
2527 	}
2528 
2529 	cm_id->lap_state = IB_CM_LAP_IDLE;
2530 out:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2531 	return ret;
2532 }
2533 EXPORT_SYMBOL(ib_send_cm_apr);
2534 
2535 static int cm_apr_handler(struct cm_work *work)
2536 {
2537 	struct cm_id_private *cm_id_priv;
2538 	struct cm_apr_msg *apr_msg;
2539 	unsigned long flags;
2540 	int ret;
2541 
2542 	apr_msg = (struct cm_apr_msg *)work->mad_recv_wc->recv_buf.mad;
2543 	cm_id_priv = cm_acquire_id(apr_msg->remote_comm_id,
2544 				   apr_msg->local_comm_id);
2545 	if (!cm_id_priv)
2546 		return -EINVAL; /* Unmatched reply. */
2547 
2548 	work->cm_event.param.apr_rcvd.ap_status = apr_msg->ap_status;
2549 	work->cm_event.param.apr_rcvd.apr_info = &apr_msg->info;
2550 	work->cm_event.param.apr_rcvd.info_len = apr_msg->info_length;
2551 	work->cm_event.private_data = &apr_msg->private_data;
2552 
2553 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2554 	if (cm_id_priv->id.state != IB_CM_ESTABLISHED ||
2555 	    (cm_id_priv->id.lap_state != IB_CM_LAP_SENT &&
2556 	     cm_id_priv->id.lap_state != IB_CM_MRA_LAP_RCVD)) {
2557 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2558 		goto out;
2559 	}
2560 	cm_id_priv->id.lap_state = IB_CM_LAP_IDLE;
2561 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2562 	cm_id_priv->msg = NULL;
2563 
2564 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2565 	if (!ret)
2566 		list_add_tail(&work->list, &cm_id_priv->work_list);
2567 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2568 
2569 	if (ret)
2570 		cm_process_work(cm_id_priv, work);
2571 	else
2572 		cm_deref_id(cm_id_priv);
2573 	return 0;
2574 out:
2575 	cm_deref_id(cm_id_priv);
2576 	return -EINVAL;
2577 }
2578 
2579 static int cm_timewait_handler(struct cm_work *work)
2580 {
2581 	struct cm_timewait_info *timewait_info;
2582 	struct cm_id_private *cm_id_priv;
2583 	unsigned long flags;
2584 	int ret;
2585 
2586 	timewait_info = (struct cm_timewait_info *)work;
2587 	cm_cleanup_timewait(timewait_info);
2588 
2589 	cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
2590 				   timewait_info->work.remote_id);
2591 	if (!cm_id_priv)
2592 		return -EINVAL;
2593 
2594 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2595 	if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
2596 	    cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
2597 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2598 		goto out;
2599 	}
2600 	cm_id_priv->id.state = IB_CM_IDLE;
2601 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
2602 	if (!ret)
2603 		list_add_tail(&work->list, &cm_id_priv->work_list);
2604 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2605 
2606 	if (ret)
2607 		cm_process_work(cm_id_priv, work);
2608 	else
2609 		cm_deref_id(cm_id_priv);
2610 	return 0;
2611 out:
2612 	cm_deref_id(cm_id_priv);
2613 	return -EINVAL;
2614 }
2615 
2616 static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
2617 			       struct cm_id_private *cm_id_priv,
2618 			       struct ib_cm_sidr_req_param *param)
2619 {
2620 	cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
2621 			  cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
2622 	sidr_req_msg->request_id = cm_id_priv->id.local_id;
2623 	sidr_req_msg->pkey = cpu_to_be16(param->path->pkey);
2624 	sidr_req_msg->service_id = param->service_id;
2625 
2626 	if (param->private_data && param->private_data_len)
2627 		memcpy(sidr_req_msg->private_data, param->private_data,
2628 		       param->private_data_len);
2629 }
2630 
2631 int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
2632 			struct ib_cm_sidr_req_param *param)
2633 {
2634 	struct cm_id_private *cm_id_priv;
2635 	struct ib_mad_send_buf *msg;
2636 	unsigned long flags;
2637 	int ret;
2638 
2639 	if (!param->path || (param->private_data &&
2640 	     param->private_data_len > IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE))
2641 		return -EINVAL;
2642 
2643 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2644 	ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
2645 	if (ret)
2646 		goto out;
2647 
2648 	cm_id->service_id = param->service_id;
2649 	cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
2650 	cm_id_priv->timeout_ms = param->timeout_ms;
2651 	cm_id_priv->max_cm_retries = param->max_cm_retries;
2652 	ret = cm_alloc_msg(cm_id_priv, &msg);
2653 	if (ret)
2654 		goto out;
2655 
2656 	cm_format_sidr_req((struct cm_sidr_req_msg *) msg->mad, cm_id_priv,
2657 			   param);
2658 	msg->timeout_ms = cm_id_priv->timeout_ms;
2659 	msg->context[1] = (void *) (unsigned long) IB_CM_SIDR_REQ_SENT;
2660 
2661 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2662 	if (cm_id->state == IB_CM_IDLE)
2663 		ret = ib_post_send_mad(msg, NULL);
2664 	else
2665 		ret = -EINVAL;
2666 
2667 	if (ret) {
2668 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2669 		cm_free_msg(msg);
2670 		goto out;
2671 	}
2672 	cm_id->state = IB_CM_SIDR_REQ_SENT;
2673 	cm_id_priv->msg = msg;
2674 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2675 out:
2676 	return ret;
2677 }
2678 EXPORT_SYMBOL(ib_send_cm_sidr_req);
2679 
2680 static void cm_format_sidr_req_event(struct cm_work *work,
2681 				     struct ib_cm_id *listen_id)
2682 {
2683 	struct cm_sidr_req_msg *sidr_req_msg;
2684 	struct ib_cm_sidr_req_event_param *param;
2685 
2686 	sidr_req_msg = (struct cm_sidr_req_msg *)
2687 				work->mad_recv_wc->recv_buf.mad;
2688 	param = &work->cm_event.param.sidr_req_rcvd;
2689 	param->pkey = __be16_to_cpu(sidr_req_msg->pkey);
2690 	param->listen_id = listen_id;
2691 	param->port = work->port->port_num;
2692 	work->cm_event.private_data = &sidr_req_msg->private_data;
2693 }
2694 
2695 static int cm_sidr_req_handler(struct cm_work *work)
2696 {
2697 	struct ib_cm_id *cm_id;
2698 	struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
2699 	struct cm_sidr_req_msg *sidr_req_msg;
2700 	struct ib_wc *wc;
2701 	unsigned long flags;
2702 
2703 	cm_id = ib_create_cm_id(work->port->cm_dev->device, NULL, NULL);
2704 	if (IS_ERR(cm_id))
2705 		return PTR_ERR(cm_id);
2706 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2707 
2708 	/* Record SGID/SLID and request ID for lookup. */
2709 	sidr_req_msg = (struct cm_sidr_req_msg *)
2710 				work->mad_recv_wc->recv_buf.mad;
2711 	wc = work->mad_recv_wc->wc;
2712 	cm_id_priv->av.dgid.global.subnet_prefix = cpu_to_be64(wc->slid);
2713 	cm_id_priv->av.dgid.global.interface_id = 0;
2714 	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
2715 				work->mad_recv_wc->recv_buf.grh,
2716 				&cm_id_priv->av);
2717 	cm_id_priv->id.remote_id = sidr_req_msg->request_id;
2718 	cm_id_priv->id.state = IB_CM_SIDR_REQ_RCVD;
2719 	cm_id_priv->tid = sidr_req_msg->hdr.tid;
2720 	atomic_inc(&cm_id_priv->work_count);
2721 
2722 	spin_lock_irqsave(&cm.lock, flags);
2723 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
2724 	if (cur_cm_id_priv) {
2725 		spin_unlock_irqrestore(&cm.lock, flags);
2726 		goto out; /* Duplicate message. */
2727 	}
2728 	cur_cm_id_priv = cm_find_listen(cm_id->device,
2729 					sidr_req_msg->service_id,
2730 					sidr_req_msg->private_data);
2731 	if (!cur_cm_id_priv) {
2732 		rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
2733 		spin_unlock_irqrestore(&cm.lock, flags);
2734 		/* todo: reply with no match */
2735 		goto out; /* No match. */
2736 	}
2737 	atomic_inc(&cur_cm_id_priv->refcount);
2738 	spin_unlock_irqrestore(&cm.lock, flags);
2739 
2740 	cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
2741 	cm_id_priv->id.context = cur_cm_id_priv->id.context;
2742 	cm_id_priv->id.service_id = sidr_req_msg->service_id;
2743 	cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
2744 
2745 	cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
2746 	cm_process_work(cm_id_priv, work);
2747 	cm_deref_id(cur_cm_id_priv);
2748 	return 0;
2749 out:
2750 	ib_destroy_cm_id(&cm_id_priv->id);
2751 	return -EINVAL;
2752 }
2753 
2754 static void cm_format_sidr_rep(struct cm_sidr_rep_msg *sidr_rep_msg,
2755 			       struct cm_id_private *cm_id_priv,
2756 			       struct ib_cm_sidr_rep_param *param)
2757 {
2758 	cm_format_mad_hdr(&sidr_rep_msg->hdr, CM_SIDR_REP_ATTR_ID,
2759 			  cm_id_priv->tid);
2760 	sidr_rep_msg->request_id = cm_id_priv->id.remote_id;
2761 	sidr_rep_msg->status = param->status;
2762 	cm_sidr_rep_set_qpn(sidr_rep_msg, cpu_to_be32(param->qp_num));
2763 	sidr_rep_msg->service_id = cm_id_priv->id.service_id;
2764 	sidr_rep_msg->qkey = cpu_to_be32(param->qkey);
2765 
2766 	if (param->info && param->info_length)
2767 		memcpy(sidr_rep_msg->info, param->info, param->info_length);
2768 
2769 	if (param->private_data && param->private_data_len)
2770 		memcpy(sidr_rep_msg->private_data, param->private_data,
2771 		       param->private_data_len);
2772 }
2773 
2774 int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
2775 			struct ib_cm_sidr_rep_param *param)
2776 {
2777 	struct cm_id_private *cm_id_priv;
2778 	struct ib_mad_send_buf *msg;
2779 	unsigned long flags;
2780 	int ret;
2781 
2782 	if ((param->info && param->info_length > IB_CM_SIDR_REP_INFO_LENGTH) ||
2783 	    (param->private_data &&
2784 	     param->private_data_len > IB_CM_SIDR_REP_PRIVATE_DATA_SIZE))
2785 		return -EINVAL;
2786 
2787 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
2788 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2789 	if (cm_id->state != IB_CM_SIDR_REQ_RCVD) {
2790 		ret = -EINVAL;
2791 		goto error;
2792 	}
2793 
2794 	ret = cm_alloc_msg(cm_id_priv, &msg);
2795 	if (ret)
2796 		goto error;
2797 
2798 	cm_format_sidr_rep((struct cm_sidr_rep_msg *) msg->mad, cm_id_priv,
2799 			   param);
2800 	ret = ib_post_send_mad(msg, NULL);
2801 	if (ret) {
2802 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2803 		cm_free_msg(msg);
2804 		return ret;
2805 	}
2806 	cm_id->state = IB_CM_IDLE;
2807 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2808 
2809 	spin_lock_irqsave(&cm.lock, flags);
2810 	rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
2811 	spin_unlock_irqrestore(&cm.lock, flags);
2812 	return 0;
2813 
2814 error:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2815 	return ret;
2816 }
2817 EXPORT_SYMBOL(ib_send_cm_sidr_rep);
2818 
2819 static void cm_format_sidr_rep_event(struct cm_work *work)
2820 {
2821 	struct cm_sidr_rep_msg *sidr_rep_msg;
2822 	struct ib_cm_sidr_rep_event_param *param;
2823 
2824 	sidr_rep_msg = (struct cm_sidr_rep_msg *)
2825 				work->mad_recv_wc->recv_buf.mad;
2826 	param = &work->cm_event.param.sidr_rep_rcvd;
2827 	param->status = sidr_rep_msg->status;
2828 	param->qkey = be32_to_cpu(sidr_rep_msg->qkey);
2829 	param->qpn = be32_to_cpu(cm_sidr_rep_get_qpn(sidr_rep_msg));
2830 	param->info = &sidr_rep_msg->info;
2831 	param->info_len = sidr_rep_msg->info_length;
2832 	work->cm_event.private_data = &sidr_rep_msg->private_data;
2833 }
2834 
2835 static int cm_sidr_rep_handler(struct cm_work *work)
2836 {
2837 	struct cm_sidr_rep_msg *sidr_rep_msg;
2838 	struct cm_id_private *cm_id_priv;
2839 	unsigned long flags;
2840 
2841 	sidr_rep_msg = (struct cm_sidr_rep_msg *)
2842 				work->mad_recv_wc->recv_buf.mad;
2843 	cm_id_priv = cm_acquire_id(sidr_rep_msg->request_id, 0);
2844 	if (!cm_id_priv)
2845 		return -EINVAL; /* Unmatched reply. */
2846 
2847 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2848 	if (cm_id_priv->id.state != IB_CM_SIDR_REQ_SENT) {
2849 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2850 		goto out;
2851 	}
2852 	cm_id_priv->id.state = IB_CM_IDLE;
2853 	ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
2854 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2855 
2856 	cm_format_sidr_rep_event(work);
2857 	cm_process_work(cm_id_priv, work);
2858 	return 0;
2859 out:
2860 	cm_deref_id(cm_id_priv);
2861 	return -EINVAL;
2862 }
2863 
2864 static void cm_process_send_error(struct ib_mad_send_buf *msg,
2865 				  enum ib_wc_status wc_status)
2866 {
2867 	struct cm_id_private *cm_id_priv;
2868 	struct ib_cm_event cm_event;
2869 	enum ib_cm_state state;
2870 	unsigned long flags;
2871 	int ret;
2872 
2873 	memset(&cm_event, 0, sizeof cm_event);
2874 	cm_id_priv = msg->context[0];
2875 
2876 	/* Discard old sends or ones without a response. */
2877 	spin_lock_irqsave(&cm_id_priv->lock, flags);
2878 	state = (enum ib_cm_state) (unsigned long) msg->context[1];
2879 	if (msg != cm_id_priv->msg || state != cm_id_priv->id.state)
2880 		goto discard;
2881 
2882 	switch (state) {
2883 	case IB_CM_REQ_SENT:
2884 	case IB_CM_MRA_REQ_RCVD:
2885 		cm_reset_to_idle(cm_id_priv);
2886 		cm_event.event = IB_CM_REQ_ERROR;
2887 		break;
2888 	case IB_CM_REP_SENT:
2889 	case IB_CM_MRA_REP_RCVD:
2890 		cm_reset_to_idle(cm_id_priv);
2891 		cm_event.event = IB_CM_REP_ERROR;
2892 		break;
2893 	case IB_CM_DREQ_SENT:
2894 		cm_enter_timewait(cm_id_priv);
2895 		cm_event.event = IB_CM_DREQ_ERROR;
2896 		break;
2897 	case IB_CM_SIDR_REQ_SENT:
2898 		cm_id_priv->id.state = IB_CM_IDLE;
2899 		cm_event.event = IB_CM_SIDR_REQ_ERROR;
2900 		break;
2901 	default:
2902 		goto discard;
2903 	}
2904 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2905 	cm_event.param.send_status = wc_status;
2906 
2907 	/* No other events can occur on the cm_id at this point. */
2908 	ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &cm_event);
2909 	cm_free_msg(msg);
2910 	if (ret)
2911 		ib_destroy_cm_id(&cm_id_priv->id);
2912 	return;
2913 discard:
2914 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
2915 	cm_free_msg(msg);
2916 }
2917 
2918 static void cm_send_handler(struct ib_mad_agent *mad_agent,
2919 			    struct ib_mad_send_wc *mad_send_wc)
2920 {
2921 	struct ib_mad_send_buf *msg = mad_send_wc->send_buf;
2922 
2923 	switch (mad_send_wc->status) {
2924 	case IB_WC_SUCCESS:
2925 	case IB_WC_WR_FLUSH_ERR:
2926 		cm_free_msg(msg);
2927 		break;
2928 	default:
2929 		if (msg->context[0] && msg->context[1])
2930 			cm_process_send_error(msg, mad_send_wc->status);
2931 		else
2932 			cm_free_msg(msg);
2933 		break;
2934 	}
2935 }
2936 
2937 static void cm_work_handler(void *data)
2938 {
2939 	struct cm_work *work = data;
2940 	int ret;
2941 
2942 	switch (work->cm_event.event) {
2943 	case IB_CM_REQ_RECEIVED:
2944 		ret = cm_req_handler(work);
2945 		break;
2946 	case IB_CM_MRA_RECEIVED:
2947 		ret = cm_mra_handler(work);
2948 		break;
2949 	case IB_CM_REJ_RECEIVED:
2950 		ret = cm_rej_handler(work);
2951 		break;
2952 	case IB_CM_REP_RECEIVED:
2953 		ret = cm_rep_handler(work);
2954 		break;
2955 	case IB_CM_RTU_RECEIVED:
2956 		ret = cm_rtu_handler(work);
2957 		break;
2958 	case IB_CM_USER_ESTABLISHED:
2959 		ret = cm_establish_handler(work);
2960 		break;
2961 	case IB_CM_DREQ_RECEIVED:
2962 		ret = cm_dreq_handler(work);
2963 		break;
2964 	case IB_CM_DREP_RECEIVED:
2965 		ret = cm_drep_handler(work);
2966 		break;
2967 	case IB_CM_SIDR_REQ_RECEIVED:
2968 		ret = cm_sidr_req_handler(work);
2969 		break;
2970 	case IB_CM_SIDR_REP_RECEIVED:
2971 		ret = cm_sidr_rep_handler(work);
2972 		break;
2973 	case IB_CM_LAP_RECEIVED:
2974 		ret = cm_lap_handler(work);
2975 		break;
2976 	case IB_CM_APR_RECEIVED:
2977 		ret = cm_apr_handler(work);
2978 		break;
2979 	case IB_CM_TIMEWAIT_EXIT:
2980 		ret = cm_timewait_handler(work);
2981 		break;
2982 	default:
2983 		ret = -EINVAL;
2984 		break;
2985 	}
2986 	if (ret)
2987 		cm_free_work(work);
2988 }
2989 
2990 int ib_cm_establish(struct ib_cm_id *cm_id)
2991 {
2992 	struct cm_id_private *cm_id_priv;
2993 	struct cm_work *work;
2994 	unsigned long flags;
2995 	int ret = 0;
2996 
2997 	work = kmalloc(sizeof *work, GFP_ATOMIC);
2998 	if (!work)
2999 		return -ENOMEM;
3000 
3001 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3002 	spin_lock_irqsave(&cm_id_priv->lock, flags);
3003 	switch (cm_id->state)
3004 	{
3005 	case IB_CM_REP_SENT:
3006 	case IB_CM_MRA_REP_RCVD:
3007 		cm_id->state = IB_CM_ESTABLISHED;
3008 		break;
3009 	case IB_CM_ESTABLISHED:
3010 		ret = -EISCONN;
3011 		break;
3012 	default:
3013 		ret = -EINVAL;
3014 		break;
3015 	}
3016 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3017 
3018 	if (ret) {
3019 		kfree(work);
3020 		goto out;
3021 	}
3022 
3023 	/*
3024 	 * The CM worker thread may try to destroy the cm_id before it
3025 	 * can execute this work item.  To prevent potential deadlock,
3026 	 * we need to find the cm_id once we're in the context of the
3027 	 * worker thread, rather than holding a reference on it.
3028 	 */
3029 	INIT_WORK(&work->work, cm_work_handler, work);
3030 	work->local_id = cm_id->local_id;
3031 	work->remote_id = cm_id->remote_id;
3032 	work->mad_recv_wc = NULL;
3033 	work->cm_event.event = IB_CM_USER_ESTABLISHED;
3034 	queue_work(cm.wq, &work->work);
3035 out:
3036 	return ret;
3037 }
3038 EXPORT_SYMBOL(ib_cm_establish);
3039 
3040 static void cm_recv_handler(struct ib_mad_agent *mad_agent,
3041 			    struct ib_mad_recv_wc *mad_recv_wc)
3042 {
3043 	struct cm_work *work;
3044 	enum ib_cm_event_type event;
3045 	int paths = 0;
3046 
3047 	switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
3048 	case CM_REQ_ATTR_ID:
3049 		paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
3050 						    alt_local_lid != 0);
3051 		event = IB_CM_REQ_RECEIVED;
3052 		break;
3053 	case CM_MRA_ATTR_ID:
3054 		event = IB_CM_MRA_RECEIVED;
3055 		break;
3056 	case CM_REJ_ATTR_ID:
3057 		event = IB_CM_REJ_RECEIVED;
3058 		break;
3059 	case CM_REP_ATTR_ID:
3060 		event = IB_CM_REP_RECEIVED;
3061 		break;
3062 	case CM_RTU_ATTR_ID:
3063 		event = IB_CM_RTU_RECEIVED;
3064 		break;
3065 	case CM_DREQ_ATTR_ID:
3066 		event = IB_CM_DREQ_RECEIVED;
3067 		break;
3068 	case CM_DREP_ATTR_ID:
3069 		event = IB_CM_DREP_RECEIVED;
3070 		break;
3071 	case CM_SIDR_REQ_ATTR_ID:
3072 		event = IB_CM_SIDR_REQ_RECEIVED;
3073 		break;
3074 	case CM_SIDR_REP_ATTR_ID:
3075 		event = IB_CM_SIDR_REP_RECEIVED;
3076 		break;
3077 	case CM_LAP_ATTR_ID:
3078 		paths = 1;
3079 		event = IB_CM_LAP_RECEIVED;
3080 		break;
3081 	case CM_APR_ATTR_ID:
3082 		event = IB_CM_APR_RECEIVED;
3083 		break;
3084 	default:
3085 		ib_free_recv_mad(mad_recv_wc);
3086 		return;
3087 	}
3088 
3089 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
3090 		       GFP_KERNEL);
3091 	if (!work) {
3092 		ib_free_recv_mad(mad_recv_wc);
3093 		return;
3094 	}
3095 
3096 	INIT_WORK(&work->work, cm_work_handler, work);
3097 	work->cm_event.event = event;
3098 	work->mad_recv_wc = mad_recv_wc;
3099 	work->port = (struct cm_port *)mad_agent->context;
3100 	queue_work(cm.wq, &work->work);
3101 }
3102 
3103 static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
3104 				struct ib_qp_attr *qp_attr,
3105 				int *qp_attr_mask)
3106 {
3107 	unsigned long flags;
3108 	int ret;
3109 
3110 	spin_lock_irqsave(&cm_id_priv->lock, flags);
3111 	switch (cm_id_priv->id.state) {
3112 	case IB_CM_REQ_SENT:
3113 	case IB_CM_MRA_REQ_RCVD:
3114 	case IB_CM_REQ_RCVD:
3115 	case IB_CM_MRA_REQ_SENT:
3116 	case IB_CM_REP_RCVD:
3117 	case IB_CM_MRA_REP_SENT:
3118 	case IB_CM_REP_SENT:
3119 	case IB_CM_MRA_REP_RCVD:
3120 	case IB_CM_ESTABLISHED:
3121 		*qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
3122 				IB_QP_PKEY_INDEX | IB_QP_PORT;
3123 		qp_attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE |
3124 					   IB_ACCESS_REMOTE_WRITE;
3125 		if (cm_id_priv->responder_resources)
3126 			qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_READ;
3127 		qp_attr->pkey_index = cm_id_priv->av.pkey_index;
3128 		qp_attr->port_num = cm_id_priv->av.port->port_num;
3129 		ret = 0;
3130 		break;
3131 	default:
3132 		ret = -EINVAL;
3133 		break;
3134 	}
3135 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3136 	return ret;
3137 }
3138 
3139 static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
3140 			       struct ib_qp_attr *qp_attr,
3141 			       int *qp_attr_mask)
3142 {
3143 	unsigned long flags;
3144 	int ret;
3145 
3146 	spin_lock_irqsave(&cm_id_priv->lock, flags);
3147 	switch (cm_id_priv->id.state) {
3148 	case IB_CM_REQ_RCVD:
3149 	case IB_CM_MRA_REQ_SENT:
3150 	case IB_CM_REP_RCVD:
3151 	case IB_CM_MRA_REP_SENT:
3152 	case IB_CM_REP_SENT:
3153 	case IB_CM_MRA_REP_RCVD:
3154 	case IB_CM_ESTABLISHED:
3155 		*qp_attr_mask = IB_QP_STATE | IB_QP_AV | IB_QP_PATH_MTU |
3156 				IB_QP_DEST_QPN | IB_QP_RQ_PSN;
3157 		qp_attr->ah_attr = cm_id_priv->av.ah_attr;
3158 		qp_attr->path_mtu = cm_id_priv->path_mtu;
3159 		qp_attr->dest_qp_num = be32_to_cpu(cm_id_priv->remote_qpn);
3160 		qp_attr->rq_psn = be32_to_cpu(cm_id_priv->rq_psn);
3161 		if (cm_id_priv->qp_type == IB_QPT_RC) {
3162 			*qp_attr_mask |= IB_QP_MAX_DEST_RD_ATOMIC |
3163 					 IB_QP_MIN_RNR_TIMER;
3164 			qp_attr->max_dest_rd_atomic =
3165 					cm_id_priv->responder_resources;
3166 			qp_attr->min_rnr_timer = 0;
3167 		}
3168 		if (cm_id_priv->alt_av.ah_attr.dlid) {
3169 			*qp_attr_mask |= IB_QP_ALT_PATH;
3170 			qp_attr->alt_port_num = cm_id_priv->alt_av.port->port_num;
3171 			qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
3172 		}
3173 		ret = 0;
3174 		break;
3175 	default:
3176 		ret = -EINVAL;
3177 		break;
3178 	}
3179 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3180 	return ret;
3181 }
3182 
3183 static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
3184 			       struct ib_qp_attr *qp_attr,
3185 			       int *qp_attr_mask)
3186 {
3187 	unsigned long flags;
3188 	int ret;
3189 
3190 	spin_lock_irqsave(&cm_id_priv->lock, flags);
3191 	switch (cm_id_priv->id.state) {
3192 	case IB_CM_REP_RCVD:
3193 	case IB_CM_MRA_REP_SENT:
3194 	case IB_CM_REP_SENT:
3195 	case IB_CM_MRA_REP_RCVD:
3196 	case IB_CM_ESTABLISHED:
3197 		*qp_attr_mask = IB_QP_STATE | IB_QP_SQ_PSN;
3198 		qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
3199 		if (cm_id_priv->qp_type == IB_QPT_RC) {
3200 			*qp_attr_mask |= IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
3201 					 IB_QP_RNR_RETRY |
3202 					 IB_QP_MAX_QP_RD_ATOMIC;
3203 			qp_attr->timeout = cm_id_priv->local_ack_timeout;
3204 			qp_attr->retry_cnt = cm_id_priv->retry_count;
3205 			qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
3206 			qp_attr->max_rd_atomic = cm_id_priv->initiator_depth;
3207 		}
3208 		if (cm_id_priv->alt_av.ah_attr.dlid) {
3209 			*qp_attr_mask |= IB_QP_PATH_MIG_STATE;
3210 			qp_attr->path_mig_state = IB_MIG_REARM;
3211 		}
3212 		ret = 0;
3213 		break;
3214 	default:
3215 		ret = -EINVAL;
3216 		break;
3217 	}
3218 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
3219 	return ret;
3220 }
3221 
3222 int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
3223 		       struct ib_qp_attr *qp_attr,
3224 		       int *qp_attr_mask)
3225 {
3226 	struct cm_id_private *cm_id_priv;
3227 	int ret;
3228 
3229 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
3230 	switch (qp_attr->qp_state) {
3231 	case IB_QPS_INIT:
3232 		ret = cm_init_qp_init_attr(cm_id_priv, qp_attr, qp_attr_mask);
3233 		break;
3234 	case IB_QPS_RTR:
3235 		ret = cm_init_qp_rtr_attr(cm_id_priv, qp_attr, qp_attr_mask);
3236 		break;
3237 	case IB_QPS_RTS:
3238 		ret = cm_init_qp_rts_attr(cm_id_priv, qp_attr, qp_attr_mask);
3239 		break;
3240 	default:
3241 		ret = -EINVAL;
3242 		break;
3243 	}
3244 	return ret;
3245 }
3246 EXPORT_SYMBOL(ib_cm_init_qp_attr);
3247 
3248 static void cm_add_one(struct ib_device *device)
3249 {
3250 	struct cm_device *cm_dev;
3251 	struct cm_port *port;
3252 	struct ib_mad_reg_req reg_req = {
3253 		.mgmt_class = IB_MGMT_CLASS_CM,
3254 		.mgmt_class_version = IB_CM_CLASS_VERSION
3255 	};
3256 	struct ib_port_modify port_modify = {
3257 		.set_port_cap_mask = IB_PORT_CM_SUP
3258 	};
3259 	unsigned long flags;
3260 	int ret;
3261 	u8 i;
3262 
3263 	cm_dev = kmalloc(sizeof(*cm_dev) + sizeof(*port) *
3264 			 device->phys_port_cnt, GFP_KERNEL);
3265 	if (!cm_dev)
3266 		return;
3267 
3268 	cm_dev->device = device;
3269 	cm_dev->ca_guid = device->node_guid;
3270 
3271 	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
3272 	for (i = 1; i <= device->phys_port_cnt; i++) {
3273 		port = &cm_dev->port[i-1];
3274 		port->cm_dev = cm_dev;
3275 		port->port_num = i;
3276 		port->mad_agent = ib_register_mad_agent(device, i,
3277 							IB_QPT_GSI,
3278 							&reg_req,
3279 							0,
3280 							cm_send_handler,
3281 							cm_recv_handler,
3282 							port);
3283 		if (IS_ERR(port->mad_agent))
3284 			goto error1;
3285 
3286 		ret = ib_modify_port(device, i, 0, &port_modify);
3287 		if (ret)
3288 			goto error2;
3289 	}
3290 	ib_set_client_data(device, &cm_client, cm_dev);
3291 
3292 	write_lock_irqsave(&cm.device_lock, flags);
3293 	list_add_tail(&cm_dev->list, &cm.device_list);
3294 	write_unlock_irqrestore(&cm.device_lock, flags);
3295 	return;
3296 
3297 error2:
3298 	ib_unregister_mad_agent(port->mad_agent);
3299 error1:
3300 	port_modify.set_port_cap_mask = 0;
3301 	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
3302 	while (--i) {
3303 		port = &cm_dev->port[i-1];
3304 		ib_modify_port(device, port->port_num, 0, &port_modify);
3305 		ib_unregister_mad_agent(port->mad_agent);
3306 	}
3307 	kfree(cm_dev);
3308 }
3309 
3310 static void cm_remove_one(struct ib_device *device)
3311 {
3312 	struct cm_device *cm_dev;
3313 	struct cm_port *port;
3314 	struct ib_port_modify port_modify = {
3315 		.clr_port_cap_mask = IB_PORT_CM_SUP
3316 	};
3317 	unsigned long flags;
3318 	int i;
3319 
3320 	cm_dev = ib_get_client_data(device, &cm_client);
3321 	if (!cm_dev)
3322 		return;
3323 
3324 	write_lock_irqsave(&cm.device_lock, flags);
3325 	list_del(&cm_dev->list);
3326 	write_unlock_irqrestore(&cm.device_lock, flags);
3327 
3328 	for (i = 1; i <= device->phys_port_cnt; i++) {
3329 		port = &cm_dev->port[i-1];
3330 		ib_modify_port(device, port->port_num, 0, &port_modify);
3331 		ib_unregister_mad_agent(port->mad_agent);
3332 	}
3333 	kfree(cm_dev);
3334 }
3335 
3336 static int __init ib_cm_init(void)
3337 {
3338 	int ret;
3339 
3340 	memset(&cm, 0, sizeof cm);
3341 	INIT_LIST_HEAD(&cm.device_list);
3342 	rwlock_init(&cm.device_lock);
3343 	spin_lock_init(&cm.lock);
3344 	cm.listen_service_table = RB_ROOT;
3345 	cm.listen_service_id = __constant_be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
3346 	cm.remote_id_table = RB_ROOT;
3347 	cm.remote_qp_table = RB_ROOT;
3348 	cm.remote_sidr_table = RB_ROOT;
3349 	idr_init(&cm.local_id_table);
3350 	idr_pre_get(&cm.local_id_table, GFP_KERNEL);
3351 
3352 	cm.wq = create_workqueue("ib_cm");
3353 	if (!cm.wq)
3354 		return -ENOMEM;
3355 
3356 	ret = ib_register_client(&cm_client);
3357 	if (ret)
3358 		goto error;
3359 
3360 	return 0;
3361 error:
3362 	destroy_workqueue(cm.wq);
3363 	return ret;
3364 }
3365 
3366 static void __exit ib_cm_cleanup(void)
3367 {
3368 	destroy_workqueue(cm.wq);
3369 	ib_unregister_client(&cm_client);
3370 	idr_destroy(&cm.local_id_table);
3371 }
3372 
3373 module_init(ib_cm_init);
3374 module_exit(ib_cm_cleanup);
3375 
3376