drivers/infiniband/core/iwcm.c

   1 /*
   2  * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
   3  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
   4  * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
   5  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
   6  * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
   7  * Copyright (c) 2005 Network Appliance, Inc. All rights reserved.
   8  *
   9  * This software is available to you under a choice of one of two
  10  * licenses.  You may choose to be licensed under the terms of the GNU
  11  * General Public License (GPL) Version 2, available from the file
  12  * COPYING in the main directory of this source tree, or the
  13  * OpenIB.org BSD license below:
  14  *
  15  *     Redistribution and use in source and binary forms, with or
  16  *     without modification, are permitted provided that the following
  17  *     conditions are met:
  18  *
  19  *      - Redistributions of source code must retain the above
  20  *        copyright notice, this list of conditions and the following
  21  *        disclaimer.
  22  *
  23  *      - Redistributions in binary form must reproduce the above
  24  *        copyright notice, this list of conditions and the following
  25  *        disclaimer in the documentation and/or other materials
  26  *        provided with the distribution.
  27  *
  28  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  29  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  30  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  31  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  32  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  33  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  34  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  35  * SOFTWARE.
  36  *
  37  */
  38 #include <linux/dma-mapping.h>
  39 #include <linux/err.h>
  40 #include <linux/idr.h>
  41 #include <linux/interrupt.h>
  42 #include <linux/rbtree.h>
  43 #include <linux/sched.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/workqueue.h>
  46 #include <linux/completion.h>
  47 #include <linux/slab.h>
  48 #include <linux/module.h>
  49 #include <linux/sysctl.h>
  50
  51 #include <rdma/iw_cm.h>
  52 #include <rdma/ib_addr.h>
  53
  54 #include "iwcm.h"
  55
  56 MODULE_AUTHOR("Tom Tucker");
  57 MODULE_DESCRIPTION("iWARP CM");
  58 MODULE_LICENSE("Dual BSD/GPL");
  59
  60 static struct workqueue_struct *iwcm_wq;
  61 struct iwcm_work {
  62         struct work_struct work;
  63         struct iwcm_id_private *cm_id;
  64         struct list_head list;
  65         struct iw_cm_event event;
  66         struct list_head free_list;
  67 };
  68
  69 static unsigned int default_backlog = 256;
  70
  71 static struct ctl_table_header *iwcm_ctl_table_hdr;
  72 static struct ctl_table iwcm_ctl_table[] = {
  73         {
  74                 .procname       = "default_backlog",
  75                 .data           = &default_backlog,
  76                 .maxlen         = sizeof(default_backlog),
  77                 .mode           = 0644,
  78                 .proc_handler   = proc_dointvec,
  79         },
  80         { }
  81 };
  82
  83 /*
  84  * The following services provide a mechanism for pre-allocating iwcm_work
  85  * elements.  The design pre-allocates them  based on the cm_id type:
  86  *      LISTENING IDS:  Get enough elements preallocated to handle the
  87  *                      listen backlog.
  88  *      ACTIVE IDS:     4: CONNECT_REPLY, ESTABLISHED, DISCONNECT, CLOSE
  89  *      PASSIVE IDS:    3: ESTABLISHED, DISCONNECT, CLOSE
  90  *
  91  * Allocating them in connect and listen avoids having to deal
  92  * with allocation failures on the event upcall from the provider (which
  93  * is called in the interrupt context).
  94  *
  95  * One exception is when creating the cm_id for incoming connection requests.
  96  * There are two cases:
  97  * 1) in the event upcall, cm_event_handler(), for a listening cm_id.  If
  98  *    the backlog is exceeded, then no more connection request events will
  99  *    be processed.  cm_event_handler() returns -ENOMEM in this case.  Its up
 100  *    to the provider to reject the connection request.
 101  * 2) in the connection request workqueue handler, cm_conn_req_handler().
 102  *    If work elements cannot be allocated for the new connect request cm_id,
 103  *    then IWCM will call the provider reject method.  This is ok since
 104  *    cm_conn_req_handler() runs in the workqueue thread context.
 105  */
 106
 107 static struct iwcm_work *get_work(struct iwcm_id_private *cm_id_priv)
 108 {
 109         struct iwcm_work *work;
 110
 111         if (list_empty(&cm_id_priv->work_free_list))
 112                 return NULL;
 113         work = list_entry(cm_id_priv->work_free_list.next, struct iwcm_work,
 114                           free_list);
 115         list_del_init(&work->free_list);
 116         return work;
 117 }
 118
 119 static void put_work(struct iwcm_work *work)
 120 {
 121         list_add(&work->free_list, &work->cm_id->work_free_list);
 122 }
 123
 124 static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv)
 125 {
 126         struct list_head *e, *tmp;
 127
 128         list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)
 129                 kfree(list_entry(e, struct iwcm_work, free_list));
 130 }
 131
 132 static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
 133 {
 134         struct iwcm_work *work;
 135
 136         BUG_ON(!list_empty(&cm_id_priv->work_free_list));
 137         while (count--) {
 138                 work = kmalloc(sizeof(struct iwcm_work), GFP_KERNEL);
 139                 if (!work) {
 140                         dealloc_work_entries(cm_id_priv);
 141                         return -ENOMEM;
 142                 }
 143                 work->cm_id = cm_id_priv;
 144                 INIT_LIST_HEAD(&work->list);
 145                 put_work(work);
 146         }
 147         return 0;
 148 }
 149
 150 /*
 151  * Save private data from incoming connection requests to
 152  * iw_cm_event, so the low level driver doesn't have to. Adjust
 153  * the event ptr to point to the local copy.
 154  */
 155 static int copy_private_data(struct iw_cm_event *event)
 156 {
 157         void *p;
 158
 159         p = kmemdup(event->private_data, event->private_data_len, GFP_ATOMIC);
 160         if (!p)
 161                 return -ENOMEM;
 162         event->private_data = p;
 163         return 0;
 164 }
 165
 166 static void free_cm_id(struct iwcm_id_private *cm_id_priv)
 167 {
 168         dealloc_work_entries(cm_id_priv);
 169         kfree(cm_id_priv);
 170 }
 171
 172 /*
 173  * Release a reference on cm_id. If the last reference is being
 174  * released, enable the waiting thread (in iw_destroy_cm_id) to
 175  * get woken up, and return 1 if a thread is already waiting.
 176  */
 177 static int iwcm_deref_id(struct iwcm_id_private *cm_id_priv)
 178 {
 179         BUG_ON(atomic_read(&cm_id_priv->refcount)==0);
 180         if (atomic_dec_and_test(&cm_id_priv->refcount)) {
 181                 BUG_ON(!list_empty(&cm_id_priv->work_list));
 182                 complete(&cm_id_priv->destroy_comp);
 183                 return 1;
 184         }
 185
 186         return 0;
 187 }
 188
 189 static void add_ref(struct iw_cm_id *cm_id)
 190 {
 191         struct iwcm_id_private *cm_id_priv;
 192         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 193         atomic_inc(&cm_id_priv->refcount);
 194 }
 195
 196 static void rem_ref(struct iw_cm_id *cm_id)
 197 {
 198         struct iwcm_id_private *cm_id_priv;
 199         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 200         if (iwcm_deref_id(cm_id_priv) &&
 201             test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags)) {
 202                 BUG_ON(!list_empty(&cm_id_priv->work_list));
 203                 free_cm_id(cm_id_priv);
 204         }
 205 }
 206
 207 static int cm_event_handler(struct iw_cm_id *cm_id, struct iw_cm_event *event);
 208
 209 struct iw_cm_id *iw_create_cm_id(struct ib_device *device,
 210                                  iw_cm_handler cm_handler,
 211                                  void *context)
 212 {
 213         struct iwcm_id_private *cm_id_priv;
 214
 215         cm_id_priv = kzalloc(sizeof(*cm_id_priv), GFP_KERNEL);
 216         if (!cm_id_priv)
 217                 return ERR_PTR(-ENOMEM);
 218
 219         cm_id_priv->state = IW_CM_STATE_IDLE;
 220         cm_id_priv->id.device = device;
 221         cm_id_priv->id.cm_handler = cm_handler;
 222         cm_id_priv->id.context = context;
 223         cm_id_priv->id.event_handler = cm_event_handler;
 224         cm_id_priv->id.add_ref = add_ref;
 225         cm_id_priv->id.rem_ref = rem_ref;
 226         spin_lock_init(&cm_id_priv->lock);
 227         atomic_set(&cm_id_priv->refcount, 1);
 228         init_waitqueue_head(&cm_id_priv->connect_wait);
 229         init_completion(&cm_id_priv->destroy_comp);
 230         INIT_LIST_HEAD(&cm_id_priv->work_list);
 231         INIT_LIST_HEAD(&cm_id_priv->work_free_list);
 232
 233         return &cm_id_priv->id;
 234 }
 235 EXPORT_SYMBOL(iw_create_cm_id);
 236
 237
 238 static int iwcm_modify_qp_err(struct ib_qp *qp)
 239 {
 240         struct ib_qp_attr qp_attr;
 241
 242         if (!qp)
 243                 return -EINVAL;
 244
 245         qp_attr.qp_state = IB_QPS_ERR;
 246         return ib_modify_qp(qp, &qp_attr, IB_QP_STATE);
 247 }
 248
 249 /*
 250  * This is really the RDMAC CLOSING state. It is most similar to the
 251  * IB SQD QP state.
 252  */
 253 static int iwcm_modify_qp_sqd(struct ib_qp *qp)
 254 {
 255         struct ib_qp_attr qp_attr;
 256
 257         BUG_ON(qp == NULL);
 258         qp_attr.qp_state = IB_QPS_SQD;
 259         return ib_modify_qp(qp, &qp_attr, IB_QP_STATE);
 260 }
 261
 262 /*
 263  * CM_ID <-- CLOSING
 264  *
 265  * Block if a passive or active connection is currently being processed. Then
 266  * process the event as follows:
 267  * - If we are ESTABLISHED, move to CLOSING and modify the QP state
 268  *   based on the abrupt flag
 269  * - If the connection is already in the CLOSING or IDLE state, the peer is
 270  *   disconnecting concurrently with us and we've already seen the
 271  *   DISCONNECT event -- ignore the request and return 0
 272  * - Disconnect on a listening endpoint returns -EINVAL
 273  */
 274 int iw_cm_disconnect(struct iw_cm_id *cm_id, int abrupt)
 275 {
 276         struct iwcm_id_private *cm_id_priv;
 277         unsigned long flags;
 278         int ret = 0;
 279         struct ib_qp *qp = NULL;
 280
 281         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 282         /* Wait if we're currently in a connect or accept downcall */
 283         wait_event(cm_id_priv->connect_wait,
 284                    !test_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags));
 285
 286         spin_lock_irqsave(&cm_id_priv->lock, flags);
 287         switch (cm_id_priv->state) {
 288         case IW_CM_STATE_ESTABLISHED:
 289                 cm_id_priv->state = IW_CM_STATE_CLOSING;
 290
 291                 /* QP could be <nul> for user-mode client */
 292                 if (cm_id_priv->qp)
 293                         qp = cm_id_priv->qp;
 294                 else
 295                         ret = -EINVAL;
 296                 break;
 297         case IW_CM_STATE_LISTEN:
 298                 ret = -EINVAL;
 299                 break;
 300         case IW_CM_STATE_CLOSING:
 301                 /* remote peer closed first */
 302         case IW_CM_STATE_IDLE:
 303                 /* accept or connect returned !0 */
 304                 break;
 305         case IW_CM_STATE_CONN_RECV:
 306                 /*
 307                  * App called disconnect before/without calling accept after
 308                  * connect_request event delivered.
 309                  */
 310                 break;
 311         case IW_CM_STATE_CONN_SENT:
 312                 /* Can only get here if wait above fails */
 313         default:
 314                 BUG();
 315         }
 316         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 317
 318         if (qp) {
 319                 if (abrupt)
 320                         ret = iwcm_modify_qp_err(qp);
 321                 else
 322                         ret = iwcm_modify_qp_sqd(qp);
 323
 324                 /*
 325                  * If both sides are disconnecting the QP could
 326                  * already be in ERR or SQD states
 327                  */
 328                 ret = 0;
 329         }
 330
 331         return ret;
 332 }
 333 EXPORT_SYMBOL(iw_cm_disconnect);
 334
 335 /*
 336  * CM_ID <-- DESTROYING
 337  *
 338  * Clean up all resources associated with the connection and release
 339  * the initial reference taken by iw_create_cm_id.
 340  */
 341 static void destroy_cm_id(struct iw_cm_id *cm_id)
 342 {
 343         struct iwcm_id_private *cm_id_priv;
 344         unsigned long flags;
 345         int ret;
 346
 347         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 348         /*
 349          * Wait if we're currently in a connect or accept downcall. A
 350          * listening endpoint should never block here.
 351          */
 352         wait_event(cm_id_priv->connect_wait,
 353                    !test_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags));
 354
 355         spin_lock_irqsave(&cm_id_priv->lock, flags);
 356         switch (cm_id_priv->state) {
 357         case IW_CM_STATE_LISTEN:
 358                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
 359                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 360                 /* destroy the listening endpoint */
 361                 ret = cm_id->device->iwcm->destroy_listen(cm_id);
 362                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 363                 break;
 364         case IW_CM_STATE_ESTABLISHED:
 365                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
 366                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 367                 /* Abrupt close of the connection */
 368                 (void)iwcm_modify_qp_err(cm_id_priv->qp);
 369                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 370                 break;
 371         case IW_CM_STATE_IDLE:
 372         case IW_CM_STATE_CLOSING:
 373                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
 374                 break;
 375         case IW_CM_STATE_CONN_RECV:
 376                 /*
 377                  * App called destroy before/without calling accept after
 378                  * receiving connection request event notification or
 379                  * returned non zero from the event callback function.
 380                  * In either case, must tell the provider to reject.
 381                  */
 382                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
 383                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 384                 cm_id->device->iwcm->reject(cm_id, NULL, 0);
 385                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 386                 break;
 387         case IW_CM_STATE_CONN_SENT:
 388         case IW_CM_STATE_DESTROYING:
 389         default:
 390                 BUG();
 391                 break;
 392         }
 393         if (cm_id_priv->qp) {
 394                 cm_id_priv->id.device->iwcm->rem_ref(cm_id_priv->qp);
 395                 cm_id_priv->qp = NULL;
 396         }
 397         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 398
 399         (void)iwcm_deref_id(cm_id_priv);
 400 }
 401
 402 /*
 403  * This function is only called by the application thread and cannot
 404  * be called by the event thread. The function will wait for all
 405  * references to be released on the cm_id and then kfree the cm_id
 406  * object.
 407  */
 408 void iw_destroy_cm_id(struct iw_cm_id *cm_id)
 409 {
 410         struct iwcm_id_private *cm_id_priv;
 411
 412         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 413         BUG_ON(test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags));
 414
 415         destroy_cm_id(cm_id);
 416
 417         wait_for_completion(&cm_id_priv->destroy_comp);
 418
 419         free_cm_id(cm_id_priv);
 420 }
 421 EXPORT_SYMBOL(iw_destroy_cm_id);
 422
 423 /*
 424  * CM_ID <-- LISTEN
 425  *
 426  * Start listening for connect requests. Generates one CONNECT_REQUEST
 427  * event for each inbound connect request.
 428  */
 429 int iw_cm_listen(struct iw_cm_id *cm_id, int backlog)
 430 {
 431         struct iwcm_id_private *cm_id_priv;
 432         unsigned long flags;
 433         int ret;
 434
 435         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 436
 437         if (!backlog)
 438                 backlog = default_backlog;
 439
 440         ret = alloc_work_entries(cm_id_priv, backlog);
 441         if (ret)
 442                 return ret;
 443
 444         spin_lock_irqsave(&cm_id_priv->lock, flags);
 445         switch (cm_id_priv->state) {
 446         case IW_CM_STATE_IDLE:
 447                 cm_id_priv->state = IW_CM_STATE_LISTEN;
 448                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 449                 ret = cm_id->device->iwcm->create_listen(cm_id, backlog);
 450                 if (ret)
 451                         cm_id_priv->state = IW_CM_STATE_IDLE;
 452                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 453                 break;
 454         default:
 455                 ret = -EINVAL;
 456         }
 457         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 458
 459         return ret;
 460 }
 461 EXPORT_SYMBOL(iw_cm_listen);
 462
 463 /*
 464  * CM_ID <-- IDLE
 465  *
 466  * Rejects an inbound connection request. No events are generated.
 467  */
 468 int iw_cm_reject(struct iw_cm_id *cm_id,
 469                  const void *private_data,
 470                  u8 private_data_len)
 471 {
 472         struct iwcm_id_private *cm_id_priv;
 473         unsigned long flags;
 474         int ret;
 475
 476         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 477         set_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 478
 479         spin_lock_irqsave(&cm_id_priv->lock, flags);
 480         if (cm_id_priv->state != IW_CM_STATE_CONN_RECV) {
 481                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 482                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 483                 wake_up_all(&cm_id_priv->connect_wait);
 484                 return -EINVAL;
 485         }
 486         cm_id_priv->state = IW_CM_STATE_IDLE;
 487         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 488
 489         ret = cm_id->device->iwcm->reject(cm_id, private_data,
 490                                           private_data_len);
 491
 492         clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 493         wake_up_all(&cm_id_priv->connect_wait);
 494
 495         return ret;
 496 }
 497 EXPORT_SYMBOL(iw_cm_reject);
 498
 499 /*
 500  * CM_ID <-- ESTABLISHED
 501  *
 502  * Accepts an inbound connection request and generates an ESTABLISHED
 503  * event. Callers of iw_cm_disconnect and iw_destroy_cm_id will block
 504  * until the ESTABLISHED event is received from the provider.
 505  */
 506 int iw_cm_accept(struct iw_cm_id *cm_id,
 507                  struct iw_cm_conn_param *iw_param)
 508 {
 509         struct iwcm_id_private *cm_id_priv;
 510         struct ib_qp *qp;
 511         unsigned long flags;
 512         int ret;
 513
 514         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 515         set_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 516
 517         spin_lock_irqsave(&cm_id_priv->lock, flags);
 518         if (cm_id_priv->state != IW_CM_STATE_CONN_RECV) {
 519                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 520                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 521                 wake_up_all(&cm_id_priv->connect_wait);
 522                 return -EINVAL;
 523         }
 524         /* Get the ib_qp given the QPN */
 525         qp = cm_id->device->iwcm->get_qp(cm_id->device, iw_param->qpn);
 526         if (!qp) {
 527                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 528                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 529                 wake_up_all(&cm_id_priv->connect_wait);
 530                 return -EINVAL;
 531         }
 532         cm_id->device->iwcm->add_ref(qp);
 533         cm_id_priv->qp = qp;
 534         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 535
 536         ret = cm_id->device->iwcm->accept(cm_id, iw_param);
 537         if (ret) {
 538                 /* An error on accept precludes provider events */
 539                 BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_RECV);
 540                 cm_id_priv->state = IW_CM_STATE_IDLE;
 541                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 542                 if (cm_id_priv->qp) {
 543                         cm_id->device->iwcm->rem_ref(qp);
 544                         cm_id_priv->qp = NULL;
 545                 }
 546                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 547                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 548                 wake_up_all(&cm_id_priv->connect_wait);
 549         }
 550
 551         return ret;
 552 }
 553 EXPORT_SYMBOL(iw_cm_accept);
 554
 555 /*
 556  * Active Side: CM_ID <-- CONN_SENT
 557  *
 558  * If successful, results in the generation of a CONNECT_REPLY
 559  * event. iw_cm_disconnect and iw_cm_destroy will block until the
 560  * CONNECT_REPLY event is received from the provider.
 561  */
 562 int iw_cm_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *iw_param)
 563 {
 564         struct iwcm_id_private *cm_id_priv;
 565         int ret;
 566         unsigned long flags;
 567         struct ib_qp *qp;
 568
 569         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 570
 571         ret = alloc_work_entries(cm_id_priv, 4);
 572         if (ret)
 573                 return ret;
 574
 575         set_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 576         spin_lock_irqsave(&cm_id_priv->lock, flags);
 577
 578         if (cm_id_priv->state != IW_CM_STATE_IDLE) {
 579                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 580                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 581                 wake_up_all(&cm_id_priv->connect_wait);
 582                 return -EINVAL;
 583         }
 584
 585         /* Get the ib_qp given the QPN */
 586         qp = cm_id->device->iwcm->get_qp(cm_id->device, iw_param->qpn);
 587         if (!qp) {
 588                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 589                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 590                 wake_up_all(&cm_id_priv->connect_wait);
 591                 return -EINVAL;
 592         }
 593         cm_id->device->iwcm->add_ref(qp);
 594         cm_id_priv->qp = qp;
 595         cm_id_priv->state = IW_CM_STATE_CONN_SENT;
 596         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 597
 598         ret = cm_id->device->iwcm->connect(cm_id, iw_param);
 599         if (ret) {
 600                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 601                 if (cm_id_priv->qp) {
 602                         cm_id->device->iwcm->rem_ref(qp);
 603                         cm_id_priv->qp = NULL;
 604                 }
 605                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 606                 BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_SENT);
 607                 cm_id_priv->state = IW_CM_STATE_IDLE;
 608                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 609                 wake_up_all(&cm_id_priv->connect_wait);
 610         }
 611
 612         return ret;
 613 }
 614 EXPORT_SYMBOL(iw_cm_connect);
 615
 616 /*
 617  * Passive Side: new CM_ID <-- CONN_RECV
 618  *
 619  * Handles an inbound connect request. The function creates a new
 620  * iw_cm_id to represent the new connection and inherits the client
 621  * callback function and other attributes from the listening parent.
 622  *
 623  * The work item contains a pointer to the listen_cm_id and the event. The
 624  * listen_cm_id contains the client cm_handler, context and
 625  * device. These are copied when the device is cloned. The event
 626  * contains the new four tuple.
 627  *
 628  * An error on the child should not affect the parent, so this
 629  * function does not return a value.
 630  */
 631 static void cm_conn_req_handler(struct iwcm_id_private *listen_id_priv,
 632                                 struct iw_cm_event *iw_event)
 633 {
 634         unsigned long flags;
 635         struct iw_cm_id *cm_id;
 636         struct iwcm_id_private *cm_id_priv;
 637         int ret;
 638
 639         /*
 640          * The provider should never generate a connection request
 641          * event with a bad status.
 642          */
 643         BUG_ON(iw_event->status);
 644
 645         /*
 646          * We could be destroying the listening id. If so, ignore this
 647          * upcall.
 648          */
 649         spin_lock_irqsave(&listen_id_priv->lock, flags);
 650         if (listen_id_priv->state != IW_CM_STATE_LISTEN) {
 651                 spin_unlock_irqrestore(&listen_id_priv->lock, flags);
 652                 goto out;
 653         }
 654         spin_unlock_irqrestore(&listen_id_priv->lock, flags);
 655
 656         cm_id = iw_create_cm_id(listen_id_priv->id.device,
 657                                 listen_id_priv->id.cm_handler,
 658                                 listen_id_priv->id.context);
 659         /* If the cm_id could not be created, ignore the request */
 660         if (IS_ERR(cm_id))
 661                 goto out;
 662
 663         cm_id->provider_data = iw_event->provider_data;
 664         cm_id->local_addr = iw_event->local_addr;
 665         cm_id->remote_addr = iw_event->remote_addr;
 666
 667         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 668         cm_id_priv->state = IW_CM_STATE_CONN_RECV;
 669
 670         ret = alloc_work_entries(cm_id_priv, 3);
 671         if (ret) {
 672                 iw_cm_reject(cm_id, NULL, 0);
 673                 iw_destroy_cm_id(cm_id);
 674                 goto out;
 675         }
 676
 677         /* Call the client CM handler */
 678         ret = cm_id->cm_handler(cm_id, iw_event);
 679         if (ret) {
 680                 iw_cm_reject(cm_id, NULL, 0);
 681                 set_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
 682                 destroy_cm_id(cm_id);
 683                 if (atomic_read(&cm_id_priv->refcount)==0)
 684                         free_cm_id(cm_id_priv);
 685         }
 686
 687 out:
 688         if (iw_event->private_data_len)
 689                 kfree(iw_event->private_data);
 690 }
 691
 692 /*
 693  * Passive Side: CM_ID <-- ESTABLISHED
 694  *
 695  * The provider generated an ESTABLISHED event which means that
 696  * the MPA negotion has completed successfully and we are now in MPA
 697  * FPDU mode.
 698  *
 699  * This event can only be received in the CONN_RECV state. If the
 700  * remote peer closed, the ESTABLISHED event would be received followed
 701  * by the CLOSE event. If the app closes, it will block until we wake
 702  * it up after processing this event.
 703  */
 704 static int cm_conn_est_handler(struct iwcm_id_private *cm_id_priv,
 705                                struct iw_cm_event *iw_event)
 706 {
 707         unsigned long flags;
 708         int ret;
 709
 710         spin_lock_irqsave(&cm_id_priv->lock, flags);
 711
 712         /*
 713          * We clear the CONNECT_WAIT bit here to allow the callback
 714          * function to call iw_cm_disconnect. Calling iw_destroy_cm_id
 715          * from a callback handler is not allowed.
 716          */
 717         clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 718         BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_RECV);
 719         cm_id_priv->state = IW_CM_STATE_ESTABLISHED;
 720         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 721         ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
 722         wake_up_all(&cm_id_priv->connect_wait);
 723
 724         return ret;
 725 }
 726
 727 /*
 728  * Active Side: CM_ID <-- ESTABLISHED
 729  *
 730  * The app has called connect and is waiting for the established event to
 731  * post it's requests to the server. This event will wake up anyone
 732  * blocked in iw_cm_disconnect or iw_destroy_id.
 733  */
 734 static int cm_conn_rep_handler(struct iwcm_id_private *cm_id_priv,
 735                                struct iw_cm_event *iw_event)
 736 {
 737         unsigned long flags;
 738         int ret;
 739
 740         spin_lock_irqsave(&cm_id_priv->lock, flags);
 741         /*
 742          * Clear the connect wait bit so a callback function calling
 743          * iw_cm_disconnect will not wait and deadlock this thread
 744          */
 745         clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
 746         BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_SENT);
 747         if (iw_event->status == 0) {
 748                 cm_id_priv->id.local_addr = iw_event->local_addr;
 749                 cm_id_priv->id.remote_addr = iw_event->remote_addr;
 750                 cm_id_priv->state = IW_CM_STATE_ESTABLISHED;
 751         } else {
 752                 /* REJECTED or RESET */
 753                 cm_id_priv->id.device->iwcm->rem_ref(cm_id_priv->qp);
 754                 cm_id_priv->qp = NULL;
 755                 cm_id_priv->state = IW_CM_STATE_IDLE;
 756         }
 757         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 758         ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
 759
 760         if (iw_event->private_data_len)
 761                 kfree(iw_event->private_data);
 762
 763         /* Wake up waiters on connect complete */
 764         wake_up_all(&cm_id_priv->connect_wait);
 765
 766         return ret;
 767 }
 768
 769 /*
 770  * CM_ID <-- CLOSING
 771  *
 772  * If in the ESTABLISHED state, move to CLOSING.
 773  */
 774 static void cm_disconnect_handler(struct iwcm_id_private *cm_id_priv,
 775                                   struct iw_cm_event *iw_event)
 776 {
 777         unsigned long flags;
 778
 779         spin_lock_irqsave(&cm_id_priv->lock, flags);
 780         if (cm_id_priv->state == IW_CM_STATE_ESTABLISHED)
 781                 cm_id_priv->state = IW_CM_STATE_CLOSING;
 782         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 783 }
 784
 785 /*
 786  * CM_ID <-- IDLE
 787  *
 788  * If in the ESTBLISHED or CLOSING states, the QP will have have been
 789  * moved by the provider to the ERR state. Disassociate the CM_ID from
 790  * the QP,  move to IDLE, and remove the 'connected' reference.
 791  *
 792  * If in some other state, the cm_id was destroyed asynchronously.
 793  * This is the last reference that will result in waking up
 794  * the app thread blocked in iw_destroy_cm_id.
 795  */
 796 static int cm_close_handler(struct iwcm_id_private *cm_id_priv,
 797                                   struct iw_cm_event *iw_event)
 798 {
 799         unsigned long flags;
 800         int ret = 0;
 801         spin_lock_irqsave(&cm_id_priv->lock, flags);
 802
 803         if (cm_id_priv->qp) {
 804                 cm_id_priv->id.device->iwcm->rem_ref(cm_id_priv->qp);
 805                 cm_id_priv->qp = NULL;
 806         }
 807         switch (cm_id_priv->state) {
 808         case IW_CM_STATE_ESTABLISHED:
 809         case IW_CM_STATE_CLOSING:
 810                 cm_id_priv->state = IW_CM_STATE_IDLE;
 811                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 812                 ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
 813                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 814                 break;
 815         case IW_CM_STATE_DESTROYING:
 816                 break;
 817         default:
 818                 BUG();
 819         }
 820         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 821
 822         return ret;
 823 }
 824
 825 static int process_event(struct iwcm_id_private *cm_id_priv,
 826                          struct iw_cm_event *iw_event)
 827 {
 828         int ret = 0;
 829
 830         switch (iw_event->event) {
 831         case IW_CM_EVENT_CONNECT_REQUEST:
 832                 cm_conn_req_handler(cm_id_priv, iw_event);
 833                 break;
 834         case IW_CM_EVENT_CONNECT_REPLY:
 835                 ret = cm_conn_rep_handler(cm_id_priv, iw_event);
 836                 break;
 837         case IW_CM_EVENT_ESTABLISHED:
 838                 ret = cm_conn_est_handler(cm_id_priv, iw_event);
 839                 break;
 840         case IW_CM_EVENT_DISCONNECT:
 841                 cm_disconnect_handler(cm_id_priv, iw_event);
 842                 break;
 843         case IW_CM_EVENT_CLOSE:
 844                 ret = cm_close_handler(cm_id_priv, iw_event);
 845                 break;
 846         default:
 847                 BUG();
 848         }
 849
 850         return ret;
 851 }
 852
 853 /*
 854  * Process events on the work_list for the cm_id. If the callback
 855  * function requests that the cm_id be deleted, a flag is set in the
 856  * cm_id flags to indicate that when the last reference is
 857  * removed, the cm_id is to be destroyed. This is necessary to
 858  * distinguish between an object that will be destroyed by the app
 859  * thread asleep on the destroy_comp list vs. an object destroyed
 860  * here synchronously when the last reference is removed.
 861  */
 862 static void cm_work_handler(struct work_struct *_work)
 863 {
 864         struct iwcm_work *work = container_of(_work, struct iwcm_work, work);
 865         struct iw_cm_event levent;
 866         struct iwcm_id_private *cm_id_priv = work->cm_id;
 867         unsigned long flags;
 868         int empty;
 869         int ret = 0;
 870         int destroy_id;
 871
 872         spin_lock_irqsave(&cm_id_priv->lock, flags);
 873         empty = list_empty(&cm_id_priv->work_list);
 874         while (!empty) {
 875                 work = list_entry(cm_id_priv->work_list.next,
 876                                   struct iwcm_work, list);
 877                 list_del_init(&work->list);
 878                 empty = list_empty(&cm_id_priv->work_list);
 879                 levent = work->event;
 880                 put_work(work);
 881                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 882
 883                 ret = process_event(cm_id_priv, &levent);
 884                 if (ret) {
 885                         set_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
 886                         destroy_cm_id(&cm_id_priv->id);
 887                 }
 888                 BUG_ON(atomic_read(&cm_id_priv->refcount)==0);
 889                 destroy_id = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
 890                 if (iwcm_deref_id(cm_id_priv)) {
 891                         if (destroy_id) {
 892                                 BUG_ON(!list_empty(&cm_id_priv->work_list));
 893                                 free_cm_id(cm_id_priv);
 894                         }
 895                         return;
 896                 }
 897                 spin_lock_irqsave(&cm_id_priv->lock, flags);
 898         }
 899         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 900 }
 901
 902 /*
 903  * This function is called on interrupt context. Schedule events on
 904  * the iwcm_wq thread to allow callback functions to downcall into
 905  * the CM and/or block.  Events are queued to a per-CM_ID
 906  * work_list. If this is the first event on the work_list, the work
 907  * element is also queued on the iwcm_wq thread.
 908  *
 909  * Each event holds a reference on the cm_id. Until the last posted
 910  * event has been delivered and processed, the cm_id cannot be
 911  * deleted.
 912  *
 913  * Returns:
 914  *            0 - the event was handled.
 915  *      -ENOMEM - the event was not handled due to lack of resources.
 916  */
 917 static int cm_event_handler(struct iw_cm_id *cm_id,
 918                              struct iw_cm_event *iw_event)
 919 {
 920         struct iwcm_work *work;
 921         struct iwcm_id_private *cm_id_priv;
 922         unsigned long flags;
 923         int ret = 0;
 924
 925         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 926
 927         spin_lock_irqsave(&cm_id_priv->lock, flags);
 928         work = get_work(cm_id_priv);
 929         if (!work) {
 930                 ret = -ENOMEM;
 931                 goto out;
 932         }
 933
 934         INIT_WORK(&work->work, cm_work_handler);
 935         work->cm_id = cm_id_priv;
 936         work->event = *iw_event;
 937
 938         if ((work->event.event == IW_CM_EVENT_CONNECT_REQUEST ||
 939              work->event.event == IW_CM_EVENT_CONNECT_REPLY) &&
 940             work->event.private_data_len) {
 941                 ret = copy_private_data(&work->event);
 942                 if (ret) {
 943                         put_work(work);
 944                         goto out;
 945                 }
 946         }
 947
 948         atomic_inc(&cm_id_priv->refcount);
 949         if (list_empty(&cm_id_priv->work_list)) {
 950                 list_add_tail(&work->list, &cm_id_priv->work_list);
 951                 queue_work(iwcm_wq, &work->work);
 952         } else
 953                 list_add_tail(&work->list, &cm_id_priv->work_list);
 954 out:
 955         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 956         return ret;
 957 }
 958
 959 static int iwcm_init_qp_init_attr(struct iwcm_id_private *cm_id_priv,
 960                                   struct ib_qp_attr *qp_attr,
 961                                   int *qp_attr_mask)
 962 {
 963         unsigned long flags;
 964         int ret;
 965
 966         spin_lock_irqsave(&cm_id_priv->lock, flags);
 967         switch (cm_id_priv->state) {
 968         case IW_CM_STATE_IDLE:
 969         case IW_CM_STATE_CONN_SENT:
 970         case IW_CM_STATE_CONN_RECV:
 971         case IW_CM_STATE_ESTABLISHED:
 972                 *qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS;
 973                 qp_attr->qp_access_flags = IB_ACCESS_REMOTE_WRITE|
 974                                            IB_ACCESS_REMOTE_READ;
 975                 ret = 0;
 976                 break;
 977         default:
 978                 ret = -EINVAL;
 979                 break;
 980         }
 981         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 982         return ret;
 983 }
 984
 985 static int iwcm_init_qp_rts_attr(struct iwcm_id_private *cm_id_priv,
 986                                   struct ib_qp_attr *qp_attr,
 987                                   int *qp_attr_mask)
 988 {
 989         unsigned long flags;
 990         int ret;
 991
 992         spin_lock_irqsave(&cm_id_priv->lock, flags);
 993         switch (cm_id_priv->state) {
 994         case IW_CM_STATE_IDLE:
 995         case IW_CM_STATE_CONN_SENT:
 996         case IW_CM_STATE_CONN_RECV:
 997         case IW_CM_STATE_ESTABLISHED:
 998                 *qp_attr_mask = 0;
 999                 ret = 0;
1000                 break;
1001         default:
1002                 ret = -EINVAL;
1003                 break;
1004         }
1005         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
1006         return ret;
1007 }
1008
1009 int iw_cm_init_qp_attr(struct iw_cm_id *cm_id,
1010                        struct ib_qp_attr *qp_attr,
1011                        int *qp_attr_mask)
1012 {
1013         struct iwcm_id_private *cm_id_priv;
1014         int ret;
1015
1016         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
1017         switch (qp_attr->qp_state) {
1018         case IB_QPS_INIT:
1019         case IB_QPS_RTR:
1020                 ret = iwcm_init_qp_init_attr(cm_id_priv,
1021                                              qp_attr, qp_attr_mask);
1022                 break;
1023         case IB_QPS_RTS:
1024                 ret = iwcm_init_qp_rts_attr(cm_id_priv,
1025                                             qp_attr, qp_attr_mask);
1026                 break;
1027         default:
1028                 ret = -EINVAL;
1029                 break;
1030         }
1031         return ret;
1032 }
1033 EXPORT_SYMBOL(iw_cm_init_qp_attr);
1034
1035 static struct ctl_path iwcm_ctl_path[] = {
1036         { .procname = "net" },
1037         { .procname = "iw_cm" },
1038         { }
1039 };
1040
1041 static int __init iw_cm_init(void)
1042 {
1043         iwcm_wq = create_singlethread_workqueue("iw_cm_wq");
1044         if (!iwcm_wq)
1045                 return -ENOMEM;
1046
1047         iwcm_ctl_table_hdr = register_net_sysctl_table(&init_net,
1048                                                        iwcm_ctl_path,
1049                                                        iwcm_ctl_table);
1050         if (!iwcm_ctl_table_hdr) {
1051                 pr_err("iw_cm: couldn't register sysctl paths\n");
1052                 destroy_workqueue(iwcm_wq);
1053                 return -ENOMEM;
1054         }
1055
1056         return 0;
1057 }
1058
1059 static void __exit iw_cm_cleanup(void)
1060 {
1061         unregister_net_sysctl_table(iwcm_ctl_table_hdr);
1062         destroy_workqueue(iwcm_wq);
1063 }
1064
1065 module_init(iw_cm_init);
1066 module_exit(iw_cm_cleanup);