xref: /openbmc/linux/drivers/infiniband/core/mad.c (revision f42b3800)
1 /*
2  * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
3  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
4  * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
5  *
6  * This software is available to you under a choice of one of two
7  * licenses.  You may choose to be licensed under the terms of the GNU
8  * General Public License (GPL) Version 2, available from the file
9  * COPYING in the main directory of this source tree, or the
10  * OpenIB.org BSD license below:
11  *
12  *     Redistribution and use in source and binary forms, with or
13  *     without modification, are permitted provided that the following
14  *     conditions are met:
15  *
16  *      - Redistributions of source code must retain the above
17  *        copyright notice, this list of conditions and the following
18  *        disclaimer.
19  *
20  *      - Redistributions in binary form must reproduce the above
21  *        copyright notice, this list of conditions and the following
22  *        disclaimer in the documentation and/or other materials
23  *        provided with the distribution.
24  *
25  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
26  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
27  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
28  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
29  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
30  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
31  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
32  * SOFTWARE.
33  *
34  */
35 #include <linux/dma-mapping.h>
36 #include <rdma/ib_cache.h>
37 
38 #include "mad_priv.h"
39 #include "mad_rmpp.h"
40 #include "smi.h"
41 #include "agent.h"
42 
43 MODULE_LICENSE("Dual BSD/GPL");
44 MODULE_DESCRIPTION("kernel IB MAD API");
45 MODULE_AUTHOR("Hal Rosenstock");
46 MODULE_AUTHOR("Sean Hefty");
47 
48 static struct kmem_cache *ib_mad_cache;
49 
50 static struct list_head ib_mad_port_list;
51 static u32 ib_mad_client_id = 0;
52 
53 /* Port list lock */
54 static spinlock_t ib_mad_port_list_lock;
55 
56 
57 /* Forward declarations */
58 static int method_in_use(struct ib_mad_mgmt_method_table **method,
59 			 struct ib_mad_reg_req *mad_reg_req);
60 static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
61 static struct ib_mad_agent_private *find_mad_agent(
62 					struct ib_mad_port_private *port_priv,
63 					struct ib_mad *mad);
64 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
65 				    struct ib_mad_private *mad);
66 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
67 static void timeout_sends(struct work_struct *work);
68 static void local_completions(struct work_struct *work);
69 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
70 			      struct ib_mad_agent_private *agent_priv,
71 			      u8 mgmt_class);
72 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
73 			   struct ib_mad_agent_private *agent_priv);
74 
75 /*
76  * Returns a ib_mad_port_private structure or NULL for a device/port
77  * Assumes ib_mad_port_list_lock is being held
78  */
79 static inline struct ib_mad_port_private *
80 __ib_get_mad_port(struct ib_device *device, int port_num)
81 {
82 	struct ib_mad_port_private *entry;
83 
84 	list_for_each_entry(entry, &ib_mad_port_list, port_list) {
85 		if (entry->device == device && entry->port_num == port_num)
86 			return entry;
87 	}
88 	return NULL;
89 }
90 
91 /*
92  * Wrapper function to return a ib_mad_port_private structure or NULL
93  * for a device/port
94  */
95 static inline struct ib_mad_port_private *
96 ib_get_mad_port(struct ib_device *device, int port_num)
97 {
98 	struct ib_mad_port_private *entry;
99 	unsigned long flags;
100 
101 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
102 	entry = __ib_get_mad_port(device, port_num);
103 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
104 
105 	return entry;
106 }
107 
108 static inline u8 convert_mgmt_class(u8 mgmt_class)
109 {
110 	/* Alias IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE to 0 */
111 	return mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE ?
112 		0 : mgmt_class;
113 }
114 
115 static int get_spl_qp_index(enum ib_qp_type qp_type)
116 {
117 	switch (qp_type)
118 	{
119 	case IB_QPT_SMI:
120 		return 0;
121 	case IB_QPT_GSI:
122 		return 1;
123 	default:
124 		return -1;
125 	}
126 }
127 
128 static int vendor_class_index(u8 mgmt_class)
129 {
130 	return mgmt_class - IB_MGMT_CLASS_VENDOR_RANGE2_START;
131 }
132 
133 static int is_vendor_class(u8 mgmt_class)
134 {
135 	if ((mgmt_class < IB_MGMT_CLASS_VENDOR_RANGE2_START) ||
136 	    (mgmt_class > IB_MGMT_CLASS_VENDOR_RANGE2_END))
137 		return 0;
138 	return 1;
139 }
140 
141 static int is_vendor_oui(char *oui)
142 {
143 	if (oui[0] || oui[1] || oui[2])
144 		return 1;
145 	return 0;
146 }
147 
148 static int is_vendor_method_in_use(
149 		struct ib_mad_mgmt_vendor_class *vendor_class,
150 		struct ib_mad_reg_req *mad_reg_req)
151 {
152 	struct ib_mad_mgmt_method_table *method;
153 	int i;
154 
155 	for (i = 0; i < MAX_MGMT_OUI; i++) {
156 		if (!memcmp(vendor_class->oui[i], mad_reg_req->oui, 3)) {
157 			method = vendor_class->method_table[i];
158 			if (method) {
159 				if (method_in_use(&method, mad_reg_req))
160 					return 1;
161 				else
162 					break;
163 			}
164 		}
165 	}
166 	return 0;
167 }
168 
169 int ib_response_mad(struct ib_mad *mad)
170 {
171 	return ((mad->mad_hdr.method & IB_MGMT_METHOD_RESP) ||
172 		(mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
173 		((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_BM) &&
174 		 (mad->mad_hdr.attr_mod & IB_BM_ATTR_MOD_RESP)));
175 }
176 EXPORT_SYMBOL(ib_response_mad);
177 
178 /*
179  * ib_register_mad_agent - Register to send/receive MADs
180  */
181 struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
182 					   u8 port_num,
183 					   enum ib_qp_type qp_type,
184 					   struct ib_mad_reg_req *mad_reg_req,
185 					   u8 rmpp_version,
186 					   ib_mad_send_handler send_handler,
187 					   ib_mad_recv_handler recv_handler,
188 					   void *context)
189 {
190 	struct ib_mad_port_private *port_priv;
191 	struct ib_mad_agent *ret = ERR_PTR(-EINVAL);
192 	struct ib_mad_agent_private *mad_agent_priv;
193 	struct ib_mad_reg_req *reg_req = NULL;
194 	struct ib_mad_mgmt_class_table *class;
195 	struct ib_mad_mgmt_vendor_class_table *vendor;
196 	struct ib_mad_mgmt_vendor_class *vendor_class;
197 	struct ib_mad_mgmt_method_table *method;
198 	int ret2, qpn;
199 	unsigned long flags;
200 	u8 mgmt_class, vclass;
201 
202 	/* Validate parameters */
203 	qpn = get_spl_qp_index(qp_type);
204 	if (qpn == -1)
205 		goto error1;
206 
207 	if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION)
208 		goto error1;
209 
210 	/* Validate MAD registration request if supplied */
211 	if (mad_reg_req) {
212 		if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION)
213 			goto error1;
214 		if (!recv_handler)
215 			goto error1;
216 		if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
217 			/*
218 			 * IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE is the only
219 			 * one in this range currently allowed
220 			 */
221 			if (mad_reg_req->mgmt_class !=
222 			    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
223 				goto error1;
224 		} else if (mad_reg_req->mgmt_class == 0) {
225 			/*
226 			 * Class 0 is reserved in IBA and is used for
227 			 * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
228 			 */
229 			goto error1;
230 		} else if (is_vendor_class(mad_reg_req->mgmt_class)) {
231 			/*
232 			 * If class is in "new" vendor range,
233 			 * ensure supplied OUI is not zero
234 			 */
235 			if (!is_vendor_oui(mad_reg_req->oui))
236 				goto error1;
237 		}
238 		/* Make sure class supplied is consistent with RMPP */
239 		if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
240 			if (rmpp_version)
241 				goto error1;
242 		}
243 		/* Make sure class supplied is consistent with QP type */
244 		if (qp_type == IB_QPT_SMI) {
245 			if ((mad_reg_req->mgmt_class !=
246 					IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
247 			    (mad_reg_req->mgmt_class !=
248 					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE))
249 				goto error1;
250 		} else {
251 			if ((mad_reg_req->mgmt_class ==
252 					IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
253 			    (mad_reg_req->mgmt_class ==
254 					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE))
255 				goto error1;
256 		}
257 	} else {
258 		/* No registration request supplied */
259 		if (!send_handler)
260 			goto error1;
261 	}
262 
263 	/* Validate device and port */
264 	port_priv = ib_get_mad_port(device, port_num);
265 	if (!port_priv) {
266 		ret = ERR_PTR(-ENODEV);
267 		goto error1;
268 	}
269 
270 	/* Allocate structures */
271 	mad_agent_priv = kzalloc(sizeof *mad_agent_priv, GFP_KERNEL);
272 	if (!mad_agent_priv) {
273 		ret = ERR_PTR(-ENOMEM);
274 		goto error1;
275 	}
276 
277 	mad_agent_priv->agent.mr = ib_get_dma_mr(port_priv->qp_info[qpn].qp->pd,
278 						 IB_ACCESS_LOCAL_WRITE);
279 	if (IS_ERR(mad_agent_priv->agent.mr)) {
280 		ret = ERR_PTR(-ENOMEM);
281 		goto error2;
282 	}
283 
284 	if (mad_reg_req) {
285 		reg_req = kmalloc(sizeof *reg_req, GFP_KERNEL);
286 		if (!reg_req) {
287 			ret = ERR_PTR(-ENOMEM);
288 			goto error3;
289 		}
290 		/* Make a copy of the MAD registration request */
291 		memcpy(reg_req, mad_reg_req, sizeof *reg_req);
292 	}
293 
294 	/* Now, fill in the various structures */
295 	mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
296 	mad_agent_priv->reg_req = reg_req;
297 	mad_agent_priv->agent.rmpp_version = rmpp_version;
298 	mad_agent_priv->agent.device = device;
299 	mad_agent_priv->agent.recv_handler = recv_handler;
300 	mad_agent_priv->agent.send_handler = send_handler;
301 	mad_agent_priv->agent.context = context;
302 	mad_agent_priv->agent.qp = port_priv->qp_info[qpn].qp;
303 	mad_agent_priv->agent.port_num = port_num;
304 
305 	spin_lock_irqsave(&port_priv->reg_lock, flags);
306 	mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
307 
308 	/*
309 	 * Make sure MAD registration (if supplied)
310 	 * is non overlapping with any existing ones
311 	 */
312 	if (mad_reg_req) {
313 		mgmt_class = convert_mgmt_class(mad_reg_req->mgmt_class);
314 		if (!is_vendor_class(mgmt_class)) {
315 			class = port_priv->version[mad_reg_req->
316 						   mgmt_class_version].class;
317 			if (class) {
318 				method = class->method_table[mgmt_class];
319 				if (method) {
320 					if (method_in_use(&method,
321 							   mad_reg_req))
322 						goto error4;
323 				}
324 			}
325 			ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
326 						  mgmt_class);
327 		} else {
328 			/* "New" vendor class range */
329 			vendor = port_priv->version[mad_reg_req->
330 						    mgmt_class_version].vendor;
331 			if (vendor) {
332 				vclass = vendor_class_index(mgmt_class);
333 				vendor_class = vendor->vendor_class[vclass];
334 				if (vendor_class) {
335 					if (is_vendor_method_in_use(
336 							vendor_class,
337 							mad_reg_req))
338 						goto error4;
339 				}
340 			}
341 			ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
342 		}
343 		if (ret2) {
344 			ret = ERR_PTR(ret2);
345 			goto error4;
346 		}
347 	}
348 
349 	/* Add mad agent into port's agent list */
350 	list_add_tail(&mad_agent_priv->agent_list, &port_priv->agent_list);
351 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
352 
353 	spin_lock_init(&mad_agent_priv->lock);
354 	INIT_LIST_HEAD(&mad_agent_priv->send_list);
355 	INIT_LIST_HEAD(&mad_agent_priv->wait_list);
356 	INIT_LIST_HEAD(&mad_agent_priv->done_list);
357 	INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
358 	INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
359 	INIT_LIST_HEAD(&mad_agent_priv->local_list);
360 	INIT_WORK(&mad_agent_priv->local_work, local_completions);
361 	atomic_set(&mad_agent_priv->refcount, 1);
362 	init_completion(&mad_agent_priv->comp);
363 
364 	return &mad_agent_priv->agent;
365 
366 error4:
367 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
368 	kfree(reg_req);
369 error3:
370 	ib_dereg_mr(mad_agent_priv->agent.mr);
371 error2:
372 	kfree(mad_agent_priv);
373 error1:
374 	return ret;
375 }
376 EXPORT_SYMBOL(ib_register_mad_agent);
377 
378 static inline int is_snooping_sends(int mad_snoop_flags)
379 {
380 	return (mad_snoop_flags &
381 		(/*IB_MAD_SNOOP_POSTED_SENDS |
382 		 IB_MAD_SNOOP_RMPP_SENDS |*/
383 		 IB_MAD_SNOOP_SEND_COMPLETIONS /*|
384 		 IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS*/));
385 }
386 
387 static inline int is_snooping_recvs(int mad_snoop_flags)
388 {
389 	return (mad_snoop_flags &
390 		(IB_MAD_SNOOP_RECVS /*|
391 		 IB_MAD_SNOOP_RMPP_RECVS*/));
392 }
393 
394 static int register_snoop_agent(struct ib_mad_qp_info *qp_info,
395 				struct ib_mad_snoop_private *mad_snoop_priv)
396 {
397 	struct ib_mad_snoop_private **new_snoop_table;
398 	unsigned long flags;
399 	int i;
400 
401 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
402 	/* Check for empty slot in array. */
403 	for (i = 0; i < qp_info->snoop_table_size; i++)
404 		if (!qp_info->snoop_table[i])
405 			break;
406 
407 	if (i == qp_info->snoop_table_size) {
408 		/* Grow table. */
409 		new_snoop_table = kmalloc(sizeof mad_snoop_priv *
410 					  qp_info->snoop_table_size + 1,
411 					  GFP_ATOMIC);
412 		if (!new_snoop_table) {
413 			i = -ENOMEM;
414 			goto out;
415 		}
416 		if (qp_info->snoop_table) {
417 			memcpy(new_snoop_table, qp_info->snoop_table,
418 			       sizeof mad_snoop_priv *
419 			       qp_info->snoop_table_size);
420 			kfree(qp_info->snoop_table);
421 		}
422 		qp_info->snoop_table = new_snoop_table;
423 		qp_info->snoop_table_size++;
424 	}
425 	qp_info->snoop_table[i] = mad_snoop_priv;
426 	atomic_inc(&qp_info->snoop_count);
427 out:
428 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
429 	return i;
430 }
431 
432 struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
433 					   u8 port_num,
434 					   enum ib_qp_type qp_type,
435 					   int mad_snoop_flags,
436 					   ib_mad_snoop_handler snoop_handler,
437 					   ib_mad_recv_handler recv_handler,
438 					   void *context)
439 {
440 	struct ib_mad_port_private *port_priv;
441 	struct ib_mad_agent *ret;
442 	struct ib_mad_snoop_private *mad_snoop_priv;
443 	int qpn;
444 
445 	/* Validate parameters */
446 	if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) ||
447 	    (is_snooping_recvs(mad_snoop_flags) && !recv_handler)) {
448 		ret = ERR_PTR(-EINVAL);
449 		goto error1;
450 	}
451 	qpn = get_spl_qp_index(qp_type);
452 	if (qpn == -1) {
453 		ret = ERR_PTR(-EINVAL);
454 		goto error1;
455 	}
456 	port_priv = ib_get_mad_port(device, port_num);
457 	if (!port_priv) {
458 		ret = ERR_PTR(-ENODEV);
459 		goto error1;
460 	}
461 	/* Allocate structures */
462 	mad_snoop_priv = kzalloc(sizeof *mad_snoop_priv, GFP_KERNEL);
463 	if (!mad_snoop_priv) {
464 		ret = ERR_PTR(-ENOMEM);
465 		goto error1;
466 	}
467 
468 	/* Now, fill in the various structures */
469 	mad_snoop_priv->qp_info = &port_priv->qp_info[qpn];
470 	mad_snoop_priv->agent.device = device;
471 	mad_snoop_priv->agent.recv_handler = recv_handler;
472 	mad_snoop_priv->agent.snoop_handler = snoop_handler;
473 	mad_snoop_priv->agent.context = context;
474 	mad_snoop_priv->agent.qp = port_priv->qp_info[qpn].qp;
475 	mad_snoop_priv->agent.port_num = port_num;
476 	mad_snoop_priv->mad_snoop_flags = mad_snoop_flags;
477 	init_completion(&mad_snoop_priv->comp);
478 	mad_snoop_priv->snoop_index = register_snoop_agent(
479 						&port_priv->qp_info[qpn],
480 						mad_snoop_priv);
481 	if (mad_snoop_priv->snoop_index < 0) {
482 		ret = ERR_PTR(mad_snoop_priv->snoop_index);
483 		goto error2;
484 	}
485 
486 	atomic_set(&mad_snoop_priv->refcount, 1);
487 	return &mad_snoop_priv->agent;
488 
489 error2:
490 	kfree(mad_snoop_priv);
491 error1:
492 	return ret;
493 }
494 EXPORT_SYMBOL(ib_register_mad_snoop);
495 
496 static inline void deref_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
497 {
498 	if (atomic_dec_and_test(&mad_agent_priv->refcount))
499 		complete(&mad_agent_priv->comp);
500 }
501 
502 static inline void deref_snoop_agent(struct ib_mad_snoop_private *mad_snoop_priv)
503 {
504 	if (atomic_dec_and_test(&mad_snoop_priv->refcount))
505 		complete(&mad_snoop_priv->comp);
506 }
507 
508 static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
509 {
510 	struct ib_mad_port_private *port_priv;
511 	unsigned long flags;
512 
513 	/* Note that we could still be handling received MADs */
514 
515 	/*
516 	 * Canceling all sends results in dropping received response
517 	 * MADs, preventing us from queuing additional work
518 	 */
519 	cancel_mads(mad_agent_priv);
520 	port_priv = mad_agent_priv->qp_info->port_priv;
521 	cancel_delayed_work(&mad_agent_priv->timed_work);
522 
523 	spin_lock_irqsave(&port_priv->reg_lock, flags);
524 	remove_mad_reg_req(mad_agent_priv);
525 	list_del(&mad_agent_priv->agent_list);
526 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
527 
528 	flush_workqueue(port_priv->wq);
529 	ib_cancel_rmpp_recvs(mad_agent_priv);
530 
531 	deref_mad_agent(mad_agent_priv);
532 	wait_for_completion(&mad_agent_priv->comp);
533 
534 	kfree(mad_agent_priv->reg_req);
535 	ib_dereg_mr(mad_agent_priv->agent.mr);
536 	kfree(mad_agent_priv);
537 }
538 
539 static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv)
540 {
541 	struct ib_mad_qp_info *qp_info;
542 	unsigned long flags;
543 
544 	qp_info = mad_snoop_priv->qp_info;
545 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
546 	qp_info->snoop_table[mad_snoop_priv->snoop_index] = NULL;
547 	atomic_dec(&qp_info->snoop_count);
548 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
549 
550 	deref_snoop_agent(mad_snoop_priv);
551 	wait_for_completion(&mad_snoop_priv->comp);
552 
553 	kfree(mad_snoop_priv);
554 }
555 
556 /*
557  * ib_unregister_mad_agent - Unregisters a client from using MAD services
558  */
559 int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
560 {
561 	struct ib_mad_agent_private *mad_agent_priv;
562 	struct ib_mad_snoop_private *mad_snoop_priv;
563 
564 	/* If the TID is zero, the agent can only snoop. */
565 	if (mad_agent->hi_tid) {
566 		mad_agent_priv = container_of(mad_agent,
567 					      struct ib_mad_agent_private,
568 					      agent);
569 		unregister_mad_agent(mad_agent_priv);
570 	} else {
571 		mad_snoop_priv = container_of(mad_agent,
572 					      struct ib_mad_snoop_private,
573 					      agent);
574 		unregister_mad_snoop(mad_snoop_priv);
575 	}
576 	return 0;
577 }
578 EXPORT_SYMBOL(ib_unregister_mad_agent);
579 
580 static void dequeue_mad(struct ib_mad_list_head *mad_list)
581 {
582 	struct ib_mad_queue *mad_queue;
583 	unsigned long flags;
584 
585 	BUG_ON(!mad_list->mad_queue);
586 	mad_queue = mad_list->mad_queue;
587 	spin_lock_irqsave(&mad_queue->lock, flags);
588 	list_del(&mad_list->list);
589 	mad_queue->count--;
590 	spin_unlock_irqrestore(&mad_queue->lock, flags);
591 }
592 
593 static void snoop_send(struct ib_mad_qp_info *qp_info,
594 		       struct ib_mad_send_buf *send_buf,
595 		       struct ib_mad_send_wc *mad_send_wc,
596 		       int mad_snoop_flags)
597 {
598 	struct ib_mad_snoop_private *mad_snoop_priv;
599 	unsigned long flags;
600 	int i;
601 
602 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
603 	for (i = 0; i < qp_info->snoop_table_size; i++) {
604 		mad_snoop_priv = qp_info->snoop_table[i];
605 		if (!mad_snoop_priv ||
606 		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
607 			continue;
608 
609 		atomic_inc(&mad_snoop_priv->refcount);
610 		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
611 		mad_snoop_priv->agent.snoop_handler(&mad_snoop_priv->agent,
612 						    send_buf, mad_send_wc);
613 		deref_snoop_agent(mad_snoop_priv);
614 		spin_lock_irqsave(&qp_info->snoop_lock, flags);
615 	}
616 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
617 }
618 
619 static void snoop_recv(struct ib_mad_qp_info *qp_info,
620 		       struct ib_mad_recv_wc *mad_recv_wc,
621 		       int mad_snoop_flags)
622 {
623 	struct ib_mad_snoop_private *mad_snoop_priv;
624 	unsigned long flags;
625 	int i;
626 
627 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
628 	for (i = 0; i < qp_info->snoop_table_size; i++) {
629 		mad_snoop_priv = qp_info->snoop_table[i];
630 		if (!mad_snoop_priv ||
631 		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
632 			continue;
633 
634 		atomic_inc(&mad_snoop_priv->refcount);
635 		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
636 		mad_snoop_priv->agent.recv_handler(&mad_snoop_priv->agent,
637 						   mad_recv_wc);
638 		deref_snoop_agent(mad_snoop_priv);
639 		spin_lock_irqsave(&qp_info->snoop_lock, flags);
640 	}
641 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
642 }
643 
644 static void build_smp_wc(struct ib_qp *qp,
645 			 u64 wr_id, u16 slid, u16 pkey_index, u8 port_num,
646 			 struct ib_wc *wc)
647 {
648 	memset(wc, 0, sizeof *wc);
649 	wc->wr_id = wr_id;
650 	wc->status = IB_WC_SUCCESS;
651 	wc->opcode = IB_WC_RECV;
652 	wc->pkey_index = pkey_index;
653 	wc->byte_len = sizeof(struct ib_mad) + sizeof(struct ib_grh);
654 	wc->src_qp = IB_QP0;
655 	wc->qp = qp;
656 	wc->slid = slid;
657 	wc->sl = 0;
658 	wc->dlid_path_bits = 0;
659 	wc->port_num = port_num;
660 }
661 
662 /*
663  * Return 0 if SMP is to be sent
664  * Return 1 if SMP was consumed locally (whether or not solicited)
665  * Return < 0 if error
666  */
667 static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
668 				  struct ib_mad_send_wr_private *mad_send_wr)
669 {
670 	int ret = 0;
671 	struct ib_smp *smp = mad_send_wr->send_buf.mad;
672 	unsigned long flags;
673 	struct ib_mad_local_private *local;
674 	struct ib_mad_private *mad_priv;
675 	struct ib_mad_port_private *port_priv;
676 	struct ib_mad_agent_private *recv_mad_agent = NULL;
677 	struct ib_device *device = mad_agent_priv->agent.device;
678 	u8 port_num;
679 	struct ib_wc mad_wc;
680 	struct ib_send_wr *send_wr = &mad_send_wr->send_wr;
681 
682 	if (device->node_type == RDMA_NODE_IB_SWITCH &&
683 	    smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
684 		port_num = send_wr->wr.ud.port_num;
685 	else
686 		port_num = mad_agent_priv->agent.port_num;
687 
688 	/*
689 	 * Directed route handling starts if the initial LID routed part of
690 	 * a request or the ending LID routed part of a response is empty.
691 	 * If we are at the start of the LID routed part, don't update the
692 	 * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
693 	 */
694 	if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
695 	     IB_LID_PERMISSIVE &&
696 	     smi_handle_dr_smp_send(smp, device->node_type, port_num) ==
697 	     IB_SMI_DISCARD) {
698 		ret = -EINVAL;
699 		printk(KERN_ERR PFX "Invalid directed route\n");
700 		goto out;
701 	}
702 
703 	/* Check to post send on QP or process locally */
704 	if (smi_check_local_smp(smp, device) == IB_SMI_DISCARD &&
705 	    smi_check_local_returning_smp(smp, device) == IB_SMI_DISCARD)
706 		goto out;
707 
708 	local = kmalloc(sizeof *local, GFP_ATOMIC);
709 	if (!local) {
710 		ret = -ENOMEM;
711 		printk(KERN_ERR PFX "No memory for ib_mad_local_private\n");
712 		goto out;
713 	}
714 	local->mad_priv = NULL;
715 	local->recv_mad_agent = NULL;
716 	mad_priv = kmem_cache_alloc(ib_mad_cache, GFP_ATOMIC);
717 	if (!mad_priv) {
718 		ret = -ENOMEM;
719 		printk(KERN_ERR PFX "No memory for local response MAD\n");
720 		kfree(local);
721 		goto out;
722 	}
723 
724 	build_smp_wc(mad_agent_priv->agent.qp,
725 		     send_wr->wr_id, be16_to_cpu(smp->dr_slid),
726 		     send_wr->wr.ud.pkey_index,
727 		     send_wr->wr.ud.port_num, &mad_wc);
728 
729 	/* No GRH for DR SMP */
730 	ret = device->process_mad(device, 0, port_num, &mad_wc, NULL,
731 				  (struct ib_mad *)smp,
732 				  (struct ib_mad *)&mad_priv->mad);
733 	switch (ret)
734 	{
735 	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
736 		if (ib_response_mad(&mad_priv->mad.mad) &&
737 		    mad_agent_priv->agent.recv_handler) {
738 			local->mad_priv = mad_priv;
739 			local->recv_mad_agent = mad_agent_priv;
740 			/*
741 			 * Reference MAD agent until receive
742 			 * side of local completion handled
743 			 */
744 			atomic_inc(&mad_agent_priv->refcount);
745 		} else
746 			kmem_cache_free(ib_mad_cache, mad_priv);
747 		break;
748 	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
749 		kmem_cache_free(ib_mad_cache, mad_priv);
750 		break;
751 	case IB_MAD_RESULT_SUCCESS:
752 		/* Treat like an incoming receive MAD */
753 		port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
754 					    mad_agent_priv->agent.port_num);
755 		if (port_priv) {
756 			memcpy(&mad_priv->mad.mad, smp, sizeof(struct ib_mad));
757 			recv_mad_agent = find_mad_agent(port_priv,
758 						        &mad_priv->mad.mad);
759 		}
760 		if (!port_priv || !recv_mad_agent) {
761 			kmem_cache_free(ib_mad_cache, mad_priv);
762 			kfree(local);
763 			ret = 0;
764 			goto out;
765 		}
766 		local->mad_priv = mad_priv;
767 		local->recv_mad_agent = recv_mad_agent;
768 		break;
769 	default:
770 		kmem_cache_free(ib_mad_cache, mad_priv);
771 		kfree(local);
772 		ret = -EINVAL;
773 		goto out;
774 	}
775 
776 	local->mad_send_wr = mad_send_wr;
777 	/* Reference MAD agent until send side of local completion handled */
778 	atomic_inc(&mad_agent_priv->refcount);
779 	/* Queue local completion to local list */
780 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
781 	list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
782 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
783 	queue_work(mad_agent_priv->qp_info->port_priv->wq,
784 		   &mad_agent_priv->local_work);
785 	ret = 1;
786 out:
787 	return ret;
788 }
789 
790 static int get_pad_size(int hdr_len, int data_len)
791 {
792 	int seg_size, pad;
793 
794 	seg_size = sizeof(struct ib_mad) - hdr_len;
795 	if (data_len && seg_size) {
796 		pad = seg_size - data_len % seg_size;
797 		return pad == seg_size ? 0 : pad;
798 	} else
799 		return seg_size;
800 }
801 
802 static void free_send_rmpp_list(struct ib_mad_send_wr_private *mad_send_wr)
803 {
804 	struct ib_rmpp_segment *s, *t;
805 
806 	list_for_each_entry_safe(s, t, &mad_send_wr->rmpp_list, list) {
807 		list_del(&s->list);
808 		kfree(s);
809 	}
810 }
811 
812 static int alloc_send_rmpp_list(struct ib_mad_send_wr_private *send_wr,
813 				gfp_t gfp_mask)
814 {
815 	struct ib_mad_send_buf *send_buf = &send_wr->send_buf;
816 	struct ib_rmpp_mad *rmpp_mad = send_buf->mad;
817 	struct ib_rmpp_segment *seg = NULL;
818 	int left, seg_size, pad;
819 
820 	send_buf->seg_size = sizeof (struct ib_mad) - send_buf->hdr_len;
821 	seg_size = send_buf->seg_size;
822 	pad = send_wr->pad;
823 
824 	/* Allocate data segments. */
825 	for (left = send_buf->data_len + pad; left > 0; left -= seg_size) {
826 		seg = kmalloc(sizeof (*seg) + seg_size, gfp_mask);
827 		if (!seg) {
828 			printk(KERN_ERR "alloc_send_rmpp_segs: RMPP mem "
829 			       "alloc failed for len %zd, gfp %#x\n",
830 			       sizeof (*seg) + seg_size, gfp_mask);
831 			free_send_rmpp_list(send_wr);
832 			return -ENOMEM;
833 		}
834 		seg->num = ++send_buf->seg_count;
835 		list_add_tail(&seg->list, &send_wr->rmpp_list);
836 	}
837 
838 	/* Zero any padding */
839 	if (pad)
840 		memset(seg->data + seg_size - pad, 0, pad);
841 
842 	rmpp_mad->rmpp_hdr.rmpp_version = send_wr->mad_agent_priv->
843 					  agent.rmpp_version;
844 	rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
845 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
846 
847 	send_wr->cur_seg = container_of(send_wr->rmpp_list.next,
848 					struct ib_rmpp_segment, list);
849 	send_wr->last_ack_seg = send_wr->cur_seg;
850 	return 0;
851 }
852 
853 struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
854 					    u32 remote_qpn, u16 pkey_index,
855 					    int rmpp_active,
856 					    int hdr_len, int data_len,
857 					    gfp_t gfp_mask)
858 {
859 	struct ib_mad_agent_private *mad_agent_priv;
860 	struct ib_mad_send_wr_private *mad_send_wr;
861 	int pad, message_size, ret, size;
862 	void *buf;
863 
864 	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
865 				      agent);
866 	pad = get_pad_size(hdr_len, data_len);
867 	message_size = hdr_len + data_len + pad;
868 
869 	if ((!mad_agent->rmpp_version &&
870 	     (rmpp_active || message_size > sizeof(struct ib_mad))) ||
871 	    (!rmpp_active && message_size > sizeof(struct ib_mad)))
872 		return ERR_PTR(-EINVAL);
873 
874 	size = rmpp_active ? hdr_len : sizeof(struct ib_mad);
875 	buf = kzalloc(sizeof *mad_send_wr + size, gfp_mask);
876 	if (!buf)
877 		return ERR_PTR(-ENOMEM);
878 
879 	mad_send_wr = buf + size;
880 	INIT_LIST_HEAD(&mad_send_wr->rmpp_list);
881 	mad_send_wr->send_buf.mad = buf;
882 	mad_send_wr->send_buf.hdr_len = hdr_len;
883 	mad_send_wr->send_buf.data_len = data_len;
884 	mad_send_wr->pad = pad;
885 
886 	mad_send_wr->mad_agent_priv = mad_agent_priv;
887 	mad_send_wr->sg_list[0].length = hdr_len;
888 	mad_send_wr->sg_list[0].lkey = mad_agent->mr->lkey;
889 	mad_send_wr->sg_list[1].length = sizeof(struct ib_mad) - hdr_len;
890 	mad_send_wr->sg_list[1].lkey = mad_agent->mr->lkey;
891 
892 	mad_send_wr->send_wr.wr_id = (unsigned long) mad_send_wr;
893 	mad_send_wr->send_wr.sg_list = mad_send_wr->sg_list;
894 	mad_send_wr->send_wr.num_sge = 2;
895 	mad_send_wr->send_wr.opcode = IB_WR_SEND;
896 	mad_send_wr->send_wr.send_flags = IB_SEND_SIGNALED;
897 	mad_send_wr->send_wr.wr.ud.remote_qpn = remote_qpn;
898 	mad_send_wr->send_wr.wr.ud.remote_qkey = IB_QP_SET_QKEY;
899 	mad_send_wr->send_wr.wr.ud.pkey_index = pkey_index;
900 
901 	if (rmpp_active) {
902 		ret = alloc_send_rmpp_list(mad_send_wr, gfp_mask);
903 		if (ret) {
904 			kfree(buf);
905 			return ERR_PTR(ret);
906 		}
907 	}
908 
909 	mad_send_wr->send_buf.mad_agent = mad_agent;
910 	atomic_inc(&mad_agent_priv->refcount);
911 	return &mad_send_wr->send_buf;
912 }
913 EXPORT_SYMBOL(ib_create_send_mad);
914 
915 int ib_get_mad_data_offset(u8 mgmt_class)
916 {
917 	if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
918 		return IB_MGMT_SA_HDR;
919 	else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
920 		 (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
921 		 (mgmt_class == IB_MGMT_CLASS_BIS))
922 		return IB_MGMT_DEVICE_HDR;
923 	else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
924 		 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
925 		return IB_MGMT_VENDOR_HDR;
926 	else
927 		return IB_MGMT_MAD_HDR;
928 }
929 EXPORT_SYMBOL(ib_get_mad_data_offset);
930 
931 int ib_is_mad_class_rmpp(u8 mgmt_class)
932 {
933 	if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
934 	    (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
935 	    (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
936 	    (mgmt_class == IB_MGMT_CLASS_BIS) ||
937 	    ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
938 	     (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
939 		return 1;
940 	return 0;
941 }
942 EXPORT_SYMBOL(ib_is_mad_class_rmpp);
943 
944 void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
945 {
946 	struct ib_mad_send_wr_private *mad_send_wr;
947 	struct list_head *list;
948 
949 	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
950 				   send_buf);
951 	list = &mad_send_wr->cur_seg->list;
952 
953 	if (mad_send_wr->cur_seg->num < seg_num) {
954 		list_for_each_entry(mad_send_wr->cur_seg, list, list)
955 			if (mad_send_wr->cur_seg->num == seg_num)
956 				break;
957 	} else if (mad_send_wr->cur_seg->num > seg_num) {
958 		list_for_each_entry_reverse(mad_send_wr->cur_seg, list, list)
959 			if (mad_send_wr->cur_seg->num == seg_num)
960 				break;
961 	}
962 	return mad_send_wr->cur_seg->data;
963 }
964 EXPORT_SYMBOL(ib_get_rmpp_segment);
965 
966 static inline void *ib_get_payload(struct ib_mad_send_wr_private *mad_send_wr)
967 {
968 	if (mad_send_wr->send_buf.seg_count)
969 		return ib_get_rmpp_segment(&mad_send_wr->send_buf,
970 					   mad_send_wr->seg_num);
971 	else
972 		return mad_send_wr->send_buf.mad +
973 		       mad_send_wr->send_buf.hdr_len;
974 }
975 
976 void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
977 {
978 	struct ib_mad_agent_private *mad_agent_priv;
979 	struct ib_mad_send_wr_private *mad_send_wr;
980 
981 	mad_agent_priv = container_of(send_buf->mad_agent,
982 				      struct ib_mad_agent_private, agent);
983 	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
984 				   send_buf);
985 
986 	free_send_rmpp_list(mad_send_wr);
987 	kfree(send_buf->mad);
988 	deref_mad_agent(mad_agent_priv);
989 }
990 EXPORT_SYMBOL(ib_free_send_mad);
991 
992 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
993 {
994 	struct ib_mad_qp_info *qp_info;
995 	struct list_head *list;
996 	struct ib_send_wr *bad_send_wr;
997 	struct ib_mad_agent *mad_agent;
998 	struct ib_sge *sge;
999 	unsigned long flags;
1000 	int ret;
1001 
1002 	/* Set WR ID to find mad_send_wr upon completion */
1003 	qp_info = mad_send_wr->mad_agent_priv->qp_info;
1004 	mad_send_wr->send_wr.wr_id = (unsigned long)&mad_send_wr->mad_list;
1005 	mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
1006 
1007 	mad_agent = mad_send_wr->send_buf.mad_agent;
1008 	sge = mad_send_wr->sg_list;
1009 	sge[0].addr = ib_dma_map_single(mad_agent->device,
1010 					mad_send_wr->send_buf.mad,
1011 					sge[0].length,
1012 					DMA_TO_DEVICE);
1013 	mad_send_wr->header_mapping = sge[0].addr;
1014 
1015 	sge[1].addr = ib_dma_map_single(mad_agent->device,
1016 					ib_get_payload(mad_send_wr),
1017 					sge[1].length,
1018 					DMA_TO_DEVICE);
1019 	mad_send_wr->payload_mapping = sge[1].addr;
1020 
1021 	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
1022 	if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
1023 		ret = ib_post_send(mad_agent->qp, &mad_send_wr->send_wr,
1024 				   &bad_send_wr);
1025 		list = &qp_info->send_queue.list;
1026 	} else {
1027 		ret = 0;
1028 		list = &qp_info->overflow_list;
1029 	}
1030 
1031 	if (!ret) {
1032 		qp_info->send_queue.count++;
1033 		list_add_tail(&mad_send_wr->mad_list.list, list);
1034 	}
1035 	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
1036 	if (ret) {
1037 		ib_dma_unmap_single(mad_agent->device,
1038 				    mad_send_wr->header_mapping,
1039 				    sge[0].length, DMA_TO_DEVICE);
1040 		ib_dma_unmap_single(mad_agent->device,
1041 				    mad_send_wr->payload_mapping,
1042 				    sge[1].length, DMA_TO_DEVICE);
1043 	}
1044 	return ret;
1045 }
1046 
1047 /*
1048  * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
1049  *  with the registered client
1050  */
1051 int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
1052 		     struct ib_mad_send_buf **bad_send_buf)
1053 {
1054 	struct ib_mad_agent_private *mad_agent_priv;
1055 	struct ib_mad_send_buf *next_send_buf;
1056 	struct ib_mad_send_wr_private *mad_send_wr;
1057 	unsigned long flags;
1058 	int ret = -EINVAL;
1059 
1060 	/* Walk list of send WRs and post each on send list */
1061 	for (; send_buf; send_buf = next_send_buf) {
1062 
1063 		mad_send_wr = container_of(send_buf,
1064 					   struct ib_mad_send_wr_private,
1065 					   send_buf);
1066 		mad_agent_priv = mad_send_wr->mad_agent_priv;
1067 
1068 		if (!send_buf->mad_agent->send_handler ||
1069 		    (send_buf->timeout_ms &&
1070 		     !send_buf->mad_agent->recv_handler)) {
1071 			ret = -EINVAL;
1072 			goto error;
1073 		}
1074 
1075 		if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
1076 			if (mad_agent_priv->agent.rmpp_version) {
1077 				ret = -EINVAL;
1078 				goto error;
1079 			}
1080 		}
1081 
1082 		/*
1083 		 * Save pointer to next work request to post in case the
1084 		 * current one completes, and the user modifies the work
1085 		 * request associated with the completion
1086 		 */
1087 		next_send_buf = send_buf->next;
1088 		mad_send_wr->send_wr.wr.ud.ah = send_buf->ah;
1089 
1090 		if (((struct ib_mad_hdr *) send_buf->mad)->mgmt_class ==
1091 		    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1092 			ret = handle_outgoing_dr_smp(mad_agent_priv,
1093 						     mad_send_wr);
1094 			if (ret < 0)		/* error */
1095 				goto error;
1096 			else if (ret == 1)	/* locally consumed */
1097 				continue;
1098 		}
1099 
1100 		mad_send_wr->tid = ((struct ib_mad_hdr *) send_buf->mad)->tid;
1101 		/* Timeout will be updated after send completes */
1102 		mad_send_wr->timeout = msecs_to_jiffies(send_buf->timeout_ms);
1103 		mad_send_wr->max_retries = send_buf->retries;
1104 		mad_send_wr->retries_left = send_buf->retries;
1105 		send_buf->retries = 0;
1106 		/* Reference for work request to QP + response */
1107 		mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
1108 		mad_send_wr->status = IB_WC_SUCCESS;
1109 
1110 		/* Reference MAD agent until send completes */
1111 		atomic_inc(&mad_agent_priv->refcount);
1112 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1113 		list_add_tail(&mad_send_wr->agent_list,
1114 			      &mad_agent_priv->send_list);
1115 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1116 
1117 		if (mad_agent_priv->agent.rmpp_version) {
1118 			ret = ib_send_rmpp_mad(mad_send_wr);
1119 			if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
1120 				ret = ib_send_mad(mad_send_wr);
1121 		} else
1122 			ret = ib_send_mad(mad_send_wr);
1123 		if (ret < 0) {
1124 			/* Fail send request */
1125 			spin_lock_irqsave(&mad_agent_priv->lock, flags);
1126 			list_del(&mad_send_wr->agent_list);
1127 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1128 			atomic_dec(&mad_agent_priv->refcount);
1129 			goto error;
1130 		}
1131 	}
1132 	return 0;
1133 error:
1134 	if (bad_send_buf)
1135 		*bad_send_buf = send_buf;
1136 	return ret;
1137 }
1138 EXPORT_SYMBOL(ib_post_send_mad);
1139 
1140 /*
1141  * ib_free_recv_mad - Returns data buffers used to receive
1142  *  a MAD to the access layer
1143  */
1144 void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
1145 {
1146 	struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
1147 	struct ib_mad_private_header *mad_priv_hdr;
1148 	struct ib_mad_private *priv;
1149 	struct list_head free_list;
1150 
1151 	INIT_LIST_HEAD(&free_list);
1152 	list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
1153 
1154 	list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
1155 					&free_list, list) {
1156 		mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
1157 					   recv_buf);
1158 		mad_priv_hdr = container_of(mad_recv_wc,
1159 					    struct ib_mad_private_header,
1160 					    recv_wc);
1161 		priv = container_of(mad_priv_hdr, struct ib_mad_private,
1162 				    header);
1163 		kmem_cache_free(ib_mad_cache, priv);
1164 	}
1165 }
1166 EXPORT_SYMBOL(ib_free_recv_mad);
1167 
1168 struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
1169 					u8 rmpp_version,
1170 					ib_mad_send_handler send_handler,
1171 					ib_mad_recv_handler recv_handler,
1172 					void *context)
1173 {
1174 	return ERR_PTR(-EINVAL);	/* XXX: for now */
1175 }
1176 EXPORT_SYMBOL(ib_redirect_mad_qp);
1177 
1178 int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
1179 		      struct ib_wc *wc)
1180 {
1181 	printk(KERN_ERR PFX "ib_process_mad_wc() not implemented yet\n");
1182 	return 0;
1183 }
1184 EXPORT_SYMBOL(ib_process_mad_wc);
1185 
1186 static int method_in_use(struct ib_mad_mgmt_method_table **method,
1187 			 struct ib_mad_reg_req *mad_reg_req)
1188 {
1189 	int i;
1190 
1191 	for (i = find_first_bit(mad_reg_req->method_mask, IB_MGMT_MAX_METHODS);
1192 	     i < IB_MGMT_MAX_METHODS;
1193 	     i = find_next_bit(mad_reg_req->method_mask, IB_MGMT_MAX_METHODS,
1194 			       1+i)) {
1195 		if ((*method)->agent[i]) {
1196 			printk(KERN_ERR PFX "Method %d already in use\n", i);
1197 			return -EINVAL;
1198 		}
1199 	}
1200 	return 0;
1201 }
1202 
1203 static int allocate_method_table(struct ib_mad_mgmt_method_table **method)
1204 {
1205 	/* Allocate management method table */
1206 	*method = kzalloc(sizeof **method, GFP_ATOMIC);
1207 	if (!*method) {
1208 		printk(KERN_ERR PFX "No memory for "
1209 		       "ib_mad_mgmt_method_table\n");
1210 		return -ENOMEM;
1211 	}
1212 
1213 	return 0;
1214 }
1215 
1216 /*
1217  * Check to see if there are any methods still in use
1218  */
1219 static int check_method_table(struct ib_mad_mgmt_method_table *method)
1220 {
1221 	int i;
1222 
1223 	for (i = 0; i < IB_MGMT_MAX_METHODS; i++)
1224 		if (method->agent[i])
1225 			return 1;
1226 	return 0;
1227 }
1228 
1229 /*
1230  * Check to see if there are any method tables for this class still in use
1231  */
1232 static int check_class_table(struct ib_mad_mgmt_class_table *class)
1233 {
1234 	int i;
1235 
1236 	for (i = 0; i < MAX_MGMT_CLASS; i++)
1237 		if (class->method_table[i])
1238 			return 1;
1239 	return 0;
1240 }
1241 
1242 static int check_vendor_class(struct ib_mad_mgmt_vendor_class *vendor_class)
1243 {
1244 	int i;
1245 
1246 	for (i = 0; i < MAX_MGMT_OUI; i++)
1247 		if (vendor_class->method_table[i])
1248 			return 1;
1249 	return 0;
1250 }
1251 
1252 static int find_vendor_oui(struct ib_mad_mgmt_vendor_class *vendor_class,
1253 			   char *oui)
1254 {
1255 	int i;
1256 
1257 	for (i = 0; i < MAX_MGMT_OUI; i++)
1258 		/* Is there matching OUI for this vendor class ? */
1259 		if (!memcmp(vendor_class->oui[i], oui, 3))
1260 			return i;
1261 
1262 	return -1;
1263 }
1264 
1265 static int check_vendor_table(struct ib_mad_mgmt_vendor_class_table *vendor)
1266 {
1267 	int i;
1268 
1269 	for (i = 0; i < MAX_MGMT_VENDOR_RANGE2; i++)
1270 		if (vendor->vendor_class[i])
1271 			return 1;
1272 
1273 	return 0;
1274 }
1275 
1276 static void remove_methods_mad_agent(struct ib_mad_mgmt_method_table *method,
1277 				     struct ib_mad_agent_private *agent)
1278 {
1279 	int i;
1280 
1281 	/* Remove any methods for this mad agent */
1282 	for (i = 0; i < IB_MGMT_MAX_METHODS; i++) {
1283 		if (method->agent[i] == agent) {
1284 			method->agent[i] = NULL;
1285 		}
1286 	}
1287 }
1288 
1289 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1290 			      struct ib_mad_agent_private *agent_priv,
1291 			      u8 mgmt_class)
1292 {
1293 	struct ib_mad_port_private *port_priv;
1294 	struct ib_mad_mgmt_class_table **class;
1295 	struct ib_mad_mgmt_method_table **method;
1296 	int i, ret;
1297 
1298 	port_priv = agent_priv->qp_info->port_priv;
1299 	class = &port_priv->version[mad_reg_req->mgmt_class_version].class;
1300 	if (!*class) {
1301 		/* Allocate management class table for "new" class version */
1302 		*class = kzalloc(sizeof **class, GFP_ATOMIC);
1303 		if (!*class) {
1304 			printk(KERN_ERR PFX "No memory for "
1305 			       "ib_mad_mgmt_class_table\n");
1306 			ret = -ENOMEM;
1307 			goto error1;
1308 		}
1309 
1310 		/* Allocate method table for this management class */
1311 		method = &(*class)->method_table[mgmt_class];
1312 		if ((ret = allocate_method_table(method)))
1313 			goto error2;
1314 	} else {
1315 		method = &(*class)->method_table[mgmt_class];
1316 		if (!*method) {
1317 			/* Allocate method table for this management class */
1318 			if ((ret = allocate_method_table(method)))
1319 				goto error1;
1320 		}
1321 	}
1322 
1323 	/* Now, make sure methods are not already in use */
1324 	if (method_in_use(method, mad_reg_req))
1325 		goto error3;
1326 
1327 	/* Finally, add in methods being registered */
1328 	for (i = find_first_bit(mad_reg_req->method_mask,
1329 				IB_MGMT_MAX_METHODS);
1330 	     i < IB_MGMT_MAX_METHODS;
1331 	     i = find_next_bit(mad_reg_req->method_mask, IB_MGMT_MAX_METHODS,
1332 			       1+i)) {
1333 		(*method)->agent[i] = agent_priv;
1334 	}
1335 	return 0;
1336 
1337 error3:
1338 	/* Remove any methods for this mad agent */
1339 	remove_methods_mad_agent(*method, agent_priv);
1340 	/* Now, check to see if there are any methods in use */
1341 	if (!check_method_table(*method)) {
1342 		/* If not, release management method table */
1343 		kfree(*method);
1344 		*method = NULL;
1345 	}
1346 	ret = -EINVAL;
1347 	goto error1;
1348 error2:
1349 	kfree(*class);
1350 	*class = NULL;
1351 error1:
1352 	return ret;
1353 }
1354 
1355 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1356 			   struct ib_mad_agent_private *agent_priv)
1357 {
1358 	struct ib_mad_port_private *port_priv;
1359 	struct ib_mad_mgmt_vendor_class_table **vendor_table;
1360 	struct ib_mad_mgmt_vendor_class_table *vendor = NULL;
1361 	struct ib_mad_mgmt_vendor_class *vendor_class = NULL;
1362 	struct ib_mad_mgmt_method_table **method;
1363 	int i, ret = -ENOMEM;
1364 	u8 vclass;
1365 
1366 	/* "New" vendor (with OUI) class */
1367 	vclass = vendor_class_index(mad_reg_req->mgmt_class);
1368 	port_priv = agent_priv->qp_info->port_priv;
1369 	vendor_table = &port_priv->version[
1370 				mad_reg_req->mgmt_class_version].vendor;
1371 	if (!*vendor_table) {
1372 		/* Allocate mgmt vendor class table for "new" class version */
1373 		vendor = kzalloc(sizeof *vendor, GFP_ATOMIC);
1374 		if (!vendor) {
1375 			printk(KERN_ERR PFX "No memory for "
1376 			       "ib_mad_mgmt_vendor_class_table\n");
1377 			goto error1;
1378 		}
1379 
1380 		*vendor_table = vendor;
1381 	}
1382 	if (!(*vendor_table)->vendor_class[vclass]) {
1383 		/* Allocate table for this management vendor class */
1384 		vendor_class = kzalloc(sizeof *vendor_class, GFP_ATOMIC);
1385 		if (!vendor_class) {
1386 			printk(KERN_ERR PFX "No memory for "
1387 			       "ib_mad_mgmt_vendor_class\n");
1388 			goto error2;
1389 		}
1390 
1391 		(*vendor_table)->vendor_class[vclass] = vendor_class;
1392 	}
1393 	for (i = 0; i < MAX_MGMT_OUI; i++) {
1394 		/* Is there matching OUI for this vendor class ? */
1395 		if (!memcmp((*vendor_table)->vendor_class[vclass]->oui[i],
1396 			    mad_reg_req->oui, 3)) {
1397 			method = &(*vendor_table)->vendor_class[
1398 						vclass]->method_table[i];
1399 			BUG_ON(!*method);
1400 			goto check_in_use;
1401 		}
1402 	}
1403 	for (i = 0; i < MAX_MGMT_OUI; i++) {
1404 		/* OUI slot available ? */
1405 		if (!is_vendor_oui((*vendor_table)->vendor_class[
1406 				vclass]->oui[i])) {
1407 			method = &(*vendor_table)->vendor_class[
1408 				vclass]->method_table[i];
1409 			BUG_ON(*method);
1410 			/* Allocate method table for this OUI */
1411 			if ((ret = allocate_method_table(method)))
1412 				goto error3;
1413 			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
1414 			       mad_reg_req->oui, 3);
1415 			goto check_in_use;
1416 		}
1417 	}
1418 	printk(KERN_ERR PFX "All OUI slots in use\n");
1419 	goto error3;
1420 
1421 check_in_use:
1422 	/* Now, make sure methods are not already in use */
1423 	if (method_in_use(method, mad_reg_req))
1424 		goto error4;
1425 
1426 	/* Finally, add in methods being registered */
1427 	for (i = find_first_bit(mad_reg_req->method_mask,
1428 				IB_MGMT_MAX_METHODS);
1429 	     i < IB_MGMT_MAX_METHODS;
1430 	     i = find_next_bit(mad_reg_req->method_mask, IB_MGMT_MAX_METHODS,
1431 			       1+i)) {
1432 		(*method)->agent[i] = agent_priv;
1433 	}
1434 	return 0;
1435 
1436 error4:
1437 	/* Remove any methods for this mad agent */
1438 	remove_methods_mad_agent(*method, agent_priv);
1439 	/* Now, check to see if there are any methods in use */
1440 	if (!check_method_table(*method)) {
1441 		/* If not, release management method table */
1442 		kfree(*method);
1443 		*method = NULL;
1444 	}
1445 	ret = -EINVAL;
1446 error3:
1447 	if (vendor_class) {
1448 		(*vendor_table)->vendor_class[vclass] = NULL;
1449 		kfree(vendor_class);
1450 	}
1451 error2:
1452 	if (vendor) {
1453 		*vendor_table = NULL;
1454 		kfree(vendor);
1455 	}
1456 error1:
1457 	return ret;
1458 }
1459 
1460 static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
1461 {
1462 	struct ib_mad_port_private *port_priv;
1463 	struct ib_mad_mgmt_class_table *class;
1464 	struct ib_mad_mgmt_method_table *method;
1465 	struct ib_mad_mgmt_vendor_class_table *vendor;
1466 	struct ib_mad_mgmt_vendor_class *vendor_class;
1467 	int index;
1468 	u8 mgmt_class;
1469 
1470 	/*
1471 	 * Was MAD registration request supplied
1472 	 * with original registration ?
1473 	 */
1474 	if (!agent_priv->reg_req) {
1475 		goto out;
1476 	}
1477 
1478 	port_priv = agent_priv->qp_info->port_priv;
1479 	mgmt_class = convert_mgmt_class(agent_priv->reg_req->mgmt_class);
1480 	class = port_priv->version[
1481 			agent_priv->reg_req->mgmt_class_version].class;
1482 	if (!class)
1483 		goto vendor_check;
1484 
1485 	method = class->method_table[mgmt_class];
1486 	if (method) {
1487 		/* Remove any methods for this mad agent */
1488 		remove_methods_mad_agent(method, agent_priv);
1489 		/* Now, check to see if there are any methods still in use */
1490 		if (!check_method_table(method)) {
1491 			/* If not, release management method table */
1492 			 kfree(method);
1493 			 class->method_table[mgmt_class] = NULL;
1494 			 /* Any management classes left ? */
1495 			if (!check_class_table(class)) {
1496 				/* If not, release management class table */
1497 				kfree(class);
1498 				port_priv->version[
1499 					agent_priv->reg_req->
1500 					mgmt_class_version].class = NULL;
1501 			}
1502 		}
1503 	}
1504 
1505 vendor_check:
1506 	if (!is_vendor_class(mgmt_class))
1507 		goto out;
1508 
1509 	/* normalize mgmt_class to vendor range 2 */
1510 	mgmt_class = vendor_class_index(agent_priv->reg_req->mgmt_class);
1511 	vendor = port_priv->version[
1512 			agent_priv->reg_req->mgmt_class_version].vendor;
1513 
1514 	if (!vendor)
1515 		goto out;
1516 
1517 	vendor_class = vendor->vendor_class[mgmt_class];
1518 	if (vendor_class) {
1519 		index = find_vendor_oui(vendor_class, agent_priv->reg_req->oui);
1520 		if (index < 0)
1521 			goto out;
1522 		method = vendor_class->method_table[index];
1523 		if (method) {
1524 			/* Remove any methods for this mad agent */
1525 			remove_methods_mad_agent(method, agent_priv);
1526 			/*
1527 			 * Now, check to see if there are
1528 			 * any methods still in use
1529 			 */
1530 			if (!check_method_table(method)) {
1531 				/* If not, release management method table */
1532 				kfree(method);
1533 				vendor_class->method_table[index] = NULL;
1534 				memset(vendor_class->oui[index], 0, 3);
1535 				/* Any OUIs left ? */
1536 				if (!check_vendor_class(vendor_class)) {
1537 					/* If not, release vendor class table */
1538 					kfree(vendor_class);
1539 					vendor->vendor_class[mgmt_class] = NULL;
1540 					/* Any other vendor classes left ? */
1541 					if (!check_vendor_table(vendor)) {
1542 						kfree(vendor);
1543 						port_priv->version[
1544 							agent_priv->reg_req->
1545 							mgmt_class_version].
1546 							vendor = NULL;
1547 					}
1548 				}
1549 			}
1550 		}
1551 	}
1552 
1553 out:
1554 	return;
1555 }
1556 
1557 static struct ib_mad_agent_private *
1558 find_mad_agent(struct ib_mad_port_private *port_priv,
1559 	       struct ib_mad *mad)
1560 {
1561 	struct ib_mad_agent_private *mad_agent = NULL;
1562 	unsigned long flags;
1563 
1564 	spin_lock_irqsave(&port_priv->reg_lock, flags);
1565 	if (ib_response_mad(mad)) {
1566 		u32 hi_tid;
1567 		struct ib_mad_agent_private *entry;
1568 
1569 		/*
1570 		 * Routing is based on high 32 bits of transaction ID
1571 		 * of MAD.
1572 		 */
1573 		hi_tid = be64_to_cpu(mad->mad_hdr.tid) >> 32;
1574 		list_for_each_entry(entry, &port_priv->agent_list, agent_list) {
1575 			if (entry->agent.hi_tid == hi_tid) {
1576 				mad_agent = entry;
1577 				break;
1578 			}
1579 		}
1580 	} else {
1581 		struct ib_mad_mgmt_class_table *class;
1582 		struct ib_mad_mgmt_method_table *method;
1583 		struct ib_mad_mgmt_vendor_class_table *vendor;
1584 		struct ib_mad_mgmt_vendor_class *vendor_class;
1585 		struct ib_vendor_mad *vendor_mad;
1586 		int index;
1587 
1588 		/*
1589 		 * Routing is based on version, class, and method
1590 		 * For "newer" vendor MADs, also based on OUI
1591 		 */
1592 		if (mad->mad_hdr.class_version >= MAX_MGMT_VERSION)
1593 			goto out;
1594 		if (!is_vendor_class(mad->mad_hdr.mgmt_class)) {
1595 			class = port_priv->version[
1596 					mad->mad_hdr.class_version].class;
1597 			if (!class)
1598 				goto out;
1599 			method = class->method_table[convert_mgmt_class(
1600 							mad->mad_hdr.mgmt_class)];
1601 			if (method)
1602 				mad_agent = method->agent[mad->mad_hdr.method &
1603 							  ~IB_MGMT_METHOD_RESP];
1604 		} else {
1605 			vendor = port_priv->version[
1606 					mad->mad_hdr.class_version].vendor;
1607 			if (!vendor)
1608 				goto out;
1609 			vendor_class = vendor->vendor_class[vendor_class_index(
1610 						mad->mad_hdr.mgmt_class)];
1611 			if (!vendor_class)
1612 				goto out;
1613 			/* Find matching OUI */
1614 			vendor_mad = (struct ib_vendor_mad *)mad;
1615 			index = find_vendor_oui(vendor_class, vendor_mad->oui);
1616 			if (index == -1)
1617 				goto out;
1618 			method = vendor_class->method_table[index];
1619 			if (method) {
1620 				mad_agent = method->agent[mad->mad_hdr.method &
1621 							  ~IB_MGMT_METHOD_RESP];
1622 			}
1623 		}
1624 	}
1625 
1626 	if (mad_agent) {
1627 		if (mad_agent->agent.recv_handler)
1628 			atomic_inc(&mad_agent->refcount);
1629 		else {
1630 			printk(KERN_NOTICE PFX "No receive handler for client "
1631 			       "%p on port %d\n",
1632 			       &mad_agent->agent, port_priv->port_num);
1633 			mad_agent = NULL;
1634 		}
1635 	}
1636 out:
1637 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
1638 
1639 	return mad_agent;
1640 }
1641 
1642 static int validate_mad(struct ib_mad *mad, u32 qp_num)
1643 {
1644 	int valid = 0;
1645 
1646 	/* Make sure MAD base version is understood */
1647 	if (mad->mad_hdr.base_version != IB_MGMT_BASE_VERSION) {
1648 		printk(KERN_ERR PFX "MAD received with unsupported base "
1649 		       "version %d\n", mad->mad_hdr.base_version);
1650 		goto out;
1651 	}
1652 
1653 	/* Filter SMI packets sent to other than QP0 */
1654 	if ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
1655 	    (mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
1656 		if (qp_num == 0)
1657 			valid = 1;
1658 	} else {
1659 		/* Filter GSI packets sent to QP0 */
1660 		if (qp_num != 0)
1661 			valid = 1;
1662 	}
1663 
1664 out:
1665 	return valid;
1666 }
1667 
1668 static int is_data_mad(struct ib_mad_agent_private *mad_agent_priv,
1669 		       struct ib_mad_hdr *mad_hdr)
1670 {
1671 	struct ib_rmpp_mad *rmpp_mad;
1672 
1673 	rmpp_mad = (struct ib_rmpp_mad *)mad_hdr;
1674 	return !mad_agent_priv->agent.rmpp_version ||
1675 		!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
1676 				    IB_MGMT_RMPP_FLAG_ACTIVE) ||
1677 		(rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
1678 }
1679 
1680 static inline int rcv_has_same_class(struct ib_mad_send_wr_private *wr,
1681 				     struct ib_mad_recv_wc *rwc)
1682 {
1683 	return ((struct ib_mad *)(wr->send_buf.mad))->mad_hdr.mgmt_class ==
1684 		rwc->recv_buf.mad->mad_hdr.mgmt_class;
1685 }
1686 
1687 static inline int rcv_has_same_gid(struct ib_mad_agent_private *mad_agent_priv,
1688 				   struct ib_mad_send_wr_private *wr,
1689 				   struct ib_mad_recv_wc *rwc )
1690 {
1691 	struct ib_ah_attr attr;
1692 	u8 send_resp, rcv_resp;
1693 	union ib_gid sgid;
1694 	struct ib_device *device = mad_agent_priv->agent.device;
1695 	u8 port_num = mad_agent_priv->agent.port_num;
1696 	u8 lmc;
1697 
1698 	send_resp = ((struct ib_mad *)(wr->send_buf.mad))->
1699 		     mad_hdr.method & IB_MGMT_METHOD_RESP;
1700 	rcv_resp = rwc->recv_buf.mad->mad_hdr.method & IB_MGMT_METHOD_RESP;
1701 
1702 	if (send_resp == rcv_resp)
1703 		/* both requests, or both responses. GIDs different */
1704 		return 0;
1705 
1706 	if (ib_query_ah(wr->send_buf.ah, &attr))
1707 		/* Assume not equal, to avoid false positives. */
1708 		return 0;
1709 
1710 	if (!!(attr.ah_flags & IB_AH_GRH) !=
1711 	    !!(rwc->wc->wc_flags & IB_WC_GRH))
1712 		/* one has GID, other does not.  Assume different */
1713 		return 0;
1714 
1715 	if (!send_resp && rcv_resp) {
1716 		/* is request/response. */
1717 		if (!(attr.ah_flags & IB_AH_GRH)) {
1718 			if (ib_get_cached_lmc(device, port_num, &lmc))
1719 				return 0;
1720 			return (!lmc || !((attr.src_path_bits ^
1721 					   rwc->wc->dlid_path_bits) &
1722 					  ((1 << lmc) - 1)));
1723 		} else {
1724 			if (ib_get_cached_gid(device, port_num,
1725 					      attr.grh.sgid_index, &sgid))
1726 				return 0;
1727 			return !memcmp(sgid.raw, rwc->recv_buf.grh->dgid.raw,
1728 				       16);
1729 		}
1730 	}
1731 
1732 	if (!(attr.ah_flags & IB_AH_GRH))
1733 		return attr.dlid == rwc->wc->slid;
1734 	else
1735 		return !memcmp(attr.grh.dgid.raw, rwc->recv_buf.grh->sgid.raw,
1736 			       16);
1737 }
1738 
1739 static inline int is_direct(u8 class)
1740 {
1741 	return (class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE);
1742 }
1743 
1744 struct ib_mad_send_wr_private*
1745 ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
1746 		 struct ib_mad_recv_wc *wc)
1747 {
1748 	struct ib_mad_send_wr_private *wr;
1749 	struct ib_mad *mad;
1750 
1751 	mad = (struct ib_mad *)wc->recv_buf.mad;
1752 
1753 	list_for_each_entry(wr, &mad_agent_priv->wait_list, agent_list) {
1754 		if ((wr->tid == mad->mad_hdr.tid) &&
1755 		    rcv_has_same_class(wr, wc) &&
1756 		    /*
1757 		     * Don't check GID for direct routed MADs.
1758 		     * These might have permissive LIDs.
1759 		     */
1760 		    (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
1761 		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1762 			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1763 	}
1764 
1765 	/*
1766 	 * It's possible to receive the response before we've
1767 	 * been notified that the send has completed
1768 	 */
1769 	list_for_each_entry(wr, &mad_agent_priv->send_list, agent_list) {
1770 		if (is_data_mad(mad_agent_priv, wr->send_buf.mad) &&
1771 		    wr->tid == mad->mad_hdr.tid &&
1772 		    wr->timeout &&
1773 		    rcv_has_same_class(wr, wc) &&
1774 		    /*
1775 		     * Don't check GID for direct routed MADs.
1776 		     * These might have permissive LIDs.
1777 		     */
1778 		    (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
1779 		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1780 			/* Verify request has not been canceled */
1781 			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1782 	}
1783 	return NULL;
1784 }
1785 
1786 void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
1787 {
1788 	mad_send_wr->timeout = 0;
1789 	if (mad_send_wr->refcount == 1)
1790 		list_move_tail(&mad_send_wr->agent_list,
1791 			      &mad_send_wr->mad_agent_priv->done_list);
1792 }
1793 
1794 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
1795 				 struct ib_mad_recv_wc *mad_recv_wc)
1796 {
1797 	struct ib_mad_send_wr_private *mad_send_wr;
1798 	struct ib_mad_send_wc mad_send_wc;
1799 	unsigned long flags;
1800 
1801 	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
1802 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
1803 	if (mad_agent_priv->agent.rmpp_version) {
1804 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
1805 						      mad_recv_wc);
1806 		if (!mad_recv_wc) {
1807 			deref_mad_agent(mad_agent_priv);
1808 			return;
1809 		}
1810 	}
1811 
1812 	/* Complete corresponding request */
1813 	if (ib_response_mad(mad_recv_wc->recv_buf.mad)) {
1814 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1815 		mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
1816 		if (!mad_send_wr) {
1817 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1818 			ib_free_recv_mad(mad_recv_wc);
1819 			deref_mad_agent(mad_agent_priv);
1820 			return;
1821 		}
1822 		ib_mark_mad_done(mad_send_wr);
1823 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1824 
1825 		/* Defined behavior is to complete response before request */
1826 		mad_recv_wc->wc->wr_id = (unsigned long) &mad_send_wr->send_buf;
1827 		mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1828 						   mad_recv_wc);
1829 		atomic_dec(&mad_agent_priv->refcount);
1830 
1831 		mad_send_wc.status = IB_WC_SUCCESS;
1832 		mad_send_wc.vendor_err = 0;
1833 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
1834 		ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
1835 	} else {
1836 		mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1837 						   mad_recv_wc);
1838 		deref_mad_agent(mad_agent_priv);
1839 	}
1840 }
1841 
1842 static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
1843 				     struct ib_wc *wc)
1844 {
1845 	struct ib_mad_qp_info *qp_info;
1846 	struct ib_mad_private_header *mad_priv_hdr;
1847 	struct ib_mad_private *recv, *response = NULL;
1848 	struct ib_mad_list_head *mad_list;
1849 	struct ib_mad_agent_private *mad_agent;
1850 	int port_num;
1851 
1852 	mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
1853 	qp_info = mad_list->mad_queue->qp_info;
1854 	dequeue_mad(mad_list);
1855 
1856 	mad_priv_hdr = container_of(mad_list, struct ib_mad_private_header,
1857 				    mad_list);
1858 	recv = container_of(mad_priv_hdr, struct ib_mad_private, header);
1859 	ib_dma_unmap_single(port_priv->device,
1860 			    recv->header.mapping,
1861 			    sizeof(struct ib_mad_private) -
1862 			      sizeof(struct ib_mad_private_header),
1863 			    DMA_FROM_DEVICE);
1864 
1865 	/* Setup MAD receive work completion from "normal" work completion */
1866 	recv->header.wc = *wc;
1867 	recv->header.recv_wc.wc = &recv->header.wc;
1868 	recv->header.recv_wc.mad_len = sizeof(struct ib_mad);
1869 	recv->header.recv_wc.recv_buf.mad = &recv->mad.mad;
1870 	recv->header.recv_wc.recv_buf.grh = &recv->grh;
1871 
1872 	if (atomic_read(&qp_info->snoop_count))
1873 		snoop_recv(qp_info, &recv->header.recv_wc, IB_MAD_SNOOP_RECVS);
1874 
1875 	/* Validate MAD */
1876 	if (!validate_mad(&recv->mad.mad, qp_info->qp->qp_num))
1877 		goto out;
1878 
1879 	response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
1880 	if (!response) {
1881 		printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "
1882 		       "for response buffer\n");
1883 		goto out;
1884 	}
1885 
1886 	if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
1887 		port_num = wc->port_num;
1888 	else
1889 		port_num = port_priv->port_num;
1890 
1891 	if (recv->mad.mad.mad_hdr.mgmt_class ==
1892 	    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1893 		enum smi_forward_action retsmi;
1894 
1895 		if (smi_handle_dr_smp_recv(&recv->mad.smp,
1896 					   port_priv->device->node_type,
1897 					   port_num,
1898 					   port_priv->device->phys_port_cnt) ==
1899 					   IB_SMI_DISCARD)
1900 			goto out;
1901 
1902 		retsmi = smi_check_forward_dr_smp(&recv->mad.smp);
1903 		if (retsmi == IB_SMI_LOCAL)
1904 			goto local;
1905 
1906 		if (retsmi == IB_SMI_SEND) { /* don't forward */
1907 			if (smi_handle_dr_smp_send(&recv->mad.smp,
1908 						   port_priv->device->node_type,
1909 						   port_num) == IB_SMI_DISCARD)
1910 				goto out;
1911 
1912 			if (smi_check_local_smp(&recv->mad.smp, port_priv->device) == IB_SMI_DISCARD)
1913 				goto out;
1914 		} else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
1915 			/* forward case for switches */
1916 			memcpy(response, recv, sizeof(*response));
1917 			response->header.recv_wc.wc = &response->header.wc;
1918 			response->header.recv_wc.recv_buf.mad = &response->mad.mad;
1919 			response->header.recv_wc.recv_buf.grh = &response->grh;
1920 
1921 			agent_send_response(&response->mad.mad,
1922 					    &response->grh, wc,
1923 					    port_priv->device,
1924 					    smi_get_fwd_port(&recv->mad.smp),
1925 					    qp_info->qp->qp_num);
1926 
1927 			goto out;
1928 		}
1929 	}
1930 
1931 local:
1932 	/* Give driver "right of first refusal" on incoming MAD */
1933 	if (port_priv->device->process_mad) {
1934 		int ret;
1935 
1936 		ret = port_priv->device->process_mad(port_priv->device, 0,
1937 						     port_priv->port_num,
1938 						     wc, &recv->grh,
1939 						     &recv->mad.mad,
1940 						     &response->mad.mad);
1941 		if (ret & IB_MAD_RESULT_SUCCESS) {
1942 			if (ret & IB_MAD_RESULT_CONSUMED)
1943 				goto out;
1944 			if (ret & IB_MAD_RESULT_REPLY) {
1945 				agent_send_response(&response->mad.mad,
1946 						    &recv->grh, wc,
1947 						    port_priv->device,
1948 						    port_num,
1949 						    qp_info->qp->qp_num);
1950 				goto out;
1951 			}
1952 		}
1953 	}
1954 
1955 	mad_agent = find_mad_agent(port_priv, &recv->mad.mad);
1956 	if (mad_agent) {
1957 		ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
1958 		/*
1959 		 * recv is freed up in error cases in ib_mad_complete_recv
1960 		 * or via recv_handler in ib_mad_complete_recv()
1961 		 */
1962 		recv = NULL;
1963 	}
1964 
1965 out:
1966 	/* Post another receive request for this QP */
1967 	if (response) {
1968 		ib_mad_post_receive_mads(qp_info, response);
1969 		if (recv)
1970 			kmem_cache_free(ib_mad_cache, recv);
1971 	} else
1972 		ib_mad_post_receive_mads(qp_info, recv);
1973 }
1974 
1975 static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
1976 {
1977 	struct ib_mad_send_wr_private *mad_send_wr;
1978 	unsigned long delay;
1979 
1980 	if (list_empty(&mad_agent_priv->wait_list)) {
1981 		cancel_delayed_work(&mad_agent_priv->timed_work);
1982 	} else {
1983 		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
1984 					 struct ib_mad_send_wr_private,
1985 					 agent_list);
1986 
1987 		if (time_after(mad_agent_priv->timeout,
1988 			       mad_send_wr->timeout)) {
1989 			mad_agent_priv->timeout = mad_send_wr->timeout;
1990 			cancel_delayed_work(&mad_agent_priv->timed_work);
1991 			delay = mad_send_wr->timeout - jiffies;
1992 			if ((long)delay <= 0)
1993 				delay = 1;
1994 			queue_delayed_work(mad_agent_priv->qp_info->
1995 					   port_priv->wq,
1996 					   &mad_agent_priv->timed_work, delay);
1997 		}
1998 	}
1999 }
2000 
2001 static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
2002 {
2003 	struct ib_mad_agent_private *mad_agent_priv;
2004 	struct ib_mad_send_wr_private *temp_mad_send_wr;
2005 	struct list_head *list_item;
2006 	unsigned long delay;
2007 
2008 	mad_agent_priv = mad_send_wr->mad_agent_priv;
2009 	list_del(&mad_send_wr->agent_list);
2010 
2011 	delay = mad_send_wr->timeout;
2012 	mad_send_wr->timeout += jiffies;
2013 
2014 	if (delay) {
2015 		list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
2016 			temp_mad_send_wr = list_entry(list_item,
2017 						struct ib_mad_send_wr_private,
2018 						agent_list);
2019 			if (time_after(mad_send_wr->timeout,
2020 				       temp_mad_send_wr->timeout))
2021 				break;
2022 		}
2023 	}
2024 	else
2025 		list_item = &mad_agent_priv->wait_list;
2026 	list_add(&mad_send_wr->agent_list, list_item);
2027 
2028 	/* Reschedule a work item if we have a shorter timeout */
2029 	if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list) {
2030 		cancel_delayed_work(&mad_agent_priv->timed_work);
2031 		queue_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2032 				   &mad_agent_priv->timed_work, delay);
2033 	}
2034 }
2035 
2036 void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
2037 			  int timeout_ms)
2038 {
2039 	mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2040 	wait_for_response(mad_send_wr);
2041 }
2042 
2043 /*
2044  * Process a send work completion
2045  */
2046 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
2047 			     struct ib_mad_send_wc *mad_send_wc)
2048 {
2049 	struct ib_mad_agent_private	*mad_agent_priv;
2050 	unsigned long			flags;
2051 	int				ret;
2052 
2053 	mad_agent_priv = mad_send_wr->mad_agent_priv;
2054 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2055 	if (mad_agent_priv->agent.rmpp_version) {
2056 		ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
2057 		if (ret == IB_RMPP_RESULT_CONSUMED)
2058 			goto done;
2059 	} else
2060 		ret = IB_RMPP_RESULT_UNHANDLED;
2061 
2062 	if (mad_send_wc->status != IB_WC_SUCCESS &&
2063 	    mad_send_wr->status == IB_WC_SUCCESS) {
2064 		mad_send_wr->status = mad_send_wc->status;
2065 		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2066 	}
2067 
2068 	if (--mad_send_wr->refcount > 0) {
2069 		if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
2070 		    mad_send_wr->status == IB_WC_SUCCESS) {
2071 			wait_for_response(mad_send_wr);
2072 		}
2073 		goto done;
2074 	}
2075 
2076 	/* Remove send from MAD agent and notify client of completion */
2077 	list_del(&mad_send_wr->agent_list);
2078 	adjust_timeout(mad_agent_priv);
2079 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2080 
2081 	if (mad_send_wr->status != IB_WC_SUCCESS )
2082 		mad_send_wc->status = mad_send_wr->status;
2083 	if (ret == IB_RMPP_RESULT_INTERNAL)
2084 		ib_rmpp_send_handler(mad_send_wc);
2085 	else
2086 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2087 						   mad_send_wc);
2088 
2089 	/* Release reference on agent taken when sending */
2090 	deref_mad_agent(mad_agent_priv);
2091 	return;
2092 done:
2093 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2094 }
2095 
2096 static void ib_mad_send_done_handler(struct ib_mad_port_private *port_priv,
2097 				     struct ib_wc *wc)
2098 {
2099 	struct ib_mad_send_wr_private	*mad_send_wr, *queued_send_wr;
2100 	struct ib_mad_list_head		*mad_list;
2101 	struct ib_mad_qp_info		*qp_info;
2102 	struct ib_mad_queue		*send_queue;
2103 	struct ib_send_wr		*bad_send_wr;
2104 	struct ib_mad_send_wc		mad_send_wc;
2105 	unsigned long flags;
2106 	int ret;
2107 
2108 	mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2109 	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2110 				   mad_list);
2111 	send_queue = mad_list->mad_queue;
2112 	qp_info = send_queue->qp_info;
2113 
2114 retry:
2115 	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2116 			    mad_send_wr->header_mapping,
2117 			    mad_send_wr->sg_list[0].length, DMA_TO_DEVICE);
2118 	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2119 			    mad_send_wr->payload_mapping,
2120 			    mad_send_wr->sg_list[1].length, DMA_TO_DEVICE);
2121 	queued_send_wr = NULL;
2122 	spin_lock_irqsave(&send_queue->lock, flags);
2123 	list_del(&mad_list->list);
2124 
2125 	/* Move queued send to the send queue */
2126 	if (send_queue->count-- > send_queue->max_active) {
2127 		mad_list = container_of(qp_info->overflow_list.next,
2128 					struct ib_mad_list_head, list);
2129 		queued_send_wr = container_of(mad_list,
2130 					struct ib_mad_send_wr_private,
2131 					mad_list);
2132 		list_move_tail(&mad_list->list, &send_queue->list);
2133 	}
2134 	spin_unlock_irqrestore(&send_queue->lock, flags);
2135 
2136 	mad_send_wc.send_buf = &mad_send_wr->send_buf;
2137 	mad_send_wc.status = wc->status;
2138 	mad_send_wc.vendor_err = wc->vendor_err;
2139 	if (atomic_read(&qp_info->snoop_count))
2140 		snoop_send(qp_info, &mad_send_wr->send_buf, &mad_send_wc,
2141 			   IB_MAD_SNOOP_SEND_COMPLETIONS);
2142 	ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2143 
2144 	if (queued_send_wr) {
2145 		ret = ib_post_send(qp_info->qp, &queued_send_wr->send_wr,
2146 				   &bad_send_wr);
2147 		if (ret) {
2148 			printk(KERN_ERR PFX "ib_post_send failed: %d\n", ret);
2149 			mad_send_wr = queued_send_wr;
2150 			wc->status = IB_WC_LOC_QP_OP_ERR;
2151 			goto retry;
2152 		}
2153 	}
2154 }
2155 
2156 static void mark_sends_for_retry(struct ib_mad_qp_info *qp_info)
2157 {
2158 	struct ib_mad_send_wr_private *mad_send_wr;
2159 	struct ib_mad_list_head *mad_list;
2160 	unsigned long flags;
2161 
2162 	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
2163 	list_for_each_entry(mad_list, &qp_info->send_queue.list, list) {
2164 		mad_send_wr = container_of(mad_list,
2165 					   struct ib_mad_send_wr_private,
2166 					   mad_list);
2167 		mad_send_wr->retry = 1;
2168 	}
2169 	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
2170 }
2171 
2172 static void mad_error_handler(struct ib_mad_port_private *port_priv,
2173 			      struct ib_wc *wc)
2174 {
2175 	struct ib_mad_list_head *mad_list;
2176 	struct ib_mad_qp_info *qp_info;
2177 	struct ib_mad_send_wr_private *mad_send_wr;
2178 	int ret;
2179 
2180 	/* Determine if failure was a send or receive */
2181 	mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2182 	qp_info = mad_list->mad_queue->qp_info;
2183 	if (mad_list->mad_queue == &qp_info->recv_queue)
2184 		/*
2185 		 * Receive errors indicate that the QP has entered the error
2186 		 * state - error handling/shutdown code will cleanup
2187 		 */
2188 		return;
2189 
2190 	/*
2191 	 * Send errors will transition the QP to SQE - move
2192 	 * QP to RTS and repost flushed work requests
2193 	 */
2194 	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2195 				   mad_list);
2196 	if (wc->status == IB_WC_WR_FLUSH_ERR) {
2197 		if (mad_send_wr->retry) {
2198 			/* Repost send */
2199 			struct ib_send_wr *bad_send_wr;
2200 
2201 			mad_send_wr->retry = 0;
2202 			ret = ib_post_send(qp_info->qp, &mad_send_wr->send_wr,
2203 					&bad_send_wr);
2204 			if (ret)
2205 				ib_mad_send_done_handler(port_priv, wc);
2206 		} else
2207 			ib_mad_send_done_handler(port_priv, wc);
2208 	} else {
2209 		struct ib_qp_attr *attr;
2210 
2211 		/* Transition QP to RTS and fail offending send */
2212 		attr = kmalloc(sizeof *attr, GFP_KERNEL);
2213 		if (attr) {
2214 			attr->qp_state = IB_QPS_RTS;
2215 			attr->cur_qp_state = IB_QPS_SQE;
2216 			ret = ib_modify_qp(qp_info->qp, attr,
2217 					   IB_QP_STATE | IB_QP_CUR_STATE);
2218 			kfree(attr);
2219 			if (ret)
2220 				printk(KERN_ERR PFX "mad_error_handler - "
2221 				       "ib_modify_qp to RTS : %d\n", ret);
2222 			else
2223 				mark_sends_for_retry(qp_info);
2224 		}
2225 		ib_mad_send_done_handler(port_priv, wc);
2226 	}
2227 }
2228 
2229 /*
2230  * IB MAD completion callback
2231  */
2232 static void ib_mad_completion_handler(struct work_struct *work)
2233 {
2234 	struct ib_mad_port_private *port_priv;
2235 	struct ib_wc wc;
2236 
2237 	port_priv = container_of(work, struct ib_mad_port_private, work);
2238 	ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
2239 
2240 	while (ib_poll_cq(port_priv->cq, 1, &wc) == 1) {
2241 		if (wc.status == IB_WC_SUCCESS) {
2242 			switch (wc.opcode) {
2243 			case IB_WC_SEND:
2244 				ib_mad_send_done_handler(port_priv, &wc);
2245 				break;
2246 			case IB_WC_RECV:
2247 				ib_mad_recv_done_handler(port_priv, &wc);
2248 				break;
2249 			default:
2250 				BUG_ON(1);
2251 				break;
2252 			}
2253 		} else
2254 			mad_error_handler(port_priv, &wc);
2255 	}
2256 }
2257 
2258 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
2259 {
2260 	unsigned long flags;
2261 	struct ib_mad_send_wr_private *mad_send_wr, *temp_mad_send_wr;
2262 	struct ib_mad_send_wc mad_send_wc;
2263 	struct list_head cancel_list;
2264 
2265 	INIT_LIST_HEAD(&cancel_list);
2266 
2267 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2268 	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2269 				 &mad_agent_priv->send_list, agent_list) {
2270 		if (mad_send_wr->status == IB_WC_SUCCESS) {
2271 			mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2272 			mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2273 		}
2274 	}
2275 
2276 	/* Empty wait list to prevent receives from finding a request */
2277 	list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
2278 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2279 
2280 	/* Report all cancelled requests */
2281 	mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
2282 	mad_send_wc.vendor_err = 0;
2283 
2284 	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2285 				 &cancel_list, agent_list) {
2286 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2287 		list_del(&mad_send_wr->agent_list);
2288 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2289 						   &mad_send_wc);
2290 		atomic_dec(&mad_agent_priv->refcount);
2291 	}
2292 }
2293 
2294 static struct ib_mad_send_wr_private*
2295 find_send_wr(struct ib_mad_agent_private *mad_agent_priv,
2296 	     struct ib_mad_send_buf *send_buf)
2297 {
2298 	struct ib_mad_send_wr_private *mad_send_wr;
2299 
2300 	list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
2301 			    agent_list) {
2302 		if (&mad_send_wr->send_buf == send_buf)
2303 			return mad_send_wr;
2304 	}
2305 
2306 	list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
2307 			    agent_list) {
2308 		if (is_data_mad(mad_agent_priv, mad_send_wr->send_buf.mad) &&
2309 		    &mad_send_wr->send_buf == send_buf)
2310 			return mad_send_wr;
2311 	}
2312 	return NULL;
2313 }
2314 
2315 int ib_modify_mad(struct ib_mad_agent *mad_agent,
2316 		  struct ib_mad_send_buf *send_buf, u32 timeout_ms)
2317 {
2318 	struct ib_mad_agent_private *mad_agent_priv;
2319 	struct ib_mad_send_wr_private *mad_send_wr;
2320 	unsigned long flags;
2321 	int active;
2322 
2323 	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
2324 				      agent);
2325 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2326 	mad_send_wr = find_send_wr(mad_agent_priv, send_buf);
2327 	if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
2328 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2329 		return -EINVAL;
2330 	}
2331 
2332 	active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
2333 	if (!timeout_ms) {
2334 		mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2335 		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2336 	}
2337 
2338 	mad_send_wr->send_buf.timeout_ms = timeout_ms;
2339 	if (active)
2340 		mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2341 	else
2342 		ib_reset_mad_timeout(mad_send_wr, timeout_ms);
2343 
2344 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2345 	return 0;
2346 }
2347 EXPORT_SYMBOL(ib_modify_mad);
2348 
2349 void ib_cancel_mad(struct ib_mad_agent *mad_agent,
2350 		   struct ib_mad_send_buf *send_buf)
2351 {
2352 	ib_modify_mad(mad_agent, send_buf, 0);
2353 }
2354 EXPORT_SYMBOL(ib_cancel_mad);
2355 
2356 static void local_completions(struct work_struct *work)
2357 {
2358 	struct ib_mad_agent_private *mad_agent_priv;
2359 	struct ib_mad_local_private *local;
2360 	struct ib_mad_agent_private *recv_mad_agent;
2361 	unsigned long flags;
2362 	int recv = 0;
2363 	struct ib_wc wc;
2364 	struct ib_mad_send_wc mad_send_wc;
2365 
2366 	mad_agent_priv =
2367 		container_of(work, struct ib_mad_agent_private, local_work);
2368 
2369 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2370 	while (!list_empty(&mad_agent_priv->local_list)) {
2371 		local = list_entry(mad_agent_priv->local_list.next,
2372 				   struct ib_mad_local_private,
2373 				   completion_list);
2374 		list_del(&local->completion_list);
2375 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2376 		if (local->mad_priv) {
2377 			recv_mad_agent = local->recv_mad_agent;
2378 			if (!recv_mad_agent) {
2379 				printk(KERN_ERR PFX "No receive MAD agent for local completion\n");
2380 				goto local_send_completion;
2381 			}
2382 
2383 			recv = 1;
2384 			/*
2385 			 * Defined behavior is to complete response
2386 			 * before request
2387 			 */
2388 			build_smp_wc(recv_mad_agent->agent.qp,
2389 				     (unsigned long) local->mad_send_wr,
2390 				     be16_to_cpu(IB_LID_PERMISSIVE),
2391 				     0, recv_mad_agent->agent.port_num, &wc);
2392 
2393 			local->mad_priv->header.recv_wc.wc = &wc;
2394 			local->mad_priv->header.recv_wc.mad_len =
2395 						sizeof(struct ib_mad);
2396 			INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
2397 			list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
2398 				 &local->mad_priv->header.recv_wc.rmpp_list);
2399 			local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
2400 			local->mad_priv->header.recv_wc.recv_buf.mad =
2401 						&local->mad_priv->mad.mad;
2402 			if (atomic_read(&recv_mad_agent->qp_info->snoop_count))
2403 				snoop_recv(recv_mad_agent->qp_info,
2404 					  &local->mad_priv->header.recv_wc,
2405 					   IB_MAD_SNOOP_RECVS);
2406 			recv_mad_agent->agent.recv_handler(
2407 						&recv_mad_agent->agent,
2408 						&local->mad_priv->header.recv_wc);
2409 			spin_lock_irqsave(&recv_mad_agent->lock, flags);
2410 			atomic_dec(&recv_mad_agent->refcount);
2411 			spin_unlock_irqrestore(&recv_mad_agent->lock, flags);
2412 		}
2413 
2414 local_send_completion:
2415 		/* Complete send */
2416 		mad_send_wc.status = IB_WC_SUCCESS;
2417 		mad_send_wc.vendor_err = 0;
2418 		mad_send_wc.send_buf = &local->mad_send_wr->send_buf;
2419 		if (atomic_read(&mad_agent_priv->qp_info->snoop_count))
2420 			snoop_send(mad_agent_priv->qp_info,
2421 				   &local->mad_send_wr->send_buf,
2422 				   &mad_send_wc, IB_MAD_SNOOP_SEND_COMPLETIONS);
2423 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2424 						   &mad_send_wc);
2425 
2426 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2427 		atomic_dec(&mad_agent_priv->refcount);
2428 		if (!recv)
2429 			kmem_cache_free(ib_mad_cache, local->mad_priv);
2430 		kfree(local);
2431 	}
2432 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2433 }
2434 
2435 static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
2436 {
2437 	int ret;
2438 
2439 	if (!mad_send_wr->retries_left)
2440 		return -ETIMEDOUT;
2441 
2442 	mad_send_wr->retries_left--;
2443 	mad_send_wr->send_buf.retries++;
2444 
2445 	mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
2446 
2447 	if (mad_send_wr->mad_agent_priv->agent.rmpp_version) {
2448 		ret = ib_retry_rmpp(mad_send_wr);
2449 		switch (ret) {
2450 		case IB_RMPP_RESULT_UNHANDLED:
2451 			ret = ib_send_mad(mad_send_wr);
2452 			break;
2453 		case IB_RMPP_RESULT_CONSUMED:
2454 			ret = 0;
2455 			break;
2456 		default:
2457 			ret = -ECOMM;
2458 			break;
2459 		}
2460 	} else
2461 		ret = ib_send_mad(mad_send_wr);
2462 
2463 	if (!ret) {
2464 		mad_send_wr->refcount++;
2465 		list_add_tail(&mad_send_wr->agent_list,
2466 			      &mad_send_wr->mad_agent_priv->send_list);
2467 	}
2468 	return ret;
2469 }
2470 
2471 static void timeout_sends(struct work_struct *work)
2472 {
2473 	struct ib_mad_agent_private *mad_agent_priv;
2474 	struct ib_mad_send_wr_private *mad_send_wr;
2475 	struct ib_mad_send_wc mad_send_wc;
2476 	unsigned long flags, delay;
2477 
2478 	mad_agent_priv = container_of(work, struct ib_mad_agent_private,
2479 				      timed_work.work);
2480 	mad_send_wc.vendor_err = 0;
2481 
2482 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2483 	while (!list_empty(&mad_agent_priv->wait_list)) {
2484 		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2485 					 struct ib_mad_send_wr_private,
2486 					 agent_list);
2487 
2488 		if (time_after(mad_send_wr->timeout, jiffies)) {
2489 			delay = mad_send_wr->timeout - jiffies;
2490 			if ((long)delay <= 0)
2491 				delay = 1;
2492 			queue_delayed_work(mad_agent_priv->qp_info->
2493 					   port_priv->wq,
2494 					   &mad_agent_priv->timed_work, delay);
2495 			break;
2496 		}
2497 
2498 		list_del(&mad_send_wr->agent_list);
2499 		if (mad_send_wr->status == IB_WC_SUCCESS &&
2500 		    !retry_send(mad_send_wr))
2501 			continue;
2502 
2503 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2504 
2505 		if (mad_send_wr->status == IB_WC_SUCCESS)
2506 			mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
2507 		else
2508 			mad_send_wc.status = mad_send_wr->status;
2509 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2510 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2511 						   &mad_send_wc);
2512 
2513 		atomic_dec(&mad_agent_priv->refcount);
2514 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2515 	}
2516 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2517 }
2518 
2519 static void ib_mad_thread_completion_handler(struct ib_cq *cq, void *arg)
2520 {
2521 	struct ib_mad_port_private *port_priv = cq->cq_context;
2522 	unsigned long flags;
2523 
2524 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2525 	if (!list_empty(&port_priv->port_list))
2526 		queue_work(port_priv->wq, &port_priv->work);
2527 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2528 }
2529 
2530 /*
2531  * Allocate receive MADs and post receive WRs for them
2532  */
2533 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
2534 				    struct ib_mad_private *mad)
2535 {
2536 	unsigned long flags;
2537 	int post, ret;
2538 	struct ib_mad_private *mad_priv;
2539 	struct ib_sge sg_list;
2540 	struct ib_recv_wr recv_wr, *bad_recv_wr;
2541 	struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
2542 
2543 	/* Initialize common scatter list fields */
2544 	sg_list.length = sizeof *mad_priv - sizeof mad_priv->header;
2545 	sg_list.lkey = (*qp_info->port_priv->mr).lkey;
2546 
2547 	/* Initialize common receive WR fields */
2548 	recv_wr.next = NULL;
2549 	recv_wr.sg_list = &sg_list;
2550 	recv_wr.num_sge = 1;
2551 
2552 	do {
2553 		/* Allocate and map receive buffer */
2554 		if (mad) {
2555 			mad_priv = mad;
2556 			mad = NULL;
2557 		} else {
2558 			mad_priv = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
2559 			if (!mad_priv) {
2560 				printk(KERN_ERR PFX "No memory for receive buffer\n");
2561 				ret = -ENOMEM;
2562 				break;
2563 			}
2564 		}
2565 		sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
2566 						 &mad_priv->grh,
2567 						 sizeof *mad_priv -
2568 						   sizeof mad_priv->header,
2569 						 DMA_FROM_DEVICE);
2570 		mad_priv->header.mapping = sg_list.addr;
2571 		recv_wr.wr_id = (unsigned long)&mad_priv->header.mad_list;
2572 		mad_priv->header.mad_list.mad_queue = recv_queue;
2573 
2574 		/* Post receive WR */
2575 		spin_lock_irqsave(&recv_queue->lock, flags);
2576 		post = (++recv_queue->count < recv_queue->max_active);
2577 		list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
2578 		spin_unlock_irqrestore(&recv_queue->lock, flags);
2579 		ret = ib_post_recv(qp_info->qp, &recv_wr, &bad_recv_wr);
2580 		if (ret) {
2581 			spin_lock_irqsave(&recv_queue->lock, flags);
2582 			list_del(&mad_priv->header.mad_list.list);
2583 			recv_queue->count--;
2584 			spin_unlock_irqrestore(&recv_queue->lock, flags);
2585 			ib_dma_unmap_single(qp_info->port_priv->device,
2586 					    mad_priv->header.mapping,
2587 					    sizeof *mad_priv -
2588 					      sizeof mad_priv->header,
2589 					    DMA_FROM_DEVICE);
2590 			kmem_cache_free(ib_mad_cache, mad_priv);
2591 			printk(KERN_ERR PFX "ib_post_recv failed: %d\n", ret);
2592 			break;
2593 		}
2594 	} while (post);
2595 
2596 	return ret;
2597 }
2598 
2599 /*
2600  * Return all the posted receive MADs
2601  */
2602 static void cleanup_recv_queue(struct ib_mad_qp_info *qp_info)
2603 {
2604 	struct ib_mad_private_header *mad_priv_hdr;
2605 	struct ib_mad_private *recv;
2606 	struct ib_mad_list_head *mad_list;
2607 
2608 	while (!list_empty(&qp_info->recv_queue.list)) {
2609 
2610 		mad_list = list_entry(qp_info->recv_queue.list.next,
2611 				      struct ib_mad_list_head, list);
2612 		mad_priv_hdr = container_of(mad_list,
2613 					    struct ib_mad_private_header,
2614 					    mad_list);
2615 		recv = container_of(mad_priv_hdr, struct ib_mad_private,
2616 				    header);
2617 
2618 		/* Remove from posted receive MAD list */
2619 		list_del(&mad_list->list);
2620 
2621 		ib_dma_unmap_single(qp_info->port_priv->device,
2622 				    recv->header.mapping,
2623 				    sizeof(struct ib_mad_private) -
2624 				      sizeof(struct ib_mad_private_header),
2625 				    DMA_FROM_DEVICE);
2626 		kmem_cache_free(ib_mad_cache, recv);
2627 	}
2628 
2629 	qp_info->recv_queue.count = 0;
2630 }
2631 
2632 /*
2633  * Start the port
2634  */
2635 static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
2636 {
2637 	int ret, i;
2638 	struct ib_qp_attr *attr;
2639 	struct ib_qp *qp;
2640 
2641 	attr = kmalloc(sizeof *attr, GFP_KERNEL);
2642 	if (!attr) {
2643 		printk(KERN_ERR PFX "Couldn't kmalloc ib_qp_attr\n");
2644 		return -ENOMEM;
2645 	}
2646 
2647 	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2648 		qp = port_priv->qp_info[i].qp;
2649 		/*
2650 		 * PKey index for QP1 is irrelevant but
2651 		 * one is needed for the Reset to Init transition
2652 		 */
2653 		attr->qp_state = IB_QPS_INIT;
2654 		attr->pkey_index = 0;
2655 		attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
2656 		ret = ib_modify_qp(qp, attr, IB_QP_STATE |
2657 					     IB_QP_PKEY_INDEX | IB_QP_QKEY);
2658 		if (ret) {
2659 			printk(KERN_ERR PFX "Couldn't change QP%d state to "
2660 			       "INIT: %d\n", i, ret);
2661 			goto out;
2662 		}
2663 
2664 		attr->qp_state = IB_QPS_RTR;
2665 		ret = ib_modify_qp(qp, attr, IB_QP_STATE);
2666 		if (ret) {
2667 			printk(KERN_ERR PFX "Couldn't change QP%d state to "
2668 			       "RTR: %d\n", i, ret);
2669 			goto out;
2670 		}
2671 
2672 		attr->qp_state = IB_QPS_RTS;
2673 		attr->sq_psn = IB_MAD_SEND_Q_PSN;
2674 		ret = ib_modify_qp(qp, attr, IB_QP_STATE | IB_QP_SQ_PSN);
2675 		if (ret) {
2676 			printk(KERN_ERR PFX "Couldn't change QP%d state to "
2677 			       "RTS: %d\n", i, ret);
2678 			goto out;
2679 		}
2680 	}
2681 
2682 	ret = ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
2683 	if (ret) {
2684 		printk(KERN_ERR PFX "Failed to request completion "
2685 		       "notification: %d\n", ret);
2686 		goto out;
2687 	}
2688 
2689 	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2690 		ret = ib_mad_post_receive_mads(&port_priv->qp_info[i], NULL);
2691 		if (ret) {
2692 			printk(KERN_ERR PFX "Couldn't post receive WRs\n");
2693 			goto out;
2694 		}
2695 	}
2696 out:
2697 	kfree(attr);
2698 	return ret;
2699 }
2700 
2701 static void qp_event_handler(struct ib_event *event, void *qp_context)
2702 {
2703 	struct ib_mad_qp_info	*qp_info = qp_context;
2704 
2705 	/* It's worse than that! He's dead, Jim! */
2706 	printk(KERN_ERR PFX "Fatal error (%d) on MAD QP (%d)\n",
2707 		event->event, qp_info->qp->qp_num);
2708 }
2709 
2710 static void init_mad_queue(struct ib_mad_qp_info *qp_info,
2711 			   struct ib_mad_queue *mad_queue)
2712 {
2713 	mad_queue->qp_info = qp_info;
2714 	mad_queue->count = 0;
2715 	spin_lock_init(&mad_queue->lock);
2716 	INIT_LIST_HEAD(&mad_queue->list);
2717 }
2718 
2719 static void init_mad_qp(struct ib_mad_port_private *port_priv,
2720 			struct ib_mad_qp_info *qp_info)
2721 {
2722 	qp_info->port_priv = port_priv;
2723 	init_mad_queue(qp_info, &qp_info->send_queue);
2724 	init_mad_queue(qp_info, &qp_info->recv_queue);
2725 	INIT_LIST_HEAD(&qp_info->overflow_list);
2726 	spin_lock_init(&qp_info->snoop_lock);
2727 	qp_info->snoop_table = NULL;
2728 	qp_info->snoop_table_size = 0;
2729 	atomic_set(&qp_info->snoop_count, 0);
2730 }
2731 
2732 static int create_mad_qp(struct ib_mad_qp_info *qp_info,
2733 			 enum ib_qp_type qp_type)
2734 {
2735 	struct ib_qp_init_attr	qp_init_attr;
2736 	int ret;
2737 
2738 	memset(&qp_init_attr, 0, sizeof qp_init_attr);
2739 	qp_init_attr.send_cq = qp_info->port_priv->cq;
2740 	qp_init_attr.recv_cq = qp_info->port_priv->cq;
2741 	qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
2742 	qp_init_attr.cap.max_send_wr = IB_MAD_QP_SEND_SIZE;
2743 	qp_init_attr.cap.max_recv_wr = IB_MAD_QP_RECV_SIZE;
2744 	qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
2745 	qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
2746 	qp_init_attr.qp_type = qp_type;
2747 	qp_init_attr.port_num = qp_info->port_priv->port_num;
2748 	qp_init_attr.qp_context = qp_info;
2749 	qp_init_attr.event_handler = qp_event_handler;
2750 	qp_info->qp = ib_create_qp(qp_info->port_priv->pd, &qp_init_attr);
2751 	if (IS_ERR(qp_info->qp)) {
2752 		printk(KERN_ERR PFX "Couldn't create ib_mad QP%d\n",
2753 		       get_spl_qp_index(qp_type));
2754 		ret = PTR_ERR(qp_info->qp);
2755 		goto error;
2756 	}
2757 	/* Use minimum queue sizes unless the CQ is resized */
2758 	qp_info->send_queue.max_active = IB_MAD_QP_SEND_SIZE;
2759 	qp_info->recv_queue.max_active = IB_MAD_QP_RECV_SIZE;
2760 	return 0;
2761 
2762 error:
2763 	return ret;
2764 }
2765 
2766 static void destroy_mad_qp(struct ib_mad_qp_info *qp_info)
2767 {
2768 	ib_destroy_qp(qp_info->qp);
2769 	kfree(qp_info->snoop_table);
2770 }
2771 
2772 /*
2773  * Open the port
2774  * Create the QP, PD, MR, and CQ if needed
2775  */
2776 static int ib_mad_port_open(struct ib_device *device,
2777 			    int port_num)
2778 {
2779 	int ret, cq_size;
2780 	struct ib_mad_port_private *port_priv;
2781 	unsigned long flags;
2782 	char name[sizeof "ib_mad123"];
2783 
2784 	/* Create new device info */
2785 	port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
2786 	if (!port_priv) {
2787 		printk(KERN_ERR PFX "No memory for ib_mad_port_private\n");
2788 		return -ENOMEM;
2789 	}
2790 
2791 	port_priv->device = device;
2792 	port_priv->port_num = port_num;
2793 	spin_lock_init(&port_priv->reg_lock);
2794 	INIT_LIST_HEAD(&port_priv->agent_list);
2795 	init_mad_qp(port_priv, &port_priv->qp_info[0]);
2796 	init_mad_qp(port_priv, &port_priv->qp_info[1]);
2797 
2798 	cq_size = (IB_MAD_QP_SEND_SIZE + IB_MAD_QP_RECV_SIZE) * 2;
2799 	port_priv->cq = ib_create_cq(port_priv->device,
2800 				     ib_mad_thread_completion_handler,
2801 				     NULL, port_priv, cq_size, 0);
2802 	if (IS_ERR(port_priv->cq)) {
2803 		printk(KERN_ERR PFX "Couldn't create ib_mad CQ\n");
2804 		ret = PTR_ERR(port_priv->cq);
2805 		goto error3;
2806 	}
2807 
2808 	port_priv->pd = ib_alloc_pd(device);
2809 	if (IS_ERR(port_priv->pd)) {
2810 		printk(KERN_ERR PFX "Couldn't create ib_mad PD\n");
2811 		ret = PTR_ERR(port_priv->pd);
2812 		goto error4;
2813 	}
2814 
2815 	port_priv->mr = ib_get_dma_mr(port_priv->pd, IB_ACCESS_LOCAL_WRITE);
2816 	if (IS_ERR(port_priv->mr)) {
2817 		printk(KERN_ERR PFX "Couldn't get ib_mad DMA MR\n");
2818 		ret = PTR_ERR(port_priv->mr);
2819 		goto error5;
2820 	}
2821 
2822 	ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
2823 	if (ret)
2824 		goto error6;
2825 	ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
2826 	if (ret)
2827 		goto error7;
2828 
2829 	snprintf(name, sizeof name, "ib_mad%d", port_num);
2830 	port_priv->wq = create_singlethread_workqueue(name);
2831 	if (!port_priv->wq) {
2832 		ret = -ENOMEM;
2833 		goto error8;
2834 	}
2835 	INIT_WORK(&port_priv->work, ib_mad_completion_handler);
2836 
2837 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2838 	list_add_tail(&port_priv->port_list, &ib_mad_port_list);
2839 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2840 
2841 	ret = ib_mad_port_start(port_priv);
2842 	if (ret) {
2843 		printk(KERN_ERR PFX "Couldn't start port\n");
2844 		goto error9;
2845 	}
2846 
2847 	return 0;
2848 
2849 error9:
2850 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2851 	list_del_init(&port_priv->port_list);
2852 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2853 
2854 	destroy_workqueue(port_priv->wq);
2855 error8:
2856 	destroy_mad_qp(&port_priv->qp_info[1]);
2857 error7:
2858 	destroy_mad_qp(&port_priv->qp_info[0]);
2859 error6:
2860 	ib_dereg_mr(port_priv->mr);
2861 error5:
2862 	ib_dealloc_pd(port_priv->pd);
2863 error4:
2864 	ib_destroy_cq(port_priv->cq);
2865 	cleanup_recv_queue(&port_priv->qp_info[1]);
2866 	cleanup_recv_queue(&port_priv->qp_info[0]);
2867 error3:
2868 	kfree(port_priv);
2869 
2870 	return ret;
2871 }
2872 
2873 /*
2874  * Close the port
2875  * If there are no classes using the port, free the port
2876  * resources (CQ, MR, PD, QP) and remove the port's info structure
2877  */
2878 static int ib_mad_port_close(struct ib_device *device, int port_num)
2879 {
2880 	struct ib_mad_port_private *port_priv;
2881 	unsigned long flags;
2882 
2883 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2884 	port_priv = __ib_get_mad_port(device, port_num);
2885 	if (port_priv == NULL) {
2886 		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2887 		printk(KERN_ERR PFX "Port %d not found\n", port_num);
2888 		return -ENODEV;
2889 	}
2890 	list_del_init(&port_priv->port_list);
2891 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2892 
2893 	destroy_workqueue(port_priv->wq);
2894 	destroy_mad_qp(&port_priv->qp_info[1]);
2895 	destroy_mad_qp(&port_priv->qp_info[0]);
2896 	ib_dereg_mr(port_priv->mr);
2897 	ib_dealloc_pd(port_priv->pd);
2898 	ib_destroy_cq(port_priv->cq);
2899 	cleanup_recv_queue(&port_priv->qp_info[1]);
2900 	cleanup_recv_queue(&port_priv->qp_info[0]);
2901 	/* XXX: Handle deallocation of MAD registration tables */
2902 
2903 	kfree(port_priv);
2904 
2905 	return 0;
2906 }
2907 
2908 static void ib_mad_init_device(struct ib_device *device)
2909 {
2910 	int start, end, i;
2911 
2912 	if (rdma_node_get_transport(device->node_type) != RDMA_TRANSPORT_IB)
2913 		return;
2914 
2915 	if (device->node_type == RDMA_NODE_IB_SWITCH) {
2916 		start = 0;
2917 		end   = 0;
2918 	} else {
2919 		start = 1;
2920 		end   = device->phys_port_cnt;
2921 	}
2922 
2923 	for (i = start; i <= end; i++) {
2924 		if (ib_mad_port_open(device, i)) {
2925 			printk(KERN_ERR PFX "Couldn't open %s port %d\n",
2926 			       device->name, i);
2927 			goto error;
2928 		}
2929 		if (ib_agent_port_open(device, i)) {
2930 			printk(KERN_ERR PFX "Couldn't open %s port %d "
2931 			       "for agents\n",
2932 			       device->name, i);
2933 			goto error_agent;
2934 		}
2935 	}
2936 	return;
2937 
2938 error_agent:
2939 	if (ib_mad_port_close(device, i))
2940 		printk(KERN_ERR PFX "Couldn't close %s port %d\n",
2941 		       device->name, i);
2942 
2943 error:
2944 	i--;
2945 
2946 	while (i >= start) {
2947 		if (ib_agent_port_close(device, i))
2948 			printk(KERN_ERR PFX "Couldn't close %s port %d "
2949 			       "for agents\n",
2950 			       device->name, i);
2951 		if (ib_mad_port_close(device, i))
2952 			printk(KERN_ERR PFX "Couldn't close %s port %d\n",
2953 			       device->name, i);
2954 		i--;
2955 	}
2956 }
2957 
2958 static void ib_mad_remove_device(struct ib_device *device)
2959 {
2960 	int i, num_ports, cur_port;
2961 
2962 	if (device->node_type == RDMA_NODE_IB_SWITCH) {
2963 		num_ports = 1;
2964 		cur_port = 0;
2965 	} else {
2966 		num_ports = device->phys_port_cnt;
2967 		cur_port = 1;
2968 	}
2969 	for (i = 0; i < num_ports; i++, cur_port++) {
2970 		if (ib_agent_port_close(device, cur_port))
2971 			printk(KERN_ERR PFX "Couldn't close %s port %d "
2972 			       "for agents\n",
2973 			       device->name, cur_port);
2974 		if (ib_mad_port_close(device, cur_port))
2975 			printk(KERN_ERR PFX "Couldn't close %s port %d\n",
2976 			       device->name, cur_port);
2977 	}
2978 }
2979 
2980 static struct ib_client mad_client = {
2981 	.name   = "mad",
2982 	.add = ib_mad_init_device,
2983 	.remove = ib_mad_remove_device
2984 };
2985 
2986 static int __init ib_mad_init_module(void)
2987 {
2988 	int ret;
2989 
2990 	spin_lock_init(&ib_mad_port_list_lock);
2991 
2992 	ib_mad_cache = kmem_cache_create("ib_mad",
2993 					 sizeof(struct ib_mad_private),
2994 					 0,
2995 					 SLAB_HWCACHE_ALIGN,
2996 					 NULL);
2997 	if (!ib_mad_cache) {
2998 		printk(KERN_ERR PFX "Couldn't create ib_mad cache\n");
2999 		ret = -ENOMEM;
3000 		goto error1;
3001 	}
3002 
3003 	INIT_LIST_HEAD(&ib_mad_port_list);
3004 
3005 	if (ib_register_client(&mad_client)) {
3006 		printk(KERN_ERR PFX "Couldn't register ib_mad client\n");
3007 		ret = -EINVAL;
3008 		goto error2;
3009 	}
3010 
3011 	return 0;
3012 
3013 error2:
3014 	kmem_cache_destroy(ib_mad_cache);
3015 error1:
3016 	return ret;
3017 }
3018 
3019 static void __exit ib_mad_cleanup_module(void)
3020 {
3021 	ib_unregister_client(&mad_client);
3022 	kmem_cache_destroy(ib_mad_cache);
3023 }
3024 
3025 module_init(ib_mad_init_module);
3026 module_exit(ib_mad_cleanup_module);
3027 
3028