xref: /openbmc/linux/drivers/rapidio/rio_cm.c (revision 3213486f)
1 /*
2  * rio_cm - RapidIO Channelized Messaging Driver
3  *
4  * Copyright 2013-2016 Integrated Device Technology, Inc.
5  * Copyright (c) 2015, Prodrive Technologies
6  * Copyright (c) 2015, RapidIO Trade Association
7  *
8  * This program is free software; you can redistribute  it and/or modify it
9  * under  the terms of  the GNU General  Public License as published by the
10  * Free Software Foundation;  either version 2 of the  License, or (at your
11  * option) any later version.
12  *
13  * THIS PROGRAM IS DISTRIBUTED IN THE HOPE THAT IT WILL BE USEFUL,
14  * BUT WITHOUT ANY WARRANTY; WITHOUT EVEN THE IMPLIED WARRANTY OF
15  * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  SEE THE
16  * GNU GENERAL PUBLIC LICENSE FOR MORE DETAILS.
17  */
18 
19 #include <linux/module.h>
20 #include <linux/kernel.h>
21 #include <linux/dma-mapping.h>
22 #include <linux/delay.h>
23 #include <linux/sched.h>
24 #include <linux/rio.h>
25 #include <linux/rio_drv.h>
26 #include <linux/slab.h>
27 #include <linux/idr.h>
28 #include <linux/interrupt.h>
29 #include <linux/cdev.h>
30 #include <linux/fs.h>
31 #include <linux/poll.h>
32 #include <linux/reboot.h>
33 #include <linux/bitops.h>
34 #include <linux/printk.h>
35 #include <linux/rio_cm_cdev.h>
36 
37 #define DRV_NAME        "rio_cm"
38 #define DRV_VERSION     "1.0.0"
39 #define DRV_AUTHOR      "Alexandre Bounine <alexandre.bounine@idt.com>"
40 #define DRV_DESC        "RapidIO Channelized Messaging Driver"
41 #define DEV_NAME	"rio_cm"
42 
43 /* Debug output filtering masks */
44 enum {
45 	DBG_NONE	= 0,
46 	DBG_INIT	= BIT(0), /* driver init */
47 	DBG_EXIT	= BIT(1), /* driver exit */
48 	DBG_MPORT	= BIT(2), /* mport add/remove */
49 	DBG_RDEV	= BIT(3), /* RapidIO device add/remove */
50 	DBG_CHOP	= BIT(4), /* channel operations */
51 	DBG_WAIT	= BIT(5), /* waiting for events */
52 	DBG_TX		= BIT(6), /* message TX */
53 	DBG_TX_EVENT	= BIT(7), /* message TX event */
54 	DBG_RX_DATA	= BIT(8), /* inbound data messages */
55 	DBG_RX_CMD	= BIT(9), /* inbound REQ/ACK/NACK messages */
56 	DBG_ALL		= ~0,
57 };
58 
59 #ifdef DEBUG
60 #define riocm_debug(level, fmt, arg...) \
61 	do { \
62 		if (DBG_##level & dbg_level) \
63 			pr_debug(DRV_NAME ": %s " fmt "\n", \
64 				__func__, ##arg); \
65 	} while (0)
66 #else
67 #define riocm_debug(level, fmt, arg...) \
68 		no_printk(KERN_DEBUG pr_fmt(DRV_NAME fmt "\n"), ##arg)
69 #endif
70 
71 #define riocm_warn(fmt, arg...) \
72 	pr_warn(DRV_NAME ": %s WARNING " fmt "\n", __func__, ##arg)
73 
74 #define riocm_error(fmt, arg...) \
75 	pr_err(DRV_NAME ": %s ERROR " fmt "\n", __func__, ##arg)
76 
77 
78 static int cmbox = 1;
79 module_param(cmbox, int, S_IRUGO);
80 MODULE_PARM_DESC(cmbox, "RapidIO Mailbox number (default 1)");
81 
82 static int chstart = 256;
83 module_param(chstart, int, S_IRUGO);
84 MODULE_PARM_DESC(chstart,
85 		 "Start channel number for dynamic allocation (default 256)");
86 
87 #ifdef DEBUG
88 static u32 dbg_level = DBG_NONE;
89 module_param(dbg_level, uint, S_IWUSR | S_IRUGO);
90 MODULE_PARM_DESC(dbg_level, "Debugging output level (default 0 = none)");
91 #endif
92 
93 MODULE_AUTHOR(DRV_AUTHOR);
94 MODULE_DESCRIPTION(DRV_DESC);
95 MODULE_LICENSE("GPL");
96 MODULE_VERSION(DRV_VERSION);
97 
98 #define RIOCM_TX_RING_SIZE	128
99 #define RIOCM_RX_RING_SIZE	128
100 #define RIOCM_CONNECT_TO	3 /* connect response TO (in sec) */
101 
102 #define RIOCM_MAX_CHNUM		0xffff /* Use full range of u16 field */
103 #define RIOCM_CHNUM_AUTO	0
104 #define RIOCM_MAX_EP_COUNT	0x10000 /* Max number of endpoints */
105 
106 enum rio_cm_state {
107 	RIO_CM_IDLE,
108 	RIO_CM_CONNECT,
109 	RIO_CM_CONNECTED,
110 	RIO_CM_DISCONNECT,
111 	RIO_CM_CHAN_BOUND,
112 	RIO_CM_LISTEN,
113 	RIO_CM_DESTROYING,
114 };
115 
116 enum rio_cm_pkt_type {
117 	RIO_CM_SYS	= 0xaa,
118 	RIO_CM_CHAN	= 0x55,
119 };
120 
121 enum rio_cm_chop {
122 	CM_CONN_REQ,
123 	CM_CONN_ACK,
124 	CM_CONN_CLOSE,
125 	CM_DATA_MSG,
126 };
127 
128 struct rio_ch_base_bhdr {
129 	u32 src_id;
130 	u32 dst_id;
131 #define RIO_HDR_LETTER_MASK 0xffff0000
132 #define RIO_HDR_MBOX_MASK   0x0000ffff
133 	u8  src_mbox;
134 	u8  dst_mbox;
135 	u8  type;
136 } __attribute__((__packed__));
137 
138 struct rio_ch_chan_hdr {
139 	struct rio_ch_base_bhdr bhdr;
140 	u8 ch_op;
141 	u16 dst_ch;
142 	u16 src_ch;
143 	u16 msg_len;
144 	u16 rsrvd;
145 } __attribute__((__packed__));
146 
147 struct tx_req {
148 	struct list_head node;
149 	struct rio_dev   *rdev;
150 	void		 *buffer;
151 	size_t		 len;
152 };
153 
154 struct cm_dev {
155 	struct list_head	list;
156 	struct rio_mport	*mport;
157 	void			*rx_buf[RIOCM_RX_RING_SIZE];
158 	int			rx_slots;
159 	struct mutex		rx_lock;
160 
161 	void			*tx_buf[RIOCM_TX_RING_SIZE];
162 	int			tx_slot;
163 	int			tx_cnt;
164 	int			tx_ack_slot;
165 	struct list_head	tx_reqs;
166 	spinlock_t		tx_lock;
167 
168 	struct list_head	peers;
169 	u32			npeers;
170 	struct workqueue_struct *rx_wq;
171 	struct work_struct	rx_work;
172 };
173 
174 struct chan_rx_ring {
175 	void	*buf[RIOCM_RX_RING_SIZE];
176 	int	head;
177 	int	tail;
178 	int	count;
179 
180 	/* Tracking RX buffers reported to upper level */
181 	void	*inuse[RIOCM_RX_RING_SIZE];
182 	int	inuse_cnt;
183 };
184 
185 struct rio_channel {
186 	u16			id;	/* local channel ID */
187 	struct kref		ref;	/* channel refcount */
188 	struct file		*filp;
189 	struct cm_dev		*cmdev;	/* associated CM device object */
190 	struct rio_dev		*rdev;	/* remote RapidIO device */
191 	enum rio_cm_state	state;
192 	int			error;
193 	spinlock_t		lock;
194 	void			*context;
195 	u32			loc_destid;	/* local destID */
196 	u32			rem_destid;	/* remote destID */
197 	u16			rem_channel;	/* remote channel ID */
198 	struct list_head	accept_queue;
199 	struct list_head	ch_node;
200 	struct completion	comp;
201 	struct completion	comp_close;
202 	struct chan_rx_ring	rx_ring;
203 };
204 
205 struct cm_peer {
206 	struct list_head node;
207 	struct rio_dev *rdev;
208 };
209 
210 struct rio_cm_work {
211 	struct work_struct work;
212 	struct cm_dev *cm;
213 	void *data;
214 };
215 
216 struct conn_req {
217 	struct list_head node;
218 	u32 destid;	/* requester destID */
219 	u16 chan;	/* requester channel ID */
220 	struct cm_dev *cmdev;
221 };
222 
223 /*
224  * A channel_dev structure represents a CM_CDEV
225  * @cdev	Character device
226  * @dev		Associated device object
227  */
228 struct channel_dev {
229 	struct cdev	cdev;
230 	struct device	*dev;
231 };
232 
233 static struct rio_channel *riocm_ch_alloc(u16 ch_num);
234 static void riocm_ch_free(struct kref *ref);
235 static int riocm_post_send(struct cm_dev *cm, struct rio_dev *rdev,
236 			   void *buffer, size_t len);
237 static int riocm_ch_close(struct rio_channel *ch);
238 
239 static DEFINE_SPINLOCK(idr_lock);
240 static DEFINE_IDR(ch_idr);
241 
242 static LIST_HEAD(cm_dev_list);
243 static DECLARE_RWSEM(rdev_sem);
244 
245 static struct class *dev_class;
246 static unsigned int dev_major;
247 static unsigned int dev_minor_base;
248 static dev_t dev_number;
249 static struct channel_dev riocm_cdev;
250 
251 #define is_msg_capable(src_ops, dst_ops)			\
252 			((src_ops & RIO_SRC_OPS_DATA_MSG) &&	\
253 			 (dst_ops & RIO_DST_OPS_DATA_MSG))
254 #define dev_cm_capable(dev) \
255 	is_msg_capable(dev->src_ops, dev->dst_ops)
256 
257 static int riocm_cmp(struct rio_channel *ch, enum rio_cm_state cmp)
258 {
259 	int ret;
260 
261 	spin_lock_bh(&ch->lock);
262 	ret = (ch->state == cmp);
263 	spin_unlock_bh(&ch->lock);
264 	return ret;
265 }
266 
267 static int riocm_cmp_exch(struct rio_channel *ch,
268 			   enum rio_cm_state cmp, enum rio_cm_state exch)
269 {
270 	int ret;
271 
272 	spin_lock_bh(&ch->lock);
273 	ret = (ch->state == cmp);
274 	if (ret)
275 		ch->state = exch;
276 	spin_unlock_bh(&ch->lock);
277 	return ret;
278 }
279 
280 static enum rio_cm_state riocm_exch(struct rio_channel *ch,
281 				    enum rio_cm_state exch)
282 {
283 	enum rio_cm_state old;
284 
285 	spin_lock_bh(&ch->lock);
286 	old = ch->state;
287 	ch->state = exch;
288 	spin_unlock_bh(&ch->lock);
289 	return old;
290 }
291 
292 static struct rio_channel *riocm_get_channel(u16 nr)
293 {
294 	struct rio_channel *ch;
295 
296 	spin_lock_bh(&idr_lock);
297 	ch = idr_find(&ch_idr, nr);
298 	if (ch)
299 		kref_get(&ch->ref);
300 	spin_unlock_bh(&idr_lock);
301 	return ch;
302 }
303 
304 static void riocm_put_channel(struct rio_channel *ch)
305 {
306 	kref_put(&ch->ref, riocm_ch_free);
307 }
308 
309 static void *riocm_rx_get_msg(struct cm_dev *cm)
310 {
311 	void *msg;
312 	int i;
313 
314 	msg = rio_get_inb_message(cm->mport, cmbox);
315 	if (msg) {
316 		for (i = 0; i < RIOCM_RX_RING_SIZE; i++) {
317 			if (cm->rx_buf[i] == msg) {
318 				cm->rx_buf[i] = NULL;
319 				cm->rx_slots++;
320 				break;
321 			}
322 		}
323 
324 		if (i == RIOCM_RX_RING_SIZE)
325 			riocm_warn("no record for buffer 0x%p", msg);
326 	}
327 
328 	return msg;
329 }
330 
331 /*
332  * riocm_rx_fill - fills a ring of receive buffers for given cm device
333  * @cm: cm_dev object
334  * @nent: max number of entries to fill
335  *
336  * Returns: none
337  */
338 static void riocm_rx_fill(struct cm_dev *cm, int nent)
339 {
340 	int i;
341 
342 	if (cm->rx_slots == 0)
343 		return;
344 
345 	for (i = 0; i < RIOCM_RX_RING_SIZE && cm->rx_slots && nent; i++) {
346 		if (cm->rx_buf[i] == NULL) {
347 			cm->rx_buf[i] = kmalloc(RIO_MAX_MSG_SIZE, GFP_KERNEL);
348 			if (cm->rx_buf[i] == NULL)
349 				break;
350 			rio_add_inb_buffer(cm->mport, cmbox, cm->rx_buf[i]);
351 			cm->rx_slots--;
352 			nent--;
353 		}
354 	}
355 }
356 
357 /*
358  * riocm_rx_free - frees all receive buffers associated with given cm device
359  * @cm: cm_dev object
360  *
361  * Returns: none
362  */
363 static void riocm_rx_free(struct cm_dev *cm)
364 {
365 	int i;
366 
367 	for (i = 0; i < RIOCM_RX_RING_SIZE; i++) {
368 		if (cm->rx_buf[i] != NULL) {
369 			kfree(cm->rx_buf[i]);
370 			cm->rx_buf[i] = NULL;
371 		}
372 	}
373 }
374 
375 /*
376  * riocm_req_handler - connection request handler
377  * @cm: cm_dev object
378  * @req_data: pointer to the request packet
379  *
380  * Returns: 0 if success, or
381  *          -EINVAL if channel is not in correct state,
382  *          -ENODEV if cannot find a channel with specified ID,
383  *          -ENOMEM if unable to allocate memory to store the request
384  */
385 static int riocm_req_handler(struct cm_dev *cm, void *req_data)
386 {
387 	struct rio_channel *ch;
388 	struct conn_req *req;
389 	struct rio_ch_chan_hdr *hh = req_data;
390 	u16 chnum;
391 
392 	chnum = ntohs(hh->dst_ch);
393 
394 	ch = riocm_get_channel(chnum);
395 
396 	if (!ch)
397 		return -ENODEV;
398 
399 	if (ch->state != RIO_CM_LISTEN) {
400 		riocm_debug(RX_CMD, "channel %d is not in listen state", chnum);
401 		riocm_put_channel(ch);
402 		return -EINVAL;
403 	}
404 
405 	req = kzalloc(sizeof(*req), GFP_KERNEL);
406 	if (!req) {
407 		riocm_put_channel(ch);
408 		return -ENOMEM;
409 	}
410 
411 	req->destid = ntohl(hh->bhdr.src_id);
412 	req->chan = ntohs(hh->src_ch);
413 	req->cmdev = cm;
414 
415 	spin_lock_bh(&ch->lock);
416 	list_add_tail(&req->node, &ch->accept_queue);
417 	spin_unlock_bh(&ch->lock);
418 	complete(&ch->comp);
419 	riocm_put_channel(ch);
420 
421 	return 0;
422 }
423 
424 /*
425  * riocm_resp_handler - response to connection request handler
426  * @resp_data: pointer to the response packet
427  *
428  * Returns: 0 if success, or
429  *          -EINVAL if channel is not in correct state,
430  *          -ENODEV if cannot find a channel with specified ID,
431  */
432 static int riocm_resp_handler(void *resp_data)
433 {
434 	struct rio_channel *ch;
435 	struct rio_ch_chan_hdr *hh = resp_data;
436 	u16 chnum;
437 
438 	chnum = ntohs(hh->dst_ch);
439 	ch = riocm_get_channel(chnum);
440 	if (!ch)
441 		return -ENODEV;
442 
443 	if (ch->state != RIO_CM_CONNECT) {
444 		riocm_put_channel(ch);
445 		return -EINVAL;
446 	}
447 
448 	riocm_exch(ch, RIO_CM_CONNECTED);
449 	ch->rem_channel = ntohs(hh->src_ch);
450 	complete(&ch->comp);
451 	riocm_put_channel(ch);
452 
453 	return 0;
454 }
455 
456 /*
457  * riocm_close_handler - channel close request handler
458  * @req_data: pointer to the request packet
459  *
460  * Returns: 0 if success, or
461  *          -ENODEV if cannot find a channel with specified ID,
462  *            + error codes returned by riocm_ch_close.
463  */
464 static int riocm_close_handler(void *data)
465 {
466 	struct rio_channel *ch;
467 	struct rio_ch_chan_hdr *hh = data;
468 	int ret;
469 
470 	riocm_debug(RX_CMD, "for ch=%d", ntohs(hh->dst_ch));
471 
472 	spin_lock_bh(&idr_lock);
473 	ch = idr_find(&ch_idr, ntohs(hh->dst_ch));
474 	if (!ch) {
475 		spin_unlock_bh(&idr_lock);
476 		return -ENODEV;
477 	}
478 	idr_remove(&ch_idr, ch->id);
479 	spin_unlock_bh(&idr_lock);
480 
481 	riocm_exch(ch, RIO_CM_DISCONNECT);
482 
483 	ret = riocm_ch_close(ch);
484 	if (ret)
485 		riocm_debug(RX_CMD, "riocm_ch_close() returned %d", ret);
486 
487 	return 0;
488 }
489 
490 /*
491  * rio_cm_handler - function that services request (non-data) packets
492  * @cm: cm_dev object
493  * @data: pointer to the packet
494  */
495 static void rio_cm_handler(struct cm_dev *cm, void *data)
496 {
497 	struct rio_ch_chan_hdr *hdr;
498 
499 	if (!rio_mport_is_running(cm->mport))
500 		goto out;
501 
502 	hdr = data;
503 
504 	riocm_debug(RX_CMD, "OP=%x for ch=%d from %d",
505 		    hdr->ch_op, ntohs(hdr->dst_ch), ntohs(hdr->src_ch));
506 
507 	switch (hdr->ch_op) {
508 	case CM_CONN_REQ:
509 		riocm_req_handler(cm, data);
510 		break;
511 	case CM_CONN_ACK:
512 		riocm_resp_handler(data);
513 		break;
514 	case CM_CONN_CLOSE:
515 		riocm_close_handler(data);
516 		break;
517 	default:
518 		riocm_error("Invalid packet header");
519 		break;
520 	}
521 out:
522 	kfree(data);
523 }
524 
525 /*
526  * rio_rx_data_handler - received data packet handler
527  * @cm: cm_dev object
528  * @buf: data packet
529  *
530  * Returns: 0 if success, or
531  *          -ENODEV if cannot find a channel with specified ID,
532  *          -EIO if channel is not in CONNECTED state,
533  *          -ENOMEM if channel RX queue is full (packet discarded)
534  */
535 static int rio_rx_data_handler(struct cm_dev *cm, void *buf)
536 {
537 	struct rio_ch_chan_hdr *hdr;
538 	struct rio_channel *ch;
539 
540 	hdr = buf;
541 
542 	riocm_debug(RX_DATA, "for ch=%d", ntohs(hdr->dst_ch));
543 
544 	ch = riocm_get_channel(ntohs(hdr->dst_ch));
545 	if (!ch) {
546 		/* Discard data message for non-existing channel */
547 		kfree(buf);
548 		return -ENODEV;
549 	}
550 
551 	/* Place pointer to the buffer into channel's RX queue */
552 	spin_lock(&ch->lock);
553 
554 	if (ch->state != RIO_CM_CONNECTED) {
555 		/* Channel is not ready to receive data, discard a packet */
556 		riocm_debug(RX_DATA, "ch=%d is in wrong state=%d",
557 			    ch->id, ch->state);
558 		spin_unlock(&ch->lock);
559 		kfree(buf);
560 		riocm_put_channel(ch);
561 		return -EIO;
562 	}
563 
564 	if (ch->rx_ring.count == RIOCM_RX_RING_SIZE) {
565 		/* If RX ring is full, discard a packet */
566 		riocm_debug(RX_DATA, "ch=%d is full", ch->id);
567 		spin_unlock(&ch->lock);
568 		kfree(buf);
569 		riocm_put_channel(ch);
570 		return -ENOMEM;
571 	}
572 
573 	ch->rx_ring.buf[ch->rx_ring.head] = buf;
574 	ch->rx_ring.head++;
575 	ch->rx_ring.count++;
576 	ch->rx_ring.head %= RIOCM_RX_RING_SIZE;
577 
578 	complete(&ch->comp);
579 
580 	spin_unlock(&ch->lock);
581 	riocm_put_channel(ch);
582 
583 	return 0;
584 }
585 
586 /*
587  * rio_ibmsg_handler - inbound message packet handler
588  */
589 static void rio_ibmsg_handler(struct work_struct *work)
590 {
591 	struct cm_dev *cm = container_of(work, struct cm_dev, rx_work);
592 	void *data;
593 	struct rio_ch_chan_hdr *hdr;
594 
595 	if (!rio_mport_is_running(cm->mport))
596 		return;
597 
598 	while (1) {
599 		mutex_lock(&cm->rx_lock);
600 		data = riocm_rx_get_msg(cm);
601 		if (data)
602 			riocm_rx_fill(cm, 1);
603 		mutex_unlock(&cm->rx_lock);
604 
605 		if (data == NULL)
606 			break;
607 
608 		hdr = data;
609 
610 		if (hdr->bhdr.type != RIO_CM_CHAN) {
611 			/* For now simply discard packets other than channel */
612 			riocm_error("Unsupported TYPE code (0x%x). Msg dropped",
613 				    hdr->bhdr.type);
614 			kfree(data);
615 			continue;
616 		}
617 
618 		/* Process a channel message */
619 		if (hdr->ch_op == CM_DATA_MSG)
620 			rio_rx_data_handler(cm, data);
621 		else
622 			rio_cm_handler(cm, data);
623 	}
624 }
625 
626 static void riocm_inb_msg_event(struct rio_mport *mport, void *dev_id,
627 				int mbox, int slot)
628 {
629 	struct cm_dev *cm = dev_id;
630 
631 	if (rio_mport_is_running(cm->mport) && !work_pending(&cm->rx_work))
632 		queue_work(cm->rx_wq, &cm->rx_work);
633 }
634 
635 /*
636  * rio_txcq_handler - TX completion handler
637  * @cm: cm_dev object
638  * @slot: TX queue slot
639  *
640  * TX completion handler also ensures that pending request packets are placed
641  * into transmit queue as soon as a free slot becomes available. This is done
642  * to give higher priority to request packets during high intensity data flow.
643  */
644 static void rio_txcq_handler(struct cm_dev *cm, int slot)
645 {
646 	int ack_slot;
647 
648 	/* ATTN: Add TX completion notification if/when direct buffer
649 	 * transfer is implemented. At this moment only correct tracking
650 	 * of tx_count is important.
651 	 */
652 	riocm_debug(TX_EVENT, "for mport_%d slot %d tx_cnt %d",
653 		    cm->mport->id, slot, cm->tx_cnt);
654 
655 	spin_lock(&cm->tx_lock);
656 	ack_slot = cm->tx_ack_slot;
657 
658 	if (ack_slot == slot)
659 		riocm_debug(TX_EVENT, "slot == ack_slot");
660 
661 	while (cm->tx_cnt && ((ack_slot != slot) ||
662 	       (cm->tx_cnt == RIOCM_TX_RING_SIZE))) {
663 
664 		cm->tx_buf[ack_slot] = NULL;
665 		++ack_slot;
666 		ack_slot &= (RIOCM_TX_RING_SIZE - 1);
667 		cm->tx_cnt--;
668 	}
669 
670 	if (cm->tx_cnt < 0 || cm->tx_cnt > RIOCM_TX_RING_SIZE)
671 		riocm_error("tx_cnt %d out of sync", cm->tx_cnt);
672 
673 	WARN_ON((cm->tx_cnt < 0) || (cm->tx_cnt > RIOCM_TX_RING_SIZE));
674 
675 	cm->tx_ack_slot = ack_slot;
676 
677 	/*
678 	 * If there are pending requests, insert them into transmit queue
679 	 */
680 	if (!list_empty(&cm->tx_reqs) && (cm->tx_cnt < RIOCM_TX_RING_SIZE)) {
681 		struct tx_req *req, *_req;
682 		int rc;
683 
684 		list_for_each_entry_safe(req, _req, &cm->tx_reqs, node) {
685 			list_del(&req->node);
686 			cm->tx_buf[cm->tx_slot] = req->buffer;
687 			rc = rio_add_outb_message(cm->mport, req->rdev, cmbox,
688 						  req->buffer, req->len);
689 			kfree(req->buffer);
690 			kfree(req);
691 
692 			++cm->tx_cnt;
693 			++cm->tx_slot;
694 			cm->tx_slot &= (RIOCM_TX_RING_SIZE - 1);
695 			if (cm->tx_cnt == RIOCM_TX_RING_SIZE)
696 				break;
697 		}
698 	}
699 
700 	spin_unlock(&cm->tx_lock);
701 }
702 
703 static void riocm_outb_msg_event(struct rio_mport *mport, void *dev_id,
704 				 int mbox, int slot)
705 {
706 	struct cm_dev *cm = dev_id;
707 
708 	if (cm && rio_mport_is_running(cm->mport))
709 		rio_txcq_handler(cm, slot);
710 }
711 
712 static int riocm_queue_req(struct cm_dev *cm, struct rio_dev *rdev,
713 			   void *buffer, size_t len)
714 {
715 	unsigned long flags;
716 	struct tx_req *treq;
717 
718 	treq = kzalloc(sizeof(*treq), GFP_KERNEL);
719 	if (treq == NULL)
720 		return -ENOMEM;
721 
722 	treq->rdev = rdev;
723 	treq->buffer = buffer;
724 	treq->len = len;
725 
726 	spin_lock_irqsave(&cm->tx_lock, flags);
727 	list_add_tail(&treq->node, &cm->tx_reqs);
728 	spin_unlock_irqrestore(&cm->tx_lock, flags);
729 	return 0;
730 }
731 
732 /*
733  * riocm_post_send - helper function that places packet into msg TX queue
734  * @cm: cm_dev object
735  * @rdev: target RapidIO device object (required by outbound msg interface)
736  * @buffer: pointer to a packet buffer to send
737  * @len: length of data to transfer
738  * @req: request priority flag
739  *
740  * Returns: 0 if success, or error code otherwise.
741  */
742 static int riocm_post_send(struct cm_dev *cm, struct rio_dev *rdev,
743 			   void *buffer, size_t len)
744 {
745 	int rc;
746 	unsigned long flags;
747 
748 	spin_lock_irqsave(&cm->tx_lock, flags);
749 
750 	if (cm->mport == NULL) {
751 		rc = -ENODEV;
752 		goto err_out;
753 	}
754 
755 	if (cm->tx_cnt == RIOCM_TX_RING_SIZE) {
756 		riocm_debug(TX, "Tx Queue is full");
757 		rc = -EBUSY;
758 		goto err_out;
759 	}
760 
761 	cm->tx_buf[cm->tx_slot] = buffer;
762 	rc = rio_add_outb_message(cm->mport, rdev, cmbox, buffer, len);
763 
764 	riocm_debug(TX, "Add buf@%p destid=%x tx_slot=%d tx_cnt=%d",
765 		 buffer, rdev->destid, cm->tx_slot, cm->tx_cnt);
766 
767 	++cm->tx_cnt;
768 	++cm->tx_slot;
769 	cm->tx_slot &= (RIOCM_TX_RING_SIZE - 1);
770 
771 err_out:
772 	spin_unlock_irqrestore(&cm->tx_lock, flags);
773 	return rc;
774 }
775 
776 /*
777  * riocm_ch_send - sends a data packet to a remote device
778  * @ch_id: local channel ID
779  * @buf: pointer to a data buffer to send (including CM header)
780  * @len: length of data to transfer (including CM header)
781  *
782  * ATTN: ASSUMES THAT THE HEADER SPACE IS RESERVED PART OF THE DATA PACKET
783  *
784  * Returns: 0 if success, or
785  *          -EINVAL if one or more input parameters is/are not valid,
786  *          -ENODEV if cannot find a channel with specified ID,
787  *          -EAGAIN if a channel is not in CONNECTED state,
788  *	    + error codes returned by HW send routine.
789  */
790 static int riocm_ch_send(u16 ch_id, void *buf, int len)
791 {
792 	struct rio_channel *ch;
793 	struct rio_ch_chan_hdr *hdr;
794 	int ret;
795 
796 	if (buf == NULL || ch_id == 0 || len == 0 || len > RIO_MAX_MSG_SIZE)
797 		return -EINVAL;
798 
799 	ch = riocm_get_channel(ch_id);
800 	if (!ch) {
801 		riocm_error("%s(%d) ch_%d not found", current->comm,
802 			    task_pid_nr(current), ch_id);
803 		return -ENODEV;
804 	}
805 
806 	if (!riocm_cmp(ch, RIO_CM_CONNECTED)) {
807 		ret = -EAGAIN;
808 		goto err_out;
809 	}
810 
811 	/*
812 	 * Fill buffer header section with corresponding channel data
813 	 */
814 	hdr = buf;
815 
816 	hdr->bhdr.src_id = htonl(ch->loc_destid);
817 	hdr->bhdr.dst_id = htonl(ch->rem_destid);
818 	hdr->bhdr.src_mbox = cmbox;
819 	hdr->bhdr.dst_mbox = cmbox;
820 	hdr->bhdr.type = RIO_CM_CHAN;
821 	hdr->ch_op = CM_DATA_MSG;
822 	hdr->dst_ch = htons(ch->rem_channel);
823 	hdr->src_ch = htons(ch->id);
824 	hdr->msg_len = htons((u16)len);
825 
826 	/* ATTN: the function call below relies on the fact that underlying
827 	 * HW-specific add_outb_message() routine copies TX data into its own
828 	 * internal transfer buffer (true for all RIONET compatible mport
829 	 * drivers). Must be reviewed if mport driver uses the buffer directly.
830 	 */
831 
832 	ret = riocm_post_send(ch->cmdev, ch->rdev, buf, len);
833 	if (ret)
834 		riocm_debug(TX, "ch %d send_err=%d", ch->id, ret);
835 err_out:
836 	riocm_put_channel(ch);
837 	return ret;
838 }
839 
840 static int riocm_ch_free_rxbuf(struct rio_channel *ch, void *buf)
841 {
842 	int i, ret = -EINVAL;
843 
844 	spin_lock_bh(&ch->lock);
845 
846 	for (i = 0; i < RIOCM_RX_RING_SIZE; i++) {
847 		if (ch->rx_ring.inuse[i] == buf) {
848 			ch->rx_ring.inuse[i] = NULL;
849 			ch->rx_ring.inuse_cnt--;
850 			ret = 0;
851 			break;
852 		}
853 	}
854 
855 	spin_unlock_bh(&ch->lock);
856 
857 	if (!ret)
858 		kfree(buf);
859 
860 	return ret;
861 }
862 
863 /*
864  * riocm_ch_receive - fetch a data packet received for the specified channel
865  * @ch: local channel ID
866  * @buf: pointer to a packet buffer
867  * @timeout: timeout to wait for incoming packet (in jiffies)
868  *
869  * Returns: 0 and valid buffer pointer if success, or NULL pointer and one of:
870  *          -EAGAIN if a channel is not in CONNECTED state,
871  *          -ENOMEM if in-use tracking queue is full,
872  *          -ETIME if wait timeout expired,
873  *	    -EINTR if wait was interrupted.
874  */
875 static int riocm_ch_receive(struct rio_channel *ch, void **buf, long timeout)
876 {
877 	void *rxmsg = NULL;
878 	int i, ret = 0;
879 	long wret;
880 
881 	if (!riocm_cmp(ch, RIO_CM_CONNECTED)) {
882 		ret = -EAGAIN;
883 		goto out;
884 	}
885 
886 	if (ch->rx_ring.inuse_cnt == RIOCM_RX_RING_SIZE) {
887 		/* If we do not have entries to track buffers given to upper
888 		 * layer, reject request.
889 		 */
890 		ret = -ENOMEM;
891 		goto out;
892 	}
893 
894 	wret = wait_for_completion_interruptible_timeout(&ch->comp, timeout);
895 
896 	riocm_debug(WAIT, "wait on %d returned %ld", ch->id, wret);
897 
898 	if (!wret)
899 		ret = -ETIME;
900 	else if (wret == -ERESTARTSYS)
901 		ret = -EINTR;
902 	else
903 		ret = riocm_cmp(ch, RIO_CM_CONNECTED) ? 0 : -ECONNRESET;
904 
905 	if (ret)
906 		goto out;
907 
908 	spin_lock_bh(&ch->lock);
909 
910 	rxmsg = ch->rx_ring.buf[ch->rx_ring.tail];
911 	ch->rx_ring.buf[ch->rx_ring.tail] = NULL;
912 	ch->rx_ring.count--;
913 	ch->rx_ring.tail++;
914 	ch->rx_ring.tail %= RIOCM_RX_RING_SIZE;
915 	ret = -ENOMEM;
916 
917 	for (i = 0; i < RIOCM_RX_RING_SIZE; i++) {
918 		if (ch->rx_ring.inuse[i] == NULL) {
919 			ch->rx_ring.inuse[i] = rxmsg;
920 			ch->rx_ring.inuse_cnt++;
921 			ret = 0;
922 			break;
923 		}
924 	}
925 
926 	if (ret) {
927 		/* We have no entry to store pending message: drop it */
928 		kfree(rxmsg);
929 		rxmsg = NULL;
930 	}
931 
932 	spin_unlock_bh(&ch->lock);
933 out:
934 	*buf = rxmsg;
935 	return ret;
936 }
937 
938 /*
939  * riocm_ch_connect - sends a connect request to a remote device
940  * @loc_ch: local channel ID
941  * @cm: CM device to send connect request
942  * @peer: target RapidIO device
943  * @rem_ch: remote channel ID
944  *
945  * Returns: 0 if success, or
946  *          -EINVAL if the channel is not in IDLE state,
947  *          -EAGAIN if no connection request available immediately,
948  *          -ETIME if ACK response timeout expired,
949  *          -EINTR if wait for response was interrupted.
950  */
951 static int riocm_ch_connect(u16 loc_ch, struct cm_dev *cm,
952 			    struct cm_peer *peer, u16 rem_ch)
953 {
954 	struct rio_channel *ch = NULL;
955 	struct rio_ch_chan_hdr *hdr;
956 	int ret;
957 	long wret;
958 
959 	ch = riocm_get_channel(loc_ch);
960 	if (!ch)
961 		return -ENODEV;
962 
963 	if (!riocm_cmp_exch(ch, RIO_CM_IDLE, RIO_CM_CONNECT)) {
964 		ret = -EINVAL;
965 		goto conn_done;
966 	}
967 
968 	ch->cmdev = cm;
969 	ch->rdev = peer->rdev;
970 	ch->context = NULL;
971 	ch->loc_destid = cm->mport->host_deviceid;
972 	ch->rem_channel = rem_ch;
973 
974 	/*
975 	 * Send connect request to the remote RapidIO device
976 	 */
977 
978 	hdr = kzalloc(sizeof(*hdr), GFP_KERNEL);
979 	if (hdr == NULL) {
980 		ret = -ENOMEM;
981 		goto conn_done;
982 	}
983 
984 	hdr->bhdr.src_id = htonl(ch->loc_destid);
985 	hdr->bhdr.dst_id = htonl(peer->rdev->destid);
986 	hdr->bhdr.src_mbox = cmbox;
987 	hdr->bhdr.dst_mbox = cmbox;
988 	hdr->bhdr.type = RIO_CM_CHAN;
989 	hdr->ch_op = CM_CONN_REQ;
990 	hdr->dst_ch = htons(rem_ch);
991 	hdr->src_ch = htons(loc_ch);
992 
993 	/* ATTN: the function call below relies on the fact that underlying
994 	 * HW-specific add_outb_message() routine copies TX data into its
995 	 * internal transfer buffer. Must be reviewed if mport driver uses
996 	 * this buffer directly.
997 	 */
998 	ret = riocm_post_send(cm, peer->rdev, hdr, sizeof(*hdr));
999 
1000 	if (ret != -EBUSY) {
1001 		kfree(hdr);
1002 	} else {
1003 		ret = riocm_queue_req(cm, peer->rdev, hdr, sizeof(*hdr));
1004 		if (ret)
1005 			kfree(hdr);
1006 	}
1007 
1008 	if (ret) {
1009 		riocm_cmp_exch(ch, RIO_CM_CONNECT, RIO_CM_IDLE);
1010 		goto conn_done;
1011 	}
1012 
1013 	/* Wait for connect response from the remote device */
1014 	wret = wait_for_completion_interruptible_timeout(&ch->comp,
1015 							 RIOCM_CONNECT_TO * HZ);
1016 	riocm_debug(WAIT, "wait on %d returns %ld", ch->id, wret);
1017 
1018 	if (!wret)
1019 		ret = -ETIME;
1020 	else if (wret == -ERESTARTSYS)
1021 		ret = -EINTR;
1022 	else
1023 		ret = riocm_cmp(ch, RIO_CM_CONNECTED) ? 0 : -1;
1024 
1025 conn_done:
1026 	riocm_put_channel(ch);
1027 	return ret;
1028 }
1029 
1030 static int riocm_send_ack(struct rio_channel *ch)
1031 {
1032 	struct rio_ch_chan_hdr *hdr;
1033 	int ret;
1034 
1035 	hdr = kzalloc(sizeof(*hdr), GFP_KERNEL);
1036 	if (hdr == NULL)
1037 		return -ENOMEM;
1038 
1039 	hdr->bhdr.src_id = htonl(ch->loc_destid);
1040 	hdr->bhdr.dst_id = htonl(ch->rem_destid);
1041 	hdr->dst_ch = htons(ch->rem_channel);
1042 	hdr->src_ch = htons(ch->id);
1043 	hdr->bhdr.src_mbox = cmbox;
1044 	hdr->bhdr.dst_mbox = cmbox;
1045 	hdr->bhdr.type = RIO_CM_CHAN;
1046 	hdr->ch_op = CM_CONN_ACK;
1047 
1048 	/* ATTN: the function call below relies on the fact that underlying
1049 	 * add_outb_message() routine copies TX data into its internal transfer
1050 	 * buffer. Review if switching to direct buffer version.
1051 	 */
1052 	ret = riocm_post_send(ch->cmdev, ch->rdev, hdr, sizeof(*hdr));
1053 
1054 	if (ret == -EBUSY && !riocm_queue_req(ch->cmdev,
1055 					      ch->rdev, hdr, sizeof(*hdr)))
1056 		return 0;
1057 	kfree(hdr);
1058 
1059 	if (ret)
1060 		riocm_error("send ACK to ch_%d on %s failed (ret=%d)",
1061 			    ch->id, rio_name(ch->rdev), ret);
1062 	return ret;
1063 }
1064 
1065 /*
1066  * riocm_ch_accept - accept incoming connection request
1067  * @ch_id: channel ID
1068  * @new_ch_id: local mport device
1069  * @timeout: wait timeout (if 0 non-blocking call, do not wait if connection
1070  *           request is not available).
1071  *
1072  * Returns: pointer to new channel struct if success, or error-valued pointer:
1073  *          -ENODEV - cannot find specified channel or mport,
1074  *          -EINVAL - the channel is not in IDLE state,
1075  *          -EAGAIN - no connection request available immediately (timeout=0),
1076  *          -ENOMEM - unable to allocate new channel,
1077  *          -ETIME - wait timeout expired,
1078  *          -EINTR - wait was interrupted.
1079  */
1080 static struct rio_channel *riocm_ch_accept(u16 ch_id, u16 *new_ch_id,
1081 					   long timeout)
1082 {
1083 	struct rio_channel *ch;
1084 	struct rio_channel *new_ch;
1085 	struct conn_req *req;
1086 	struct cm_peer *peer;
1087 	int found = 0;
1088 	int err = 0;
1089 	long wret;
1090 
1091 	ch = riocm_get_channel(ch_id);
1092 	if (!ch)
1093 		return ERR_PTR(-EINVAL);
1094 
1095 	if (!riocm_cmp(ch, RIO_CM_LISTEN)) {
1096 		err = -EINVAL;
1097 		goto err_put;
1098 	}
1099 
1100 	/* Don't sleep if this is a non blocking call */
1101 	if (!timeout) {
1102 		if (!try_wait_for_completion(&ch->comp)) {
1103 			err = -EAGAIN;
1104 			goto err_put;
1105 		}
1106 	} else {
1107 		riocm_debug(WAIT, "on %d", ch->id);
1108 
1109 		wret = wait_for_completion_interruptible_timeout(&ch->comp,
1110 								 timeout);
1111 		if (!wret) {
1112 			err = -ETIME;
1113 			goto err_put;
1114 		} else if (wret == -ERESTARTSYS) {
1115 			err = -EINTR;
1116 			goto err_put;
1117 		}
1118 	}
1119 
1120 	spin_lock_bh(&ch->lock);
1121 
1122 	if (ch->state != RIO_CM_LISTEN) {
1123 		err = -ECANCELED;
1124 	} else if (list_empty(&ch->accept_queue)) {
1125 		riocm_debug(WAIT, "on %d accept_queue is empty on completion",
1126 			    ch->id);
1127 		err = -EIO;
1128 	}
1129 
1130 	spin_unlock_bh(&ch->lock);
1131 
1132 	if (err) {
1133 		riocm_debug(WAIT, "on %d returns %d", ch->id, err);
1134 		goto err_put;
1135 	}
1136 
1137 	/* Create new channel for this connection */
1138 	new_ch = riocm_ch_alloc(RIOCM_CHNUM_AUTO);
1139 
1140 	if (IS_ERR(new_ch)) {
1141 		riocm_error("failed to get channel for new req (%ld)",
1142 			PTR_ERR(new_ch));
1143 		err = -ENOMEM;
1144 		goto err_put;
1145 	}
1146 
1147 	spin_lock_bh(&ch->lock);
1148 
1149 	req = list_first_entry(&ch->accept_queue, struct conn_req, node);
1150 	list_del(&req->node);
1151 	new_ch->cmdev = ch->cmdev;
1152 	new_ch->loc_destid = ch->loc_destid;
1153 	new_ch->rem_destid = req->destid;
1154 	new_ch->rem_channel = req->chan;
1155 
1156 	spin_unlock_bh(&ch->lock);
1157 	riocm_put_channel(ch);
1158 	ch = NULL;
1159 	kfree(req);
1160 
1161 	down_read(&rdev_sem);
1162 	/* Find requester's device object */
1163 	list_for_each_entry(peer, &new_ch->cmdev->peers, node) {
1164 		if (peer->rdev->destid == new_ch->rem_destid) {
1165 			riocm_debug(RX_CMD, "found matching device(%s)",
1166 				    rio_name(peer->rdev));
1167 			found = 1;
1168 			break;
1169 		}
1170 	}
1171 	up_read(&rdev_sem);
1172 
1173 	if (!found) {
1174 		/* If peer device object not found, simply ignore the request */
1175 		err = -ENODEV;
1176 		goto err_put_new_ch;
1177 	}
1178 
1179 	new_ch->rdev = peer->rdev;
1180 	new_ch->state = RIO_CM_CONNECTED;
1181 	spin_lock_init(&new_ch->lock);
1182 
1183 	/* Acknowledge the connection request. */
1184 	riocm_send_ack(new_ch);
1185 
1186 	*new_ch_id = new_ch->id;
1187 	return new_ch;
1188 
1189 err_put_new_ch:
1190 	spin_lock_bh(&idr_lock);
1191 	idr_remove(&ch_idr, new_ch->id);
1192 	spin_unlock_bh(&idr_lock);
1193 	riocm_put_channel(new_ch);
1194 
1195 err_put:
1196 	if (ch)
1197 		riocm_put_channel(ch);
1198 	*new_ch_id = 0;
1199 	return ERR_PTR(err);
1200 }
1201 
1202 /*
1203  * riocm_ch_listen - puts a channel into LISTEN state
1204  * @ch_id: channel ID
1205  *
1206  * Returns: 0 if success, or
1207  *          -EINVAL if the specified channel does not exists or
1208  *                  is not in CHAN_BOUND state.
1209  */
1210 static int riocm_ch_listen(u16 ch_id)
1211 {
1212 	struct rio_channel *ch = NULL;
1213 	int ret = 0;
1214 
1215 	riocm_debug(CHOP, "(ch_%d)", ch_id);
1216 
1217 	ch = riocm_get_channel(ch_id);
1218 	if (!ch)
1219 		return -EINVAL;
1220 	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
1221 		ret = -EINVAL;
1222 	riocm_put_channel(ch);
1223 	return ret;
1224 }
1225 
1226 /*
1227  * riocm_ch_bind - associate a channel object and an mport device
1228  * @ch_id: channel ID
1229  * @mport_id: local mport device ID
1230  * @context: pointer to the additional caller's context
1231  *
1232  * Returns: 0 if success, or
1233  *          -ENODEV if cannot find specified mport,
1234  *          -EINVAL if the specified channel does not exist or
1235  *                  is not in IDLE state.
1236  */
1237 static int riocm_ch_bind(u16 ch_id, u8 mport_id, void *context)
1238 {
1239 	struct rio_channel *ch = NULL;
1240 	struct cm_dev *cm;
1241 	int rc = -ENODEV;
1242 
1243 	riocm_debug(CHOP, "ch_%d to mport_%d", ch_id, mport_id);
1244 
1245 	/* Find matching cm_dev object */
1246 	down_read(&rdev_sem);
1247 	list_for_each_entry(cm, &cm_dev_list, list) {
1248 		if ((cm->mport->id == mport_id) &&
1249 		     rio_mport_is_running(cm->mport)) {
1250 			rc = 0;
1251 			break;
1252 		}
1253 	}
1254 
1255 	if (rc)
1256 		goto exit;
1257 
1258 	ch = riocm_get_channel(ch_id);
1259 	if (!ch) {
1260 		rc = -EINVAL;
1261 		goto exit;
1262 	}
1263 
1264 	spin_lock_bh(&ch->lock);
1265 	if (ch->state != RIO_CM_IDLE) {
1266 		spin_unlock_bh(&ch->lock);
1267 		rc = -EINVAL;
1268 		goto err_put;
1269 	}
1270 
1271 	ch->cmdev = cm;
1272 	ch->loc_destid = cm->mport->host_deviceid;
1273 	ch->context = context;
1274 	ch->state = RIO_CM_CHAN_BOUND;
1275 	spin_unlock_bh(&ch->lock);
1276 err_put:
1277 	riocm_put_channel(ch);
1278 exit:
1279 	up_read(&rdev_sem);
1280 	return rc;
1281 }
1282 
1283 /*
1284  * riocm_ch_alloc - channel object allocation helper routine
1285  * @ch_num: channel ID (1 ... RIOCM_MAX_CHNUM, 0 = automatic)
1286  *
1287  * Return value: pointer to newly created channel object,
1288  *               or error-valued pointer
1289  */
1290 static struct rio_channel *riocm_ch_alloc(u16 ch_num)
1291 {
1292 	int id;
1293 	int start, end;
1294 	struct rio_channel *ch;
1295 
1296 	ch = kzalloc(sizeof(*ch), GFP_KERNEL);
1297 	if (!ch)
1298 		return ERR_PTR(-ENOMEM);
1299 
1300 	if (ch_num) {
1301 		/* If requested, try to obtain the specified channel ID */
1302 		start = ch_num;
1303 		end = ch_num + 1;
1304 	} else {
1305 		/* Obtain channel ID from the dynamic allocation range */
1306 		start = chstart;
1307 		end = RIOCM_MAX_CHNUM + 1;
1308 	}
1309 
1310 	idr_preload(GFP_KERNEL);
1311 	spin_lock_bh(&idr_lock);
1312 	id = idr_alloc_cyclic(&ch_idr, ch, start, end, GFP_NOWAIT);
1313 	spin_unlock_bh(&idr_lock);
1314 	idr_preload_end();
1315 
1316 	if (id < 0) {
1317 		kfree(ch);
1318 		return ERR_PTR(id == -ENOSPC ? -EBUSY : id);
1319 	}
1320 
1321 	ch->id = (u16)id;
1322 	ch->state = RIO_CM_IDLE;
1323 	spin_lock_init(&ch->lock);
1324 	INIT_LIST_HEAD(&ch->accept_queue);
1325 	INIT_LIST_HEAD(&ch->ch_node);
1326 	init_completion(&ch->comp);
1327 	init_completion(&ch->comp_close);
1328 	kref_init(&ch->ref);
1329 	ch->rx_ring.head = 0;
1330 	ch->rx_ring.tail = 0;
1331 	ch->rx_ring.count = 0;
1332 	ch->rx_ring.inuse_cnt = 0;
1333 
1334 	return ch;
1335 }
1336 
1337 /*
1338  * riocm_ch_create - creates a new channel object and allocates ID for it
1339  * @ch_num: channel ID (1 ... RIOCM_MAX_CHNUM, 0 = automatic)
1340  *
1341  * Allocates and initializes a new channel object. If the parameter ch_num > 0
1342  * and is within the valid range, riocm_ch_create tries to allocate the
1343  * specified ID for the new channel. If ch_num = 0, channel ID will be assigned
1344  * automatically from the range (chstart ... RIOCM_MAX_CHNUM).
1345  * Module parameter 'chstart' defines start of an ID range available for dynamic
1346  * allocation. Range below 'chstart' is reserved for pre-defined ID numbers.
1347  * Available channel numbers are limited by 16-bit size of channel numbers used
1348  * in the packet header.
1349  *
1350  * Return value: PTR to rio_channel structure if successful (with channel number
1351  *               updated via pointer) or error-valued pointer if error.
1352  */
1353 static struct rio_channel *riocm_ch_create(u16 *ch_num)
1354 {
1355 	struct rio_channel *ch = NULL;
1356 
1357 	ch = riocm_ch_alloc(*ch_num);
1358 
1359 	if (IS_ERR(ch))
1360 		riocm_debug(CHOP, "Failed to allocate channel %d (err=%ld)",
1361 			    *ch_num, PTR_ERR(ch));
1362 	else
1363 		*ch_num = ch->id;
1364 
1365 	return ch;
1366 }
1367 
1368 /*
1369  * riocm_ch_free - channel object release routine
1370  * @ref: pointer to a channel's kref structure
1371  */
1372 static void riocm_ch_free(struct kref *ref)
1373 {
1374 	struct rio_channel *ch = container_of(ref, struct rio_channel, ref);
1375 	int i;
1376 
1377 	riocm_debug(CHOP, "(ch_%d)", ch->id);
1378 
1379 	if (ch->rx_ring.inuse_cnt) {
1380 		for (i = 0;
1381 		     i < RIOCM_RX_RING_SIZE && ch->rx_ring.inuse_cnt; i++) {
1382 			if (ch->rx_ring.inuse[i] != NULL) {
1383 				kfree(ch->rx_ring.inuse[i]);
1384 				ch->rx_ring.inuse_cnt--;
1385 			}
1386 		}
1387 	}
1388 
1389 	if (ch->rx_ring.count)
1390 		for (i = 0; i < RIOCM_RX_RING_SIZE && ch->rx_ring.count; i++) {
1391 			if (ch->rx_ring.buf[i] != NULL) {
1392 				kfree(ch->rx_ring.buf[i]);
1393 				ch->rx_ring.count--;
1394 			}
1395 		}
1396 
1397 	complete(&ch->comp_close);
1398 }
1399 
1400 static int riocm_send_close(struct rio_channel *ch)
1401 {
1402 	struct rio_ch_chan_hdr *hdr;
1403 	int ret;
1404 
1405 	/*
1406 	 * Send CH_CLOSE notification to the remote RapidIO device
1407 	 */
1408 
1409 	hdr = kzalloc(sizeof(*hdr), GFP_KERNEL);
1410 	if (hdr == NULL)
1411 		return -ENOMEM;
1412 
1413 	hdr->bhdr.src_id = htonl(ch->loc_destid);
1414 	hdr->bhdr.dst_id = htonl(ch->rem_destid);
1415 	hdr->bhdr.src_mbox = cmbox;
1416 	hdr->bhdr.dst_mbox = cmbox;
1417 	hdr->bhdr.type = RIO_CM_CHAN;
1418 	hdr->ch_op = CM_CONN_CLOSE;
1419 	hdr->dst_ch = htons(ch->rem_channel);
1420 	hdr->src_ch = htons(ch->id);
1421 
1422 	/* ATTN: the function call below relies on the fact that underlying
1423 	 * add_outb_message() routine copies TX data into its internal transfer
1424 	 * buffer. Needs to be reviewed if switched to direct buffer mode.
1425 	 */
1426 	ret = riocm_post_send(ch->cmdev, ch->rdev, hdr, sizeof(*hdr));
1427 
1428 	if (ret == -EBUSY && !riocm_queue_req(ch->cmdev, ch->rdev,
1429 					      hdr, sizeof(*hdr)))
1430 		return 0;
1431 	kfree(hdr);
1432 
1433 	if (ret)
1434 		riocm_error("ch(%d) send CLOSE failed (ret=%d)", ch->id, ret);
1435 
1436 	return ret;
1437 }
1438 
1439 /*
1440  * riocm_ch_close - closes a channel object with specified ID (by local request)
1441  * @ch: channel to be closed
1442  */
1443 static int riocm_ch_close(struct rio_channel *ch)
1444 {
1445 	unsigned long tmo = msecs_to_jiffies(3000);
1446 	enum rio_cm_state state;
1447 	long wret;
1448 	int ret = 0;
1449 
1450 	riocm_debug(CHOP, "ch_%d by %s(%d)",
1451 		    ch->id, current->comm, task_pid_nr(current));
1452 
1453 	state = riocm_exch(ch, RIO_CM_DESTROYING);
1454 	if (state == RIO_CM_CONNECTED)
1455 		riocm_send_close(ch);
1456 
1457 	complete_all(&ch->comp);
1458 
1459 	riocm_put_channel(ch);
1460 	wret = wait_for_completion_interruptible_timeout(&ch->comp_close, tmo);
1461 
1462 	riocm_debug(WAIT, "wait on %d returns %ld", ch->id, wret);
1463 
1464 	if (wret == 0) {
1465 		/* Timeout on wait occurred */
1466 		riocm_debug(CHOP, "%s(%d) timed out waiting for ch %d",
1467 		       current->comm, task_pid_nr(current), ch->id);
1468 		ret = -ETIMEDOUT;
1469 	} else if (wret == -ERESTARTSYS) {
1470 		/* Wait_for_completion was interrupted by a signal */
1471 		riocm_debug(CHOP, "%s(%d) wait for ch %d was interrupted",
1472 			current->comm, task_pid_nr(current), ch->id);
1473 		ret = -EINTR;
1474 	}
1475 
1476 	if (!ret) {
1477 		riocm_debug(CHOP, "ch_%d resources released", ch->id);
1478 		kfree(ch);
1479 	} else {
1480 		riocm_debug(CHOP, "failed to release ch_%d resources", ch->id);
1481 	}
1482 
1483 	return ret;
1484 }
1485 
1486 /*
1487  * riocm_cdev_open() - Open character device
1488  */
1489 static int riocm_cdev_open(struct inode *inode, struct file *filp)
1490 {
1491 	riocm_debug(INIT, "by %s(%d) filp=%p ",
1492 		    current->comm, task_pid_nr(current), filp);
1493 
1494 	if (list_empty(&cm_dev_list))
1495 		return -ENODEV;
1496 
1497 	return 0;
1498 }
1499 
1500 /*
1501  * riocm_cdev_release() - Release character device
1502  */
1503 static int riocm_cdev_release(struct inode *inode, struct file *filp)
1504 {
1505 	struct rio_channel *ch, *_c;
1506 	unsigned int i;
1507 	LIST_HEAD(list);
1508 
1509 	riocm_debug(EXIT, "by %s(%d) filp=%p",
1510 		    current->comm, task_pid_nr(current), filp);
1511 
1512 	/* Check if there are channels associated with this file descriptor */
1513 	spin_lock_bh(&idr_lock);
1514 	idr_for_each_entry(&ch_idr, ch, i) {
1515 		if (ch && ch->filp == filp) {
1516 			riocm_debug(EXIT, "ch_%d not released by %s(%d)",
1517 				    ch->id, current->comm,
1518 				    task_pid_nr(current));
1519 			idr_remove(&ch_idr, ch->id);
1520 			list_add(&ch->ch_node, &list);
1521 		}
1522 	}
1523 	spin_unlock_bh(&idr_lock);
1524 
1525 	if (!list_empty(&list)) {
1526 		list_for_each_entry_safe(ch, _c, &list, ch_node) {
1527 			list_del(&ch->ch_node);
1528 			riocm_ch_close(ch);
1529 		}
1530 	}
1531 
1532 	return 0;
1533 }
1534 
1535 /*
1536  * cm_ep_get_list_size() - Reports number of endpoints in the network
1537  */
1538 static int cm_ep_get_list_size(void __user *arg)
1539 {
1540 	u32 __user *p = arg;
1541 	u32 mport_id;
1542 	u32 count = 0;
1543 	struct cm_dev *cm;
1544 
1545 	if (get_user(mport_id, p))
1546 		return -EFAULT;
1547 	if (mport_id >= RIO_MAX_MPORTS)
1548 		return -EINVAL;
1549 
1550 	/* Find a matching cm_dev object */
1551 	down_read(&rdev_sem);
1552 	list_for_each_entry(cm, &cm_dev_list, list) {
1553 		if (cm->mport->id == mport_id) {
1554 			count = cm->npeers;
1555 			up_read(&rdev_sem);
1556 			if (copy_to_user(arg, &count, sizeof(u32)))
1557 				return -EFAULT;
1558 			return 0;
1559 		}
1560 	}
1561 	up_read(&rdev_sem);
1562 
1563 	return -ENODEV;
1564 }
1565 
1566 /*
1567  * cm_ep_get_list() - Returns list of attached endpoints
1568  */
1569 static int cm_ep_get_list(void __user *arg)
1570 {
1571 	struct cm_dev *cm;
1572 	struct cm_peer *peer;
1573 	u32 info[2];
1574 	void *buf;
1575 	u32 nent;
1576 	u32 *entry_ptr;
1577 	u32 i = 0;
1578 	int ret = 0;
1579 
1580 	if (copy_from_user(&info, arg, sizeof(info)))
1581 		return -EFAULT;
1582 
1583 	if (info[1] >= RIO_MAX_MPORTS || info[0] > RIOCM_MAX_EP_COUNT)
1584 		return -EINVAL;
1585 
1586 	/* Find a matching cm_dev object */
1587 	down_read(&rdev_sem);
1588 	list_for_each_entry(cm, &cm_dev_list, list)
1589 		if (cm->mport->id == (u8)info[1])
1590 			goto found;
1591 
1592 	up_read(&rdev_sem);
1593 	return -ENODEV;
1594 
1595 found:
1596 	nent = min(info[0], cm->npeers);
1597 	buf = kcalloc(nent + 2, sizeof(u32), GFP_KERNEL);
1598 	if (!buf) {
1599 		up_read(&rdev_sem);
1600 		return -ENOMEM;
1601 	}
1602 
1603 	entry_ptr = (u32 *)((uintptr_t)buf + 2*sizeof(u32));
1604 
1605 	list_for_each_entry(peer, &cm->peers, node) {
1606 		*entry_ptr = (u32)peer->rdev->destid;
1607 		entry_ptr++;
1608 		if (++i == nent)
1609 			break;
1610 	}
1611 	up_read(&rdev_sem);
1612 
1613 	((u32 *)buf)[0] = i; /* report an updated number of entries */
1614 	((u32 *)buf)[1] = info[1]; /* put back an mport ID */
1615 	if (copy_to_user(arg, buf, sizeof(u32) * (info[0] + 2)))
1616 		ret = -EFAULT;
1617 
1618 	kfree(buf);
1619 	return ret;
1620 }
1621 
1622 /*
1623  * cm_mport_get_list() - Returns list of available local mport devices
1624  */
1625 static int cm_mport_get_list(void __user *arg)
1626 {
1627 	int ret = 0;
1628 	u32 entries;
1629 	void *buf;
1630 	struct cm_dev *cm;
1631 	u32 *entry_ptr;
1632 	int count = 0;
1633 
1634 	if (copy_from_user(&entries, arg, sizeof(entries)))
1635 		return -EFAULT;
1636 	if (entries == 0 || entries > RIO_MAX_MPORTS)
1637 		return -EINVAL;
1638 	buf = kcalloc(entries + 1, sizeof(u32), GFP_KERNEL);
1639 	if (!buf)
1640 		return -ENOMEM;
1641 
1642 	/* Scan all registered cm_dev objects */
1643 	entry_ptr = (u32 *)((uintptr_t)buf + sizeof(u32));
1644 	down_read(&rdev_sem);
1645 	list_for_each_entry(cm, &cm_dev_list, list) {
1646 		if (count++ < entries) {
1647 			*entry_ptr = (cm->mport->id << 16) |
1648 				      cm->mport->host_deviceid;
1649 			entry_ptr++;
1650 		}
1651 	}
1652 	up_read(&rdev_sem);
1653 
1654 	*((u32 *)buf) = count; /* report a real number of entries */
1655 	if (copy_to_user(arg, buf, sizeof(u32) * (count + 1)))
1656 		ret = -EFAULT;
1657 
1658 	kfree(buf);
1659 	return ret;
1660 }
1661 
1662 /*
1663  * cm_chan_create() - Create a message exchange channel
1664  */
1665 static int cm_chan_create(struct file *filp, void __user *arg)
1666 {
1667 	u16 __user *p = arg;
1668 	u16 ch_num;
1669 	struct rio_channel *ch;
1670 
1671 	if (get_user(ch_num, p))
1672 		return -EFAULT;
1673 
1674 	riocm_debug(CHOP, "ch_%d requested by %s(%d)",
1675 		    ch_num, current->comm, task_pid_nr(current));
1676 	ch = riocm_ch_create(&ch_num);
1677 	if (IS_ERR(ch))
1678 		return PTR_ERR(ch);
1679 
1680 	ch->filp = filp;
1681 	riocm_debug(CHOP, "ch_%d created by %s(%d)",
1682 		    ch_num, current->comm, task_pid_nr(current));
1683 	return put_user(ch_num, p);
1684 }
1685 
1686 /*
1687  * cm_chan_close() - Close channel
1688  * @filp:	Pointer to file object
1689  * @arg:	Channel to close
1690  */
1691 static int cm_chan_close(struct file *filp, void __user *arg)
1692 {
1693 	u16 __user *p = arg;
1694 	u16 ch_num;
1695 	struct rio_channel *ch;
1696 
1697 	if (get_user(ch_num, p))
1698 		return -EFAULT;
1699 
1700 	riocm_debug(CHOP, "ch_%d by %s(%d)",
1701 		    ch_num, current->comm, task_pid_nr(current));
1702 
1703 	spin_lock_bh(&idr_lock);
1704 	ch = idr_find(&ch_idr, ch_num);
1705 	if (!ch) {
1706 		spin_unlock_bh(&idr_lock);
1707 		return 0;
1708 	}
1709 	if (ch->filp != filp) {
1710 		spin_unlock_bh(&idr_lock);
1711 		return -EINVAL;
1712 	}
1713 	idr_remove(&ch_idr, ch->id);
1714 	spin_unlock_bh(&idr_lock);
1715 
1716 	return riocm_ch_close(ch);
1717 }
1718 
1719 /*
1720  * cm_chan_bind() - Bind channel
1721  * @arg:	Channel number
1722  */
1723 static int cm_chan_bind(void __user *arg)
1724 {
1725 	struct rio_cm_channel chan;
1726 
1727 	if (copy_from_user(&chan, arg, sizeof(chan)))
1728 		return -EFAULT;
1729 	if (chan.mport_id >= RIO_MAX_MPORTS)
1730 		return -EINVAL;
1731 
1732 	return riocm_ch_bind(chan.id, chan.mport_id, NULL);
1733 }
1734 
1735 /*
1736  * cm_chan_listen() - Listen on channel
1737  * @arg:	Channel number
1738  */
1739 static int cm_chan_listen(void __user *arg)
1740 {
1741 	u16 __user *p = arg;
1742 	u16 ch_num;
1743 
1744 	if (get_user(ch_num, p))
1745 		return -EFAULT;
1746 
1747 	return riocm_ch_listen(ch_num);
1748 }
1749 
1750 /*
1751  * cm_chan_accept() - Accept incoming connection
1752  * @filp:	Pointer to file object
1753  * @arg:	Channel number
1754  */
1755 static int cm_chan_accept(struct file *filp, void __user *arg)
1756 {
1757 	struct rio_cm_accept param;
1758 	long accept_to;
1759 	struct rio_channel *ch;
1760 
1761 	if (copy_from_user(&param, arg, sizeof(param)))
1762 		return -EFAULT;
1763 
1764 	riocm_debug(CHOP, "on ch_%d by %s(%d)",
1765 		    param.ch_num, current->comm, task_pid_nr(current));
1766 
1767 	accept_to = param.wait_to ?
1768 			msecs_to_jiffies(param.wait_to) : 0;
1769 
1770 	ch = riocm_ch_accept(param.ch_num, &param.ch_num, accept_to);
1771 	if (IS_ERR(ch))
1772 		return PTR_ERR(ch);
1773 	ch->filp = filp;
1774 
1775 	riocm_debug(CHOP, "new ch_%d for %s(%d)",
1776 		    ch->id, current->comm, task_pid_nr(current));
1777 
1778 	if (copy_to_user(arg, &param, sizeof(param)))
1779 		return -EFAULT;
1780 	return 0;
1781 }
1782 
1783 /*
1784  * cm_chan_connect() - Connect on channel
1785  * @arg:	Channel information
1786  */
1787 static int cm_chan_connect(void __user *arg)
1788 {
1789 	struct rio_cm_channel chan;
1790 	struct cm_dev *cm;
1791 	struct cm_peer *peer;
1792 	int ret = -ENODEV;
1793 
1794 	if (copy_from_user(&chan, arg, sizeof(chan)))
1795 		return -EFAULT;
1796 	if (chan.mport_id >= RIO_MAX_MPORTS)
1797 		return -EINVAL;
1798 
1799 	down_read(&rdev_sem);
1800 
1801 	/* Find matching cm_dev object */
1802 	list_for_each_entry(cm, &cm_dev_list, list) {
1803 		if (cm->mport->id == chan.mport_id) {
1804 			ret = 0;
1805 			break;
1806 		}
1807 	}
1808 
1809 	if (ret)
1810 		goto err_out;
1811 
1812 	if (chan.remote_destid >= RIO_ANY_DESTID(cm->mport->sys_size)) {
1813 		ret = -EINVAL;
1814 		goto err_out;
1815 	}
1816 
1817 	/* Find corresponding RapidIO endpoint device object */
1818 	ret = -ENODEV;
1819 
1820 	list_for_each_entry(peer, &cm->peers, node) {
1821 		if (peer->rdev->destid == chan.remote_destid) {
1822 			ret = 0;
1823 			break;
1824 		}
1825 	}
1826 
1827 	if (ret)
1828 		goto err_out;
1829 
1830 	up_read(&rdev_sem);
1831 
1832 	return riocm_ch_connect(chan.id, cm, peer, chan.remote_channel);
1833 err_out:
1834 	up_read(&rdev_sem);
1835 	return ret;
1836 }
1837 
1838 /*
1839  * cm_chan_msg_send() - Send a message through channel
1840  * @arg:	Outbound message information
1841  */
1842 static int cm_chan_msg_send(void __user *arg)
1843 {
1844 	struct rio_cm_msg msg;
1845 	void *buf;
1846 	int ret;
1847 
1848 	if (copy_from_user(&msg, arg, sizeof(msg)))
1849 		return -EFAULT;
1850 	if (msg.size > RIO_MAX_MSG_SIZE)
1851 		return -EINVAL;
1852 
1853 	buf = memdup_user((void __user *)(uintptr_t)msg.msg, msg.size);
1854 	if (IS_ERR(buf))
1855 		return PTR_ERR(buf);
1856 
1857 	ret = riocm_ch_send(msg.ch_num, buf, msg.size);
1858 
1859 	kfree(buf);
1860 	return ret;
1861 }
1862 
1863 /*
1864  * cm_chan_msg_rcv() - Receive a message through channel
1865  * @arg:	Inbound message information
1866  */
1867 static int cm_chan_msg_rcv(void __user *arg)
1868 {
1869 	struct rio_cm_msg msg;
1870 	struct rio_channel *ch;
1871 	void *buf;
1872 	long rxto;
1873 	int ret = 0, msg_size;
1874 
1875 	if (copy_from_user(&msg, arg, sizeof(msg)))
1876 		return -EFAULT;
1877 
1878 	if (msg.ch_num == 0 || msg.size == 0)
1879 		return -EINVAL;
1880 
1881 	ch = riocm_get_channel(msg.ch_num);
1882 	if (!ch)
1883 		return -ENODEV;
1884 
1885 	rxto = msg.rxto ? msecs_to_jiffies(msg.rxto) : MAX_SCHEDULE_TIMEOUT;
1886 
1887 	ret = riocm_ch_receive(ch, &buf, rxto);
1888 	if (ret)
1889 		goto out;
1890 
1891 	msg_size = min(msg.size, (u16)(RIO_MAX_MSG_SIZE));
1892 
1893 	if (copy_to_user((void __user *)(uintptr_t)msg.msg, buf, msg_size))
1894 		ret = -EFAULT;
1895 
1896 	riocm_ch_free_rxbuf(ch, buf);
1897 out:
1898 	riocm_put_channel(ch);
1899 	return ret;
1900 }
1901 
1902 /*
1903  * riocm_cdev_ioctl() - IOCTL requests handler
1904  */
1905 static long
1906 riocm_cdev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
1907 {
1908 	switch (cmd) {
1909 	case RIO_CM_EP_GET_LIST_SIZE:
1910 		return cm_ep_get_list_size((void __user *)arg);
1911 	case RIO_CM_EP_GET_LIST:
1912 		return cm_ep_get_list((void __user *)arg);
1913 	case RIO_CM_CHAN_CREATE:
1914 		return cm_chan_create(filp, (void __user *)arg);
1915 	case RIO_CM_CHAN_CLOSE:
1916 		return cm_chan_close(filp, (void __user *)arg);
1917 	case RIO_CM_CHAN_BIND:
1918 		return cm_chan_bind((void __user *)arg);
1919 	case RIO_CM_CHAN_LISTEN:
1920 		return cm_chan_listen((void __user *)arg);
1921 	case RIO_CM_CHAN_ACCEPT:
1922 		return cm_chan_accept(filp, (void __user *)arg);
1923 	case RIO_CM_CHAN_CONNECT:
1924 		return cm_chan_connect((void __user *)arg);
1925 	case RIO_CM_CHAN_SEND:
1926 		return cm_chan_msg_send((void __user *)arg);
1927 	case RIO_CM_CHAN_RECEIVE:
1928 		return cm_chan_msg_rcv((void __user *)arg);
1929 	case RIO_CM_MPORT_GET_LIST:
1930 		return cm_mport_get_list((void __user *)arg);
1931 	default:
1932 		break;
1933 	}
1934 
1935 	return -EINVAL;
1936 }
1937 
1938 static const struct file_operations riocm_cdev_fops = {
1939 	.owner		= THIS_MODULE,
1940 	.open		= riocm_cdev_open,
1941 	.release	= riocm_cdev_release,
1942 	.unlocked_ioctl = riocm_cdev_ioctl,
1943 };
1944 
1945 /*
1946  * riocm_add_dev - add new remote RapidIO device into channel management core
1947  * @dev: device object associated with RapidIO device
1948  * @sif: subsystem interface
1949  *
1950  * Adds the specified RapidIO device (if applicable) into peers list of
1951  * the corresponding channel management device (cm_dev).
1952  */
1953 static int riocm_add_dev(struct device *dev, struct subsys_interface *sif)
1954 {
1955 	struct cm_peer *peer;
1956 	struct rio_dev *rdev = to_rio_dev(dev);
1957 	struct cm_dev *cm;
1958 
1959 	/* Check if the remote device has capabilities required to support CM */
1960 	if (!dev_cm_capable(rdev))
1961 		return 0;
1962 
1963 	riocm_debug(RDEV, "(%s)", rio_name(rdev));
1964 
1965 	peer = kmalloc(sizeof(*peer), GFP_KERNEL);
1966 	if (!peer)
1967 		return -ENOMEM;
1968 
1969 	/* Find a corresponding cm_dev object */
1970 	down_write(&rdev_sem);
1971 	list_for_each_entry(cm, &cm_dev_list, list) {
1972 		if (cm->mport == rdev->net->hport)
1973 			goto found;
1974 	}
1975 
1976 	up_write(&rdev_sem);
1977 	kfree(peer);
1978 	return -ENODEV;
1979 
1980 found:
1981 	peer->rdev = rdev;
1982 	list_add_tail(&peer->node, &cm->peers);
1983 	cm->npeers++;
1984 
1985 	up_write(&rdev_sem);
1986 	return 0;
1987 }
1988 
1989 /*
1990  * riocm_remove_dev - remove remote RapidIO device from channel management core
1991  * @dev: device object associated with RapidIO device
1992  * @sif: subsystem interface
1993  *
1994  * Removes the specified RapidIO device (if applicable) from peers list of
1995  * the corresponding channel management device (cm_dev).
1996  */
1997 static void riocm_remove_dev(struct device *dev, struct subsys_interface *sif)
1998 {
1999 	struct rio_dev *rdev = to_rio_dev(dev);
2000 	struct cm_dev *cm;
2001 	struct cm_peer *peer;
2002 	struct rio_channel *ch, *_c;
2003 	unsigned int i;
2004 	bool found = false;
2005 	LIST_HEAD(list);
2006 
2007 	/* Check if the remote device has capabilities required to support CM */
2008 	if (!dev_cm_capable(rdev))
2009 		return;
2010 
2011 	riocm_debug(RDEV, "(%s)", rio_name(rdev));
2012 
2013 	/* Find matching cm_dev object */
2014 	down_write(&rdev_sem);
2015 	list_for_each_entry(cm, &cm_dev_list, list) {
2016 		if (cm->mport == rdev->net->hport) {
2017 			found = true;
2018 			break;
2019 		}
2020 	}
2021 
2022 	if (!found) {
2023 		up_write(&rdev_sem);
2024 		return;
2025 	}
2026 
2027 	/* Remove remote device from the list of peers */
2028 	found = false;
2029 	list_for_each_entry(peer, &cm->peers, node) {
2030 		if (peer->rdev == rdev) {
2031 			riocm_debug(RDEV, "removing peer %s", rio_name(rdev));
2032 			found = true;
2033 			list_del(&peer->node);
2034 			cm->npeers--;
2035 			kfree(peer);
2036 			break;
2037 		}
2038 	}
2039 
2040 	up_write(&rdev_sem);
2041 
2042 	if (!found)
2043 		return;
2044 
2045 	/*
2046 	 * Release channels associated with this peer
2047 	 */
2048 
2049 	spin_lock_bh(&idr_lock);
2050 	idr_for_each_entry(&ch_idr, ch, i) {
2051 		if (ch && ch->rdev == rdev) {
2052 			if (atomic_read(&rdev->state) != RIO_DEVICE_SHUTDOWN)
2053 				riocm_exch(ch, RIO_CM_DISCONNECT);
2054 			idr_remove(&ch_idr, ch->id);
2055 			list_add(&ch->ch_node, &list);
2056 		}
2057 	}
2058 	spin_unlock_bh(&idr_lock);
2059 
2060 	if (!list_empty(&list)) {
2061 		list_for_each_entry_safe(ch, _c, &list, ch_node) {
2062 			list_del(&ch->ch_node);
2063 			riocm_ch_close(ch);
2064 		}
2065 	}
2066 }
2067 
2068 /*
2069  * riocm_cdev_add() - Create rio_cm char device
2070  * @devno: device number assigned to device (MAJ + MIN)
2071  */
2072 static int riocm_cdev_add(dev_t devno)
2073 {
2074 	int ret;
2075 
2076 	cdev_init(&riocm_cdev.cdev, &riocm_cdev_fops);
2077 	riocm_cdev.cdev.owner = THIS_MODULE;
2078 	ret = cdev_add(&riocm_cdev.cdev, devno, 1);
2079 	if (ret < 0) {
2080 		riocm_error("Cannot register a device with error %d", ret);
2081 		return ret;
2082 	}
2083 
2084 	riocm_cdev.dev = device_create(dev_class, NULL, devno, NULL, DEV_NAME);
2085 	if (IS_ERR(riocm_cdev.dev)) {
2086 		cdev_del(&riocm_cdev.cdev);
2087 		return PTR_ERR(riocm_cdev.dev);
2088 	}
2089 
2090 	riocm_debug(MPORT, "Added %s cdev(%d:%d)",
2091 		    DEV_NAME, MAJOR(devno), MINOR(devno));
2092 
2093 	return 0;
2094 }
2095 
2096 /*
2097  * riocm_add_mport - add new local mport device into channel management core
2098  * @dev: device object associated with mport
2099  * @class_intf: class interface
2100  *
2101  * When a new mport device is added, CM immediately reserves inbound and
2102  * outbound RapidIO mailboxes that will be used.
2103  */
2104 static int riocm_add_mport(struct device *dev,
2105 			   struct class_interface *class_intf)
2106 {
2107 	int rc;
2108 	int i;
2109 	struct cm_dev *cm;
2110 	struct rio_mport *mport = to_rio_mport(dev);
2111 
2112 	riocm_debug(MPORT, "add mport %s", mport->name);
2113 
2114 	cm = kzalloc(sizeof(*cm), GFP_KERNEL);
2115 	if (!cm)
2116 		return -ENOMEM;
2117 
2118 	cm->mport = mport;
2119 
2120 	rc = rio_request_outb_mbox(mport, cm, cmbox,
2121 				   RIOCM_TX_RING_SIZE, riocm_outb_msg_event);
2122 	if (rc) {
2123 		riocm_error("failed to allocate OBMBOX_%d on %s",
2124 			    cmbox, mport->name);
2125 		kfree(cm);
2126 		return -ENODEV;
2127 	}
2128 
2129 	rc = rio_request_inb_mbox(mport, cm, cmbox,
2130 				  RIOCM_RX_RING_SIZE, riocm_inb_msg_event);
2131 	if (rc) {
2132 		riocm_error("failed to allocate IBMBOX_%d on %s",
2133 			    cmbox, mport->name);
2134 		rio_release_outb_mbox(mport, cmbox);
2135 		kfree(cm);
2136 		return -ENODEV;
2137 	}
2138 
2139 	/*
2140 	 * Allocate and register inbound messaging buffers to be ready
2141 	 * to receive channel and system management requests
2142 	 */
2143 	for (i = 0; i < RIOCM_RX_RING_SIZE; i++)
2144 		cm->rx_buf[i] = NULL;
2145 
2146 	cm->rx_slots = RIOCM_RX_RING_SIZE;
2147 	mutex_init(&cm->rx_lock);
2148 	riocm_rx_fill(cm, RIOCM_RX_RING_SIZE);
2149 	cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
2150 	INIT_WORK(&cm->rx_work, rio_ibmsg_handler);
2151 
2152 	cm->tx_slot = 0;
2153 	cm->tx_cnt = 0;
2154 	cm->tx_ack_slot = 0;
2155 	spin_lock_init(&cm->tx_lock);
2156 
2157 	INIT_LIST_HEAD(&cm->peers);
2158 	cm->npeers = 0;
2159 	INIT_LIST_HEAD(&cm->tx_reqs);
2160 
2161 	down_write(&rdev_sem);
2162 	list_add_tail(&cm->list, &cm_dev_list);
2163 	up_write(&rdev_sem);
2164 
2165 	return 0;
2166 }
2167 
2168 /*
2169  * riocm_remove_mport - remove local mport device from channel management core
2170  * @dev: device object associated with mport
2171  * @class_intf: class interface
2172  *
2173  * Removes a local mport device from the list of registered devices that provide
2174  * channel management services. Returns an error if the specified mport is not
2175  * registered with the CM core.
2176  */
2177 static void riocm_remove_mport(struct device *dev,
2178 			       struct class_interface *class_intf)
2179 {
2180 	struct rio_mport *mport = to_rio_mport(dev);
2181 	struct cm_dev *cm;
2182 	struct cm_peer *peer, *temp;
2183 	struct rio_channel *ch, *_c;
2184 	unsigned int i;
2185 	bool found = false;
2186 	LIST_HEAD(list);
2187 
2188 	riocm_debug(MPORT, "%s", mport->name);
2189 
2190 	/* Find a matching cm_dev object */
2191 	down_write(&rdev_sem);
2192 	list_for_each_entry(cm, &cm_dev_list, list) {
2193 		if (cm->mport == mport) {
2194 			list_del(&cm->list);
2195 			found = true;
2196 			break;
2197 		}
2198 	}
2199 	up_write(&rdev_sem);
2200 	if (!found)
2201 		return;
2202 
2203 	flush_workqueue(cm->rx_wq);
2204 	destroy_workqueue(cm->rx_wq);
2205 
2206 	/* Release channels bound to this mport */
2207 	spin_lock_bh(&idr_lock);
2208 	idr_for_each_entry(&ch_idr, ch, i) {
2209 		if (ch->cmdev == cm) {
2210 			riocm_debug(RDEV, "%s drop ch_%d",
2211 				    mport->name, ch->id);
2212 			idr_remove(&ch_idr, ch->id);
2213 			list_add(&ch->ch_node, &list);
2214 		}
2215 	}
2216 	spin_unlock_bh(&idr_lock);
2217 
2218 	if (!list_empty(&list)) {
2219 		list_for_each_entry_safe(ch, _c, &list, ch_node) {
2220 			list_del(&ch->ch_node);
2221 			riocm_ch_close(ch);
2222 		}
2223 	}
2224 
2225 	rio_release_inb_mbox(mport, cmbox);
2226 	rio_release_outb_mbox(mport, cmbox);
2227 
2228 	/* Remove and free peer entries */
2229 	if (!list_empty(&cm->peers))
2230 		riocm_debug(RDEV, "ATTN: peer list not empty");
2231 	list_for_each_entry_safe(peer, temp, &cm->peers, node) {
2232 		riocm_debug(RDEV, "removing peer %s", rio_name(peer->rdev));
2233 		list_del(&peer->node);
2234 		kfree(peer);
2235 	}
2236 
2237 	riocm_rx_free(cm);
2238 	kfree(cm);
2239 	riocm_debug(MPORT, "%s done", mport->name);
2240 }
2241 
2242 static int rio_cm_shutdown(struct notifier_block *nb, unsigned long code,
2243 	void *unused)
2244 {
2245 	struct rio_channel *ch;
2246 	unsigned int i;
2247 	LIST_HEAD(list);
2248 
2249 	riocm_debug(EXIT, ".");
2250 
2251 	/*
2252 	 * If there are any channels left in connected state send
2253 	 * close notification to the connection partner.
2254 	 * First build a list of channels that require a closing
2255 	 * notification because function riocm_send_close() should
2256 	 * be called outside of spinlock protected code.
2257 	 */
2258 	spin_lock_bh(&idr_lock);
2259 	idr_for_each_entry(&ch_idr, ch, i) {
2260 		if (ch->state == RIO_CM_CONNECTED) {
2261 			riocm_debug(EXIT, "close ch %d", ch->id);
2262 			idr_remove(&ch_idr, ch->id);
2263 			list_add(&ch->ch_node, &list);
2264 		}
2265 	}
2266 	spin_unlock_bh(&idr_lock);
2267 
2268 	list_for_each_entry(ch, &list, ch_node)
2269 		riocm_send_close(ch);
2270 
2271 	return NOTIFY_DONE;
2272 }
2273 
2274 /*
2275  * riocm_interface handles addition/removal of remote RapidIO devices
2276  */
2277 static struct subsys_interface riocm_interface = {
2278 	.name		= "rio_cm",
2279 	.subsys		= &rio_bus_type,
2280 	.add_dev	= riocm_add_dev,
2281 	.remove_dev	= riocm_remove_dev,
2282 };
2283 
2284 /*
2285  * rio_mport_interface handles addition/removal local mport devices
2286  */
2287 static struct class_interface rio_mport_interface __refdata = {
2288 	.class = &rio_mport_class,
2289 	.add_dev = riocm_add_mport,
2290 	.remove_dev = riocm_remove_mport,
2291 };
2292 
2293 static struct notifier_block rio_cm_notifier = {
2294 	.notifier_call = rio_cm_shutdown,
2295 };
2296 
2297 static int __init riocm_init(void)
2298 {
2299 	int ret;
2300 
2301 	/* Create device class needed by udev */
2302 	dev_class = class_create(THIS_MODULE, DRV_NAME);
2303 	if (IS_ERR(dev_class)) {
2304 		riocm_error("Cannot create " DRV_NAME " class");
2305 		return PTR_ERR(dev_class);
2306 	}
2307 
2308 	ret = alloc_chrdev_region(&dev_number, 0, 1, DRV_NAME);
2309 	if (ret) {
2310 		class_destroy(dev_class);
2311 		return ret;
2312 	}
2313 
2314 	dev_major = MAJOR(dev_number);
2315 	dev_minor_base = MINOR(dev_number);
2316 	riocm_debug(INIT, "Registered class with %d major", dev_major);
2317 
2318 	/*
2319 	 * Register as rapidio_port class interface to get notifications about
2320 	 * mport additions and removals.
2321 	 */
2322 	ret = class_interface_register(&rio_mport_interface);
2323 	if (ret) {
2324 		riocm_error("class_interface_register error: %d", ret);
2325 		goto err_reg;
2326 	}
2327 
2328 	/*
2329 	 * Register as RapidIO bus interface to get notifications about
2330 	 * addition/removal of remote RapidIO devices.
2331 	 */
2332 	ret = subsys_interface_register(&riocm_interface);
2333 	if (ret) {
2334 		riocm_error("subsys_interface_register error: %d", ret);
2335 		goto err_cl;
2336 	}
2337 
2338 	ret = register_reboot_notifier(&rio_cm_notifier);
2339 	if (ret) {
2340 		riocm_error("failed to register reboot notifier (err=%d)", ret);
2341 		goto err_sif;
2342 	}
2343 
2344 	ret = riocm_cdev_add(dev_number);
2345 	if (ret) {
2346 		unregister_reboot_notifier(&rio_cm_notifier);
2347 		ret = -ENODEV;
2348 		goto err_sif;
2349 	}
2350 
2351 	return 0;
2352 err_sif:
2353 	subsys_interface_unregister(&riocm_interface);
2354 err_cl:
2355 	class_interface_unregister(&rio_mport_interface);
2356 err_reg:
2357 	unregister_chrdev_region(dev_number, 1);
2358 	class_destroy(dev_class);
2359 	return ret;
2360 }
2361 
2362 static void __exit riocm_exit(void)
2363 {
2364 	riocm_debug(EXIT, "enter");
2365 	unregister_reboot_notifier(&rio_cm_notifier);
2366 	subsys_interface_unregister(&riocm_interface);
2367 	class_interface_unregister(&rio_mport_interface);
2368 	idr_destroy(&ch_idr);
2369 
2370 	device_unregister(riocm_cdev.dev);
2371 	cdev_del(&(riocm_cdev.cdev));
2372 
2373 	class_destroy(dev_class);
2374 	unregister_chrdev_region(dev_number, 1);
2375 }
2376 
2377 late_initcall(riocm_init);
2378 module_exit(riocm_exit);
2379