/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2018 Joyent, Inc.
 */
/* Copyright (c) 1990 Mentat Inc. */

/*
 * An implementation of the IPoIB-CM standard based on PSARC 2009/593.
 */
#include <sys/types.h>
#include <sys/conf.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/modctl.h>
#include <sys/stropts.h>
#include <sys/stream.h>
#include <sys/strsun.h>
#include <sys/strsubr.h>
#include <sys/dlpi.h>
#include <sys/mac_provider.h>

#include <sys/pattr.h>          /* for HCK_FULLCKSUM */
#include <sys/atomic.h>         /* for atomic_add*() */
#include <sys/ethernet.h>       /* for ETHERTYPE_IP */
#include <netinet/in.h>         /* for netinet/ip.h below */
#include <netinet/ip.h>         /* for struct ip */
#include <inet/common.h>        /* for inet/ip.h below */
#include <inet/ip.h>            /* for ipha_t */
#include <inet/ip_if.h>         /* for ETHERTYPE_IPV6 */
#include <inet/ip6.h>           /* for ip6_t */
#include <netinet/icmp6.h>      /* for icmp6_t */

#include <sys/ib/clients/ibd/ibd.h>

extern ibd_global_state_t ibd_gstate;
extern int ibd_rc_conn_timeout;
uint_t ibd_rc_tx_softintr = 1;
/*
 * If the number of WRs in receive queue of each RC connection less than
 * IBD_RC_RX_WR_THRESHOLD, we will post more receive WRs into it.
 */
#define IBD_RC_RX_WR_THRESHOLD          0x20

/*
 * If the number of free SWQEs (or large Tx buf) is larger than or equal to
 * IBD_RC_TX_FREE_THRESH, we will call mac_tx_update to notify GLD to continue
 * transmitting packets.
 */
#define IBD_RC_TX_FREE_THRESH           8

#define IBD_RC_QPN_TO_SID(qpn) \
        ((uint64_t)(IBD_RC_SERVICE_ID | ((qpn) & 0xffffff)))

/* For interop with legacy OFED */
#define IBD_RC_QPN_TO_SID_OFED_INTEROP(qpn) \
        ((uint64_t)(IBD_RC_SERVICE_ID_OFED_INTEROP | ((qpn) & 0xffffff)))

/* Internet Header + 64 bits of Data Datagram. Refer to RFC 792 */
#define IBD_RC_IP_ICMP_RETURN_DATA_BYTES        64


/* Functions for Reliable Connected Mode */
/* Connection Setup/Close Functions */
static ibt_cm_status_t ibd_rc_dispatch_pass_mad(void *,
    ibt_cm_event_t *, ibt_cm_return_args_t *, void *, ibt_priv_data_len_t);
static ibt_cm_status_t ibd_rc_dispatch_actv_mad(void *,
    ibt_cm_event_t *, ibt_cm_return_args_t *, void *, ibt_priv_data_len_t);
static void ibd_rc_act_close(ibd_rc_chan_t *, boolean_t);

static inline void ibd_rc_add_to_chan_list(ibd_rc_chan_list_t *,
    ibd_rc_chan_t *);
static inline ibd_rc_chan_t *ibd_rc_rm_header_chan_list(
    ibd_rc_chan_list_t *);
static inline ibd_rc_chan_t *ibd_rc_rm_from_chan_list(ibd_rc_chan_list_t *,
    ibd_rc_chan_t *);

/* CQ handlers */
static void ibd_rc_rcq_handler(ibt_cq_hdl_t, void *);
static void ibd_rc_scq_handler(ibt_cq_hdl_t, void *);
static void ibd_rc_poll_rcq(ibd_rc_chan_t *, ibt_cq_hdl_t);

/* Receive Functions */
static int ibd_rc_post_srq(ibd_state_t *, ibd_rwqe_t *);
static void ibd_rc_srq_freemsg_cb(char *);
static void ibd_rc_srq_free_rwqe(ibd_state_t *, ibd_rwqe_t *);

static int ibd_rc_post_rwqe(ibd_rc_chan_t *, ibd_rwqe_t *);
static void ibd_rc_freemsg_cb(char *);
static void ibd_rc_process_rx(ibd_rc_chan_t *, ibd_rwqe_t *, ibt_wc_t *);
static void ibd_rc_free_rwqe(ibd_rc_chan_t *, ibd_rwqe_t *);
static void ibd_rc_fini_rxlist(ibd_rc_chan_t *);


/* Send Functions */
static void ibd_rc_release_swqe(ibd_rc_chan_t *, ibd_swqe_t *);
static int ibd_rc_init_txlist(ibd_rc_chan_t *);
static void ibd_rc_fini_txlist(ibd_rc_chan_t *);
static uint_t ibd_rc_tx_recycle(caddr_t);


void
ibd_async_rc_close_act_chan(ibd_state_t *state, ibd_req_t *req)
{
        ibd_rc_chan_t *rc_chan = req->rq_ptr;
        ibd_ace_t *ace;

        while (rc_chan != NULL) {
                ace = rc_chan->ace;
                ASSERT(ace != NULL);
                /* Close old RC channel */
                ibd_rc_act_close(rc_chan, B_TRUE);
                mutex_enter(&state->id_ac_mutex);
                ASSERT(ace->ac_ref != 0);
                atomic_dec_32(&ace->ac_ref);
                ace->ac_chan = NULL;
                if ((ace->ac_ref == 0) || (ace->ac_ref == CYCLEVAL)) {
                        IBD_ACACHE_INSERT_FREE(state, ace);
                        ace->ac_ref = 0;
                } else {
                        ace->ac_ref |= CYCLEVAL;
                        state->rc_delay_ace_recycle++;
                }
                mutex_exit(&state->id_ac_mutex);
                rc_chan = ibd_rc_rm_header_chan_list(
                    &state->rc_obs_act_chan_list);
        }
}

void
ibd_async_rc_recycle_ace(ibd_state_t *state, ibd_req_t *req)
{
        ibd_ace_t *ace = req->rq_ptr;
        ibd_rc_chan_t *rc_chan;

        ASSERT(ace != NULL);
        rc_chan = ace->ac_chan;
        ASSERT(rc_chan != NULL);
        /* Close old RC channel */
        ibd_rc_act_close(rc_chan, B_TRUE);
        mutex_enter(&state->id_ac_mutex);
        ASSERT(ace->ac_ref != 0);
        atomic_dec_32(&ace->ac_ref);
        ace->ac_chan = NULL;
        if ((ace->ac_ref == 0) || (ace->ac_ref == CYCLEVAL)) {
                IBD_ACACHE_INSERT_FREE(state, ace);
                ace->ac_ref = 0;
        } else {
                ace->ac_ref |= CYCLEVAL;
                state->rc_delay_ace_recycle++;
        }
        mutex_exit(&state->id_ac_mutex);
        mutex_enter(&state->rc_ace_recycle_lock);
        state->rc_ace_recycle = NULL;
        mutex_exit(&state->rc_ace_recycle_lock);
}

/* Simple ICMP IP Header Template */
static const ipha_t icmp_ipha = {
        IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
};

/* Packet is too big. Send ICMP packet to GLD to request a smaller MTU */
void
ibd_async_rc_process_too_big(ibd_state_t *state, ibd_req_t *req)
{
        mblk_t *mp = req->rq_ptr;
        ibd_ace_t *ace = req->rq_ptr2;
        uint16_t mtu = state->id_mtu - IPOIB_HDRSIZE;
        uint_t  len_needed;
        size_t  msg_len;
        mblk_t  *pmtu_mp;
        ushort_t        sap;
        ib_header_info_t *ibha; /* ib header for pmtu_pkt */
        /*
         * ipha: IP header for pmtu_pkt
         * old_ipha: IP header for old packet
         */
        ipha_t *ipha, *old_ipha;
        icmph_t *icmph;

        sap = ntohs(((ipoib_hdr_t *)mp->b_rptr)->ipoib_type);

        if (!pullupmsg(mp, -1)) {
                DPRINT(40, "ibd_async_rc_process_too_big: pullupmsg fail");
                goto too_big_fail;
        }
        /* move to IP header. */
        mp->b_rptr += IPOIB_HDRSIZE;
        old_ipha = (ipha_t *)mp->b_rptr;

        len_needed = IPH_HDR_LENGTH(old_ipha);
        if (old_ipha->ipha_protocol == IPPROTO_ENCAP) {
                len_needed += IPH_HDR_LENGTH(((uchar_t *)old_ipha +
                    len_needed));
        } else if (old_ipha->ipha_protocol == IPPROTO_IPV6) {
                ip6_t *ip6h = (ip6_t *)((uchar_t *)old_ipha
                    + len_needed);
                len_needed += ip_hdr_length_v6(mp, ip6h);
        }
        len_needed += IBD_RC_IP_ICMP_RETURN_DATA_BYTES;
        msg_len = msgdsize(mp);
        if (msg_len > len_needed) {
                (void) adjmsg(mp, len_needed - msg_len);
                msg_len = len_needed;
        }

        if ((pmtu_mp = allocb(sizeof (ib_header_info_t) + sizeof (ipha_t)
            + sizeof (icmph_t), BPRI_MED)) == NULL) {
                DPRINT(40, "ibd_async_rc_process_too_big: allocb fail");
                goto too_big_fail;
        }
        pmtu_mp->b_cont = mp;
        pmtu_mp->b_wptr = pmtu_mp->b_rptr + sizeof (ib_header_info_t)
            + sizeof (ipha_t) + sizeof (icmph_t);

        ibha = (ib_header_info_t *)pmtu_mp->b_rptr;

        /* Fill IB header */
        bcopy(&state->id_macaddr, &ibha->ib_dst, IPOIB_ADDRL);
        /*
         * If the GRH is not valid, indicate to GLDv3 by setting
         * the VerTcFlow field to 0.
         */
        ibha->ib_grh.ipoib_vertcflow = 0;
        ibha->ipib_rhdr.ipoib_type = htons(sap);
        ibha->ipib_rhdr.ipoib_mbz = 0;

        /* Fill IP header */
        ipha = (ipha_t *)&ibha[1];
        *ipha = icmp_ipha;
        ipha->ipha_src = old_ipha->ipha_dst;
        ipha->ipha_dst = old_ipha->ipha_src;
        ipha->ipha_ttl = old_ipha->ipha_ttl;
        msg_len += sizeof (icmp_ipha) + sizeof (icmph_t);
        if (msg_len > IP_MAXPACKET) {
                ibd_print_warn(state, "ibd_rc_process_too_big_pkt: msg_len(%d) "
                    "> IP_MAXPACKET", (uint32_t)msg_len);
                (void) adjmsg(mp, IP_MAXPACKET - msg_len);
                msg_len = IP_MAXPACKET;
        }
        ipha->ipha_length = htons((uint16_t)msg_len);
        ipha->ipha_hdr_checksum = 0;
        ipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(ipha);

        /* Fill ICMP body */
        icmph = (icmph_t *)&ipha[1];
        bzero(icmph, sizeof (icmph_t));
        icmph->icmph_type = ICMP_DEST_UNREACHABLE;
        icmph->icmph_code = ICMP_FRAGMENTATION_NEEDED;
        icmph->icmph_du_mtu = htons(mtu);
        icmph->icmph_checksum = 0;
        icmph->icmph_checksum = IP_CSUM(pmtu_mp,
            (int32_t)sizeof (ib_header_info_t) + (int32_t)sizeof (ipha_t), 0);

        mac_hcksum_set(pmtu_mp, 0, 0, 0, 0, HCK_FULLCKSUM | HCK_FULLCKSUM_OK);

        DPRINT(30, "ibd_async_rc_process_too_big: sap=0x%x, ip_src=0x%x, "
            "ip_dst=0x%x, ttl=%d, len_needed=%d, msg_len=%d",
            sap, ipha->ipha_src, ipha->ipha_dst, ipha->ipha_ttl,
            len_needed, (uint32_t)msg_len);

        mac_rx(state->id_mh, state->id_rh, pmtu_mp);

        mutex_enter(&ace->tx_too_big_mutex);
        ace->tx_too_big_ongoing = B_FALSE;
        mutex_exit(&ace->tx_too_big_mutex);
        return;

too_big_fail:
        /* Drop packet */
        freemsg(mp);
        mutex_enter(&ace->tx_too_big_mutex);
        ace->tx_too_big_ongoing = B_FALSE;
        mutex_exit(&ace->tx_too_big_mutex);
}

/*
 * Check all active/passive channels. If any ative/passive
 * channel has not been used for a long time, close it.
 */
void
ibd_rc_conn_timeout_call(void *carg)
{
        ibd_state_t *state = carg;
        ibd_ace_t *ace, *pre_ace;
        ibd_rc_chan_t *chan, *pre_chan, *next_chan;
        ibd_req_t *req;

        /* Check all active channels. If chan->is_used == B_FALSE, close it */
        mutex_enter(&state->id_ac_mutex);
        ace = list_head(&state->id_ah_active);
        while ((pre_ace = ace) != NULL) {
                ace = list_next(&state->id_ah_active, ace);
                if (pre_ace->ac_chan != NULL) {
                        chan = pre_ace->ac_chan;
                        ASSERT(state->id_enable_rc == B_TRUE);
                        if (chan->chan_state == IBD_RC_STATE_ACT_ESTAB) {
                                if (chan->is_used == B_FALSE) {
                                        state->rc_timeout_act++;
                                        INC_REF(pre_ace, 1);
                                        IBD_ACACHE_PULLOUT_ACTIVE(state,
                                            pre_ace);
                                        chan->chan_state =
                                            IBD_RC_STATE_ACT_CLOSING;
                                        ibd_rc_signal_act_close(state, pre_ace);
                                } else {
                                        chan->is_used = B_FALSE;
                                }
                        }
                }
        }
        mutex_exit(&state->id_ac_mutex);

        /* Check all passive channels. If chan->is_used == B_FALSE, close it */
        mutex_enter(&state->rc_pass_chan_list.chan_list_mutex);
        next_chan = state->rc_pass_chan_list.chan_list;
        pre_chan = NULL;
        while ((chan = next_chan) != NULL) {
                next_chan = chan->next;
                if (chan->is_used == B_FALSE) {
                        req = kmem_cache_alloc(state->id_req_kmc, KM_NOSLEEP);
                        if (req != NULL) {
                                /* remove it */
                                state->rc_timeout_pas++;
                                req->rq_ptr = chan;
                                ibd_queue_work_slot(state, req,
                                    IBD_ASYNC_RC_CLOSE_PAS_CHAN);
                        } else {
                                ibd_print_warn(state, "ibd_rc_conn_timeout: "
                                    "alloc ibd_req_t fail");
                                if (pre_chan == NULL) {
                                        state->rc_pass_chan_list.chan_list =
                                            chan;
                                } else {
                                        pre_chan->next = chan;
                                }
                                pre_chan = chan;
                        }
                } else {
                        if (pre_chan == NULL) {
                                state->rc_pass_chan_list.chan_list = chan;
                        } else {
                                pre_chan->next = chan;
                        }
                        pre_chan = chan;
                        chan->is_used = B_FALSE;
                }
        }
        if (pre_chan != NULL) {
                pre_chan->next = NULL;
        } else {
                state->rc_pass_chan_list.chan_list = NULL;
        }
        mutex_exit(&state->rc_pass_chan_list.chan_list_mutex);

        mutex_enter(&state->rc_timeout_lock);
        if (state->rc_timeout_start == B_TRUE) {
                state->rc_timeout = timeout(ibd_rc_conn_timeout_call, state,
                    SEC_TO_TICK(ibd_rc_conn_timeout));
        }
        mutex_exit(&state->rc_timeout_lock);
}

#ifdef DEBUG
/*
 * ibd_rc_update_stats - update driver private kstat counters
 *
 * This routine will dump the internal statistics counters for ibd's
 * Reliable Connected Mode. The current stats dump values will
 * be sent to the kernel status area.
 */
static int
ibd_rc_update_stats(kstat_t *ksp, int rw)
{
        ibd_state_t *state;
        ibd_rc_stat_t *ibd_rc_ksp;

        if (rw == KSTAT_WRITE)
                return (EACCES);

        state = (ibd_state_t *)ksp->ks_private;
        ASSERT(state != NULL);
        ibd_rc_ksp = (ibd_rc_stat_t *)ksp->ks_data;

        ibd_rc_ksp->rc_rcv_trans_byte.value.ul = state->rc_rcv_trans_byte;
        ibd_rc_ksp->rc_rcv_trans_pkt.value.ul = state->rc_rcv_trans_pkt;
        ibd_rc_ksp->rc_rcv_copy_byte.value.ul = state->rc_rcv_copy_byte;
        ibd_rc_ksp->rc_rcv_copy_pkt.value.ul = state->rc_rcv_copy_pkt;
        ibd_rc_ksp->rc_rcv_alloc_fail.value.ul = state->rc_rcv_alloc_fail;

        ibd_rc_ksp->rc_rcq_err.value.ul = state->rc_rcq_err;

        ibd_rc_ksp->rc_rwqe_short.value.ul = state->rc_rwqe_short;

        ibd_rc_ksp->rc_xmt_bytes.value.ul = state->rc_xmt_bytes;
        ibd_rc_ksp->rc_xmt_small_pkt.value.ul = state->rc_xmt_small_pkt;
        ibd_rc_ksp->rc_xmt_fragmented_pkt.value.ul =
            state->rc_xmt_fragmented_pkt;
        ibd_rc_ksp->rc_xmt_map_fail_pkt.value.ul = state->rc_xmt_map_fail_pkt;
        ibd_rc_ksp->rc_xmt_map_succ_pkt.value.ul = state->rc_xmt_map_succ_pkt;
        ibd_rc_ksp->rc_ace_not_found.value.ul = state->rc_ace_not_found;

        ibd_rc_ksp->rc_scq_no_swqe.value.ul = state->rc_scq_no_swqe;
        ibd_rc_ksp->rc_scq_no_largebuf.value.ul = state->rc_scq_no_largebuf;
        ibd_rc_ksp->rc_swqe_short.value.ul = state->rc_swqe_short;
        ibd_rc_ksp->rc_swqe_mac_update.value.ul = state->rc_swqe_mac_update;
        ibd_rc_ksp->rc_xmt_buf_short.value.ul = state->rc_xmt_buf_short;
        ibd_rc_ksp->rc_xmt_buf_mac_update.value.ul =
            state->rc_xmt_buf_mac_update;

        ibd_rc_ksp->rc_conn_succ.value.ul = state->rc_conn_succ;
        ibd_rc_ksp->rc_conn_fail.value.ul = state->rc_conn_fail;
        ibd_rc_ksp->rc_null_conn.value.ul = state->rc_null_conn;
        ibd_rc_ksp->rc_no_estab_conn.value.ul = state->rc_no_estab_conn;

        ibd_rc_ksp->rc_act_close.value.ul = state->rc_act_close;
        ibd_rc_ksp->rc_pas_close.value.ul = state->rc_pas_close;
        ibd_rc_ksp->rc_delay_ace_recycle.value.ul = state->rc_delay_ace_recycle;
        ibd_rc_ksp->rc_act_close_simultaneous.value.ul =
            state->rc_act_close_simultaneous;
        ibd_rc_ksp->rc_reset_cnt.value.ul = state->rc_reset_cnt;
        ibd_rc_ksp->rc_timeout_act.value.ul = state->rc_timeout_act;
        ibd_rc_ksp->rc_timeout_pas.value.ul = state->rc_timeout_pas;

        return (0);
}


/*
 * ibd_rc_init_stats - initialize kstat data structures
 *
 * This routine will create and initialize the driver private
 * statistics counters.
 */
int
ibd_rc_init_stats(ibd_state_t *state)
{
        kstat_t *ksp;
        ibd_rc_stat_t *ibd_rc_ksp;
        char stat_name[KSTAT_STRLEN];
        int inst;

        /*
         * Create and init kstat
         */
        inst = ddi_get_instance(state->id_dip);
        (void) snprintf(stat_name, KSTAT_STRLEN, "statistics%d_%x_%u", inst,
            state->id_pkey, state->id_plinkid);
        ksp = kstat_create("ibd", 0, stat_name, "net", KSTAT_TYPE_NAMED,
            sizeof (ibd_rc_stat_t) / sizeof (kstat_named_t), 0);

        if (ksp == NULL) {
                ibd_print_warn(state, "ibd_rc_init_stats: Could not create "
                    "kernel statistics");
                return (DDI_FAILURE);
        }

        state->rc_ksp = ksp;    /* Fill in the ksp of ibd over RC mode */

        ibd_rc_ksp = (ibd_rc_stat_t *)ksp->ks_data;

        /*
         * Initialize all the statistics
         */
        kstat_named_init(&ibd_rc_ksp->rc_rcv_trans_byte, "RC: Rx Bytes, "
            "transfer mode", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_rcv_trans_pkt, "RC: Rx Pkts, "
            "transfer mode", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_rcv_copy_byte, "RC: Rx Bytes, "
            "copy mode", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_rcv_copy_pkt, "RC: Rx Pkts, "
            "copy mode", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_rcv_alloc_fail, "RC: Rx alloc fail",
            KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_rcq_err, "RC: fail in Recv CQ handler",
            KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_rwqe_short, "RC: Short rwqe",
            KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_xmt_bytes, "RC: Sent Bytes",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_small_pkt,
            "RC: Tx pkt small size", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_fragmented_pkt,
            "RC: Tx pkt fragmentary", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_map_fail_pkt,
            "RC: Tx pkt fail ibt_map_mem_iov()", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_map_succ_pkt,
            "RC: Tx pkt succ ibt_map_mem_iov()", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_ace_not_found, "RC: ace not found",
            KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_scq_no_swqe, "RC: No swqe after "
            "recycle", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_scq_no_largebuf, "RC: No large tx buf "
            "after recycle", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_swqe_short, "RC: No swqe in ibd_send",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_swqe_mac_update, "RC: mac_tx_update "
            "#, swqe available", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_buf_short, "RC: No buf in "
            "ibd_send", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_xmt_buf_mac_update, "RC: "
            "mac_tx_update #, buf available", KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_conn_succ, "RC: succ connected",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_conn_fail, "RC: fail connect",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_null_conn, "RC: null conn for unicast "
            "pkt", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_no_estab_conn, "RC: not in act estab "
            "state", KSTAT_DATA_ULONG);

        kstat_named_init(&ibd_rc_ksp->rc_act_close, "RC: call ibd_rc_act_close",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_pas_close, "RC: call ibd_rc_pas_close",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_delay_ace_recycle, "RC: delay ace "
            "recycle", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_act_close_simultaneous, "RC: "
            "simultaneous ibd_rc_act_close", KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_reset_cnt, "RC: Reset RC channel",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_act_close, "RC: timeout act side",
            KSTAT_DATA_ULONG);
        kstat_named_init(&ibd_rc_ksp->rc_pas_close, "RC: timeout pas side",
            KSTAT_DATA_ULONG);

        /*
         * Function to provide kernel stat update on demand
         */
        ksp->ks_update = ibd_rc_update_stats;

        /*
         * Pointer into provider's raw statistics
         */
        ksp->ks_private = (void *)state;

        /*
         * Add kstat to systems kstat chain
         */
        kstat_install(ksp);

        return (DDI_SUCCESS);
}
#endif

static ibt_status_t
ibd_rc_alloc_chan(ibd_rc_chan_t **ret_chan, ibd_state_t *state,
    boolean_t is_tx_chan)
{
        ibt_status_t result;
        ibd_rc_chan_t *chan;
        ibt_rc_chan_alloc_args_t alloc_args;
        ibt_chan_alloc_flags_t alloc_flags;
        ibt_chan_sizes_t sizes;
        ibt_cq_attr_t cq_atts;
        int rv;

        chan = kmem_zalloc(sizeof (ibd_rc_chan_t), KM_SLEEP);

        chan->state = state;
        mutex_init(&chan->rx_wqe_list.dl_mutex, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&chan->rx_free_list.dl_mutex, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&chan->tx_wqe_list.dl_mutex, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&chan->tx_rel_list.dl_mutex, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&chan->tx_post_lock, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&chan->tx_poll_lock, NULL, MUTEX_DRIVER, NULL);

        /* Allocate IB structures for a new RC channel. */
        if (is_tx_chan) {
                chan->scq_size = state->id_rc_num_swqe;
                chan->rcq_size = IBD_RC_MIN_CQ_SIZE;
        } else {
                chan->scq_size = IBD_RC_MIN_CQ_SIZE;
                chan->rcq_size = state->id_rc_num_rwqe;
        }
        cq_atts.cq_size = chan->scq_size;
        cq_atts.cq_sched = NULL;
        cq_atts.cq_flags = IBT_CQ_NO_FLAGS;
        result = ibt_alloc_cq(state->id_hca_hdl, &cq_atts, &chan->scq_hdl,
            &chan->scq_size);
        if (result != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_alloc_chan: error <%d>"
                    "create scq completion queue (size <%d>)",
                    result, chan->scq_size);
                goto alloc_scq_err;
        }       /* if failure to alloc cq */

        if (ibt_modify_cq(chan->scq_hdl, state->id_rc_tx_comp_count,
            state->id_rc_tx_comp_usec, 0) != IBT_SUCCESS) {
                DPRINT(30, "ibd_rc_alloc_chan: Send CQ "
                    "interrupt moderation failed");
        }

        ibt_set_cq_private(chan->scq_hdl, (void *) (uintptr_t)chan);
        ibt_set_cq_handler(chan->scq_hdl, ibd_rc_scq_handler,
            (void *) (uintptr_t)chan);

        cq_atts.cq_size = chan->rcq_size;
        cq_atts.cq_sched = NULL;
        cq_atts.cq_flags = IBT_CQ_NO_FLAGS;
        result = ibt_alloc_cq(state->id_hca_hdl, &cq_atts, &chan->rcq_hdl,
            &chan->rcq_size);
        if (result != IBT_SUCCESS) {
                ibd_print_warn(state, "ibd_rc_alloc_chan: error <%d> creating "
                    "rx completion queue (size <%d>)", result, chan->rcq_size);
                goto alloc_rcq_err;
        }       /* if failure to alloc cq */

        if (ibt_modify_cq(chan->rcq_hdl, state->id_rc_rx_comp_count,
            state->id_rc_rx_comp_usec, 0) != IBT_SUCCESS) {
                DPRINT(30, "ibd_rc_alloc_chan: Receive CQ "
                    "interrupt moderation failed");
        }

        ibt_set_cq_private(chan->rcq_hdl, (void *) (uintptr_t)chan);
        ibt_set_cq_handler(chan->rcq_hdl, ibd_rc_rcq_handler,
            (void *)(uintptr_t)chan);

        if (is_tx_chan) {
                chan->is_tx_chan = B_TRUE;
                if (ibd_rc_init_txlist(chan) != DDI_SUCCESS) {
                        ibd_print_warn(state, "ibd_rc_alloc_chan: "
                            "ibd_rc_init_txlist failed");
                        goto init_txlist_err;
                }
                if (ibd_rc_tx_softintr == 1) {
                        if ((rv = ddi_add_softintr(state->id_dip,
                            DDI_SOFTINT_LOW, &chan->scq_softintr, NULL, NULL,
                            ibd_rc_tx_recycle, (caddr_t)chan)) !=
                            DDI_SUCCESS) {
                                DPRINT(10, "ibd_rc_alloc_chan: failed in "
                                    "ddi_add_softintr(scq_softintr), ret=%d",
                                    rv);
                                goto alloc_softintr_err;
                        }
                }
        } else {
                chan->is_tx_chan = B_FALSE;
        }

        /*
         * enable completions
         */
        result = ibt_enable_cq_notify(chan->scq_hdl, IBT_NEXT_COMPLETION);
        if (result != IBT_SUCCESS) {
                ibd_print_warn(state, "ibd_rc_alloc_chan: ibt_enable_cq_notify"
                    "(scq) failed: status %d\n", result);
                goto alloc_scq_enable_err;
        }

        /* We will enable chan->rcq_hdl later. */

        /* alloc a RC channel */
        bzero(&alloc_args, sizeof (ibt_rc_chan_alloc_args_t));
        bzero(&sizes, sizeof (ibt_chan_sizes_t));

        alloc_args.rc_flags = IBT_WR_SIGNALED;
        alloc_args.rc_control = IBT_CEP_NO_FLAGS;

        alloc_args.rc_scq = chan->scq_hdl;
        alloc_args.rc_rcq = chan->rcq_hdl;
        alloc_args.rc_pd = state->id_pd_hdl;

        alloc_args.rc_hca_port_num = state->id_port;
        alloc_args.rc_clone_chan = NULL;

        /* scatter/gather */
        alloc_args.rc_sizes.cs_sq_sgl = state->rc_tx_max_sqseg;

        /*
         * For the number of SGL elements in receive side, I think it
         * should be 1. Because ibd driver allocates a whole block memory
         * for each ibt_post_recv().
         */
        alloc_args.rc_sizes.cs_rq_sgl = 1;

        /* The send queue size and the receive queue size */
        alloc_args.rc_sizes.cs_sq = chan->scq_size;
        alloc_args.rc_sizes.cs_rq = chan->rcq_size;

        if (state->id_hca_res_lkey_capab) {
                alloc_args.rc_flags = IBT_FAST_REG_RES_LKEY;
        } else {
                DPRINT(40, "ibd_rc_alloc_chan: not support reserved lkey");
        }

        if (state->rc_enable_srq) {
                alloc_flags = IBT_ACHAN_USES_SRQ;
                alloc_args.rc_srq = state->rc_srq_hdl;
        } else {
                alloc_flags = IBT_ACHAN_NO_FLAGS;
        }

        result = ibt_alloc_rc_channel(state->id_hca_hdl,
            alloc_flags, &alloc_args, &chan->chan_hdl, &sizes);
        if (result != IBT_SUCCESS) {
                ibd_print_warn(state, "ibd_rc_alloc_chan: ibd_rc_open_channel"
                    " fail:<%d>", result);
                goto alloc_scq_enable_err;
        }

        if (is_tx_chan)
                atomic_inc_32(&state->rc_num_tx_chan);
        else
                atomic_inc_32(&state->rc_num_rx_chan);

        /* For the connection reaper routine ibd_rc_conn_timeout_call() */
        chan->is_used = B_TRUE;

        *ret_chan = chan;
        return (IBT_SUCCESS);

alloc_scq_enable_err:
        if (is_tx_chan) {
                if (ibd_rc_tx_softintr == 1) {
                        ddi_remove_softintr(chan->scq_softintr);
                }
        }
alloc_softintr_err:
        if (is_tx_chan) {
                ibd_rc_fini_txlist(chan);
        }
init_txlist_err:
        (void) ibt_free_cq(chan->rcq_hdl);
alloc_rcq_err:
        (void) ibt_free_cq(chan->scq_hdl);
alloc_scq_err:
        mutex_destroy(&chan->tx_poll_lock);
        mutex_destroy(&chan->tx_post_lock);
        mutex_destroy(&chan->tx_rel_list.dl_mutex);
        mutex_destroy(&chan->tx_wqe_list.dl_mutex);
        mutex_destroy(&chan->rx_free_list.dl_mutex);
        mutex_destroy(&chan->rx_wqe_list.dl_mutex);
        kmem_free(chan, sizeof (ibd_rc_chan_t));
        return (result);
}

static void
ibd_rc_free_chan(ibd_rc_chan_t *chan)
{
        ibt_status_t ret;

        /* DPRINT(30, "ibd_rc_free_chan: chan=%p", chan); */

        if (chan->chan_hdl != NULL) {
                ret = ibt_free_channel(chan->chan_hdl);
                if (ret != IBT_SUCCESS) {
                        DPRINT(40, "ib_rc_free_chan: ibt_free_channel failed, "
                            "chan=%p, returned: %d", chan, ret);
                        return;
                }
                chan->chan_hdl = NULL;
        }

        if (chan->rcq_hdl != NULL) {
                ret = ibt_free_cq(chan->rcq_hdl);
                if (ret != IBT_SUCCESS) {
                        DPRINT(40, "ib_rc_free_chan: ibt_free_cq(rcq) failed, "
                            "chan=%p, returned: %d", chan, ret);
                        return;
                }
                chan->rcq_hdl = NULL;
        }

        if (chan->scq_hdl != NULL) {
                ret = ibt_free_cq(chan->scq_hdl);
                if (ret != IBT_SUCCESS) {
                        DPRINT(40, "ib_rc_free_chan: ibt_free_cq(scq) failed, "
                            "chan=%p, returned: %d", chan, ret);
                        return;
                }
                chan->scq_hdl = NULL;
        }

        /* Free buffers */
        if (chan->is_tx_chan) {
                ibd_rc_fini_txlist(chan);
                if (ibd_rc_tx_softintr == 1) {
                        ddi_remove_softintr(chan->scq_softintr);
                }
                atomic_dec_32(&chan->state->rc_num_tx_chan);
        } else {
                if (!chan->state->rc_enable_srq) {
                        ibd_rc_fini_rxlist(chan);
                }
                atomic_dec_32(&chan->state->rc_num_rx_chan);
        }

        mutex_destroy(&chan->tx_poll_lock);
        mutex_destroy(&chan->tx_post_lock);
        mutex_destroy(&chan->tx_rel_list.dl_mutex);
        mutex_destroy(&chan->tx_wqe_list.dl_mutex);
        mutex_destroy(&chan->rx_free_list.dl_mutex);
        mutex_destroy(&chan->rx_wqe_list.dl_mutex);

        /*
         * If it is a passive channel, must make sure it has been removed
         * from chan->state->rc_pass_chan_list
         */
        kmem_free(chan, sizeof (ibd_rc_chan_t));
}

/* Add a RC channel */
static inline void
ibd_rc_add_to_chan_list(ibd_rc_chan_list_t *list, ibd_rc_chan_t *chan)
{
        mutex_enter(&list->chan_list_mutex);
        if (list->chan_list == NULL) {
                list->chan_list = chan;
                chan->next = NULL;
        } else {
                chan->next = list->chan_list;
                list->chan_list = chan;
        }
        mutex_exit(&list->chan_list_mutex);
}

static boolean_t
ibd_rc_re_add_to_pas_chan_list(ibd_rc_chan_t *chan)
{
        ibd_state_t *state = chan->state;

        mutex_enter(&state->rc_pass_chan_list.chan_list_mutex);
        if ((state->id_mac_state & IBD_DRV_STARTED) == 0) {
                mutex_exit(&state->rc_pass_chan_list.chan_list_mutex);
                return (B_FALSE);
        } else {
                if (state->rc_pass_chan_list.chan_list == NULL) {
                        state->rc_pass_chan_list.chan_list = chan;
                        chan->next = NULL;
                } else {
                        chan->next = state->rc_pass_chan_list.chan_list;
                        state->rc_pass_chan_list.chan_list = chan;
                }
                mutex_exit(&state->rc_pass_chan_list.chan_list_mutex);
                return (B_TRUE);
        }
}

/* Remove a RC channel */
static inline ibd_rc_chan_t *
ibd_rc_rm_from_chan_list(ibd_rc_chan_list_t *list, ibd_rc_chan_t *chan)
{
        ibd_rc_chan_t *pre_chan;

        mutex_enter(&list->chan_list_mutex);
        if (list->chan_list == chan) {
                DPRINT(30, "ibd_rc_rm_from_chan_list(first): found chan(%p)"
                    " in chan_list", chan);
                list->chan_list = chan->next;
        } else {
                pre_chan = list->chan_list;
                while (pre_chan != NULL) {
                        if (pre_chan->next == chan) {
                                DPRINT(30, "ibd_rc_rm_from_chan_list"
                                    "(middle): found chan(%p)", chan);
                                pre_chan->next = chan->next;
                                break;
                        }
                        pre_chan = pre_chan->next;
                }
                if (pre_chan == NULL)
                        chan = NULL;
        }
        mutex_exit(&list->chan_list_mutex);
        return (chan);
}

static inline ibd_rc_chan_t *
ibd_rc_rm_header_chan_list(ibd_rc_chan_list_t *list)
{
        ibd_rc_chan_t *rc_chan;

        mutex_enter(&list->chan_list_mutex);
        rc_chan = list->chan_list;
        if (rc_chan != NULL) {
                list->chan_list = rc_chan->next;
        }
        mutex_exit(&list->chan_list_mutex);
        return (rc_chan);
}

static int
ibd_rc_alloc_srq_copybufs(ibd_state_t *state)
{
        ibt_mr_attr_t mem_attr;
        uint_t rc_rx_bufs_sz;

        /*
         * Allocate one big chunk for all regular rx copy bufs
         */
        rc_rx_bufs_sz =  (state->rc_mtu + IPOIB_GRH_SIZE) * state->rc_srq_size;

        state->rc_srq_rx_bufs = kmem_zalloc(rc_rx_bufs_sz, KM_SLEEP);

        state->rc_srq_rwqes = kmem_zalloc(state->rc_srq_size *
            sizeof (ibd_rwqe_t), KM_SLEEP);

        /*
         * Do one memory registration on the entire rxbuf area
         */
        mem_attr.mr_vaddr = (uint64_t)(uintptr_t)state->rc_srq_rx_bufs;
        mem_attr.mr_len = rc_rx_bufs_sz;
        mem_attr.mr_as = NULL;
        mem_attr.mr_flags = IBT_MR_SLEEP | IBT_MR_ENABLE_LOCAL_WRITE;
        if (ibt_register_mr(state->id_hca_hdl, state->id_pd_hdl, &mem_attr,
            &state->rc_srq_rx_mr_hdl, &state->rc_srq_rx_mr_desc)
            != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_alloc_srq_copybufs: ibt_register_mr() "
                    "failed");
                kmem_free(state->rc_srq_rwqes,
                    state->rc_srq_size * sizeof (ibd_rwqe_t));
                kmem_free(state->rc_srq_rx_bufs, rc_rx_bufs_sz);
                state->rc_srq_rx_bufs = NULL;
                state->rc_srq_rwqes = NULL;
                return (DDI_FAILURE);
        }

        return (DDI_SUCCESS);
}

static void
ibd_rc_free_srq_copybufs(ibd_state_t *state)
{
        uint_t rc_rx_buf_sz;

        /*
         * Don't change the value of state->rc_mtu at the period from call
         * ibd_rc_alloc_srq_copybufs() to call ibd_rc_free_srq_copybufs().
         */
        rc_rx_buf_sz = state->rc_mtu + IPOIB_GRH_SIZE;

        /*
         * Unregister rxbuf mr
         */
        if (ibt_deregister_mr(state->id_hca_hdl,
            state->rc_srq_rx_mr_hdl) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_free_srq_copybufs: ibt_deregister_mr()"
                    " failed");
        }
        state->rc_srq_rx_mr_hdl = NULL;

        /*
         * Free rxbuf memory
         */
        kmem_free(state->rc_srq_rwqes,
            state->rc_srq_size * sizeof (ibd_rwqe_t));
        kmem_free(state->rc_srq_rx_bufs, state->rc_srq_size * rc_rx_buf_sz);
        state->rc_srq_rwqes = NULL;
        state->rc_srq_rx_bufs = NULL;
}

/*
 * Allocate and post a certain number of SRQ receive buffers and WRs.
 */
int
ibd_rc_init_srq_list(ibd_state_t *state)
{
        ibd_rwqe_t *rwqe;
        ibt_lkey_t lkey;
        int i;
        uint_t len;
        uint8_t *bufaddr;
        ibt_srq_sizes_t srq_sizes;
        ibt_srq_sizes_t  srq_real_sizes;
        ibt_status_t ret;

        srq_sizes.srq_sgl_sz = 1;
        srq_sizes.srq_wr_sz = state->id_rc_num_srq;
        ret = ibt_alloc_srq(state->id_hca_hdl, IBT_SRQ_NO_FLAGS,
            state->id_pd_hdl, &srq_sizes, &state->rc_srq_hdl, &srq_real_sizes);
        if (ret != IBT_SUCCESS) {
                /*
                 * The following code is for CR 6932460 (can't configure ibd
                 * interface on 32 bits x86 systems). 32 bits x86 system has
                 * less memory resource than 64 bits x86 system. If current
                 * resource request can't be satisfied, we request less
                 * resource here.
                 */
                len = state->id_rc_num_srq;
                while ((ret == IBT_HCA_WR_EXCEEDED) &&
                    (len >= 2 * IBD_RC_MIN_CQ_SIZE)) {
                        len = len/2;
                        srq_sizes.srq_sgl_sz = 1;
                        srq_sizes.srq_wr_sz = len;
                        ret = ibt_alloc_srq(state->id_hca_hdl,
                            IBT_SRQ_NO_FLAGS, state->id_pd_hdl, &srq_sizes,
                            &state->rc_srq_hdl, &srq_real_sizes);
                }
                if (ret != IBT_SUCCESS) {
                        DPRINT(10, "ibd_rc_init_srq_list: ibt_alloc_srq failed."
                            "req_sgl_sz=%d, req_wr_sz=0x%x, final_req_wr_sz="
                            "0x%x, ret=%d", srq_sizes.srq_sgl_sz,
                            srq_sizes.srq_wr_sz, len, ret);
                        return (DDI_FAILURE);
                }
                state->id_rc_num_srq = len;
                state->id_rc_num_rwqe = state->id_rc_num_srq + 1;
        }

        state->rc_srq_size = srq_real_sizes.srq_wr_sz;
        if (ibd_rc_alloc_srq_copybufs(state) != DDI_SUCCESS) {
                ret = ibt_free_srq(state->rc_srq_hdl);
                if (ret != IBT_SUCCESS) {
                        ibd_print_warn(state, "ibd_rc_init_srq_list: "
                            "ibt_free_srq fail, ret=%d", ret);
                }
                return (DDI_FAILURE);
        }

        /*
         * Allocate and setup the rwqe list
         */
        lkey = state->rc_srq_rx_mr_desc.md_lkey;
        rwqe = state->rc_srq_rwqes;
        bufaddr = state->rc_srq_rx_bufs;
        len = state->rc_mtu + IPOIB_GRH_SIZE;
        state->rc_srq_rwqe_list.dl_cnt = 0;
        state->rc_srq_rwqe_list.dl_bufs_outstanding = 0;
        for (i = 0; i < state->rc_srq_size; i++, rwqe++, bufaddr += len) {
                rwqe->w_state = state;
                rwqe->w_freeing_wqe = B_FALSE;
                rwqe->w_freemsg_cb.free_func = ibd_rc_srq_freemsg_cb;
                rwqe->w_freemsg_cb.free_arg = (char *)rwqe;
                rwqe->rwqe_copybuf.ic_bufaddr = bufaddr;

                if ((rwqe->rwqe_im_mblk = desballoc(bufaddr, len, 0,
                    &rwqe->w_freemsg_cb)) == NULL) {
                        DPRINT(40, "ibd_rc_init_srq_list : desballoc() failed");
                        rwqe->rwqe_copybuf.ic_bufaddr = NULL;
                        if (atomic_dec_32_nv(&state->id_running) != 0) {
                                cmn_err(CE_WARN, "ibd_rc_init_srq_list: "
                                    "id_running was not 1\n");
                        }
                        ibd_rc_fini_srq_list(state);
                        atomic_inc_32(&state->id_running);
                        return (DDI_FAILURE);
                }

                rwqe->rwqe_copybuf.ic_sgl.ds_key = lkey;
                /* Leave IPOIB_GRH_SIZE space */
                rwqe->rwqe_copybuf.ic_sgl.ds_va =
                    (ib_vaddr_t)(uintptr_t)(bufaddr + IPOIB_GRH_SIZE);
                rwqe->rwqe_copybuf.ic_sgl.ds_len = state->rc_mtu;
                rwqe->w_rwr.wr_id = (ibt_wrid_t)(uintptr_t)rwqe;
                rwqe->w_rwr.wr_nds = 1;
                rwqe->w_rwr.wr_sgl = &rwqe->rwqe_copybuf.ic_sgl;
                (void) ibd_rc_post_srq(state, rwqe);
        }

        mutex_enter(&state->rc_srq_free_list.dl_mutex);
        state->rc_srq_free_list.dl_head = NULL;
        state->rc_srq_free_list.dl_cnt = 0;
        mutex_exit(&state->rc_srq_free_list.dl_mutex);

        return (DDI_SUCCESS);
}

/*
 * Free the statically allocated Rx buffer list for SRQ.
 */
void
ibd_rc_fini_srq_list(ibd_state_t *state)
{
        ibd_rwqe_t *rwqe;
        int i;
        ibt_status_t ret;

        ASSERT(state->id_running == 0);
        ret = ibt_free_srq(state->rc_srq_hdl);
        if (ret != IBT_SUCCESS) {
                ibd_print_warn(state, "ibd_rc_fini_srq_list: "
                    "ibt_free_srq fail, ret=%d", ret);
        }

        mutex_enter(&state->rc_srq_rwqe_list.dl_mutex);
        rwqe = state->rc_srq_rwqes;
        for (i = 0; i < state->rc_srq_size; i++, rwqe++) {
                if (rwqe->rwqe_im_mblk != NULL) {
                        rwqe->w_freeing_wqe = B_TRUE;
                        freemsg(rwqe->rwqe_im_mblk);
                }
        }
        mutex_exit(&state->rc_srq_rwqe_list.dl_mutex);

        ibd_rc_free_srq_copybufs(state);
}

/* Repost the elements in state->ib_rc_free_list */
int
ibd_rc_repost_srq_free_list(ibd_state_t *state)
{
        ibd_rwqe_t *rwqe;
        ibd_wqe_t *list;
        uint_t len;

        mutex_enter(&state->rc_srq_free_list.dl_mutex);
        if (state->rc_srq_free_list.dl_head != NULL) {
                /* repost them */
                len = state->rc_mtu + IPOIB_GRH_SIZE;
                list = state->rc_srq_free_list.dl_head;
                state->rc_srq_free_list.dl_head = NULL;
                state->rc_srq_free_list.dl_cnt = 0;
                mutex_exit(&state->rc_srq_free_list.dl_mutex);
                while (list != NULL) {
                        rwqe = WQE_TO_RWQE(list);
                        if ((rwqe->rwqe_im_mblk == NULL) &&
                            ((rwqe->rwqe_im_mblk = desballoc(
                            rwqe->rwqe_copybuf.ic_bufaddr, len, 0,
                            &rwqe->w_freemsg_cb)) == NULL)) {
                                DPRINT(40, "ibd_rc_repost_srq_free_list: "
                                    "failed in desballoc()");
                                do {
                                        ibd_rc_srq_free_rwqe(state, rwqe);
                                        list = list->w_next;
                                        rwqe = WQE_TO_RWQE(list);
                                } while (list != NULL);
                                return (DDI_FAILURE);
                        }
                        if (ibd_rc_post_srq(state, rwqe) == DDI_FAILURE) {
                                ibd_rc_srq_free_rwqe(state, rwqe);
                        }
                        list = list->w_next;
                }
                return (DDI_SUCCESS);
        }
        mutex_exit(&state->rc_srq_free_list.dl_mutex);
        return (DDI_SUCCESS);
}

/*
 * Free an allocated recv wqe.
 */
static void
ibd_rc_srq_free_rwqe(ibd_state_t *state, ibd_rwqe_t *rwqe)
{
        /*
         * desballoc() failed (no memory) or the posting of rwqe failed.
         *
         * This rwqe is placed on a free list so that it
         * can be reinstated in future.
         *
         * NOTE: no code currently exists to reinstate
         * these "lost" rwqes.
         */
        mutex_enter(&state->rc_srq_free_list.dl_mutex);
        state->rc_srq_free_list.dl_cnt++;
        rwqe->rwqe_next = state->rc_srq_free_list.dl_head;
        state->rc_srq_free_list.dl_head = RWQE_TO_WQE(rwqe);
        mutex_exit(&state->rc_srq_free_list.dl_mutex);
}

static void
ibd_rc_srq_freemsg_cb(char *arg)
{
        ibd_rwqe_t *rwqe = (ibd_rwqe_t *)arg;
        ibd_state_t *state = rwqe->w_state;

        ASSERT(state->rc_enable_srq);

        /*
         * If the driver is stopped, just free the rwqe.
         */
        if (atomic_add_32_nv(&state->id_running, 0) == 0) {
                if (!rwqe->w_freeing_wqe) {
                        atomic_dec_32(
                            &state->rc_srq_rwqe_list.dl_bufs_outstanding);
                        DPRINT(6, "ibd_rc_srq_freemsg_cb: wqe being freed");
                        rwqe->rwqe_im_mblk = NULL;
                        ibd_rc_srq_free_rwqe(state, rwqe);
                }
                return;
        }

        atomic_dec_32(&state->rc_srq_rwqe_list.dl_bufs_outstanding);

        ASSERT(state->rc_srq_rwqe_list.dl_cnt < state->rc_srq_size);
        ASSERT(!rwqe->w_freeing_wqe);

        /*
         * Upper layer has released held mblk, so we have
         * no more use for keeping the old pointer in
         * our rwqe.
         */
        rwqe->rwqe_im_mblk = desballoc(rwqe->rwqe_copybuf.ic_bufaddr,
            state->rc_mtu + IPOIB_GRH_SIZE, 0, &rwqe->w_freemsg_cb);
        if (rwqe->rwqe_im_mblk == NULL) {
                DPRINT(40, "ibd_rc_srq_freemsg_cb: desballoc failed");
                ibd_rc_srq_free_rwqe(state, rwqe);
                return;
        }

        if (ibd_rc_post_srq(state, rwqe) == DDI_FAILURE) {
                ibd_print_warn(state, "ibd_rc_srq_freemsg_cb: ibd_rc_post_srq"
                    " failed");
                ibd_rc_srq_free_rwqe(state, rwqe);
                return;
        }
}

/*
 * Post a rwqe to the hardware and add it to the Rx list.
 */
static int
ibd_rc_post_srq(ibd_state_t *state, ibd_rwqe_t *rwqe)
{
        /*
         * Here we should add dl_cnt before post recv, because
         * we would have to make sure dl_cnt is updated before
         * the corresponding ibd_rc_process_rx() is called.
         */
        ASSERT(state->rc_srq_rwqe_list.dl_cnt < state->rc_srq_size);
        atomic_inc_32(&state->rc_srq_rwqe_list.dl_cnt);
        if (ibt_post_srq(state->rc_srq_hdl, &rwqe->w_rwr, 1, NULL) !=
            IBT_SUCCESS) {
                atomic_dec_32(&state->rc_srq_rwqe_list.dl_cnt);
                DPRINT(40, "ibd_rc_post_srq : ibt_post_srq() failed");
                return (DDI_FAILURE);
        }

        return (DDI_SUCCESS);
}

/*
 * Post a rwqe to the hardware and add it to the Rx list.
 */
static int
ibd_rc_post_rwqe(ibd_rc_chan_t *chan, ibd_rwqe_t *rwqe)
{
        /*
         * Here we should add dl_cnt before post recv, because we would
         * have to make sure dl_cnt has already updated before
         * corresponding ibd_rc_process_rx() is called.
         */
        atomic_inc_32(&chan->rx_wqe_list.dl_cnt);
        if (ibt_post_recv(chan->chan_hdl, &rwqe->w_rwr, 1, NULL) !=
            IBT_SUCCESS) {
                atomic_dec_32(&chan->rx_wqe_list.dl_cnt);
                DPRINT(40, "ibd_rc_post_rwqe : failed in ibt_post_recv()");
                return (DDI_FAILURE);
        }
        return (DDI_SUCCESS);
}

static int
ibd_rc_alloc_rx_copybufs(ibd_rc_chan_t *chan)
{
        ibd_state_t *state = chan->state;
        ibt_mr_attr_t mem_attr;
        uint_t rc_rx_bufs_sz;

        /*
         * Allocate one big chunk for all regular rx copy bufs
         */
        rc_rx_bufs_sz = (state->rc_mtu + IPOIB_GRH_SIZE) * chan->rcq_size;

        chan->rx_bufs = kmem_zalloc(rc_rx_bufs_sz, KM_SLEEP);

        chan->rx_rwqes = kmem_zalloc(chan->rcq_size *
            sizeof (ibd_rwqe_t), KM_SLEEP);

        /*
         * Do one memory registration on the entire rxbuf area
         */
        mem_attr.mr_vaddr = (uint64_t)(uintptr_t)chan->rx_bufs;
        mem_attr.mr_len = rc_rx_bufs_sz;
        mem_attr.mr_as = NULL;
        mem_attr.mr_flags = IBT_MR_SLEEP | IBT_MR_ENABLE_LOCAL_WRITE;
        if (ibt_register_mr(state->id_hca_hdl, state->id_pd_hdl, &mem_attr,
            &chan->rx_mr_hdl, &chan->rx_mr_desc) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_alloc_srq_copybufs: ibt_register_mr failed");
                kmem_free(chan->rx_rwqes, chan->rcq_size * sizeof (ibd_rwqe_t));
                kmem_free(chan->rx_bufs, rc_rx_bufs_sz);
                chan->rx_bufs = NULL;
                chan->rx_rwqes = NULL;
                return (DDI_FAILURE);
        }

        return (DDI_SUCCESS);
}

static void
ibd_rc_free_rx_copybufs(ibd_rc_chan_t *chan)
{
        ibd_state_t *state = chan->state;
        uint_t rc_rx_buf_sz;

        ASSERT(!state->rc_enable_srq);
        ASSERT(chan->rx_rwqes != NULL);
        ASSERT(chan->rx_bufs != NULL);

        /*
         * Don't change the value of state->rc_mtu at the period from call
         * ibd_rc_alloc_rx_copybufs() to call ibd_rc_free_rx_copybufs().
         */
        rc_rx_buf_sz = state->rc_mtu + IPOIB_GRH_SIZE;

        /*
         * Unregister rxbuf mr
         */
        if (ibt_deregister_mr(state->id_hca_hdl,
            chan->rx_mr_hdl) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_free_rx_copybufs: ibt_deregister_mr failed");
        }
        chan->rx_mr_hdl = NULL;

        /*
         * Free rxbuf memory
         */
        kmem_free(chan->rx_rwqes, chan->rcq_size * sizeof (ibd_rwqe_t));
        chan->rx_rwqes = NULL;

        kmem_free(chan->rx_bufs, chan->rcq_size * rc_rx_buf_sz);
        chan->rx_bufs = NULL;
}

/*
 * Post a certain number of receive buffers and WRs on a RC channel.
 */
static int
ibd_rc_init_rxlist(ibd_rc_chan_t *chan)
{
        ibd_state_t *state = chan->state;
        ibd_rwqe_t *rwqe;
        ibt_lkey_t lkey;
        int i;
        uint_t len;
        uint8_t *bufaddr;

        ASSERT(!state->rc_enable_srq);
        if (ibd_rc_alloc_rx_copybufs(chan) != DDI_SUCCESS)
                return (DDI_FAILURE);

        /*
         * Allocate and setup the rwqe list
         */
        lkey = chan->rx_mr_desc.md_lkey;
        rwqe = chan->rx_rwqes;
        bufaddr = chan->rx_bufs;
        len = state->rc_mtu + IPOIB_GRH_SIZE;
        for (i = 0; i < chan->rcq_size; i++, rwqe++, bufaddr += len) {
                rwqe->w_state = state;
                rwqe->w_chan = chan;
                rwqe->w_freeing_wqe = B_FALSE;
                rwqe->w_freemsg_cb.free_func = ibd_rc_freemsg_cb;
                rwqe->w_freemsg_cb.free_arg = (char *)rwqe;
                rwqe->rwqe_copybuf.ic_bufaddr = bufaddr;

                if ((rwqe->rwqe_im_mblk = desballoc(bufaddr, len, 0,
                    &rwqe->w_freemsg_cb)) == NULL) {
                        DPRINT(40, "ibd_rc_init_srq_list: desballoc() failed");
                        rwqe->rwqe_copybuf.ic_bufaddr = NULL;
                        ibd_rc_fini_rxlist(chan);
                        return (DDI_FAILURE);
                }

                rwqe->rwqe_copybuf.ic_sgl.ds_key = lkey;
                rwqe->rwqe_copybuf.ic_sgl.ds_va =
                    (ib_vaddr_t)(uintptr_t)(bufaddr + IPOIB_GRH_SIZE);
                rwqe->rwqe_copybuf.ic_sgl.ds_len = state->rc_mtu;
                rwqe->w_rwr.wr_id = (ibt_wrid_t)(uintptr_t)rwqe;
                rwqe->w_rwr.wr_nds = 1;
                rwqe->w_rwr.wr_sgl = &rwqe->rwqe_copybuf.ic_sgl;
                (void) ibd_rc_post_rwqe(chan, rwqe);
        }

        return (DDI_SUCCESS);
}

/*
 * Free the statically allocated Rx buffer list for SRQ.
 */
static void
ibd_rc_fini_rxlist(ibd_rc_chan_t *chan)
{
        ibd_rwqe_t *rwqe;
        int i;

        if (chan->rx_bufs == NULL) {
                DPRINT(40, "ibd_rc_fini_rxlist: empty chan->rx_bufs, quit");
                return;
        }

        /* bufs_outstanding must be 0 */
        ASSERT((chan->rx_wqe_list.dl_head == NULL) ||
            (chan->rx_wqe_list.dl_bufs_outstanding == 0));

        mutex_enter(&chan->rx_wqe_list.dl_mutex);
        rwqe = chan->rx_rwqes;
        for (i = 0; i < chan->rcq_size; i++, rwqe++) {
                if (rwqe->rwqe_im_mblk != NULL) {
                        rwqe->w_freeing_wqe = B_TRUE;
                        freemsg(rwqe->rwqe_im_mblk);
                }
        }
        mutex_exit(&chan->rx_wqe_list.dl_mutex);

        ibd_rc_free_rx_copybufs(chan);
}

/*
 * Free an allocated recv wqe.
 */
static void
ibd_rc_free_rwqe(ibd_rc_chan_t *chan, ibd_rwqe_t *rwqe)
{
        /*
         * desballoc() failed (no memory) or the posting of rwqe failed.
         *
         * This rwqe is placed on a free list so that it
         * can be reinstated in future.
         *
         * NOTE: no code currently exists to reinstate
         * these "lost" rwqes.
         */
        mutex_enter(&chan->rx_free_list.dl_mutex);
        chan->rx_free_list.dl_cnt++;
        rwqe->rwqe_next = chan->rx_free_list.dl_head;
        chan->rx_free_list.dl_head = RWQE_TO_WQE(rwqe);
        mutex_exit(&chan->rx_free_list.dl_mutex);
}

/*
 * Processing to be done after receipt of a packet; hand off to GLD
 * in the format expected by GLD.
 */
static void
ibd_rc_process_rx(ibd_rc_chan_t *chan, ibd_rwqe_t *rwqe, ibt_wc_t *wc)
{
        ibd_state_t *state = chan->state;
        ib_header_info_t *phdr;
        ipoib_hdr_t *ipibp;
        mblk_t *mp;
        mblk_t *mpc;
        int rxcnt;
        ip6_t *ip6h;
        int len;

        /*
         * Track number handed to upper layer, and number still
         * available to receive packets.
         */
        if (state->rc_enable_srq) {
                rxcnt = atomic_dec_32_nv(&state->rc_srq_rwqe_list.dl_cnt);
        } else {
                rxcnt = atomic_dec_32_nv(&chan->rx_wqe_list.dl_cnt);
        }

        /*
         * It can not be a IBA multicast packet.
         */
        ASSERT(!wc->wc_flags & IBT_WC_GRH_PRESENT);

        /* For the connection reaper routine ibd_rc_conn_timeout_call() */
        chan->is_used = B_TRUE;

#ifdef DEBUG
        if (rxcnt < state->id_rc_rx_rwqe_thresh) {
                state->rc_rwqe_short++;
        }
#endif

        /*
         * Possibly replenish the Rx pool if needed.
         */
        if ((rxcnt >= state->id_rc_rx_rwqe_thresh) &&
            (wc->wc_bytes_xfer > state->id_rc_rx_copy_thresh)) {
                atomic_add_64(&state->rc_rcv_trans_byte, wc->wc_bytes_xfer);
                atomic_inc_64(&state->rc_rcv_trans_pkt);

                /*
                 * Record how many rwqe has been occupied by upper
                 * network layer
                 */
                if (state->rc_enable_srq) {
                        atomic_inc_32(
                            &state->rc_srq_rwqe_list.dl_bufs_outstanding);
                } else {
                        atomic_inc_32(&chan->rx_wqe_list.dl_bufs_outstanding);
                }
                mp = rwqe->rwqe_im_mblk;
        } else {
                atomic_add_64(&state->rc_rcv_copy_byte, wc->wc_bytes_xfer);
                atomic_inc_64(&state->rc_rcv_copy_pkt);

                if ((mp = allocb(wc->wc_bytes_xfer + IPOIB_GRH_SIZE,
                    BPRI_HI)) == NULL) {        /* no memory */
                        DPRINT(40, "ibd_rc_process_rx: allocb() failed");
                        state->rc_rcv_alloc_fail++;
                        if (state->rc_enable_srq) {
                                if (ibd_rc_post_srq(state, rwqe) ==
                                    DDI_FAILURE) {
                                        ibd_rc_srq_free_rwqe(state, rwqe);
                                }
                        } else {
                                if (ibd_rc_post_rwqe(chan, rwqe) ==
                                    DDI_FAILURE) {
                                        ibd_rc_free_rwqe(chan, rwqe);
                                }
                        }
                        return;
                }

                bcopy(rwqe->rwqe_im_mblk->b_rptr + IPOIB_GRH_SIZE,
                    mp->b_wptr + IPOIB_GRH_SIZE, wc->wc_bytes_xfer);

                if (state->rc_enable_srq) {
                        if (ibd_rc_post_srq(state, rwqe) == DDI_FAILURE) {
                                ibd_rc_srq_free_rwqe(state, rwqe);
                        }
                } else {
                        if (ibd_rc_post_rwqe(chan, rwqe) == DDI_FAILURE) {
                                ibd_rc_free_rwqe(chan, rwqe);
                        }
                }
        }

        ipibp = (ipoib_hdr_t *)((uchar_t *)mp->b_rptr + IPOIB_GRH_SIZE);
        if (ntohs(ipibp->ipoib_type) == ETHERTYPE_IPV6) {
                ip6h = (ip6_t *)((uchar_t *)ipibp + sizeof (ipoib_hdr_t));
                len = ntohs(ip6h->ip6_plen);
                if (ip6h->ip6_nxt == IPPROTO_ICMPV6) {
                        /* LINTED: E_CONSTANT_CONDITION */
                        IBD_PAD_NSNA(ip6h, len, IBD_RECV);
                }
        }

        phdr = (ib_header_info_t *)mp->b_rptr;
        phdr->ib_grh.ipoib_vertcflow = 0;
        ovbcopy(&state->id_macaddr, &phdr->ib_dst,
            sizeof (ipoib_mac_t));
        mp->b_wptr = mp->b_rptr + wc->wc_bytes_xfer+ IPOIB_GRH_SIZE;

        /*
         * Can RC mode in IB guarantee its checksum correctness?
         *
         * mac_hcksum_set(mp, 0, 0, 0, 0, HCK_FULLCKSUM | HCK_FULLCKSUM_OK);
         */

        /*
         * Make sure this is NULL or we're in trouble.
         */
        if (mp->b_next != NULL) {
                ibd_print_warn(state,
                    "ibd_rc_process_rx: got duplicate mp from rcq?");
                mp->b_next = NULL;
        }

        /*
         * Add this mp to the list of processed mp's to send to
         * the nw layer
         */
        if (state->rc_enable_srq) {
                mutex_enter(&state->rc_rx_lock);
                if (state->rc_rx_mp) {
                        ASSERT(state->rc_rx_mp_tail != NULL);
                        state->rc_rx_mp_tail->b_next = mp;
                } else {
                        ASSERT(state->rc_rx_mp_tail == NULL);
                        state->rc_rx_mp = mp;
                }

                state->rc_rx_mp_tail = mp;
                state->rc_rx_mp_len++;

                if (state->rc_rx_mp_len  >= IBD_MAX_RX_MP_LEN) {
                        mpc = state->rc_rx_mp;

                        state->rc_rx_mp = NULL;
                        state->rc_rx_mp_tail = NULL;
                        state->rc_rx_mp_len = 0;
                        mutex_exit(&state->rc_rx_lock);
                        mac_rx(state->id_mh, NULL, mpc);
                } else {
                        mutex_exit(&state->rc_rx_lock);
                }
        } else {
                mutex_enter(&chan->rx_lock);
                if (chan->rx_mp) {
                        ASSERT(chan->rx_mp_tail != NULL);
                        chan->rx_mp_tail->b_next = mp;
                } else {
                        ASSERT(chan->rx_mp_tail == NULL);
                        chan->rx_mp = mp;
                }

                chan->rx_mp_tail = mp;
                chan->rx_mp_len++;

                if (chan->rx_mp_len  >= IBD_MAX_RX_MP_LEN) {
                        mpc = chan->rx_mp;

                        chan->rx_mp = NULL;
                        chan->rx_mp_tail = NULL;
                        chan->rx_mp_len = 0;
                        mutex_exit(&chan->rx_lock);
                        mac_rx(state->id_mh, NULL, mpc);
                } else {
                        mutex_exit(&chan->rx_lock);
                }
        }
}

/*
 * Callback code invoked from STREAMs when the recv data buffer is free
 * for recycling.
 */
static void
ibd_rc_freemsg_cb(char *arg)
{
        ibd_rwqe_t *rwqe = (ibd_rwqe_t *)arg;
        ibd_rc_chan_t *chan = rwqe->w_chan;
        ibd_state_t *state = rwqe->w_state;

        /*
         * If the wqe is being destructed, do not attempt recycling.
         */
        if (rwqe->w_freeing_wqe == B_TRUE) {
                return;
        }

        ASSERT(!state->rc_enable_srq);
        ASSERT(chan->rx_wqe_list.dl_cnt < chan->rcq_size);

        rwqe->rwqe_im_mblk = desballoc(rwqe->rwqe_copybuf.ic_bufaddr,
            state->rc_mtu + IPOIB_GRH_SIZE, 0, &rwqe->w_freemsg_cb);
        if (rwqe->rwqe_im_mblk == NULL) {
                DPRINT(40, "ibd_rc_freemsg_cb: desballoc() failed");
                ibd_rc_free_rwqe(chan, rwqe);
                return;
        }

        /*
         * Post back to h/w. We could actually have more than
         * id_num_rwqe WQEs on the list if there were multiple
         * ibd_freemsg_cb() calls outstanding (since the lock is
         * not held the entire time). This will start getting
         * corrected over subsequent ibd_freemsg_cb() calls.
         */
        if (ibd_rc_post_rwqe(chan, rwqe) == DDI_FAILURE) {
                ibd_rc_free_rwqe(chan, rwqe);
                return;
        }
        atomic_dec_32(&chan->rx_wqe_list.dl_bufs_outstanding);
}

/*
 * Common code for interrupt handling as well as for polling
 * for all completed wqe's while detaching.
 */
static void
ibd_rc_poll_rcq(ibd_rc_chan_t *chan, ibt_cq_hdl_t cq_hdl)
{
        ibd_wqe_t *wqe;
        ibt_wc_t *wc, *wcs;
        uint_t numwcs, real_numwcs;
        int i;

        wcs = chan->rx_wc;
        numwcs = IBD_RC_MAX_CQ_WC;

        while (ibt_poll_cq(cq_hdl, wcs, numwcs, &real_numwcs) == IBT_SUCCESS) {
                for (i = 0, wc = wcs; i < real_numwcs; i++, wc++) {
                        wqe = (ibd_wqe_t *)(uintptr_t)wc->wc_id;
                        if (wc->wc_status != IBT_WC_SUCCESS) {
                                chan->state->rc_rcq_err++;
                                /*
                                 * Channel being torn down.
                                 */
                                DPRINT(40, "ibd_rc_poll_rcq: wc_status(%d) != "
                                    "SUCC, chan=%p", wc->wc_status, chan);
                                if (wc->wc_status == IBT_WC_WR_FLUSHED_ERR) {
                                        /*
                                         * Do not invoke Rx handler because
                                         * it might add buffers to the Rx pool
                                         * when we are trying to deinitialize.
                                         */
                                        continue;
                                }
                        }
                        ibd_rc_process_rx(chan, WQE_TO_RWQE(wqe), wc);
                }
        }
}

/* Receive CQ handler */
/* ARGSUSED */
static void
ibd_rc_rcq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
        ibd_rc_chan_t *chan = (ibd_rc_chan_t *)arg;
        ibd_state_t *state = chan->state;

        atomic_inc_32(&chan->rcq_invoking);
        ASSERT(chan->chan_state == IBD_RC_STATE_PAS_ESTAB);

        /*
         * Poll for completed entries; the CQ will not interrupt any
         * more for incoming (or transmitted) packets.
         */
        ibd_rc_poll_rcq(chan, chan->rcq_hdl);

        /*
         * Now enable CQ notifications; all packets that arrive now
         * (or complete transmission) will cause new interrupts.
         */
        if (ibt_enable_cq_notify(chan->rcq_hdl, IBT_NEXT_COMPLETION) !=
            IBT_SUCCESS) {
                /*
                 * We do not expect a failure here.
                 */
                DPRINT(40, "ibd_rc_rcq_handler: ibt_enable_cq_notify() failed");
        }

        /*
         * Repoll to catch all packets that might have arrived after
         * we finished the first poll loop and before interrupts got
         * armed.
         */
        ibd_rc_poll_rcq(chan, chan->rcq_hdl);

        if (state->rc_enable_srq) {
                mutex_enter(&state->rc_rx_lock);

                if (state->rc_rx_mp != NULL) {
                        mblk_t *mpc;
                        mpc = state->rc_rx_mp;

                        state->rc_rx_mp = NULL;
                        state->rc_rx_mp_tail = NULL;
                        state->rc_rx_mp_len = 0;

                        mutex_exit(&state->rc_rx_lock);
                        mac_rx(state->id_mh, NULL, mpc);
                } else {
                        mutex_exit(&state->rc_rx_lock);
                }
        } else {
                mutex_enter(&chan->rx_lock);

                if (chan->rx_mp != NULL) {
                        mblk_t *mpc;
                        mpc = chan->rx_mp;

                        chan->rx_mp = NULL;
                        chan->rx_mp_tail = NULL;
                        chan->rx_mp_len = 0;

                        mutex_exit(&chan->rx_lock);
                        mac_rx(state->id_mh, NULL, mpc);
                } else {
                        mutex_exit(&chan->rx_lock);
                }
        }
        atomic_dec_32(&chan->rcq_invoking);
}

/*
 * Allocate the statically allocated Tx buffer list.
 */
int
ibd_rc_init_tx_largebuf_list(ibd_state_t *state)
{
        ibd_rc_tx_largebuf_t *lbufp;
        ibd_rc_tx_largebuf_t *tail;
        uint8_t *memp;
        ibt_mr_attr_t mem_attr;
        uint32_t num_swqe;
        size_t  mem_size;
        int i;

        num_swqe = state->id_rc_num_swqe - 1;

        /*
         * Allocate one big chunk for all Tx large copy bufs
         */
        /* Don't transfer IPOIB_GRH_SIZE bytes (40 bytes) */
        mem_size = num_swqe * state->rc_mtu;
        state->rc_tx_mr_bufs = kmem_zalloc(mem_size, KM_SLEEP);

        mem_attr.mr_len = mem_size;
        mem_attr.mr_vaddr = (uint64_t)(uintptr_t)state->rc_tx_mr_bufs;
        mem_attr.mr_as = NULL;
        mem_attr.mr_flags = IBT_MR_SLEEP;
        if (ibt_register_mr(state->id_hca_hdl, state->id_pd_hdl, &mem_attr,
            &state->rc_tx_mr_hdl, &state->rc_tx_mr_desc) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_init_tx_largebuf_list: ibt_register_mr "
                    "failed");
                kmem_free(state->rc_tx_mr_bufs, mem_size);
                state->rc_tx_mr_bufs = NULL;
                return (DDI_FAILURE);
        }

        state->rc_tx_largebuf_desc_base = kmem_zalloc(num_swqe *
            sizeof (ibd_rc_tx_largebuf_t), KM_SLEEP);

        /*
         * Set up the buf chain
         */
        memp = state->rc_tx_mr_bufs;
        mutex_enter(&state->rc_tx_large_bufs_lock);
        lbufp = state->rc_tx_largebuf_desc_base;
        for (i = 0; i < num_swqe; i++) {
                lbufp->lb_buf = memp;
                lbufp->lb_next = lbufp + 1;

                tail = lbufp;

                memp += state->rc_mtu;
                lbufp++;
        }
        tail->lb_next = NULL;

        /*
         * Set up the buffer information in ibd state
         */
        state->rc_tx_largebuf_free_head = state->rc_tx_largebuf_desc_base;
        state->rc_tx_largebuf_nfree = num_swqe;
        mutex_exit(&state->rc_tx_large_bufs_lock);
        return (DDI_SUCCESS);
}

void
ibd_rc_fini_tx_largebuf_list(ibd_state_t *state)
{
        uint32_t num_swqe;

        num_swqe = state->id_rc_num_swqe - 1;

        if (ibt_deregister_mr(state->id_hca_hdl,
            state->rc_tx_mr_hdl) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_fini_tx_largebuf_list: ibt_deregister_mr() "
                    "failed");
        }
        state->rc_tx_mr_hdl = NULL;

        kmem_free(state->rc_tx_mr_bufs, num_swqe * state->rc_mtu);
        state->rc_tx_mr_bufs = NULL;

        kmem_free(state->rc_tx_largebuf_desc_base,
            num_swqe * sizeof (ibd_rc_tx_largebuf_t));
        state->rc_tx_largebuf_desc_base = NULL;
}

static int
ibd_rc_alloc_tx_copybufs(ibd_rc_chan_t *chan)
{
        ibt_mr_attr_t mem_attr;
        ibd_state_t *state;

        state = chan->state;
        ASSERT(state != NULL);

        /*
         * Allocate one big chunk for all regular tx copy bufs
         */
        mem_attr.mr_len = chan->scq_size * state->id_rc_tx_copy_thresh;

        chan->tx_mr_bufs = kmem_zalloc(mem_attr.mr_len, KM_SLEEP);

        /*
         * Do one memory registration on the entire txbuf area
         */
        mem_attr.mr_vaddr = (uint64_t)(uintptr_t)chan->tx_mr_bufs;
        mem_attr.mr_as = NULL;
        mem_attr.mr_flags = IBT_MR_SLEEP;
        if (ibt_register_mr(state->id_hca_hdl, state->id_pd_hdl, &mem_attr,
            &chan->tx_mr_hdl, &chan->tx_mr_desc) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_alloc_tx_copybufs: ibt_register_mr failed");
                ASSERT(mem_attr.mr_len ==
                    chan->scq_size * state->id_rc_tx_copy_thresh);
                kmem_free(chan->tx_mr_bufs, mem_attr.mr_len);
                chan->tx_mr_bufs = NULL;
                return (DDI_FAILURE);
        }

        return (DDI_SUCCESS);
}

/*
 * Allocate the statically allocated Tx buffer list.
 */
static int
ibd_rc_init_txlist(ibd_rc_chan_t *chan)
{
        ibd_swqe_t *swqe;
        int i;
        ibt_lkey_t lkey;
        ibd_state_t *state = chan->state;

        if (ibd_rc_alloc_tx_copybufs(chan) != DDI_SUCCESS)
                return (DDI_FAILURE);

        /*
         * Allocate and setup the swqe list
         */
        lkey = chan->tx_mr_desc.md_lkey;
        chan->tx_wqes = kmem_zalloc(chan->scq_size *
            sizeof (ibd_swqe_t), KM_SLEEP);
        swqe = chan->tx_wqes;
        for (i = 0; i < chan->scq_size; i++, swqe++) {
                swqe->swqe_next = NULL;
                swqe->swqe_im_mblk = NULL;

                swqe->swqe_copybuf.ic_sgl.ds_key = lkey;
                swqe->swqe_copybuf.ic_sgl.ds_len = 0; /* set in send */

                swqe->w_swr.wr_id = (ibt_wrid_t)(uintptr_t)swqe;
                swqe->w_swr.wr_flags = IBT_WR_SEND_SIGNAL;
                swqe->swqe_copybuf.ic_sgl.ds_va = (ib_vaddr_t)(uintptr_t)
                    (chan->tx_mr_bufs + i * state->id_rc_tx_copy_thresh);
                swqe->w_swr.wr_trans = IBT_RC_SRV;

                /* Add to list */
                mutex_enter(&chan->tx_wqe_list.dl_mutex);
                chan->tx_wqe_list.dl_cnt++;
                swqe->swqe_next = chan->tx_wqe_list.dl_head;
                chan->tx_wqe_list.dl_head = SWQE_TO_WQE(swqe);
                mutex_exit(&chan->tx_wqe_list.dl_mutex);
        }

        return (DDI_SUCCESS);
}

/*
 * Free the statically allocated Tx buffer list.
 */
static void
ibd_rc_fini_txlist(ibd_rc_chan_t *chan)
{
        ibd_state_t *state = chan->state;
        if (chan->tx_mr_hdl != NULL) {
                if (ibt_deregister_mr(chan->state->id_hca_hdl,
                    chan->tx_mr_hdl) != IBT_SUCCESS) {
                        DPRINT(40, "ibd_rc_fini_txlist: ibt_deregister_mr "
                            "failed");
                }
                chan->tx_mr_hdl = NULL;
        }

        if (chan->tx_mr_bufs != NULL) {
                kmem_free(chan->tx_mr_bufs, chan->scq_size *
                    state->id_rc_tx_copy_thresh);
                chan->tx_mr_bufs = NULL;
        }

        if (chan->tx_wqes != NULL) {
                kmem_free(chan->tx_wqes, chan->scq_size *
                    sizeof (ibd_swqe_t));
                chan->tx_wqes = NULL;
        }
}

/*
 * Acquire send wqe from free list.
 * Returns error number and send wqe pointer.
 */
ibd_swqe_t *
ibd_rc_acquire_swqes(ibd_rc_chan_t *chan)
{
        ibd_swqe_t *wqe;

        mutex_enter(&chan->tx_rel_list.dl_mutex);
        if (chan->tx_rel_list.dl_head != NULL) {
                /* transfer id_tx_rel_list to id_tx_list */
                chan->tx_wqe_list.dl_head =
                    chan->tx_rel_list.dl_head;
                chan->tx_wqe_list.dl_cnt =
                    chan->tx_rel_list.dl_cnt;
                chan->tx_wqe_list.dl_pending_sends = B_FALSE;

                /* clear id_tx_rel_list */
                chan->tx_rel_list.dl_head = NULL;
                chan->tx_rel_list.dl_cnt = 0;
                mutex_exit(&chan->tx_rel_list.dl_mutex);

                wqe = WQE_TO_SWQE(chan->tx_wqe_list.dl_head);
                chan->tx_wqe_list.dl_cnt -= 1;
                chan->tx_wqe_list.dl_head = wqe->swqe_next;
        } else {        /* no free swqe */
                mutex_exit(&chan->tx_rel_list.dl_mutex);
                chan->tx_wqe_list.dl_pending_sends = B_TRUE;
                wqe = NULL;
        }
        return (wqe);
}

/*
 * Release send wqe back into free list.
 */
static void
ibd_rc_release_swqe(ibd_rc_chan_t *chan, ibd_swqe_t *swqe)
{
        /*
         * Add back on Tx list for reuse.
         */
        swqe->swqe_next = NULL;
        mutex_enter(&chan->tx_rel_list.dl_mutex);
        chan->tx_rel_list.dl_pending_sends = B_FALSE;
        swqe->swqe_next = chan->tx_rel_list.dl_head;
        chan->tx_rel_list.dl_head = SWQE_TO_WQE(swqe);
        chan->tx_rel_list.dl_cnt++;
        mutex_exit(&chan->tx_rel_list.dl_mutex);
}

void
ibd_rc_post_send(ibd_rc_chan_t *chan, ibd_swqe_t *node)
{
        uint_t          i;
        uint_t          num_posted;
        uint_t          n_wrs;
        ibt_status_t    ibt_status;
        ibt_send_wr_t   wrs[IBD_MAX_TX_POST_MULTIPLE];
        ibd_swqe_t      *tx_head, *elem;
        ibd_swqe_t      *nodes[IBD_MAX_TX_POST_MULTIPLE];

        /* post the one request, then check for more */
        ibt_status = ibt_post_send(chan->chan_hdl,
            &node->w_swr, 1, NULL);
        if (ibt_status != IBT_SUCCESS) {
                ibd_print_warn(chan->state, "ibd_post_send: "
                    "posting one wr failed: ret=%d", ibt_status);
                ibd_rc_tx_cleanup(node);
        }

        tx_head = NULL;
        for (;;) {
                if (tx_head == NULL) {
                        mutex_enter(&chan->tx_post_lock);
                        tx_head = chan->tx_head;
                        if (tx_head == NULL) {
                                chan->tx_busy = 0;
                                mutex_exit(&chan->tx_post_lock);
                                return;
                        }
                        chan->tx_head = NULL;
                        mutex_exit(&chan->tx_post_lock);
                }

                /*
                 * Collect pending requests, IBD_MAX_TX_POST_MULTIPLE wrs
                 * at a time if possible, and keep posting them.
                 */
                for (n_wrs = 0, elem = tx_head;
                    (elem) && (n_wrs < IBD_MAX_TX_POST_MULTIPLE);
                    elem = WQE_TO_SWQE(elem->swqe_next), n_wrs++) {
                        nodes[n_wrs] = elem;
                        wrs[n_wrs] = elem->w_swr;
                }
                tx_head = elem;

                ASSERT(n_wrs != 0);

                /*
                 * If posting fails for some reason, we'll never receive
                 * completion intimation, so we'll need to cleanup. But
                 * we need to make sure we don't clean up nodes whose
                 * wrs have been successfully posted. We assume that the
                 * hca driver returns on the first failure to post and
                 * therefore the first 'num_posted' entries don't need
                 * cleanup here.
                 */
                num_posted = 0;
                ibt_status = ibt_post_send(chan->chan_hdl,
                    wrs, n_wrs, &num_posted);
                if (ibt_status != IBT_SUCCESS) {
                        ibd_print_warn(chan->state, "ibd_post_send: "
                            "posting multiple wrs failed: "
                            "requested=%d, done=%d, ret=%d",
                            n_wrs, num_posted, ibt_status);

                        for (i = num_posted; i < n_wrs; i++)
                                ibd_rc_tx_cleanup(nodes[i]);
                }
        }
}

/*
 * Common code that deals with clean ups after a successful or
 * erroneous transmission attempt.
 */
void
ibd_rc_tx_cleanup(ibd_swqe_t *swqe)
{
        ibd_ace_t *ace = swqe->w_ahandle;
        ibd_state_t *state;

        ASSERT(ace != NULL);
        ASSERT(ace->ac_chan != NULL);

        state = ace->ac_chan->state;

        /*
         * If this was a dynamic registration in ibd_send(),
         * deregister now.
         */
        if (swqe->swqe_im_mblk != NULL) {
                ASSERT(swqe->w_buftype == IBD_WQE_MAPPED);
                if (swqe->w_buftype == IBD_WQE_MAPPED) {
                        ibd_unmap_mem(state, swqe);
                }
                freemsg(swqe->swqe_im_mblk);
                swqe->swqe_im_mblk = NULL;
        } else {
                ASSERT(swqe->w_buftype != IBD_WQE_MAPPED);
        }

        if (swqe->w_buftype == IBD_WQE_RC_COPYBUF) {
                ibd_rc_tx_largebuf_t *lbufp;

                lbufp = swqe->w_rc_tx_largebuf;
                ASSERT(lbufp != NULL);

                mutex_enter(&state->rc_tx_large_bufs_lock);
                lbufp->lb_next = state->rc_tx_largebuf_free_head;
                state->rc_tx_largebuf_free_head = lbufp;
                state->rc_tx_largebuf_nfree ++;
                mutex_exit(&state->rc_tx_large_bufs_lock);
                swqe->w_rc_tx_largebuf = NULL;
        }


        /*
         * Release the send wqe for reuse.
         */
        ibd_rc_release_swqe(ace->ac_chan, swqe);

        /*
         * Drop the reference count on the AH; it can be reused
         * now for a different destination if there are no more
         * posted sends that will use it. This can be eliminated
         * if we can always associate each Tx buffer with an AH.
         * The ace can be null if we are cleaning up from the
         * ibd_send() error path.
         */
        ibd_dec_ref_ace(state, ace);
}

void
ibd_rc_drain_scq(ibd_rc_chan_t *chan, ibt_cq_hdl_t cq_hdl)
{
        ibd_state_t *state = chan->state;
        ibd_wqe_t *wqe;
        ibt_wc_t *wc, *wcs;
        ibd_ace_t *ace;
        uint_t numwcs, real_numwcs;
        int i;
        boolean_t encount_error;

        wcs = chan->tx_wc;
        numwcs = IBD_RC_MAX_CQ_WC;
        encount_error = B_FALSE;

        while (ibt_poll_cq(cq_hdl, wcs, numwcs, &real_numwcs) == IBT_SUCCESS) {
                for (i = 0, wc = wcs; i < real_numwcs; i++, wc++) {
                        wqe = (ibd_wqe_t *)(uintptr_t)wc->wc_id;
                        if (wc->wc_status != IBT_WC_SUCCESS) {
                                if (encount_error == B_FALSE) {
                                        /*
                                         * This RC channle is in error status,
                                         * remove it.
                                         */
                                        encount_error = B_TRUE;
                                        mutex_enter(&state->id_ac_mutex);
                                        if ((chan->chan_state ==
                                            IBD_RC_STATE_ACT_ESTAB) &&
                                            (chan->state->id_link_state ==
                                            LINK_STATE_UP) &&
                                            ((ace = ibd_acache_find(state,
                                            &chan->ace->ac_mac, B_FALSE, 0))
                                            != NULL) && (ace == chan->ace)) {
                                                ASSERT(ace->ac_mce == NULL);
                                                INC_REF(ace, 1);
                                                IBD_ACACHE_PULLOUT_ACTIVE(
                                                    state, ace);
                                                chan->chan_state =
                                                    IBD_RC_STATE_ACT_CLOSING;
                                                mutex_exit(&state->id_ac_mutex);
                                                state->rc_reset_cnt++;
                                                DPRINT(30, "ibd_rc_drain_scq: "
                                                    "wc_status(%d) != SUCC, "
                                                    "chan=%p, ace=%p, "
                                                    "link_state=%d"
                                                    "reset RC channel",
                                                    wc->wc_status, chan,
                                                    chan->ace, chan->state->
                                                    id_link_state);
                                                ibd_rc_signal_act_close(
                                                    state, ace);
                                        } else {
                                                mutex_exit(&state->id_ac_mutex);
                                                state->
                                                    rc_act_close_simultaneous++;
                                                DPRINT(40, "ibd_rc_drain_scq: "
                                                    "wc_status(%d) != SUCC, "
                                                    "chan=%p, chan_state=%d,"
                                                    "ace=%p, link_state=%d."
                                                    "other thread is closing "
                                                    "it", wc->wc_status, chan,
                                                    chan->chan_state, chan->ace,
                                                    chan->state->id_link_state);
                                        }
                                }
                        }
                        ibd_rc_tx_cleanup(WQE_TO_SWQE(wqe));
                }

                mutex_enter(&state->id_sched_lock);
                if (state->id_sched_needed == 0) {
                        mutex_exit(&state->id_sched_lock);
                } else if (state->id_sched_needed & IBD_RSRC_RC_SWQE) {
                        mutex_enter(&chan->tx_wqe_list.dl_mutex);
                        mutex_enter(&chan->tx_rel_list.dl_mutex);
                        if ((chan->tx_rel_list.dl_cnt +
                            chan->tx_wqe_list.dl_cnt) > IBD_RC_TX_FREE_THRESH) {
                                state->id_sched_needed &= ~IBD_RSRC_RC_SWQE;
                                mutex_exit(&chan->tx_rel_list.dl_mutex);
                                mutex_exit(&chan->tx_wqe_list.dl_mutex);
                                mutex_exit(&state->id_sched_lock);
                                state->rc_swqe_mac_update++;
                                mac_tx_update(state->id_mh);
                        } else {
                                state->rc_scq_no_swqe++;
                                mutex_exit(&chan->tx_rel_list.dl_mutex);
                                mutex_exit(&chan->tx_wqe_list.dl_mutex);
                                mutex_exit(&state->id_sched_lock);
                        }
                } else if (state->id_sched_needed & IBD_RSRC_RC_TX_LARGEBUF) {
                        mutex_enter(&state->rc_tx_large_bufs_lock);
                        if (state->rc_tx_largebuf_nfree >
                            IBD_RC_TX_FREE_THRESH) {
                                ASSERT(state->rc_tx_largebuf_free_head != NULL);
                                state->id_sched_needed &=
                                    ~IBD_RSRC_RC_TX_LARGEBUF;
                                mutex_exit(&state->rc_tx_large_bufs_lock);
                                mutex_exit(&state->id_sched_lock);
                                state->rc_xmt_buf_mac_update++;
                                mac_tx_update(state->id_mh);
                        } else {
                                state->rc_scq_no_largebuf++;
                                mutex_exit(&state->rc_tx_large_bufs_lock);
                                mutex_exit(&state->id_sched_lock);
                        }
                } else if (state->id_sched_needed & IBD_RSRC_SWQE) {
                        mutex_enter(&state->id_tx_list.dl_mutex);
                        mutex_enter(&state->id_tx_rel_list.dl_mutex);
                        if ((state->id_tx_list.dl_cnt +
                            state->id_tx_rel_list.dl_cnt)
                            > IBD_FREE_SWQES_THRESH) {
                                state->id_sched_needed &= ~IBD_RSRC_SWQE;
                                state->id_sched_cnt++;
                                mutex_exit(&state->id_tx_rel_list.dl_mutex);
                                mutex_exit(&state->id_tx_list.dl_mutex);
                                mutex_exit(&state->id_sched_lock);
                                mac_tx_update(state->id_mh);
                        } else {
                                mutex_exit(&state->id_tx_rel_list.dl_mutex);
                                mutex_exit(&state->id_tx_list.dl_mutex);
                                mutex_exit(&state->id_sched_lock);
                        }
                } else {
                        mutex_exit(&state->id_sched_lock);
                }
        }
}

/* Send CQ handler, call ibd_rx_tx_cleanup to recycle Tx buffers */
/* ARGSUSED */
static void
ibd_rc_scq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
        ibd_rc_chan_t *chan = (ibd_rc_chan_t *)arg;

        if (ibd_rc_tx_softintr == 1) {
                mutex_enter(&chan->tx_poll_lock);
                if (chan->tx_poll_busy & IBD_CQ_POLLING) {
                        chan->tx_poll_busy |= IBD_REDO_CQ_POLLING;
                        mutex_exit(&chan->tx_poll_lock);
                        return;
                } else {
                        mutex_exit(&chan->tx_poll_lock);
                        ddi_trigger_softintr(chan->scq_softintr);
                }
        } else
                (void) ibd_rc_tx_recycle(arg);
}

static uint_t
ibd_rc_tx_recycle(caddr_t arg)
{
        ibd_rc_chan_t *chan = (ibd_rc_chan_t *)arg;
        ibd_state_t *state = chan->state;
        int flag, redo_flag;
        int redo = 1;

        flag = IBD_CQ_POLLING;
        redo_flag = IBD_REDO_CQ_POLLING;

        mutex_enter(&chan->tx_poll_lock);
        if (chan->tx_poll_busy & flag) {
                ibd_print_warn(state, "ibd_rc_tx_recycle: multiple polling "
                    "threads");
                chan->tx_poll_busy |= redo_flag;
                mutex_exit(&chan->tx_poll_lock);
                return (DDI_INTR_CLAIMED);
        }
        chan->tx_poll_busy |= flag;
        mutex_exit(&chan->tx_poll_lock);

        /*
         * Poll for completed entries; the CQ will not interrupt any
         * more for completed packets.
         */
        ibd_rc_drain_scq(chan, chan->scq_hdl);

        /*
         * Now enable CQ notifications; all completions originating now
         * will cause new interrupts.
         */
        do {
                if (ibt_enable_cq_notify(chan->scq_hdl, IBT_NEXT_COMPLETION) !=
                    IBT_SUCCESS) {
                        /*
                         * We do not expect a failure here.
                         */
                        DPRINT(40, "ibd_rc_scq_handler: ibt_enable_cq_notify()"
                            " failed");
                }

                ibd_rc_drain_scq(chan, chan->scq_hdl);

                mutex_enter(&chan->tx_poll_lock);
                if (chan->tx_poll_busy & redo_flag)
                        chan->tx_poll_busy &= ~redo_flag;
                else {
                        chan->tx_poll_busy &= ~flag;
                        redo = 0;
                }
                mutex_exit(&chan->tx_poll_lock);

        } while (redo);

        return (DDI_INTR_CLAIMED);
}

static ibt_status_t
ibd_register_service(ibt_srv_desc_t *srv, ib_svc_id_t sid,
    int num_sids, ibt_srv_hdl_t *srv_hdl, ib_svc_id_t *ret_sid)
{
        ibd_service_t *p;
        ibt_status_t status;

        mutex_enter(&ibd_gstate.ig_mutex);
        for (p = ibd_gstate.ig_service_list; p != NULL; p = p->is_link) {
                if (p->is_sid == sid) {
                        p->is_ref_cnt++;
                        *srv_hdl = p->is_srv_hdl;
                        *ret_sid = sid;
                        mutex_exit(&ibd_gstate.ig_mutex);
                        return (IBT_SUCCESS);
                }
        }
        status = ibt_register_service(ibd_gstate.ig_ibt_hdl, srv, sid,
            num_sids, srv_hdl, ret_sid);
        if (status == IBT_SUCCESS) {
                p = kmem_alloc(sizeof (*p), KM_SLEEP);
                p->is_srv_hdl = *srv_hdl;
                p->is_sid = sid;
                p->is_ref_cnt = 1;
                p->is_link = ibd_gstate.ig_service_list;
                ibd_gstate.ig_service_list = p;
        }
        mutex_exit(&ibd_gstate.ig_mutex);
        return (status);
}

static ibt_status_t
ibd_deregister_service(ibt_srv_hdl_t srv_hdl)
{
        ibd_service_t *p, **pp;
        ibt_status_t status;

        mutex_enter(&ibd_gstate.ig_mutex);
        for (pp = &ibd_gstate.ig_service_list; *pp != NULL;
            pp = &((*pp)->is_link)) {
                p = *pp;
                if (p->is_srv_hdl == srv_hdl) { /* Found it */
                        if (--p->is_ref_cnt == 0) {
                                status = ibt_deregister_service(
                                    ibd_gstate.ig_ibt_hdl, srv_hdl);
                                *pp = p->is_link; /* link prev to next */
                                kmem_free(p, sizeof (*p));
                        } else {
                                status = IBT_SUCCESS;
                        }
                        mutex_exit(&ibd_gstate.ig_mutex);
                        return (status);
                }
        }
        /* Should not ever get here */
        mutex_exit(&ibd_gstate.ig_mutex);
        return (IBT_FAILURE);
}

/* Listen with corresponding service ID */
ibt_status_t
ibd_rc_listen(ibd_state_t *state)
{
        ibt_srv_desc_t srvdesc;
        ib_svc_id_t ret_sid;
        ibt_status_t status;
        ib_gid_t gid;

        if (state->rc_listen_hdl != NULL) {
                DPRINT(40, "ibd_rc_listen: rc_listen_hdl should be NULL");
                return (IBT_FAILURE);
        }

        bzero(&srvdesc, sizeof (ibt_srv_desc_t));
        srvdesc.sd_handler = ibd_rc_dispatch_pass_mad;
        srvdesc.sd_flags = IBT_SRV_NO_FLAGS;

        /*
         * Register the service with service id
         * Incoming connection requests should arrive on this service id.
         */
        status = ibd_register_service(&srvdesc,
            IBD_RC_QPN_TO_SID(state->id_qpnum),
            1, &state->rc_listen_hdl, &ret_sid);
        if (status != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_listen: Service Registration Failed, "
                    "ret=%d", status);
                return (status);
        }

        gid = state->id_sgid;

        /* pass state as cm_private */
        status = ibt_bind_service(state->rc_listen_hdl,
            gid, NULL, state, &state->rc_listen_bind);
        if (status != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_listen:"
                    " fail to bind port: <%d>", status);
                (void) ibd_deregister_service(state->rc_listen_hdl);
                return (status);
        }

        /*
         * Legacy OFED had used a wrong service ID (one additional zero digit)
         * for many years. To interop with legacy OFED, we support this wrong
         * service ID here.
         */
        ASSERT(state->rc_listen_hdl_OFED_interop == NULL);

        bzero(&srvdesc, sizeof (ibt_srv_desc_t));
        srvdesc.sd_handler = ibd_rc_dispatch_pass_mad;
        srvdesc.sd_flags = IBT_SRV_NO_FLAGS;

        /*
         * Register the service with service id
         * Incoming connection requests should arrive on this service id.
         */
        status = ibd_register_service(&srvdesc,
            IBD_RC_QPN_TO_SID_OFED_INTEROP(state->id_qpnum),
            1, &state->rc_listen_hdl_OFED_interop, &ret_sid);
        if (status != IBT_SUCCESS) {
                DPRINT(40,
                    "ibd_rc_listen: Service Registration for Legacy OFED "
                    "Failed %d", status);
                (void) ibt_unbind_service(state->rc_listen_hdl,
                    state->rc_listen_bind);
                (void) ibd_deregister_service(state->rc_listen_hdl);
                return (status);
        }

        gid = state->id_sgid;

        /* pass state as cm_private */
        status = ibt_bind_service(state->rc_listen_hdl_OFED_interop,
            gid, NULL, state, &state->rc_listen_bind_OFED_interop);
        if (status != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_listen: fail to bind port: <%d> for "
                    "Legacy OFED listener", status);
                (void) ibd_deregister_service(
                    state->rc_listen_hdl_OFED_interop);
                (void) ibt_unbind_service(state->rc_listen_hdl,
                    state->rc_listen_bind);
                (void) ibd_deregister_service(state->rc_listen_hdl);
                return (status);
        }

        return (IBT_SUCCESS);
}

void
ibd_rc_stop_listen(ibd_state_t *state)
{
        int ret;

        /* Disable incoming connection requests */
        if (state->rc_listen_hdl != NULL) {
                ret = ibt_unbind_all_services(state->rc_listen_hdl);
                if (ret != 0) {
                        DPRINT(40, "ibd_rc_stop_listen:"
                            "ibt_unbind_all_services() failed, ret=%d", ret);
                }
                ret = ibd_deregister_service(state->rc_listen_hdl);
                if (ret != 0) {
                        DPRINT(40, "ibd_rc_stop_listen:"
                            "ibd_deregister_service() failed, ret=%d", ret);
                } else {
                        state->rc_listen_hdl = NULL;
                }
        }

        /* Disable incoming connection requests */
        if (state->rc_listen_hdl_OFED_interop != NULL) {
                ret = ibt_unbind_all_services(
                    state->rc_listen_hdl_OFED_interop);
                if (ret != 0) {
                        DPRINT(40, "ibd_rc_stop_listen:"
                            "ibt_unbind_all_services() failed: %d", ret);
                }
                ret = ibd_deregister_service(state->rc_listen_hdl_OFED_interop);
                if (ret != 0) {
                        DPRINT(40, "ibd_rc_stop_listen:"
                            "ibd_deregister_service() failed: %d", ret);
                } else {
                        state->rc_listen_hdl_OFED_interop = NULL;
                }
        }
}

void
ibd_rc_close_all_chan(ibd_state_t *state)
{
        ibd_rc_chan_t *rc_chan;
        ibd_ace_t *ace, *pre_ace;
        uint_t attempts;

        /* Disable all Rx routines */
        mutex_enter(&state->rc_pass_chan_list.chan_list_mutex);
        rc_chan = state->rc_pass_chan_list.chan_list;
        while (rc_chan != NULL) {
                ibt_set_cq_handler(rc_chan->rcq_hdl, 0, 0);
                rc_chan = rc_chan->next;
        }
        mutex_exit(&state->rc_pass_chan_list.chan_list_mutex);

        if (state->rc_enable_srq) {
                attempts = 10;
                while (state->rc_srq_rwqe_list.dl_bufs_outstanding > 0) {
                        DPRINT(30, "ibd_rc_close_all_chan: outstanding > 0");
                        delay(drv_usectohz(100000));
                        if (--attempts == 0) {
                                /*
                                 * There are pending bufs with the network
                                 * layer and we have no choice but to wait
                                 * for them to be done with. Reap all the
                                 * Tx/Rx completions that were posted since
                                 * we turned off the notification and
                                 * return failure.
                                 */
                                break;
                        }
                }
        }

        /* Close all passive RC channels */
        rc_chan = ibd_rc_rm_header_chan_list(&state->rc_pass_chan_list);
        while (rc_chan != NULL) {
                (void) ibd_rc_pas_close(rc_chan, B_TRUE, B_FALSE);
                rc_chan = ibd_rc_rm_header_chan_list(&state->rc_pass_chan_list);
        }

        /* Close all active RC channels */
        mutex_enter(&state->id_ac_mutex);
        state->id_ac_hot_ace = NULL;
        ace = list_head(&state->id_ah_active);
        while ((pre_ace = ace) != NULL) {
                ace = list_next(&state->id_ah_active, ace);
                if (pre_ace->ac_chan != NULL) {
                        INC_REF(pre_ace, 1);
                        IBD_ACACHE_PULLOUT_ACTIVE(state, pre_ace);
                        pre_ace->ac_chan->chan_state = IBD_RC_STATE_ACT_CLOSING;
                        ibd_rc_add_to_chan_list(&state->rc_obs_act_chan_list,
                            pre_ace->ac_chan);
                }
        }
        mutex_exit(&state->id_ac_mutex);

        rc_chan = ibd_rc_rm_header_chan_list(&state->rc_obs_act_chan_list);
        while (rc_chan != NULL) {
                ace = rc_chan->ace;
                ibd_rc_act_close(rc_chan, B_TRUE);
                if (ace != NULL) {
                        mutex_enter(&state->id_ac_mutex);
                        ASSERT(ace->ac_ref != 0);
                        atomic_dec_32(&ace->ac_ref);
                        ace->ac_chan = NULL;
                        if ((ace->ac_ref == 0) || (ace->ac_ref == CYCLEVAL)) {
                                IBD_ACACHE_INSERT_FREE(state, ace);
                                ace->ac_ref = 0;
                        } else {
                                ace->ac_ref |= CYCLEVAL;
                                state->rc_delay_ace_recycle++;
                        }
                        mutex_exit(&state->id_ac_mutex);
                }
                rc_chan = ibd_rc_rm_header_chan_list(
                    &state->rc_obs_act_chan_list);
        }

        attempts = 400;
        while (((state->rc_num_tx_chan != 0) ||
            (state->rc_num_rx_chan != 0)) && (attempts > 0)) {
                /* Other thread is closing CM channel, wait it */
                delay(drv_usectohz(100000));
                attempts--;
        }
}

void
ibd_rc_try_connect(ibd_state_t *state, ibd_ace_t *ace,  ibt_path_info_t *path)
{
        ibt_status_t status;

        if ((state->id_mac_state & IBD_DRV_STARTED) == 0)
                return;

        status = ibd_rc_connect(state, ace, path,
            IBD_RC_SERVICE_ID_OFED_INTEROP);

        if (status != IBT_SUCCESS) {
                /* wait peer side remove stale channel */
                delay(drv_usectohz(10000));
                if ((state->id_mac_state & IBD_DRV_STARTED) == 0)
                        return;
                status = ibd_rc_connect(state, ace, path,
                    IBD_RC_SERVICE_ID_OFED_INTEROP);
        }

        if (status != IBT_SUCCESS) {
                /* wait peer side remove stale channel */
                delay(drv_usectohz(10000));
                if ((state->id_mac_state & IBD_DRV_STARTED) == 0)
                        return;
                (void) ibd_rc_connect(state, ace, path,
                    IBD_RC_SERVICE_ID);
        }
}

/*
 * Allocates channel and sets the ace->ac_chan to it.
 * Opens the channel.
 */
ibt_status_t
ibd_rc_connect(ibd_state_t *state, ibd_ace_t *ace,  ibt_path_info_t *path,
    uint64_t ietf_cm_service_id)
{
        ibt_status_t status = 0;
        ibt_rc_returns_t open_returns;
        ibt_chan_open_args_t open_args;
        ibd_rc_msg_hello_t hello_req_msg;
        ibd_rc_msg_hello_t *hello_ack_msg;
        ibd_rc_chan_t *chan;
        ibt_ud_dest_query_attr_t dest_attrs;

        ASSERT(ace != NULL);
        ASSERT(ace->ac_mce == NULL);
        ASSERT(ace->ac_chan == NULL);

        if ((status = ibd_rc_alloc_chan(&chan, state, B_TRUE)) != IBT_SUCCESS) {
                DPRINT(10, "ibd_rc_connect: ibd_rc_alloc_chan() failed");
                return (status);
        }

        ace->ac_chan = chan;
        chan->state = state;
        chan->ace = ace;

        ibt_set_chan_private(chan->chan_hdl, (void *)(uintptr_t)ace);

        hello_ack_msg = kmem_zalloc(sizeof (ibd_rc_msg_hello_t), KM_SLEEP);

        /*
         * open the channels
         */
        bzero(&open_args, sizeof (ibt_chan_open_args_t));
        bzero(&open_returns, sizeof (ibt_rc_returns_t));

        open_args.oc_cm_handler = ibd_rc_dispatch_actv_mad;
        open_args.oc_cm_clnt_private = (void *)(uintptr_t)ace;

        /*
         * update path record with the SID
         */
        if ((status = ibt_query_ud_dest(ace->ac_dest, &dest_attrs))
            != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_connect: ibt_query_ud_dest() failed, "
                    "ret=%d", status);
                return (status);
        }

        path->pi_sid =
            ietf_cm_service_id | ((dest_attrs.ud_dst_qpn) & 0xffffff);


        /* pre-allocate memory for hello ack message */
        open_returns.rc_priv_data_len = sizeof (ibd_rc_msg_hello_t);
        open_returns.rc_priv_data = hello_ack_msg;

        open_args.oc_path = path;

        open_args.oc_path_rnr_retry_cnt = 1;
        open_args.oc_path_retry_cnt = 1;

        /* We don't do RDMA */
        open_args.oc_rdma_ra_out = 0;
        open_args.oc_rdma_ra_in = 0;

        hello_req_msg.reserved_qpn = htonl(state->id_qpnum);
        hello_req_msg.rx_mtu = htonl(state->rc_mtu);
        open_args.oc_priv_data_len = sizeof (ibd_rc_msg_hello_t);
        open_args.oc_priv_data = (void *)(&hello_req_msg);

        ASSERT(open_args.oc_priv_data_len <= IBT_REQ_PRIV_DATA_SZ);
        ASSERT(open_returns.rc_priv_data_len <= IBT_REP_PRIV_DATA_SZ);
        ASSERT(open_args.oc_cm_handler != NULL);

        status = ibt_open_rc_channel(chan->chan_hdl, IBT_OCHAN_NO_FLAGS,
            IBT_BLOCKING, &open_args, &open_returns);

        if (status == IBT_SUCCESS) {
                /* Success! */
                DPRINT(2, "ibd_rc_connect: call ibt_open_rc_channel succ!");
                state->rc_conn_succ++;
                kmem_free(hello_ack_msg, sizeof (ibd_rc_msg_hello_t));
                return (IBT_SUCCESS);
        }

        /* failure */
        (void) ibt_flush_channel(chan->chan_hdl);
        ibd_rc_free_chan(chan);
        ace->ac_chan = NULL;

        /* check open_returns report error and exit */
        DPRINT(30, "ibd_rc_connect: call ibt_open_rc_chan fail."
            "ret status = %d, reason=%d, ace=%p, mtu=0x%x, qpn=0x%x,"
            " peer qpn=0x%x", status, (int)open_returns.rc_status, ace,
            hello_req_msg.rx_mtu, hello_req_msg.reserved_qpn,
            dest_attrs.ud_dst_qpn);
        kmem_free(hello_ack_msg, sizeof (ibd_rc_msg_hello_t));
        return (status);
}

void
ibd_rc_signal_act_close(ibd_state_t *state, ibd_ace_t *ace)
{
        ibd_req_t *req;

        req = kmem_cache_alloc(state->id_req_kmc, KM_NOSLEEP);
        if (req == NULL) {
                ibd_print_warn(state, "ibd_rc_signal_act_close: alloc "
                    "ibd_req_t fail");
                mutex_enter(&state->rc_obs_act_chan_list.chan_list_mutex);
                ace->ac_chan->next = state->rc_obs_act_chan_list.chan_list;
                state->rc_obs_act_chan_list.chan_list = ace->ac_chan;
                mutex_exit(&state->rc_obs_act_chan_list.chan_list_mutex);
        } else {
                req->rq_ptr = ace->ac_chan;
                ibd_queue_work_slot(state, req, IBD_ASYNC_RC_CLOSE_ACT_CHAN);
        }
}

void
ibd_rc_signal_ace_recycle(ibd_state_t *state, ibd_ace_t *ace)
{
        ibd_req_t *req;

        mutex_enter(&state->rc_ace_recycle_lock);
        if (state->rc_ace_recycle != NULL) {
                mutex_exit(&state->rc_ace_recycle_lock);
                return;
        }

        req = kmem_cache_alloc(state->id_req_kmc, KM_NOSLEEP);
        if (req == NULL) {
                mutex_exit(&state->rc_ace_recycle_lock);
                return;
        }

        state->rc_ace_recycle = ace;
        mutex_exit(&state->rc_ace_recycle_lock);
        ASSERT(ace->ac_mce == NULL);
        INC_REF(ace, 1);
        IBD_ACACHE_PULLOUT_ACTIVE(state, ace);
        req->rq_ptr = ace;
        ibd_queue_work_slot(state, req, IBD_ASYNC_RC_RECYCLE_ACE);
}

/*
 * Close an active channel
 *
 * is_close_rc_chan: if B_TRUE, we will call ibt_close_rc_channel()
 */
static void
ibd_rc_act_close(ibd_rc_chan_t *chan, boolean_t is_close_rc_chan)
{
        ibd_state_t *state;
        ibd_ace_t *ace;
        uint_t times;
        ibt_status_t ret;

        ASSERT(chan != NULL);

        chan->state->rc_act_close++;
        switch (chan->chan_state) {
        case IBD_RC_STATE_ACT_CLOSING:  /* stale, close it */
        case IBD_RC_STATE_ACT_ESTAB:
                DPRINT(30, "ibd_rc_act_close-1: close and free chan, "
                    "act_state=%d, chan=%p", chan->chan_state, chan);
                chan->chan_state = IBD_RC_STATE_ACT_CLOSED;
                ibt_set_cq_handler(chan->rcq_hdl, 0, 0);
                /*
                 * Wait send queue empty. Its old value is 50 (5 seconds). But
                 * in my experiment, 5 seconds is not enough time to let IBTL
                 * return all buffers and ace->ac_ref. I tried 25 seconds, it
                 * works well. As another evidence, I saw IBTL takes about 17
                 * seconds every time it cleans a stale RC channel.
                 */
                times = 250;
                ace = chan->ace;
                ASSERT(ace != NULL);
                state = chan->state;
                ASSERT(state != NULL);
                mutex_enter(&state->id_ac_mutex);
                mutex_enter(&chan->tx_wqe_list.dl_mutex);
                mutex_enter(&chan->tx_rel_list.dl_mutex);
                while (((chan->tx_wqe_list.dl_cnt + chan->tx_rel_list.dl_cnt)
                    != chan->scq_size) || ((ace->ac_ref != 1) &&
                    (ace->ac_ref != (CYCLEVAL+1)))) {
                        mutex_exit(&chan->tx_rel_list.dl_mutex);
                        mutex_exit(&chan->tx_wqe_list.dl_mutex);
                        mutex_exit(&state->id_ac_mutex);
                        times--;
                        if (times == 0) {
                                state->rc_act_close_not_clean++;
                                DPRINT(40, "ibd_rc_act_close: dl_cnt(tx_wqe_"
                                    "list=%d, tx_rel_list=%d) != chan->"
                                    "scq_size=%d, OR ac_ref(=%d) not clean",
                                    chan->tx_wqe_list.dl_cnt,
                                    chan->tx_rel_list.dl_cnt,
                                    chan->scq_size, ace->ac_ref);
                                break;
                        }
                        mutex_enter(&chan->tx_poll_lock);
                        if (chan->tx_poll_busy & IBD_CQ_POLLING) {
                                DPRINT(40, "ibd_rc_act_close: multiple "
                                    "polling threads");
                                mutex_exit(&chan->tx_poll_lock);
                        } else {
                                chan->tx_poll_busy = IBD_CQ_POLLING;
                                mutex_exit(&chan->tx_poll_lock);
                                ibd_rc_drain_scq(chan, chan->scq_hdl);
                                mutex_enter(&chan->tx_poll_lock);
                                chan->tx_poll_busy = 0;
                                mutex_exit(&chan->tx_poll_lock);
                        }
                        delay(drv_usectohz(100000));
                        mutex_enter(&state->id_ac_mutex);
                        mutex_enter(&chan->tx_wqe_list.dl_mutex);
                        mutex_enter(&chan->tx_rel_list.dl_mutex);
                }
                if (times != 0) {
                        mutex_exit(&chan->tx_rel_list.dl_mutex);
                        mutex_exit(&chan->tx_wqe_list.dl_mutex);
                        mutex_exit(&state->id_ac_mutex);
                }

                ibt_set_cq_handler(chan->scq_hdl, 0, 0);
                if (is_close_rc_chan) {
                        ret = ibt_close_rc_channel(chan->chan_hdl,
                            IBT_BLOCKING|IBT_NOCALLBACKS, NULL, 0, NULL, NULL,
                            0);
                        if (ret != IBT_SUCCESS) {
                                DPRINT(40, "ibd_rc_act_close: ibt_close_rc_"
                                    "channel fail, chan=%p, ret=%d",
                                    chan, ret);
                        } else {
                                DPRINT(30, "ibd_rc_act_close: ibt_close_rc_"
                                    "channel succ, chan=%p", chan);
                        }
                }

                ibd_rc_free_chan(chan);
                break;
        case IBD_RC_STATE_ACT_REP_RECV:
                chan->chan_state = IBD_RC_STATE_ACT_CLOSED;
                (void) ibt_flush_channel(chan->chan_hdl);
                ibd_rc_free_chan(chan);
                break;
        case IBD_RC_STATE_ACT_ERROR:
                DPRINT(40, "ibd_rc_act_close: IBD_RC_STATE_ERROR branch");
                break;
        default:
                DPRINT(40, "ibd_rc_act_close: default branch, act_state=%d, "
                    "chan=%p", chan->chan_state, chan);
        }
}

/*
 * Close a passive channel
 *
 * is_close_rc_chan: if B_TRUE, we will call ibt_close_rc_channel()
 *
 * is_timeout_close: if B_TRUE, this function is called by the connection
 * reaper (refer to function ibd_rc_conn_timeout_call). When the connection
 * reaper calls ibd_rc_pas_close(), and if it finds that dl_bufs_outstanding
 * or chan->rcq_invoking is non-zero, then it can simply put that channel back
 * on the passive channels list and move on, since it might be an indication
 * that the channel became active again by the time we started it's cleanup.
 * It is costlier to do the cleanup and then reinitiate the channel
 * establishment and hence it will help to be conservative when we do the
 * cleanup.
 */
int
ibd_rc_pas_close(ibd_rc_chan_t *chan, boolean_t is_close_rc_chan,
    boolean_t is_timeout_close)
{
        uint_t times;
        ibt_status_t ret;

        ASSERT(chan != NULL);
        chan->state->rc_pas_close++;

        switch (chan->chan_state) {
        case IBD_RC_STATE_PAS_ESTAB:
                if (is_timeout_close) {
                        if ((chan->rcq_invoking != 0) ||
                            ((!chan->state->rc_enable_srq) &&
                            (chan->rx_wqe_list.dl_bufs_outstanding > 0))) {
                                if (ibd_rc_re_add_to_pas_chan_list(chan)) {
                                        return (DDI_FAILURE);
                                }
                        }
                }
                /*
                 * First, stop receive interrupts; this stops the
                 * connection from handing up buffers to higher layers.
                 * Wait for receive buffers to be returned; give up
                 * after 5 seconds.
                 */
                ibt_set_cq_handler(chan->rcq_hdl, 0, 0);
                /* Wait 0.01 second to let ibt_set_cq_handler() take effect */
                delay(drv_usectohz(10000));
                if (!chan->state->rc_enable_srq) {
                        times = 50;
                        while (chan->rx_wqe_list.dl_bufs_outstanding > 0) {
                                delay(drv_usectohz(100000));
                                if (--times == 0) {
                                        DPRINT(40, "ibd_rc_pas_close : "
                                            "reclaiming failed");
                                        ibd_rc_poll_rcq(chan, chan->rcq_hdl);
                                        ibt_set_cq_handler(chan->rcq_hdl,
                                            ibd_rc_rcq_handler,
                                            (void *)(uintptr_t)chan);
                                        return (DDI_FAILURE);
                                }
                        }
                }
                times = 50;
                while (chan->rcq_invoking != 0) {
                        delay(drv_usectohz(100000));
                        if (--times == 0) {
                                DPRINT(40, "ibd_rc_pas_close : "
                                    "rcq handler is being invoked");
                                chan->state->rc_pas_close_rcq_invoking++;
                                break;
                        }
                }
                ibt_set_cq_handler(chan->scq_hdl, 0, 0);
                chan->chan_state = IBD_RC_STATE_PAS_CLOSED;
                DPRINT(30, "ibd_rc_pas_close-1: close and free chan, "
                    "chan_state=%d, chan=%p", chan->chan_state, chan);
                if (is_close_rc_chan) {
                        ret = ibt_close_rc_channel(chan->chan_hdl,
                            IBT_BLOCKING|IBT_NOCALLBACKS, NULL, 0, NULL, NULL,
                            0);
                        if (ret != IBT_SUCCESS) {
                                DPRINT(40, "ibd_rc_pas_close: ibt_close_rc_"
                                    "channel() fail, chan=%p, ret=%d", chan,
                                    ret);
                        } else {
                                DPRINT(30, "ibd_rc_pas_close: ibt_close_rc_"
                                    "channel() succ, chan=%p", chan);
                        }
                }
                ibd_rc_free_chan(chan);
                break;
        case IBD_RC_STATE_PAS_REQ_RECV:
                chan->chan_state = IBD_RC_STATE_PAS_CLOSED;
                (void) ibt_flush_channel(chan->chan_hdl);
                ibd_rc_free_chan(chan);
                break;
        default:
                DPRINT(40, "ibd_rc_pas_close: default, chan_state=%d, chan=%p",
                    chan->chan_state, chan);
        }
        return (DDI_SUCCESS);
}

/*
 * Passive Side:
 *      Handle an incoming CM REQ from active side.
 *
 *      If success, this function allocates an ibd_rc_chan_t, then
 * assigns it to "*ret_conn".
 */
static ibt_cm_status_t
ibd_rc_handle_req(void *arg, ibd_rc_chan_t **ret_conn,
    ibt_cm_event_t *ibt_cm_event, ibt_cm_return_args_t *ret_args,
    void *ret_priv_data)
{
        ibd_rc_msg_hello_t *hello_msg;
        ibd_state_t *state = (ibd_state_t *)arg;
        ibd_rc_chan_t *chan;

        if (ibd_rc_alloc_chan(&chan, state, B_FALSE) != IBT_SUCCESS) {
                DPRINT(40, "ibd_rc_handle_req: ibd_rc_alloc_chan() failed");
                return (IBT_CM_REJECT);
        }

        ibd_rc_add_to_chan_list(&state->rc_pass_chan_list, chan);

        ibt_set_chan_private(chan->chan_hdl, (void *)(uintptr_t)chan);

        if (!state->rc_enable_srq) {
                if (ibd_rc_init_rxlist(chan) != DDI_SUCCESS) {
                        ibd_rc_free_chan(chan);
                        DPRINT(40, "ibd_rc_handle_req: ibd_rc_init_rxlist() "
                            "failed");
                        return (IBT_CM_REJECT);
                }
        }

        ret_args->cm_ret.rep.cm_channel = chan->chan_hdl;

        /* We don't do RDMA */
        ret_args->cm_ret.rep.cm_rdma_ra_out = 0;
        ret_args->cm_ret.rep.cm_rdma_ra_in = 0;

        ret_args->cm_ret.rep.cm_rnr_retry_cnt = 7;
        ret_args->cm_ret_len = sizeof (ibd_rc_msg_hello_t);

        hello_msg = (ibd_rc_msg_hello_t *)ibt_cm_event->cm_priv_data;
        DPRINT(30, "ibd_rc_handle_req(): peer qpn=0x%x, peer mtu=0x%x",
            ntohl(hello_msg->reserved_qpn), ntohl(hello_msg->rx_mtu));

        hello_msg = (ibd_rc_msg_hello_t *)ret_priv_data;
        hello_msg->reserved_qpn = htonl(state->id_qpnum);
        hello_msg->rx_mtu = htonl(state->rc_mtu);

        chan->chan_state = IBD_RC_STATE_PAS_REQ_RECV;   /* ready to receive */
        *ret_conn = chan;

        return (IBT_CM_ACCEPT);
}

/*
 * ibd_rc_handle_act_estab -- handler for connection established completion
 * for active side.
 */
static ibt_cm_status_t
ibd_rc_handle_act_estab(ibd_ace_t *ace)
{
        ibt_status_t result;

        switch (ace->ac_chan->chan_state) {
                case IBD_RC_STATE_ACT_REP_RECV:
                        ace->ac_chan->chan_state = IBD_RC_STATE_ACT_ESTAB;
                        result = ibt_enable_cq_notify(ace->ac_chan->rcq_hdl,
                            IBT_NEXT_COMPLETION);
                        if (result != IBT_SUCCESS) {
                                DPRINT(40, "ibd_rc_handle_act_estab: "
                                    "ibt_enable_cq_notify(rcq) "
                                    "failed: status %d", result);
                                return (IBT_CM_REJECT);
                        }
                        break;
                default:
                        DPRINT(40, "ibd_rc_handle_act_estab: default "
                            "branch, act_state=%d", ace->ac_chan->chan_state);
                        return (IBT_CM_REJECT);
        }
        return (IBT_CM_ACCEPT);
}

/*
 * ibd_rc_handle_pas_estab -- handler for connection established completion
 * for passive side.
 */
static ibt_cm_status_t
ibd_rc_handle_pas_estab(ibd_rc_chan_t *chan)
{
        ibt_status_t result;

        switch (chan->chan_state) {
                case IBD_RC_STATE_PAS_REQ_RECV:
                        chan->chan_state = IBD_RC_STATE_PAS_ESTAB;

                        result = ibt_enable_cq_notify(chan->rcq_hdl,
                            IBT_NEXT_COMPLETION);
                        if (result != IBT_SUCCESS) {
                                DPRINT(40, "ibd_rc_handle_pas_estab: "
                                    "ibt_enable_cq_notify(rcq) "
                                    "failed: status %d", result);
                                return (IBT_CM_REJECT);
                        }
                        break;
                default:
                        DPRINT(40, "ibd_rc_handle_pas_estab: default "
                            "branch, chan_state=%d", chan->chan_state);
                        return (IBT_CM_REJECT);
        }
        return (IBT_CM_ACCEPT);
}

/* ARGSUSED */
static ibt_cm_status_t
ibd_rc_dispatch_actv_mad(void *arg, ibt_cm_event_t *ibt_cm_event,
    ibt_cm_return_args_t *ret_args, void *ret_priv_data,
    ibt_priv_data_len_t ret_len_max)
{
        ibt_cm_status_t result = IBT_CM_ACCEPT;
        ibd_ace_t *ace = (ibd_ace_t *)(uintptr_t)arg;
        ibd_rc_chan_t *rc_chan;
        ibd_state_t *state;
        ibd_rc_msg_hello_t *hello_ack;

        switch (ibt_cm_event->cm_type) {
        case IBT_CM_EVENT_REP_RCV:
                ASSERT(ace->ac_chan != NULL);
                ASSERT(ace->ac_chan->chan_state == IBD_RC_STATE_INIT);
                hello_ack = (ibd_rc_msg_hello_t *)ibt_cm_event->cm_priv_data;
                DPRINT(30, "ibd_rc_handle_rep: hello_ack->mtu=0x%x, "
                    "hello_ack->qpn=0x%x", ntohl(hello_ack->rx_mtu),
                    ntohl(hello_ack->reserved_qpn));
                ace->ac_chan->chan_state = IBD_RC_STATE_ACT_REP_RECV;
                break;

        case IBT_CM_EVENT_CONN_EST:
                ASSERT(ace->ac_chan != NULL);
                DPRINT(30, "ibd_rc_dispatch_actv_mad: IBT_CM_EVENT_CONN_EST, "
                    "ace=%p, act_state=%d, chan=%p",
                    ace, ace->ac_chan->chan_state, ace->ac_chan);
                result = ibd_rc_handle_act_estab(ace);
                break;

        case IBT_CM_EVENT_CONN_CLOSED:
                rc_chan = ace->ac_chan;
                if (rc_chan == NULL) {
                        DPRINT(40, "ibd_rc_dispatch_actv_mad: "
                            "rc_chan==NULL, IBT_CM_EVENT_CONN_CLOSED");
                        return (IBT_CM_ACCEPT);
                }
                state = rc_chan->state;
                mutex_enter(&state->id_ac_mutex);
                if ((rc_chan->chan_state == IBD_RC_STATE_ACT_ESTAB) &&
                    ((ace = ibd_acache_find(state, &ace->ac_mac, B_FALSE, 0))
                    != NULL) && (ace == rc_chan->ace)) {
                        rc_chan->chan_state = IBD_RC_STATE_ACT_CLOSING;
                        ASSERT(ace->ac_mce == NULL);
                        INC_REF(ace, 1);
                        IBD_ACACHE_PULLOUT_ACTIVE(state, ace);
                        mutex_exit(&state->id_ac_mutex);
                        DPRINT(30, "ibd_rc_dispatch_actv_mad: "
                            "IBT_CM_EVENT_CONN_CLOSED, ace=%p, chan=%p, "
                            "reason=%d", ace, rc_chan,
                            ibt_cm_event->cm_event.closed);
                } else {
                        mutex_exit(&state->id_ac_mutex);
                        state->rc_act_close_simultaneous++;
                        DPRINT(40, "ibd_rc_dispatch_actv_mad: other thread "
                            "is closing it, IBT_CM_EVENT_CONN_CLOSED, "
                            "chan_state=%d", rc_chan->chan_state);
                        return (IBT_CM_ACCEPT);
                }
                ibd_rc_act_close(rc_chan, B_FALSE);
                mutex_enter(&state->id_ac_mutex);
                ace->ac_chan = NULL;
                ASSERT(ace->ac_ref != 0);
                atomic_dec_32(&ace->ac_ref);
                if ((ace->ac_ref == 0) || (ace->ac_ref == CYCLEVAL)) {
                        IBD_ACACHE_INSERT_FREE(state, ace);
                        ace->ac_ref = 0;
                } else {
                        ace->ac_ref |= CYCLEVAL;
                        state->rc_delay_ace_recycle++;
                }
                mutex_exit(&state->id_ac_mutex);
                break;

        case IBT_CM_EVENT_FAILURE:
                DPRINT(30, "ibd_rc_dispatch_actv_mad: IBT_CM_EVENT_FAILURE,"
                    "ace=%p, chan=%p, code: %d, msg: %d, reason=%d",
                    ace, ace->ac_chan,
                    ibt_cm_event->cm_event.failed.cf_code,
                    ibt_cm_event->cm_event.failed.cf_msg,
                    ibt_cm_event->cm_event.failed.cf_reason);
                /*
                 * Don't need free resource here. The resource is freed
                 * at function ibd_rc_connect()
                 */
                break;

        case IBT_CM_EVENT_MRA_RCV:
                DPRINT(40, "ibd_rc_dispatch_actv_mad: IBT_CM_EVENT_MRA_RCV");
                break;
        case IBT_CM_EVENT_LAP_RCV:
                DPRINT(40, "ibd_rc_dispatch_actv_mad: LAP message received");
                break;
        case IBT_CM_EVENT_APR_RCV:
                DPRINT(40, "ibd_rc_dispatch_actv_mad: APR message received");
                break;
        default:
                DPRINT(40, "ibd_rc_dispatch_actv_mad: default branch, "
                    "ibt_cm_event->cm_type=%d", ibt_cm_event->cm_type);
                break;
        }

        return (result);
}

/* ARGSUSED */
static ibt_cm_status_t
ibd_rc_dispatch_pass_mad(void *arg, ibt_cm_event_t *ibt_cm_event,
    ibt_cm_return_args_t *ret_args, void *ret_priv_data,
    ibt_priv_data_len_t ret_len_max)
{
        ibt_cm_status_t result = IBT_CM_ACCEPT;
        ibd_rc_chan_t *chan;

        if (ibt_cm_event->cm_type == IBT_CM_EVENT_REQ_RCV) {
                DPRINT(30, "ibd_rc_dispatch_pass_mad: IBT_CM_EVENT_REQ_RCV,"
                    "req_pkey=%x", ibt_cm_event->cm_event.req.req_pkey);
                /* Receive an incoming CM REQ from active side */
                result = ibd_rc_handle_req(arg, &chan, ibt_cm_event, ret_args,
                    ret_priv_data);
                return (result);
        }

        if (ibt_cm_event->cm_channel == 0) {
                DPRINT(30, "ibd_rc_dispatch_pass_mad: "
                    "ERROR ibt_cm_event->cm_channel == 0");
                return (IBT_CM_REJECT);
        }

        chan =
            (ibd_rc_chan_t *)ibt_get_chan_private(ibt_cm_event->cm_channel);
        if (chan == NULL) {
                DPRINT(40, "ibd_rc_dispatch_pass_mad: conn == 0");
                return (IBT_CM_REJECT);
        }

        switch (ibt_cm_event->cm_type) {
        case IBT_CM_EVENT_CONN_EST:
                DPRINT(30, "ibd_rc_dispatch_pass_mad: IBT_CM_EVENT_CONN_EST, "
                    "chan=%p", chan);
                result = ibd_rc_handle_pas_estab(chan);
                break;
        case IBT_CM_EVENT_CONN_CLOSED:
                DPRINT(30, "ibd_rc_dispatch_pass_mad: IBT_CM_EVENT_CONN_CLOSED,"
                    " chan=%p, reason=%d", chan, ibt_cm_event->cm_event.closed);
                chan = ibd_rc_rm_from_chan_list(&chan->state->rc_pass_chan_list,
                    chan);
                if (chan != NULL)
                        (void) ibd_rc_pas_close(chan, B_FALSE, B_FALSE);
                break;
        case IBT_CM_EVENT_FAILURE:
                DPRINT(30, "ibd_rc_dispatch_pass_mad: IBT_CM_EVENT_FAILURE,"
                    " chan=%p, code: %d, msg: %d, reason=%d", chan,
                    ibt_cm_event->cm_event.failed.cf_code,
                    ibt_cm_event->cm_event.failed.cf_msg,
                    ibt_cm_event->cm_event.failed.cf_reason);
                chan = ibd_rc_rm_from_chan_list(&chan->state->rc_pass_chan_list,
                    chan);
                if (chan != NULL)
                        (void) ibd_rc_pas_close(chan, B_FALSE, B_FALSE);
                return (IBT_CM_ACCEPT);
        case IBT_CM_EVENT_MRA_RCV:
                DPRINT(40, "ibd_rc_dispatch_pass_mad: IBT_CM_EVENT_MRA_RCV");
                break;
        case IBT_CM_EVENT_LAP_RCV:
                DPRINT(40, "ibd_rc_dispatch_pass_mad: LAP message received");
                break;
        case IBT_CM_EVENT_APR_RCV:
                DPRINT(40, "ibd_rc_dispatch_pass_mad: APR message received");
                break;
        default:
                DPRINT(40, "ibd_rc_dispatch_pass_mad: default, type=%d, "
                    "chan=%p", ibt_cm_event->cm_type, chan);
                break;
        }

        return (result);
}