1/*-
2 * SPDX-License-Identifier: BSD-2-Clause OR GPL-2.0
3 *
4 * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
5 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
6 * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
7 * Copyright (c) 2009 HNR Consulting. All rights reserved.
8 * Copyright (c) 2014 Intel Corporation.  All rights reserved.
9 *
10 * This software is available to you under a choice of one of two
11 * licenses.  You may choose to be licensed under the terms of the GNU
12 * General Public License (GPL) Version 2, available from the file
13 * COPYING in the main directory of this source tree, or the
14 * OpenIB.org BSD license below:
15 *
16 *     Redistribution and use in source and binary forms, with or
17 *     without modification, are permitted provided that the following
18 *     conditions are met:
19 *
20 *      - Redistributions of source code must retain the above
21 *        copyright notice, this list of conditions and the following
22 *        disclaimer.
23 *
24 *      - Redistributions in binary form must reproduce the above
25 *        copyright notice, this list of conditions and the following
26 *        disclaimer in the documentation and/or other materials
27 *        provided with the distribution.
28 *
29 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
30 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
31 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
32 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
33 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
34 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
35 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36 * SOFTWARE.
37 */
38
39#include <sys/cdefs.h>
40__FBSDID("$FreeBSD: stable/11/sys/ofed/drivers/infiniband/core/ib_mad.c 341866 2018-12-12 10:29:48Z hselasky $");
41
42#define	LINUXKPI_PARAM_PREFIX ibcore_
43#define	KBUILD_MODNAME "ibcore"
44
45#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
46
47#include <linux/dma-mapping.h>
48#include <linux/slab.h>
49#include <linux/module.h>
50#include <rdma/ib_cache.h>
51
52#include "mad_priv.h"
53#include "mad_rmpp.h"
54#include "smi.h"
55#include "opa_smi.h"
56#include "agent.h"
57#include "core_priv.h"
58
59static int mad_sendq_size = IB_MAD_QP_SEND_SIZE;
60static int mad_recvq_size = IB_MAD_QP_RECV_SIZE;
61
62module_param_named(send_queue_size, mad_sendq_size, int, 0444);
63MODULE_PARM_DESC(send_queue_size, "Size of send queue in number of work requests");
64module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
65MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
66
67static struct list_head ib_mad_port_list;
68static u32 ib_mad_client_id = 0;
69
70/* Port list lock */
71static DEFINE_SPINLOCK(ib_mad_port_list_lock);
72
73/* Forward declarations */
74static int method_in_use(struct ib_mad_mgmt_method_table **method,
75			 struct ib_mad_reg_req *mad_reg_req);
76static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
77static struct ib_mad_agent_private *find_mad_agent(
78					struct ib_mad_port_private *port_priv,
79					const struct ib_mad_hdr *mad);
80static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
81				    struct ib_mad_private *mad);
82static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
83static void timeout_sends(struct work_struct *work);
84static void local_completions(struct work_struct *work);
85static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
86			      struct ib_mad_agent_private *agent_priv,
87			      u8 mgmt_class);
88static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
89			   struct ib_mad_agent_private *agent_priv);
90static bool ib_mad_send_error(struct ib_mad_port_private *port_priv,
91			      struct ib_wc *wc);
92static void ib_mad_send_done(struct ib_cq *cq, struct ib_wc *wc);
93
94/*
95 * Returns a ib_mad_port_private structure or NULL for a device/port
96 * Assumes ib_mad_port_list_lock is being held
97 */
98static inline struct ib_mad_port_private *
99__ib_get_mad_port(struct ib_device *device, int port_num)
100{
101	struct ib_mad_port_private *entry;
102
103	list_for_each_entry(entry, &ib_mad_port_list, port_list) {
104		if (entry->device == device && entry->port_num == port_num)
105			return entry;
106	}
107	return NULL;
108}
109
110/*
111 * Wrapper function to return a ib_mad_port_private structure or NULL
112 * for a device/port
113 */
114static inline struct ib_mad_port_private *
115ib_get_mad_port(struct ib_device *device, int port_num)
116{
117	struct ib_mad_port_private *entry;
118	unsigned long flags;
119
120	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
121	entry = __ib_get_mad_port(device, port_num);
122	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
123
124	return entry;
125}
126
127static inline u8 convert_mgmt_class(u8 mgmt_class)
128{
129	/* Alias IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE to 0 */
130	return mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE ?
131		0 : mgmt_class;
132}
133
134static int get_spl_qp_index(enum ib_qp_type qp_type)
135{
136	switch (qp_type)
137	{
138	case IB_QPT_SMI:
139		return 0;
140	case IB_QPT_GSI:
141		return 1;
142	default:
143		return -1;
144	}
145}
146
147static int vendor_class_index(u8 mgmt_class)
148{
149	return mgmt_class - IB_MGMT_CLASS_VENDOR_RANGE2_START;
150}
151
152static int is_vendor_class(u8 mgmt_class)
153{
154	if ((mgmt_class < IB_MGMT_CLASS_VENDOR_RANGE2_START) ||
155	    (mgmt_class > IB_MGMT_CLASS_VENDOR_RANGE2_END))
156		return 0;
157	return 1;
158}
159
160static int is_vendor_oui(char *oui)
161{
162	if (oui[0] || oui[1] || oui[2])
163		return 1;
164	return 0;
165}
166
167static int is_vendor_method_in_use(
168		struct ib_mad_mgmt_vendor_class *vendor_class,
169		struct ib_mad_reg_req *mad_reg_req)
170{
171	struct ib_mad_mgmt_method_table *method;
172	int i;
173
174	for (i = 0; i < MAX_MGMT_OUI; i++) {
175		if (!memcmp(vendor_class->oui[i], mad_reg_req->oui, 3)) {
176			method = vendor_class->method_table[i];
177			if (method) {
178				if (method_in_use(&method, mad_reg_req))
179					return 1;
180				else
181					break;
182			}
183		}
184	}
185	return 0;
186}
187
188int ib_response_mad(const struct ib_mad_hdr *hdr)
189{
190	return ((hdr->method & IB_MGMT_METHOD_RESP) ||
191		(hdr->method == IB_MGMT_METHOD_TRAP_REPRESS) ||
192		((hdr->mgmt_class == IB_MGMT_CLASS_BM) &&
193		 (hdr->attr_mod & IB_BM_ATTR_MOD_RESP)));
194}
195EXPORT_SYMBOL(ib_response_mad);
196
197/*
198 * ib_register_mad_agent - Register to send/receive MADs
199 */
200struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
201					   u8 port_num,
202					   enum ib_qp_type qp_type,
203					   struct ib_mad_reg_req *mad_reg_req,
204					   u8 rmpp_version,
205					   ib_mad_send_handler send_handler,
206					   ib_mad_recv_handler recv_handler,
207					   void *context,
208					   u32 registration_flags)
209{
210	struct ib_mad_port_private *port_priv;
211	struct ib_mad_agent *ret = ERR_PTR(-EINVAL);
212	struct ib_mad_agent_private *mad_agent_priv;
213	struct ib_mad_reg_req *reg_req = NULL;
214	struct ib_mad_mgmt_class_table *class;
215	struct ib_mad_mgmt_vendor_class_table *vendor;
216	struct ib_mad_mgmt_vendor_class *vendor_class;
217	struct ib_mad_mgmt_method_table *method;
218	int ret2, qpn;
219	unsigned long flags;
220	u8 mgmt_class, vclass;
221
222	/* Validate parameters */
223	qpn = get_spl_qp_index(qp_type);
224	if (qpn == -1) {
225		dev_notice(&device->dev,
226			   "ib_register_mad_agent: invalid QP Type %d\n",
227			   qp_type);
228		goto error1;
229	}
230
231	if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
232		dev_notice(&device->dev,
233			   "ib_register_mad_agent: invalid RMPP Version %u\n",
234			   rmpp_version);
235		goto error1;
236	}
237
238	/* Validate MAD registration request if supplied */
239	if (mad_reg_req) {
240		if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
241			dev_notice(&device->dev,
242				   "ib_register_mad_agent: invalid Class Version %u\n",
243				   mad_reg_req->mgmt_class_version);
244			goto error1;
245		}
246		if (!recv_handler) {
247			dev_notice(&device->dev,
248				   "ib_register_mad_agent: no recv_handler\n");
249			goto error1;
250		}
251		if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
252			/*
253			 * IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE is the only
254			 * one in this range currently allowed
255			 */
256			if (mad_reg_req->mgmt_class !=
257			    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
258				dev_notice(&device->dev,
259					   "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
260					   mad_reg_req->mgmt_class);
261				goto error1;
262			}
263		} else if (mad_reg_req->mgmt_class == 0) {
264			/*
265			 * Class 0 is reserved in IBA and is used for
266			 * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
267			 */
268			dev_notice(&device->dev,
269				   "ib_register_mad_agent: Invalid Mgmt Class 0\n");
270			goto error1;
271		} else if (is_vendor_class(mad_reg_req->mgmt_class)) {
272			/*
273			 * If class is in "new" vendor range,
274			 * ensure supplied OUI is not zero
275			 */
276			if (!is_vendor_oui(mad_reg_req->oui)) {
277				dev_notice(&device->dev,
278					   "ib_register_mad_agent: No OUI specified for class 0x%x\n",
279					   mad_reg_req->mgmt_class);
280				goto error1;
281			}
282		}
283		/* Make sure class supplied is consistent with RMPP */
284		if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
285			if (rmpp_version) {
286				dev_notice(&device->dev,
287					   "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
288					   mad_reg_req->mgmt_class);
289				goto error1;
290			}
291		}
292
293		/* Make sure class supplied is consistent with QP type */
294		if (qp_type == IB_QPT_SMI) {
295			if ((mad_reg_req->mgmt_class !=
296					IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
297			    (mad_reg_req->mgmt_class !=
298					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
299				dev_notice(&device->dev,
300					   "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
301					   mad_reg_req->mgmt_class);
302				goto error1;
303			}
304		} else {
305			if ((mad_reg_req->mgmt_class ==
306					IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
307			    (mad_reg_req->mgmt_class ==
308					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
309				dev_notice(&device->dev,
310					   "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
311					   mad_reg_req->mgmt_class);
312				goto error1;
313			}
314		}
315	} else {
316		/* No registration request supplied */
317		if (!send_handler)
318			goto error1;
319		if (registration_flags & IB_MAD_USER_RMPP)
320			goto error1;
321	}
322
323	/* Validate device and port */
324	port_priv = ib_get_mad_port(device, port_num);
325	if (!port_priv) {
326		dev_notice(&device->dev, "ib_register_mad_agent: Invalid port\n");
327		ret = ERR_PTR(-ENODEV);
328		goto error1;
329	}
330
331	/* Verify the QP requested is supported.  For example, Ethernet devices
332	 * will not have QP0 */
333	if (!port_priv->qp_info[qpn].qp) {
334		dev_notice(&device->dev,
335			   "ib_register_mad_agent: QP %d not supported\n", qpn);
336		ret = ERR_PTR(-EPROTONOSUPPORT);
337		goto error1;
338	}
339
340	/* Allocate structures */
341	mad_agent_priv = kzalloc(sizeof *mad_agent_priv, GFP_KERNEL);
342	if (!mad_agent_priv) {
343		ret = ERR_PTR(-ENOMEM);
344		goto error1;
345	}
346
347	if (mad_reg_req) {
348		reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
349		if (!reg_req) {
350			ret = ERR_PTR(-ENOMEM);
351			goto error3;
352		}
353	}
354
355	/* Now, fill in the various structures */
356	mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
357	mad_agent_priv->reg_req = reg_req;
358	mad_agent_priv->agent.rmpp_version = rmpp_version;
359	mad_agent_priv->agent.device = device;
360	mad_agent_priv->agent.recv_handler = recv_handler;
361	mad_agent_priv->agent.send_handler = send_handler;
362	mad_agent_priv->agent.context = context;
363	mad_agent_priv->agent.qp = port_priv->qp_info[qpn].qp;
364	mad_agent_priv->agent.port_num = port_num;
365	mad_agent_priv->agent.flags = registration_flags;
366	spin_lock_init(&mad_agent_priv->lock);
367	INIT_LIST_HEAD(&mad_agent_priv->send_list);
368	INIT_LIST_HEAD(&mad_agent_priv->wait_list);
369	INIT_LIST_HEAD(&mad_agent_priv->done_list);
370	INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
371	INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
372	INIT_LIST_HEAD(&mad_agent_priv->local_list);
373	INIT_WORK(&mad_agent_priv->local_work, local_completions);
374	atomic_set(&mad_agent_priv->refcount, 1);
375	init_completion(&mad_agent_priv->comp);
376
377	spin_lock_irqsave(&port_priv->reg_lock, flags);
378	mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
379
380	/*
381	 * Make sure MAD registration (if supplied)
382	 * is non overlapping with any existing ones
383	 */
384	if (mad_reg_req) {
385		mgmt_class = convert_mgmt_class(mad_reg_req->mgmt_class);
386		if (!is_vendor_class(mgmt_class)) {
387			class = port_priv->version[mad_reg_req->
388						   mgmt_class_version].class;
389			if (class) {
390				method = class->method_table[mgmt_class];
391				if (method) {
392					if (method_in_use(&method,
393							   mad_reg_req))
394						goto error4;
395				}
396			}
397			ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
398						  mgmt_class);
399		} else {
400			/* "New" vendor class range */
401			vendor = port_priv->version[mad_reg_req->
402						    mgmt_class_version].vendor;
403			if (vendor) {
404				vclass = vendor_class_index(mgmt_class);
405				vendor_class = vendor->vendor_class[vclass];
406				if (vendor_class) {
407					if (is_vendor_method_in_use(
408							vendor_class,
409							mad_reg_req))
410						goto error4;
411				}
412			}
413			ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
414		}
415		if (ret2) {
416			ret = ERR_PTR(ret2);
417			goto error4;
418		}
419	}
420
421	/* Add mad agent into port's agent list */
422	list_add_tail(&mad_agent_priv->agent_list, &port_priv->agent_list);
423	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
424
425	return &mad_agent_priv->agent;
426
427error4:
428	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
429	kfree(reg_req);
430error3:
431	kfree(mad_agent_priv);
432error1:
433	return ret;
434}
435EXPORT_SYMBOL(ib_register_mad_agent);
436
437static inline int is_snooping_sends(int mad_snoop_flags)
438{
439	return (mad_snoop_flags &
440		(/*IB_MAD_SNOOP_POSTED_SENDS |
441		 IB_MAD_SNOOP_RMPP_SENDS |*/
442		 IB_MAD_SNOOP_SEND_COMPLETIONS /*|
443		 IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS*/));
444}
445
446static inline int is_snooping_recvs(int mad_snoop_flags)
447{
448	return (mad_snoop_flags &
449		(IB_MAD_SNOOP_RECVS /*|
450		 IB_MAD_SNOOP_RMPP_RECVS*/));
451}
452
453static int register_snoop_agent(struct ib_mad_qp_info *qp_info,
454				struct ib_mad_snoop_private *mad_snoop_priv)
455{
456	struct ib_mad_snoop_private **new_snoop_table;
457	unsigned long flags;
458	int i;
459
460	spin_lock_irqsave(&qp_info->snoop_lock, flags);
461	/* Check for empty slot in array. */
462	for (i = 0; i < qp_info->snoop_table_size; i++)
463		if (!qp_info->snoop_table[i])
464			break;
465
466	if (i == qp_info->snoop_table_size) {
467		/* Grow table. */
468		new_snoop_table = krealloc(qp_info->snoop_table,
469					   sizeof mad_snoop_priv *
470					   (qp_info->snoop_table_size + 1),
471					   GFP_ATOMIC);
472		if (!new_snoop_table) {
473			i = -ENOMEM;
474			goto out;
475		}
476
477		qp_info->snoop_table = new_snoop_table;
478		qp_info->snoop_table_size++;
479	}
480	qp_info->snoop_table[i] = mad_snoop_priv;
481	atomic_inc(&qp_info->snoop_count);
482out:
483	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
484	return i;
485}
486
487struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
488					   u8 port_num,
489					   enum ib_qp_type qp_type,
490					   int mad_snoop_flags,
491					   ib_mad_snoop_handler snoop_handler,
492					   ib_mad_recv_handler recv_handler,
493					   void *context)
494{
495	struct ib_mad_port_private *port_priv;
496	struct ib_mad_agent *ret;
497	struct ib_mad_snoop_private *mad_snoop_priv;
498	int qpn;
499
500	/* Validate parameters */
501	if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) ||
502	    (is_snooping_recvs(mad_snoop_flags) && !recv_handler)) {
503		ret = ERR_PTR(-EINVAL);
504		goto error1;
505	}
506	qpn = get_spl_qp_index(qp_type);
507	if (qpn == -1) {
508		ret = ERR_PTR(-EINVAL);
509		goto error1;
510	}
511	port_priv = ib_get_mad_port(device, port_num);
512	if (!port_priv) {
513		ret = ERR_PTR(-ENODEV);
514		goto error1;
515	}
516	/* Allocate structures */
517	mad_snoop_priv = kzalloc(sizeof *mad_snoop_priv, GFP_KERNEL);
518	if (!mad_snoop_priv) {
519		ret = ERR_PTR(-ENOMEM);
520		goto error1;
521	}
522
523	/* Now, fill in the various structures */
524	mad_snoop_priv->qp_info = &port_priv->qp_info[qpn];
525	mad_snoop_priv->agent.device = device;
526	mad_snoop_priv->agent.recv_handler = recv_handler;
527	mad_snoop_priv->agent.snoop_handler = snoop_handler;
528	mad_snoop_priv->agent.context = context;
529	mad_snoop_priv->agent.qp = port_priv->qp_info[qpn].qp;
530	mad_snoop_priv->agent.port_num = port_num;
531	mad_snoop_priv->mad_snoop_flags = mad_snoop_flags;
532	init_completion(&mad_snoop_priv->comp);
533	mad_snoop_priv->snoop_index = register_snoop_agent(
534						&port_priv->qp_info[qpn],
535						mad_snoop_priv);
536	if (mad_snoop_priv->snoop_index < 0) {
537		ret = ERR_PTR(mad_snoop_priv->snoop_index);
538		goto error2;
539	}
540
541	atomic_set(&mad_snoop_priv->refcount, 1);
542	return &mad_snoop_priv->agent;
543
544error2:
545	kfree(mad_snoop_priv);
546error1:
547	return ret;
548}
549EXPORT_SYMBOL(ib_register_mad_snoop);
550
551static inline void deref_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
552{
553	if (atomic_dec_and_test(&mad_agent_priv->refcount))
554		complete(&mad_agent_priv->comp);
555}
556
557static inline void deref_snoop_agent(struct ib_mad_snoop_private *mad_snoop_priv)
558{
559	if (atomic_dec_and_test(&mad_snoop_priv->refcount))
560		complete(&mad_snoop_priv->comp);
561}
562
563static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
564{
565	struct ib_mad_port_private *port_priv;
566	unsigned long flags;
567
568	/* Note that we could still be handling received MADs */
569
570	/*
571	 * Canceling all sends results in dropping received response
572	 * MADs, preventing us from queuing additional work
573	 */
574	cancel_mads(mad_agent_priv);
575	port_priv = mad_agent_priv->qp_info->port_priv;
576	cancel_delayed_work_sync(&mad_agent_priv->timed_work);
577
578	spin_lock_irqsave(&port_priv->reg_lock, flags);
579	remove_mad_reg_req(mad_agent_priv);
580	list_del(&mad_agent_priv->agent_list);
581	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
582
583	flush_workqueue(port_priv->wq);
584	ib_cancel_rmpp_recvs(mad_agent_priv);
585
586	deref_mad_agent(mad_agent_priv);
587	wait_for_completion(&mad_agent_priv->comp);
588
589	kfree(mad_agent_priv->reg_req);
590	kfree(mad_agent_priv);
591}
592
593static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv)
594{
595	struct ib_mad_qp_info *qp_info;
596	unsigned long flags;
597
598	qp_info = mad_snoop_priv->qp_info;
599	spin_lock_irqsave(&qp_info->snoop_lock, flags);
600	qp_info->snoop_table[mad_snoop_priv->snoop_index] = NULL;
601	atomic_dec(&qp_info->snoop_count);
602	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
603
604	deref_snoop_agent(mad_snoop_priv);
605	wait_for_completion(&mad_snoop_priv->comp);
606
607	kfree(mad_snoop_priv);
608}
609
610/*
611 * ib_unregister_mad_agent - Unregisters a client from using MAD services
612 */
613int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
614{
615	struct ib_mad_agent_private *mad_agent_priv;
616	struct ib_mad_snoop_private *mad_snoop_priv;
617
618	/* If the TID is zero, the agent can only snoop. */
619	if (mad_agent->hi_tid) {
620		mad_agent_priv = container_of(mad_agent,
621					      struct ib_mad_agent_private,
622					      agent);
623		unregister_mad_agent(mad_agent_priv);
624	} else {
625		mad_snoop_priv = container_of(mad_agent,
626					      struct ib_mad_snoop_private,
627					      agent);
628		unregister_mad_snoop(mad_snoop_priv);
629	}
630	return 0;
631}
632EXPORT_SYMBOL(ib_unregister_mad_agent);
633
634static void dequeue_mad(struct ib_mad_list_head *mad_list)
635{
636	struct ib_mad_queue *mad_queue;
637	unsigned long flags;
638
639	BUG_ON(!mad_list->mad_queue);
640	mad_queue = mad_list->mad_queue;
641	spin_lock_irqsave(&mad_queue->lock, flags);
642	list_del(&mad_list->list);
643	mad_queue->count--;
644	spin_unlock_irqrestore(&mad_queue->lock, flags);
645}
646
647static void snoop_send(struct ib_mad_qp_info *qp_info,
648		       struct ib_mad_send_buf *send_buf,
649		       struct ib_mad_send_wc *mad_send_wc,
650		       int mad_snoop_flags)
651{
652	struct ib_mad_snoop_private *mad_snoop_priv;
653	unsigned long flags;
654	int i;
655
656	spin_lock_irqsave(&qp_info->snoop_lock, flags);
657	for (i = 0; i < qp_info->snoop_table_size; i++) {
658		mad_snoop_priv = qp_info->snoop_table[i];
659		if (!mad_snoop_priv ||
660		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
661			continue;
662
663		atomic_inc(&mad_snoop_priv->refcount);
664		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
665		mad_snoop_priv->agent.snoop_handler(&mad_snoop_priv->agent,
666						    send_buf, mad_send_wc);
667		deref_snoop_agent(mad_snoop_priv);
668		spin_lock_irqsave(&qp_info->snoop_lock, flags);
669	}
670	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
671}
672
673static void snoop_recv(struct ib_mad_qp_info *qp_info,
674		       struct ib_mad_recv_wc *mad_recv_wc,
675		       int mad_snoop_flags)
676{
677	struct ib_mad_snoop_private *mad_snoop_priv;
678	unsigned long flags;
679	int i;
680
681	spin_lock_irqsave(&qp_info->snoop_lock, flags);
682	for (i = 0; i < qp_info->snoop_table_size; i++) {
683		mad_snoop_priv = qp_info->snoop_table[i];
684		if (!mad_snoop_priv ||
685		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
686			continue;
687
688		atomic_inc(&mad_snoop_priv->refcount);
689		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
690		mad_snoop_priv->agent.recv_handler(&mad_snoop_priv->agent, NULL,
691						   mad_recv_wc);
692		deref_snoop_agent(mad_snoop_priv);
693		spin_lock_irqsave(&qp_info->snoop_lock, flags);
694	}
695	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
696}
697
698static void build_smp_wc(struct ib_qp *qp, struct ib_cqe *cqe, u16 slid,
699		u16 pkey_index, u8 port_num, struct ib_wc *wc)
700{
701	memset(wc, 0, sizeof *wc);
702	wc->wr_cqe = cqe;
703	wc->status = IB_WC_SUCCESS;
704	wc->opcode = IB_WC_RECV;
705	wc->pkey_index = pkey_index;
706	wc->byte_len = sizeof(struct ib_mad) + sizeof(struct ib_grh);
707	wc->src_qp = IB_QP0;
708	wc->qp = qp;
709	wc->slid = slid;
710	wc->sl = 0;
711	wc->dlid_path_bits = 0;
712	wc->port_num = port_num;
713}
714
715static size_t mad_priv_size(const struct ib_mad_private *mp)
716{
717	return sizeof(struct ib_mad_private) + mp->mad_size;
718}
719
720static struct ib_mad_private *alloc_mad_private(size_t mad_size, gfp_t flags)
721{
722	size_t size = sizeof(struct ib_mad_private) + mad_size;
723	struct ib_mad_private *ret = kzalloc(size, flags);
724
725	if (ret)
726		ret->mad_size = mad_size;
727
728	return ret;
729}
730
731static size_t port_mad_size(const struct ib_mad_port_private *port_priv)
732{
733	return rdma_max_mad_size(port_priv->device, port_priv->port_num);
734}
735
736static size_t mad_priv_dma_size(const struct ib_mad_private *mp)
737{
738	return sizeof(struct ib_grh) + mp->mad_size;
739}
740
741/*
742 * Return 0 if SMP is to be sent
743 * Return 1 if SMP was consumed locally (whether or not solicited)
744 * Return < 0 if error
745 */
746static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
747				  struct ib_mad_send_wr_private *mad_send_wr)
748{
749	int ret = 0;
750	struct ib_smp *smp = mad_send_wr->send_buf.mad;
751	struct opa_smp *opa_smp = (struct opa_smp *)smp;
752	unsigned long flags;
753	struct ib_mad_local_private *local;
754	struct ib_mad_private *mad_priv;
755	struct ib_mad_port_private *port_priv;
756	struct ib_mad_agent_private *recv_mad_agent = NULL;
757	struct ib_device *device = mad_agent_priv->agent.device;
758	u8 port_num;
759	struct ib_wc mad_wc;
760	struct ib_ud_wr *send_wr = &mad_send_wr->send_wr;
761	size_t mad_size = port_mad_size(mad_agent_priv->qp_info->port_priv);
762	u16 out_mad_pkey_index = 0;
763	u16 drslid;
764	bool opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
765				    mad_agent_priv->qp_info->port_priv->port_num);
766
767	if (rdma_cap_ib_switch(device) &&
768	    smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
769		port_num = send_wr->port_num;
770	else
771		port_num = mad_agent_priv->agent.port_num;
772
773	/*
774	 * Directed route handling starts if the initial LID routed part of
775	 * a request or the ending LID routed part of a response is empty.
776	 * If we are at the start of the LID routed part, don't update the
777	 * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
778	 */
779	if (opa && smp->class_version == OPA_SMP_CLASS_VERSION) {
780		u32 opa_drslid;
781
782		if ((opa_get_smp_direction(opa_smp)
783		     ? opa_smp->route.dr.dr_dlid : opa_smp->route.dr.dr_slid) ==
784		     OPA_LID_PERMISSIVE &&
785		     opa_smi_handle_dr_smp_send(opa_smp,
786						rdma_cap_ib_switch(device),
787						port_num) == IB_SMI_DISCARD) {
788			ret = -EINVAL;
789			dev_err(&device->dev, "OPA Invalid directed route\n");
790			goto out;
791		}
792		opa_drslid = be32_to_cpu(opa_smp->route.dr.dr_slid);
793		if (opa_drslid != be32_to_cpu(OPA_LID_PERMISSIVE) &&
794		    opa_drslid & 0xffff0000) {
795			ret = -EINVAL;
796			dev_err(&device->dev, "OPA Invalid dr_slid 0x%x\n",
797			       opa_drslid);
798			goto out;
799		}
800		drslid = (u16)(opa_drslid & 0x0000ffff);
801
802		/* Check to post send on QP or process locally */
803		if (opa_smi_check_local_smp(opa_smp, device) == IB_SMI_DISCARD &&
804		    opa_smi_check_local_returning_smp(opa_smp, device) == IB_SMI_DISCARD)
805			goto out;
806	} else {
807		if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
808		     IB_LID_PERMISSIVE &&
809		     smi_handle_dr_smp_send(smp, rdma_cap_ib_switch(device), port_num) ==
810		     IB_SMI_DISCARD) {
811			ret = -EINVAL;
812			dev_err(&device->dev, "Invalid directed route\n");
813			goto out;
814		}
815		drslid = be16_to_cpu(smp->dr_slid);
816
817		/* Check to post send on QP or process locally */
818		if (smi_check_local_smp(smp, device) == IB_SMI_DISCARD &&
819		    smi_check_local_returning_smp(smp, device) == IB_SMI_DISCARD)
820			goto out;
821	}
822
823	local = kmalloc(sizeof *local, GFP_ATOMIC);
824	if (!local) {
825		ret = -ENOMEM;
826		dev_err(&device->dev, "No memory for ib_mad_local_private\n");
827		goto out;
828	}
829	local->mad_priv = NULL;
830	local->recv_mad_agent = NULL;
831	mad_priv = alloc_mad_private(mad_size, GFP_ATOMIC);
832	if (!mad_priv) {
833		ret = -ENOMEM;
834		dev_err(&device->dev, "No memory for local response MAD\n");
835		kfree(local);
836		goto out;
837	}
838
839	build_smp_wc(mad_agent_priv->agent.qp,
840		     send_wr->wr.wr_cqe, drslid,
841		     send_wr->pkey_index,
842		     send_wr->port_num, &mad_wc);
843
844	if (opa && smp->base_version == OPA_MGMT_BASE_VERSION) {
845		mad_wc.byte_len = mad_send_wr->send_buf.hdr_len
846					+ mad_send_wr->send_buf.data_len
847					+ sizeof(struct ib_grh);
848	}
849
850	/* No GRH for DR SMP */
851	ret = device->process_mad(device, 0, port_num, &mad_wc, NULL,
852				  (const struct ib_mad_hdr *)smp, mad_size,
853				  (struct ib_mad_hdr *)mad_priv->mad,
854				  &mad_size, &out_mad_pkey_index);
855	switch (ret)
856	{
857	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
858		if (ib_response_mad((const struct ib_mad_hdr *)mad_priv->mad) &&
859		    mad_agent_priv->agent.recv_handler) {
860			local->mad_priv = mad_priv;
861			local->recv_mad_agent = mad_agent_priv;
862			/*
863			 * Reference MAD agent until receive
864			 * side of local completion handled
865			 */
866			atomic_inc(&mad_agent_priv->refcount);
867		} else
868			kfree(mad_priv);
869		break;
870	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
871		kfree(mad_priv);
872		break;
873	case IB_MAD_RESULT_SUCCESS:
874		/* Treat like an incoming receive MAD */
875		port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
876					    mad_agent_priv->agent.port_num);
877		if (port_priv) {
878			memcpy(mad_priv->mad, smp, mad_priv->mad_size);
879			recv_mad_agent = find_mad_agent(port_priv,
880						        (const struct ib_mad_hdr *)mad_priv->mad);
881		}
882		if (!port_priv || !recv_mad_agent) {
883			/*
884			 * No receiving agent so drop packet and
885			 * generate send completion.
886			 */
887			kfree(mad_priv);
888			break;
889		}
890		local->mad_priv = mad_priv;
891		local->recv_mad_agent = recv_mad_agent;
892		break;
893	default:
894		kfree(mad_priv);
895		kfree(local);
896		ret = -EINVAL;
897		goto out;
898	}
899
900	local->mad_send_wr = mad_send_wr;
901	if (opa) {
902		local->mad_send_wr->send_wr.pkey_index = out_mad_pkey_index;
903		local->return_wc_byte_len = mad_size;
904	}
905	/* Reference MAD agent until send side of local completion handled */
906	atomic_inc(&mad_agent_priv->refcount);
907	/* Queue local completion to local list */
908	spin_lock_irqsave(&mad_agent_priv->lock, flags);
909	list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
910	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
911	queue_work(mad_agent_priv->qp_info->port_priv->wq,
912		   &mad_agent_priv->local_work);
913	ret = 1;
914out:
915	return ret;
916}
917
918static int get_pad_size(int hdr_len, int data_len, size_t mad_size)
919{
920	int seg_size, pad;
921
922	seg_size = mad_size - hdr_len;
923	if (data_len && seg_size) {
924		pad = seg_size - data_len % seg_size;
925		return pad == seg_size ? 0 : pad;
926	} else
927		return seg_size;
928}
929
930static void free_send_rmpp_list(struct ib_mad_send_wr_private *mad_send_wr)
931{
932	struct ib_rmpp_segment *s, *t;
933
934	list_for_each_entry_safe(s, t, &mad_send_wr->rmpp_list, list) {
935		list_del(&s->list);
936		kfree(s);
937	}
938}
939
940static int alloc_send_rmpp_list(struct ib_mad_send_wr_private *send_wr,
941				size_t mad_size, gfp_t gfp_mask)
942{
943	struct ib_mad_send_buf *send_buf = &send_wr->send_buf;
944	struct ib_rmpp_mad *rmpp_mad = send_buf->mad;
945	struct ib_rmpp_segment *seg = NULL;
946	int left, seg_size, pad;
947
948	send_buf->seg_size = mad_size - send_buf->hdr_len;
949	send_buf->seg_rmpp_size = mad_size - IB_MGMT_RMPP_HDR;
950	seg_size = send_buf->seg_size;
951	pad = send_wr->pad;
952
953	/* Allocate data segments. */
954	for (left = send_buf->data_len + pad; left > 0; left -= seg_size) {
955		seg = kmalloc(sizeof (*seg) + seg_size, gfp_mask);
956		if (!seg) {
957			dev_err(&send_buf->mad_agent->device->dev,
958				"alloc_send_rmpp_segs: RMPP mem alloc failed for len %zd, gfp %#x\n",
959				sizeof (*seg) + seg_size, gfp_mask);
960			free_send_rmpp_list(send_wr);
961			return -ENOMEM;
962		}
963		seg->num = ++send_buf->seg_count;
964		list_add_tail(&seg->list, &send_wr->rmpp_list);
965	}
966
967	/* Zero any padding */
968	if (pad)
969		memset(seg->data + seg_size - pad, 0, pad);
970
971	rmpp_mad->rmpp_hdr.rmpp_version = send_wr->mad_agent_priv->
972					  agent.rmpp_version;
973	rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
974	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
975
976	send_wr->cur_seg = container_of(send_wr->rmpp_list.next,
977					struct ib_rmpp_segment, list);
978	send_wr->last_ack_seg = send_wr->cur_seg;
979	return 0;
980}
981
982int ib_mad_kernel_rmpp_agent(const struct ib_mad_agent *agent)
983{
984	return agent->rmpp_version && !(agent->flags & IB_MAD_USER_RMPP);
985}
986EXPORT_SYMBOL(ib_mad_kernel_rmpp_agent);
987
988struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
989					    u32 remote_qpn, u16 pkey_index,
990					    int rmpp_active,
991					    int hdr_len, int data_len,
992					    gfp_t gfp_mask,
993					    u8 base_version)
994{
995	struct ib_mad_agent_private *mad_agent_priv;
996	struct ib_mad_send_wr_private *mad_send_wr;
997	int pad, message_size, ret, size;
998	void *buf;
999	size_t mad_size;
1000	bool opa;
1001
1002	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
1003				      agent);
1004
1005	opa = rdma_cap_opa_mad(mad_agent->device, mad_agent->port_num);
1006
1007	if (opa && base_version == OPA_MGMT_BASE_VERSION)
1008		mad_size = sizeof(struct opa_mad);
1009	else
1010		mad_size = sizeof(struct ib_mad);
1011
1012	pad = get_pad_size(hdr_len, data_len, mad_size);
1013	message_size = hdr_len + data_len + pad;
1014
1015	if (ib_mad_kernel_rmpp_agent(mad_agent)) {
1016		if (!rmpp_active && message_size > mad_size)
1017			return ERR_PTR(-EINVAL);
1018	} else
1019		if (rmpp_active || message_size > mad_size)
1020			return ERR_PTR(-EINVAL);
1021
1022	size = rmpp_active ? hdr_len : mad_size;
1023	buf = kzalloc(sizeof *mad_send_wr + size, gfp_mask);
1024	if (!buf)
1025		return ERR_PTR(-ENOMEM);
1026
1027	mad_send_wr = (struct ib_mad_send_wr_private *)((char *)buf + size);
1028	INIT_LIST_HEAD(&mad_send_wr->rmpp_list);
1029	mad_send_wr->send_buf.mad = buf;
1030	mad_send_wr->send_buf.hdr_len = hdr_len;
1031	mad_send_wr->send_buf.data_len = data_len;
1032	mad_send_wr->pad = pad;
1033
1034	mad_send_wr->mad_agent_priv = mad_agent_priv;
1035	mad_send_wr->sg_list[0].length = hdr_len;
1036	mad_send_wr->sg_list[0].lkey = mad_agent->qp->pd->local_dma_lkey;
1037
1038	/* OPA MADs don't have to be the full 2048 bytes */
1039	if (opa && base_version == OPA_MGMT_BASE_VERSION &&
1040	    data_len < mad_size - hdr_len)
1041		mad_send_wr->sg_list[1].length = data_len;
1042	else
1043		mad_send_wr->sg_list[1].length = mad_size - hdr_len;
1044
1045	mad_send_wr->sg_list[1].lkey = mad_agent->qp->pd->local_dma_lkey;
1046
1047	mad_send_wr->mad_list.cqe.done = ib_mad_send_done;
1048
1049	mad_send_wr->send_wr.wr.wr_cqe = &mad_send_wr->mad_list.cqe;
1050	mad_send_wr->send_wr.wr.sg_list = mad_send_wr->sg_list;
1051	mad_send_wr->send_wr.wr.num_sge = 2;
1052	mad_send_wr->send_wr.wr.opcode = IB_WR_SEND;
1053	mad_send_wr->send_wr.wr.send_flags = IB_SEND_SIGNALED;
1054	mad_send_wr->send_wr.remote_qpn = remote_qpn;
1055	mad_send_wr->send_wr.remote_qkey = IB_QP_SET_QKEY;
1056	mad_send_wr->send_wr.pkey_index = pkey_index;
1057
1058	if (rmpp_active) {
1059		ret = alloc_send_rmpp_list(mad_send_wr, mad_size, gfp_mask);
1060		if (ret) {
1061			kfree(buf);
1062			return ERR_PTR(ret);
1063		}
1064	}
1065
1066	mad_send_wr->send_buf.mad_agent = mad_agent;
1067	atomic_inc(&mad_agent_priv->refcount);
1068	return &mad_send_wr->send_buf;
1069}
1070EXPORT_SYMBOL(ib_create_send_mad);
1071
1072int ib_get_mad_data_offset(u8 mgmt_class)
1073{
1074	if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
1075		return IB_MGMT_SA_HDR;
1076	else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1077		 (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1078		 (mgmt_class == IB_MGMT_CLASS_BIS))
1079		return IB_MGMT_DEVICE_HDR;
1080	else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1081		 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
1082		return IB_MGMT_VENDOR_HDR;
1083	else
1084		return IB_MGMT_MAD_HDR;
1085}
1086EXPORT_SYMBOL(ib_get_mad_data_offset);
1087
1088int ib_is_mad_class_rmpp(u8 mgmt_class)
1089{
1090	if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
1091	    (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1092	    (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1093	    (mgmt_class == IB_MGMT_CLASS_BIS) ||
1094	    ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1095	     (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
1096		return 1;
1097	return 0;
1098}
1099EXPORT_SYMBOL(ib_is_mad_class_rmpp);
1100
1101void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
1102{
1103	struct ib_mad_send_wr_private *mad_send_wr;
1104	struct list_head *list;
1105
1106	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1107				   send_buf);
1108	list = &mad_send_wr->cur_seg->list;
1109
1110	if (mad_send_wr->cur_seg->num < seg_num) {
1111		list_for_each_entry(mad_send_wr->cur_seg, list, list)
1112			if (mad_send_wr->cur_seg->num == seg_num)
1113				break;
1114	} else if (mad_send_wr->cur_seg->num > seg_num) {
1115		list_for_each_entry_reverse(mad_send_wr->cur_seg, list, list)
1116			if (mad_send_wr->cur_seg->num == seg_num)
1117				break;
1118	}
1119	return mad_send_wr->cur_seg->data;
1120}
1121EXPORT_SYMBOL(ib_get_rmpp_segment);
1122
1123static inline void *ib_get_payload(struct ib_mad_send_wr_private *mad_send_wr)
1124{
1125	if (mad_send_wr->send_buf.seg_count)
1126		return ib_get_rmpp_segment(&mad_send_wr->send_buf,
1127					   mad_send_wr->seg_num);
1128	else
1129		return (char *)mad_send_wr->send_buf.mad +
1130		       mad_send_wr->send_buf.hdr_len;
1131}
1132
1133void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
1134{
1135	struct ib_mad_agent_private *mad_agent_priv;
1136	struct ib_mad_send_wr_private *mad_send_wr;
1137
1138	mad_agent_priv = container_of(send_buf->mad_agent,
1139				      struct ib_mad_agent_private, agent);
1140	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1141				   send_buf);
1142
1143	free_send_rmpp_list(mad_send_wr);
1144	kfree(send_buf->mad);
1145	deref_mad_agent(mad_agent_priv);
1146}
1147EXPORT_SYMBOL(ib_free_send_mad);
1148
1149int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
1150{
1151	struct ib_mad_qp_info *qp_info;
1152	struct list_head *list;
1153	struct ib_send_wr *bad_send_wr;
1154	struct ib_mad_agent *mad_agent;
1155	struct ib_sge *sge;
1156	unsigned long flags;
1157	int ret;
1158
1159	/* Set WR ID to find mad_send_wr upon completion */
1160	qp_info = mad_send_wr->mad_agent_priv->qp_info;
1161	mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
1162	mad_send_wr->mad_list.cqe.done = ib_mad_send_done;
1163	mad_send_wr->send_wr.wr.wr_cqe = &mad_send_wr->mad_list.cqe;
1164
1165	mad_agent = mad_send_wr->send_buf.mad_agent;
1166	sge = mad_send_wr->sg_list;
1167	sge[0].addr = ib_dma_map_single(mad_agent->device,
1168					mad_send_wr->send_buf.mad,
1169					sge[0].length,
1170					DMA_TO_DEVICE);
1171	if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[0].addr)))
1172		return -ENOMEM;
1173
1174	mad_send_wr->header_mapping = sge[0].addr;
1175
1176	sge[1].addr = ib_dma_map_single(mad_agent->device,
1177					ib_get_payload(mad_send_wr),
1178					sge[1].length,
1179					DMA_TO_DEVICE);
1180	if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[1].addr))) {
1181		ib_dma_unmap_single(mad_agent->device,
1182				    mad_send_wr->header_mapping,
1183				    sge[0].length, DMA_TO_DEVICE);
1184		return -ENOMEM;
1185	}
1186	mad_send_wr->payload_mapping = sge[1].addr;
1187
1188	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
1189	if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
1190		ret = ib_post_send(mad_agent->qp, &mad_send_wr->send_wr.wr,
1191				   &bad_send_wr);
1192		list = &qp_info->send_queue.list;
1193	} else {
1194		ret = 0;
1195		list = &qp_info->overflow_list;
1196	}
1197
1198	if (!ret) {
1199		qp_info->send_queue.count++;
1200		list_add_tail(&mad_send_wr->mad_list.list, list);
1201	}
1202	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
1203	if (ret) {
1204		ib_dma_unmap_single(mad_agent->device,
1205				    mad_send_wr->header_mapping,
1206				    sge[0].length, DMA_TO_DEVICE);
1207		ib_dma_unmap_single(mad_agent->device,
1208				    mad_send_wr->payload_mapping,
1209				    sge[1].length, DMA_TO_DEVICE);
1210	}
1211	return ret;
1212}
1213
1214/*
1215 * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
1216 *  with the registered client
1217 */
1218int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
1219		     struct ib_mad_send_buf **bad_send_buf)
1220{
1221	struct ib_mad_agent_private *mad_agent_priv;
1222	struct ib_mad_send_buf *next_send_buf;
1223	struct ib_mad_send_wr_private *mad_send_wr;
1224	unsigned long flags;
1225	int ret = -EINVAL;
1226
1227	/* Walk list of send WRs and post each on send list */
1228	for (; send_buf; send_buf = next_send_buf) {
1229
1230		mad_send_wr = container_of(send_buf,
1231					   struct ib_mad_send_wr_private,
1232					   send_buf);
1233		mad_agent_priv = mad_send_wr->mad_agent_priv;
1234
1235		if (!send_buf->mad_agent->send_handler ||
1236		    (send_buf->timeout_ms &&
1237		     !send_buf->mad_agent->recv_handler)) {
1238			ret = -EINVAL;
1239			goto error;
1240		}
1241
1242		if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
1243			if (mad_agent_priv->agent.rmpp_version) {
1244				ret = -EINVAL;
1245				goto error;
1246			}
1247		}
1248
1249		/*
1250		 * Save pointer to next work request to post in case the
1251		 * current one completes, and the user modifies the work
1252		 * request associated with the completion
1253		 */
1254		next_send_buf = send_buf->next;
1255		mad_send_wr->send_wr.ah = send_buf->ah;
1256
1257		if (((struct ib_mad_hdr *) send_buf->mad)->mgmt_class ==
1258		    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1259			ret = handle_outgoing_dr_smp(mad_agent_priv,
1260						     mad_send_wr);
1261			if (ret < 0)		/* error */
1262				goto error;
1263			else if (ret == 1)	/* locally consumed */
1264				continue;
1265		}
1266
1267		mad_send_wr->tid = ((struct ib_mad_hdr *) send_buf->mad)->tid;
1268		/* Timeout will be updated after send completes */
1269		mad_send_wr->timeout = msecs_to_jiffies(send_buf->timeout_ms);
1270		mad_send_wr->max_retries = send_buf->retries;
1271		mad_send_wr->retries_left = send_buf->retries;
1272		send_buf->retries = 0;
1273		/* Reference for work request to QP + response */
1274		mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
1275		mad_send_wr->status = IB_WC_SUCCESS;
1276
1277		/* Reference MAD agent until send completes */
1278		atomic_inc(&mad_agent_priv->refcount);
1279		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1280		list_add_tail(&mad_send_wr->agent_list,
1281			      &mad_agent_priv->send_list);
1282		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1283
1284		if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1285			ret = ib_send_rmpp_mad(mad_send_wr);
1286			if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
1287				ret = ib_send_mad(mad_send_wr);
1288		} else
1289			ret = ib_send_mad(mad_send_wr);
1290		if (ret < 0) {
1291			/* Fail send request */
1292			spin_lock_irqsave(&mad_agent_priv->lock, flags);
1293			list_del(&mad_send_wr->agent_list);
1294			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1295			atomic_dec(&mad_agent_priv->refcount);
1296			goto error;
1297		}
1298	}
1299	return 0;
1300error:
1301	if (bad_send_buf)
1302		*bad_send_buf = send_buf;
1303	return ret;
1304}
1305EXPORT_SYMBOL(ib_post_send_mad);
1306
1307/*
1308 * ib_free_recv_mad - Returns data buffers used to receive
1309 *  a MAD to the access layer
1310 */
1311void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
1312{
1313	struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
1314	struct ib_mad_private_header *mad_priv_hdr;
1315	struct ib_mad_private *priv;
1316	struct list_head free_list;
1317
1318	INIT_LIST_HEAD(&free_list);
1319	list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
1320
1321	list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
1322					&free_list, list) {
1323		mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
1324					   recv_buf);
1325		mad_priv_hdr = container_of(mad_recv_wc,
1326					    struct ib_mad_private_header,
1327					    recv_wc);
1328		priv = container_of(mad_priv_hdr, struct ib_mad_private,
1329				    header);
1330		kfree(priv);
1331	}
1332}
1333EXPORT_SYMBOL(ib_free_recv_mad);
1334
1335struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
1336					u8 rmpp_version,
1337					ib_mad_send_handler send_handler,
1338					ib_mad_recv_handler recv_handler,
1339					void *context)
1340{
1341	return ERR_PTR(-EINVAL);	/* XXX: for now */
1342}
1343EXPORT_SYMBOL(ib_redirect_mad_qp);
1344
1345int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
1346		      struct ib_wc *wc)
1347{
1348	dev_err(&mad_agent->device->dev,
1349		"ib_process_mad_wc() not implemented yet\n");
1350	return 0;
1351}
1352EXPORT_SYMBOL(ib_process_mad_wc);
1353
1354static int method_in_use(struct ib_mad_mgmt_method_table **method,
1355			 struct ib_mad_reg_req *mad_reg_req)
1356{
1357	int i;
1358
1359	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS) {
1360		if ((*method)->agent[i]) {
1361			pr_err("Method %d already in use\n", i);
1362			return -EINVAL;
1363		}
1364	}
1365	return 0;
1366}
1367
1368static int allocate_method_table(struct ib_mad_mgmt_method_table **method)
1369{
1370	/* Allocate management method table */
1371	*method = kzalloc(sizeof **method, GFP_ATOMIC);
1372	if (!*method) {
1373		pr_err("No memory for ib_mad_mgmt_method_table\n");
1374		return -ENOMEM;
1375	}
1376
1377	return 0;
1378}
1379
1380/*
1381 * Check to see if there are any methods still in use
1382 */
1383static int check_method_table(struct ib_mad_mgmt_method_table *method)
1384{
1385	int i;
1386
1387	for (i = 0; i < IB_MGMT_MAX_METHODS; i++)
1388		if (method->agent[i])
1389			return 1;
1390	return 0;
1391}
1392
1393/*
1394 * Check to see if there are any method tables for this class still in use
1395 */
1396static int check_class_table(struct ib_mad_mgmt_class_table *class)
1397{
1398	int i;
1399
1400	for (i = 0; i < MAX_MGMT_CLASS; i++)
1401		if (class->method_table[i])
1402			return 1;
1403	return 0;
1404}
1405
1406static int check_vendor_class(struct ib_mad_mgmt_vendor_class *vendor_class)
1407{
1408	int i;
1409
1410	for (i = 0; i < MAX_MGMT_OUI; i++)
1411		if (vendor_class->method_table[i])
1412			return 1;
1413	return 0;
1414}
1415
1416static int find_vendor_oui(struct ib_mad_mgmt_vendor_class *vendor_class,
1417			   const char *oui)
1418{
1419	int i;
1420
1421	for (i = 0; i < MAX_MGMT_OUI; i++)
1422		/* Is there matching OUI for this vendor class ? */
1423		if (!memcmp(vendor_class->oui[i], oui, 3))
1424			return i;
1425
1426	return -1;
1427}
1428
1429static int check_vendor_table(struct ib_mad_mgmt_vendor_class_table *vendor)
1430{
1431	int i;
1432
1433	for (i = 0; i < MAX_MGMT_VENDOR_RANGE2; i++)
1434		if (vendor->vendor_class[i])
1435			return 1;
1436
1437	return 0;
1438}
1439
1440static void remove_methods_mad_agent(struct ib_mad_mgmt_method_table *method,
1441				     struct ib_mad_agent_private *agent)
1442{
1443	int i;
1444
1445	/* Remove any methods for this mad agent */
1446	for (i = 0; i < IB_MGMT_MAX_METHODS; i++) {
1447		if (method->agent[i] == agent) {
1448			method->agent[i] = NULL;
1449		}
1450	}
1451}
1452
1453static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1454			      struct ib_mad_agent_private *agent_priv,
1455			      u8 mgmt_class)
1456{
1457	struct ib_mad_port_private *port_priv;
1458	struct ib_mad_mgmt_class_table **class;
1459	struct ib_mad_mgmt_method_table **method;
1460	int i, ret;
1461
1462	port_priv = agent_priv->qp_info->port_priv;
1463	class = &port_priv->version[mad_reg_req->mgmt_class_version].class;
1464	if (!*class) {
1465		/* Allocate management class table for "new" class version */
1466		*class = kzalloc(sizeof **class, GFP_ATOMIC);
1467		if (!*class) {
1468			dev_err(&agent_priv->agent.device->dev,
1469				"No memory for ib_mad_mgmt_class_table\n");
1470			ret = -ENOMEM;
1471			goto error1;
1472		}
1473
1474		/* Allocate method table for this management class */
1475		method = &(*class)->method_table[mgmt_class];
1476		if ((ret = allocate_method_table(method)))
1477			goto error2;
1478	} else {
1479		method = &(*class)->method_table[mgmt_class];
1480		if (!*method) {
1481			/* Allocate method table for this management class */
1482			if ((ret = allocate_method_table(method)))
1483				goto error1;
1484		}
1485	}
1486
1487	/* Now, make sure methods are not already in use */
1488	if (method_in_use(method, mad_reg_req))
1489		goto error3;
1490
1491	/* Finally, add in methods being registered */
1492	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1493		(*method)->agent[i] = agent_priv;
1494
1495	return 0;
1496
1497error3:
1498	/* Remove any methods for this mad agent */
1499	remove_methods_mad_agent(*method, agent_priv);
1500	/* Now, check to see if there are any methods in use */
1501	if (!check_method_table(*method)) {
1502		/* If not, release management method table */
1503		kfree(*method);
1504		*method = NULL;
1505	}
1506	ret = -EINVAL;
1507	goto error1;
1508error2:
1509	kfree(*class);
1510	*class = NULL;
1511error1:
1512	return ret;
1513}
1514
1515static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1516			   struct ib_mad_agent_private *agent_priv)
1517{
1518	struct ib_mad_port_private *port_priv;
1519	struct ib_mad_mgmt_vendor_class_table **vendor_table;
1520	struct ib_mad_mgmt_vendor_class_table *vendor = NULL;
1521	struct ib_mad_mgmt_vendor_class *vendor_class = NULL;
1522	struct ib_mad_mgmt_method_table **method;
1523	int i, ret = -ENOMEM;
1524	u8 vclass;
1525
1526	/* "New" vendor (with OUI) class */
1527	vclass = vendor_class_index(mad_reg_req->mgmt_class);
1528	port_priv = agent_priv->qp_info->port_priv;
1529	vendor_table = &port_priv->version[
1530				mad_reg_req->mgmt_class_version].vendor;
1531	if (!*vendor_table) {
1532		/* Allocate mgmt vendor class table for "new" class version */
1533		vendor = kzalloc(sizeof *vendor, GFP_ATOMIC);
1534		if (!vendor) {
1535			dev_err(&agent_priv->agent.device->dev,
1536				"No memory for ib_mad_mgmt_vendor_class_table\n");
1537			goto error1;
1538		}
1539
1540		*vendor_table = vendor;
1541	}
1542	if (!(*vendor_table)->vendor_class[vclass]) {
1543		/* Allocate table for this management vendor class */
1544		vendor_class = kzalloc(sizeof *vendor_class, GFP_ATOMIC);
1545		if (!vendor_class) {
1546			dev_err(&agent_priv->agent.device->dev,
1547				"No memory for ib_mad_mgmt_vendor_class\n");
1548			goto error2;
1549		}
1550
1551		(*vendor_table)->vendor_class[vclass] = vendor_class;
1552	}
1553	for (i = 0; i < MAX_MGMT_OUI; i++) {
1554		/* Is there matching OUI for this vendor class ? */
1555		if (!memcmp((*vendor_table)->vendor_class[vclass]->oui[i],
1556			    mad_reg_req->oui, 3)) {
1557			method = &(*vendor_table)->vendor_class[
1558						vclass]->method_table[i];
1559			BUG_ON(!*method);
1560			goto check_in_use;
1561		}
1562	}
1563	for (i = 0; i < MAX_MGMT_OUI; i++) {
1564		/* OUI slot available ? */
1565		if (!is_vendor_oui((*vendor_table)->vendor_class[
1566				vclass]->oui[i])) {
1567			method = &(*vendor_table)->vendor_class[
1568				vclass]->method_table[i];
1569			BUG_ON(*method);
1570			/* Allocate method table for this OUI */
1571			if ((ret = allocate_method_table(method)))
1572				goto error3;
1573			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
1574			       mad_reg_req->oui, 3);
1575			goto check_in_use;
1576		}
1577	}
1578	dev_err(&agent_priv->agent.device->dev, "All OUI slots in use\n");
1579	goto error3;
1580
1581check_in_use:
1582	/* Now, make sure methods are not already in use */
1583	if (method_in_use(method, mad_reg_req))
1584		goto error4;
1585
1586	/* Finally, add in methods being registered */
1587	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1588		(*method)->agent[i] = agent_priv;
1589
1590	return 0;
1591
1592error4:
1593	/* Remove any methods for this mad agent */
1594	remove_methods_mad_agent(*method, agent_priv);
1595	/* Now, check to see if there are any methods in use */
1596	if (!check_method_table(*method)) {
1597		/* If not, release management method table */
1598		kfree(*method);
1599		*method = NULL;
1600	}
1601	ret = -EINVAL;
1602error3:
1603	if (vendor_class) {
1604		(*vendor_table)->vendor_class[vclass] = NULL;
1605		kfree(vendor_class);
1606	}
1607error2:
1608	if (vendor) {
1609		*vendor_table = NULL;
1610		kfree(vendor);
1611	}
1612error1:
1613	return ret;
1614}
1615
1616static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
1617{
1618	struct ib_mad_port_private *port_priv;
1619	struct ib_mad_mgmt_class_table *class;
1620	struct ib_mad_mgmt_method_table *method;
1621	struct ib_mad_mgmt_vendor_class_table *vendor;
1622	struct ib_mad_mgmt_vendor_class *vendor_class;
1623	int index;
1624	u8 mgmt_class;
1625
1626	/*
1627	 * Was MAD registration request supplied
1628	 * with original registration ?
1629	 */
1630	if (!agent_priv->reg_req) {
1631		goto out;
1632	}
1633
1634	port_priv = agent_priv->qp_info->port_priv;
1635	mgmt_class = convert_mgmt_class(agent_priv->reg_req->mgmt_class);
1636	class = port_priv->version[
1637			agent_priv->reg_req->mgmt_class_version].class;
1638	if (!class)
1639		goto vendor_check;
1640
1641	method = class->method_table[mgmt_class];
1642	if (method) {
1643		/* Remove any methods for this mad agent */
1644		remove_methods_mad_agent(method, agent_priv);
1645		/* Now, check to see if there are any methods still in use */
1646		if (!check_method_table(method)) {
1647			/* If not, release management method table */
1648			kfree(method);
1649			class->method_table[mgmt_class] = NULL;
1650			/* Any management classes left ? */
1651			if (!check_class_table(class)) {
1652				/* If not, release management class table */
1653				kfree(class);
1654				port_priv->version[
1655					agent_priv->reg_req->
1656					mgmt_class_version].class = NULL;
1657			}
1658		}
1659	}
1660
1661vendor_check:
1662	if (!is_vendor_class(mgmt_class))
1663		goto out;
1664
1665	/* normalize mgmt_class to vendor range 2 */
1666	mgmt_class = vendor_class_index(agent_priv->reg_req->mgmt_class);
1667	vendor = port_priv->version[
1668			agent_priv->reg_req->mgmt_class_version].vendor;
1669
1670	if (!vendor)
1671		goto out;
1672
1673	vendor_class = vendor->vendor_class[mgmt_class];
1674	if (vendor_class) {
1675		index = find_vendor_oui(vendor_class, agent_priv->reg_req->oui);
1676		if (index < 0)
1677			goto out;
1678		method = vendor_class->method_table[index];
1679		if (method) {
1680			/* Remove any methods for this mad agent */
1681			remove_methods_mad_agent(method, agent_priv);
1682			/*
1683			 * Now, check to see if there are
1684			 * any methods still in use
1685			 */
1686			if (!check_method_table(method)) {
1687				/* If not, release management method table */
1688				kfree(method);
1689				vendor_class->method_table[index] = NULL;
1690				memset(vendor_class->oui[index], 0, 3);
1691				/* Any OUIs left ? */
1692				if (!check_vendor_class(vendor_class)) {
1693					/* If not, release vendor class table */
1694					kfree(vendor_class);
1695					vendor->vendor_class[mgmt_class] = NULL;
1696					/* Any other vendor classes left ? */
1697					if (!check_vendor_table(vendor)) {
1698						kfree(vendor);
1699						port_priv->version[
1700							agent_priv->reg_req->
1701							mgmt_class_version].
1702							vendor = NULL;
1703					}
1704				}
1705			}
1706		}
1707	}
1708
1709out:
1710	return;
1711}
1712
1713static struct ib_mad_agent_private *
1714find_mad_agent(struct ib_mad_port_private *port_priv,
1715	       const struct ib_mad_hdr *mad_hdr)
1716{
1717	struct ib_mad_agent_private *mad_agent = NULL;
1718	unsigned long flags;
1719
1720	spin_lock_irqsave(&port_priv->reg_lock, flags);
1721	if (ib_response_mad(mad_hdr)) {
1722		u32 hi_tid;
1723		struct ib_mad_agent_private *entry;
1724
1725		/*
1726		 * Routing is based on high 32 bits of transaction ID
1727		 * of MAD.
1728		 */
1729		hi_tid = be64_to_cpu(mad_hdr->tid) >> 32;
1730		list_for_each_entry(entry, &port_priv->agent_list, agent_list) {
1731			if (entry->agent.hi_tid == hi_tid) {
1732				mad_agent = entry;
1733				break;
1734			}
1735		}
1736	} else {
1737		struct ib_mad_mgmt_class_table *class;
1738		struct ib_mad_mgmt_method_table *method;
1739		struct ib_mad_mgmt_vendor_class_table *vendor;
1740		struct ib_mad_mgmt_vendor_class *vendor_class;
1741		const struct ib_vendor_mad *vendor_mad;
1742		int index;
1743
1744		/*
1745		 * Routing is based on version, class, and method
1746		 * For "newer" vendor MADs, also based on OUI
1747		 */
1748		if (mad_hdr->class_version >= MAX_MGMT_VERSION)
1749			goto out;
1750		if (!is_vendor_class(mad_hdr->mgmt_class)) {
1751			class = port_priv->version[
1752					mad_hdr->class_version].class;
1753			if (!class)
1754				goto out;
1755			if (convert_mgmt_class(mad_hdr->mgmt_class) >=
1756			    ARRAY_SIZE(class->method_table))
1757				goto out;
1758			method = class->method_table[convert_mgmt_class(
1759							mad_hdr->mgmt_class)];
1760			if (method)
1761				mad_agent = method->agent[mad_hdr->method &
1762							  ~IB_MGMT_METHOD_RESP];
1763		} else {
1764			vendor = port_priv->version[
1765					mad_hdr->class_version].vendor;
1766			if (!vendor)
1767				goto out;
1768			vendor_class = vendor->vendor_class[vendor_class_index(
1769						mad_hdr->mgmt_class)];
1770			if (!vendor_class)
1771				goto out;
1772			/* Find matching OUI */
1773			vendor_mad = (const struct ib_vendor_mad *)mad_hdr;
1774			index = find_vendor_oui(vendor_class, vendor_mad->oui);
1775			if (index == -1)
1776				goto out;
1777			method = vendor_class->method_table[index];
1778			if (method) {
1779				mad_agent = method->agent[mad_hdr->method &
1780							  ~IB_MGMT_METHOD_RESP];
1781			}
1782		}
1783	}
1784
1785	if (mad_agent) {
1786		if (mad_agent->agent.recv_handler)
1787			atomic_inc(&mad_agent->refcount);
1788		else {
1789			dev_notice(&port_priv->device->dev,
1790				   "No receive handler for client %p on port %d\n",
1791				   &mad_agent->agent, port_priv->port_num);
1792			mad_agent = NULL;
1793		}
1794	}
1795out:
1796	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
1797
1798	return mad_agent;
1799}
1800
1801static int validate_mad(const struct ib_mad_hdr *mad_hdr,
1802			const struct ib_mad_qp_info *qp_info,
1803			bool opa)
1804{
1805	int valid = 0;
1806	u32 qp_num = qp_info->qp->qp_num;
1807
1808	/* Make sure MAD base version is understood */
1809	if (mad_hdr->base_version != IB_MGMT_BASE_VERSION &&
1810	    (!opa || mad_hdr->base_version != OPA_MGMT_BASE_VERSION)) {
1811		pr_err("MAD received with unsupported base version %d %s\n",
1812		       mad_hdr->base_version, opa ? "(opa)" : "");
1813		goto out;
1814	}
1815
1816	/* Filter SMI packets sent to other than QP0 */
1817	if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
1818	    (mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
1819		if (qp_num == 0)
1820			valid = 1;
1821	} else {
1822		/* CM attributes other than ClassPortInfo only use Send method */
1823		if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
1824		    (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
1825		    (mad_hdr->method != IB_MGMT_METHOD_SEND))
1826			goto out;
1827		/* Filter GSI packets sent to QP0 */
1828		if (qp_num != 0)
1829			valid = 1;
1830	}
1831
1832out:
1833	return valid;
1834}
1835
1836static int is_rmpp_data_mad(const struct ib_mad_agent_private *mad_agent_priv,
1837			    const struct ib_mad_hdr *mad_hdr)
1838{
1839	const struct ib_rmpp_mad *rmpp_mad;
1840
1841	rmpp_mad = (const struct ib_rmpp_mad *)mad_hdr;
1842	return !mad_agent_priv->agent.rmpp_version ||
1843		!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent) ||
1844		!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
1845				    IB_MGMT_RMPP_FLAG_ACTIVE) ||
1846		(rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
1847}
1848
1849static inline int rcv_has_same_class(const struct ib_mad_send_wr_private *wr,
1850				     const struct ib_mad_recv_wc *rwc)
1851{
1852	return ((struct ib_mad_hdr *)(wr->send_buf.mad))->mgmt_class ==
1853		rwc->recv_buf.mad->mad_hdr.mgmt_class;
1854}
1855
1856static inline int rcv_has_same_gid(const struct ib_mad_agent_private *mad_agent_priv,
1857				   const struct ib_mad_send_wr_private *wr,
1858				   const struct ib_mad_recv_wc *rwc )
1859{
1860	struct ib_ah_attr attr;
1861	u8 send_resp, rcv_resp;
1862	union ib_gid sgid;
1863	struct ib_device *device = mad_agent_priv->agent.device;
1864	u8 port_num = mad_agent_priv->agent.port_num;
1865	u8 lmc;
1866
1867	send_resp = ib_response_mad((struct ib_mad_hdr *)wr->send_buf.mad);
1868	rcv_resp = ib_response_mad(&rwc->recv_buf.mad->mad_hdr);
1869
1870	if (send_resp == rcv_resp)
1871		/* both requests, or both responses. GIDs different */
1872		return 0;
1873
1874	if (ib_query_ah(wr->send_buf.ah, &attr))
1875		/* Assume not equal, to avoid false positives. */
1876		return 0;
1877
1878	if (!!(attr.ah_flags & IB_AH_GRH) !=
1879	    !!(rwc->wc->wc_flags & IB_WC_GRH))
1880		/* one has GID, other does not.  Assume different */
1881		return 0;
1882
1883	if (!send_resp && rcv_resp) {
1884		/* is request/response. */
1885		if (!(attr.ah_flags & IB_AH_GRH)) {
1886			if (ib_get_cached_lmc(device, port_num, &lmc))
1887				return 0;
1888			return (!lmc || !((attr.src_path_bits ^
1889					   rwc->wc->dlid_path_bits) &
1890					  ((1 << lmc) - 1)));
1891		} else {
1892			if (ib_get_cached_gid(device, port_num,
1893					      attr.grh.sgid_index, &sgid, NULL))
1894				return 0;
1895			return !memcmp(sgid.raw, rwc->recv_buf.grh->dgid.raw,
1896				       16);
1897		}
1898	}
1899
1900	if (!(attr.ah_flags & IB_AH_GRH))
1901		return attr.dlid == rwc->wc->slid;
1902	else
1903		return !memcmp(attr.grh.dgid.raw, rwc->recv_buf.grh->sgid.raw,
1904			       16);
1905}
1906
1907static inline int is_direct(u8 class)
1908{
1909	return (class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE);
1910}
1911
1912struct ib_mad_send_wr_private*
1913ib_find_send_mad(const struct ib_mad_agent_private *mad_agent_priv,
1914		 const struct ib_mad_recv_wc *wc)
1915{
1916	struct ib_mad_send_wr_private *wr;
1917	const struct ib_mad_hdr *mad_hdr;
1918
1919	mad_hdr = &wc->recv_buf.mad->mad_hdr;
1920
1921	list_for_each_entry(wr, &mad_agent_priv->wait_list, agent_list) {
1922		if ((wr->tid == mad_hdr->tid) &&
1923		    rcv_has_same_class(wr, wc) &&
1924		    /*
1925		     * Don't check GID for direct routed MADs.
1926		     * These might have permissive LIDs.
1927		     */
1928		    (is_direct(mad_hdr->mgmt_class) ||
1929		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1930			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1931	}
1932
1933	/*
1934	 * It's possible to receive the response before we've
1935	 * been notified that the send has completed
1936	 */
1937	list_for_each_entry(wr, &mad_agent_priv->send_list, agent_list) {
1938		if (is_rmpp_data_mad(mad_agent_priv, wr->send_buf.mad) &&
1939		    wr->tid == mad_hdr->tid &&
1940		    wr->timeout &&
1941		    rcv_has_same_class(wr, wc) &&
1942		    /*
1943		     * Don't check GID for direct routed MADs.
1944		     * These might have permissive LIDs.
1945		     */
1946		    (is_direct(mad_hdr->mgmt_class) ||
1947		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1948			/* Verify request has not been canceled */
1949			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1950	}
1951	return NULL;
1952}
1953
1954void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
1955{
1956	mad_send_wr->timeout = 0;
1957	if (mad_send_wr->refcount == 1)
1958		list_move_tail(&mad_send_wr->agent_list,
1959			      &mad_send_wr->mad_agent_priv->done_list);
1960}
1961
1962static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
1963				 struct ib_mad_recv_wc *mad_recv_wc)
1964{
1965	struct ib_mad_send_wr_private *mad_send_wr;
1966	struct ib_mad_send_wc mad_send_wc;
1967	unsigned long flags;
1968
1969	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
1970	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
1971	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1972		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
1973						      mad_recv_wc);
1974		if (!mad_recv_wc) {
1975			deref_mad_agent(mad_agent_priv);
1976			return;
1977		}
1978	}
1979
1980	/* Complete corresponding request */
1981	if (ib_response_mad(&mad_recv_wc->recv_buf.mad->mad_hdr)) {
1982		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1983		mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
1984		if (!mad_send_wr) {
1985			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1986			if (!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)
1987			   && ib_is_mad_class_rmpp(mad_recv_wc->recv_buf.mad->mad_hdr.mgmt_class)
1988			   && (ib_get_rmpp_flags(&((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr)
1989					& IB_MGMT_RMPP_FLAG_ACTIVE)) {
1990				/* user rmpp is in effect
1991				 * and this is an active RMPP MAD
1992				 */
1993				mad_agent_priv->agent.recv_handler(
1994						&mad_agent_priv->agent, NULL,
1995						mad_recv_wc);
1996				atomic_dec(&mad_agent_priv->refcount);
1997			} else {
1998				/* not user rmpp, revert to normal behavior and
1999				 * drop the mad */
2000				ib_free_recv_mad(mad_recv_wc);
2001				deref_mad_agent(mad_agent_priv);
2002				return;
2003			}
2004		} else {
2005			ib_mark_mad_done(mad_send_wr);
2006			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2007
2008			/* Defined behavior is to complete response before request */
2009			mad_agent_priv->agent.recv_handler(
2010					&mad_agent_priv->agent,
2011					&mad_send_wr->send_buf,
2012					mad_recv_wc);
2013			atomic_dec(&mad_agent_priv->refcount);
2014
2015			mad_send_wc.status = IB_WC_SUCCESS;
2016			mad_send_wc.vendor_err = 0;
2017			mad_send_wc.send_buf = &mad_send_wr->send_buf;
2018			ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2019		}
2020	} else {
2021		mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent, NULL,
2022						   mad_recv_wc);
2023		deref_mad_agent(mad_agent_priv);
2024	}
2025}
2026
2027static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv,
2028				     const struct ib_mad_qp_info *qp_info,
2029				     const struct ib_wc *wc,
2030				     int port_num,
2031				     struct ib_mad_private *recv,
2032				     struct ib_mad_private *response)
2033{
2034	enum smi_forward_action retsmi;
2035	struct ib_smp *smp = (struct ib_smp *)recv->mad;
2036
2037	if (smi_handle_dr_smp_recv(smp,
2038				   rdma_cap_ib_switch(port_priv->device),
2039				   port_num,
2040				   port_priv->device->phys_port_cnt) ==
2041				   IB_SMI_DISCARD)
2042		return IB_SMI_DISCARD;
2043
2044	retsmi = smi_check_forward_dr_smp(smp);
2045	if (retsmi == IB_SMI_LOCAL)
2046		return IB_SMI_HANDLE;
2047
2048	if (retsmi == IB_SMI_SEND) { /* don't forward */
2049		if (smi_handle_dr_smp_send(smp,
2050					   rdma_cap_ib_switch(port_priv->device),
2051					   port_num) == IB_SMI_DISCARD)
2052			return IB_SMI_DISCARD;
2053
2054		if (smi_check_local_smp(smp, port_priv->device) == IB_SMI_DISCARD)
2055			return IB_SMI_DISCARD;
2056	} else if (rdma_cap_ib_switch(port_priv->device)) {
2057		/* forward case for switches */
2058		memcpy(response, recv, mad_priv_size(response));
2059		response->header.recv_wc.wc = &response->header.wc;
2060		response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2061		response->header.recv_wc.recv_buf.grh = &response->grh;
2062
2063		agent_send_response((const struct ib_mad_hdr *)response->mad,
2064				    &response->grh, wc,
2065				    port_priv->device,
2066				    smi_get_fwd_port(smp),
2067				    qp_info->qp->qp_num,
2068				    response->mad_size,
2069				    false);
2070
2071		return IB_SMI_DISCARD;
2072	}
2073	return IB_SMI_HANDLE;
2074}
2075
2076static bool generate_unmatched_resp(const struct ib_mad_private *recv,
2077				    struct ib_mad_private *response,
2078				    size_t *resp_len, bool opa)
2079{
2080	const struct ib_mad_hdr *recv_hdr = (const struct ib_mad_hdr *)recv->mad;
2081	struct ib_mad_hdr *resp_hdr = (struct ib_mad_hdr *)response->mad;
2082
2083	if (recv_hdr->method == IB_MGMT_METHOD_GET ||
2084	    recv_hdr->method == IB_MGMT_METHOD_SET) {
2085		memcpy(response, recv, mad_priv_size(response));
2086		response->header.recv_wc.wc = &response->header.wc;
2087		response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2088		response->header.recv_wc.recv_buf.grh = &response->grh;
2089		resp_hdr->method = IB_MGMT_METHOD_GET_RESP;
2090		resp_hdr->status = cpu_to_be16(IB_MGMT_MAD_STATUS_UNSUPPORTED_METHOD_ATTRIB);
2091		if (recv_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2092			resp_hdr->status |= IB_SMP_DIRECTION;
2093
2094		if (opa && recv_hdr->base_version == OPA_MGMT_BASE_VERSION) {
2095			if (recv_hdr->mgmt_class ==
2096			    IB_MGMT_CLASS_SUBN_LID_ROUTED ||
2097			    recv_hdr->mgmt_class ==
2098			    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2099				*resp_len = opa_get_smp_header_size(
2100							(const struct opa_smp *)recv->mad);
2101			else
2102				*resp_len = sizeof(struct ib_mad_hdr);
2103		}
2104
2105		return true;
2106	} else {
2107		return false;
2108	}
2109}
2110
2111static enum smi_action
2112handle_opa_smi(struct ib_mad_port_private *port_priv,
2113	       struct ib_mad_qp_info *qp_info,
2114	       struct ib_wc *wc,
2115	       int port_num,
2116	       struct ib_mad_private *recv,
2117	       struct ib_mad_private *response)
2118{
2119	enum smi_forward_action retsmi;
2120	struct opa_smp *smp = (struct opa_smp *)recv->mad;
2121
2122	if (opa_smi_handle_dr_smp_recv(smp,
2123				   rdma_cap_ib_switch(port_priv->device),
2124				   port_num,
2125				   port_priv->device->phys_port_cnt) ==
2126				   IB_SMI_DISCARD)
2127		return IB_SMI_DISCARD;
2128
2129	retsmi = opa_smi_check_forward_dr_smp(smp);
2130	if (retsmi == IB_SMI_LOCAL)
2131		return IB_SMI_HANDLE;
2132
2133	if (retsmi == IB_SMI_SEND) { /* don't forward */
2134		if (opa_smi_handle_dr_smp_send(smp,
2135					   rdma_cap_ib_switch(port_priv->device),
2136					   port_num) == IB_SMI_DISCARD)
2137			return IB_SMI_DISCARD;
2138
2139		if (opa_smi_check_local_smp(smp, port_priv->device) ==
2140		    IB_SMI_DISCARD)
2141			return IB_SMI_DISCARD;
2142
2143	} else if (rdma_cap_ib_switch(port_priv->device)) {
2144		/* forward case for switches */
2145		memcpy(response, recv, mad_priv_size(response));
2146		response->header.recv_wc.wc = &response->header.wc;
2147		response->header.recv_wc.recv_buf.opa_mad =
2148				(struct opa_mad *)response->mad;
2149		response->header.recv_wc.recv_buf.grh = &response->grh;
2150
2151		agent_send_response((const struct ib_mad_hdr *)response->mad,
2152				    &response->grh, wc,
2153				    port_priv->device,
2154				    opa_smi_get_fwd_port(smp),
2155				    qp_info->qp->qp_num,
2156				    recv->header.wc.byte_len,
2157				    true);
2158
2159		return IB_SMI_DISCARD;
2160	}
2161
2162	return IB_SMI_HANDLE;
2163}
2164
2165static enum smi_action
2166handle_smi(struct ib_mad_port_private *port_priv,
2167	   struct ib_mad_qp_info *qp_info,
2168	   struct ib_wc *wc,
2169	   int port_num,
2170	   struct ib_mad_private *recv,
2171	   struct ib_mad_private *response,
2172	   bool opa)
2173{
2174	struct ib_mad_hdr *mad_hdr = (struct ib_mad_hdr *)recv->mad;
2175
2176	if (opa && mad_hdr->base_version == OPA_MGMT_BASE_VERSION &&
2177	    mad_hdr->class_version == OPA_SMI_CLASS_VERSION)
2178		return handle_opa_smi(port_priv, qp_info, wc, port_num, recv,
2179				      response);
2180
2181	return handle_ib_smi(port_priv, qp_info, wc, port_num, recv, response);
2182}
2183
2184static void ib_mad_recv_done(struct ib_cq *cq, struct ib_wc *wc)
2185{
2186	struct ib_mad_port_private *port_priv = cq->cq_context;
2187	struct ib_mad_list_head *mad_list =
2188		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2189	struct ib_mad_qp_info *qp_info;
2190	struct ib_mad_private_header *mad_priv_hdr;
2191	struct ib_mad_private *recv, *response = NULL;
2192	struct ib_mad_agent_private *mad_agent;
2193	int port_num;
2194	int ret = IB_MAD_RESULT_SUCCESS;
2195	size_t mad_size;
2196	u16 resp_mad_pkey_index = 0;
2197	bool opa;
2198
2199	if (list_empty_careful(&port_priv->port_list))
2200		return;
2201
2202	if (wc->status != IB_WC_SUCCESS) {
2203		/*
2204		 * Receive errors indicate that the QP has entered the error
2205		 * state - error handling/shutdown code will cleanup
2206		 */
2207		return;
2208	}
2209
2210	qp_info = mad_list->mad_queue->qp_info;
2211	dequeue_mad(mad_list);
2212
2213	opa = rdma_cap_opa_mad(qp_info->port_priv->device,
2214			       qp_info->port_priv->port_num);
2215
2216	mad_priv_hdr = container_of(mad_list, struct ib_mad_private_header,
2217				    mad_list);
2218	recv = container_of(mad_priv_hdr, struct ib_mad_private, header);
2219	ib_dma_unmap_single(port_priv->device,
2220			    recv->header.mapping,
2221			    mad_priv_dma_size(recv),
2222			    DMA_FROM_DEVICE);
2223
2224	/* Setup MAD receive work completion from "normal" work completion */
2225	recv->header.wc = *wc;
2226	recv->header.recv_wc.wc = &recv->header.wc;
2227
2228	if (opa && ((struct ib_mad_hdr *)(recv->mad))->base_version == OPA_MGMT_BASE_VERSION) {
2229		recv->header.recv_wc.mad_len = wc->byte_len - sizeof(struct ib_grh);
2230		recv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2231	} else {
2232		recv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2233		recv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2234	}
2235
2236	recv->header.recv_wc.recv_buf.mad = (struct ib_mad *)recv->mad;
2237	recv->header.recv_wc.recv_buf.grh = &recv->grh;
2238
2239	if (atomic_read(&qp_info->snoop_count))
2240		snoop_recv(qp_info, &recv->header.recv_wc, IB_MAD_SNOOP_RECVS);
2241
2242	/* Validate MAD */
2243	if (!validate_mad((const struct ib_mad_hdr *)recv->mad, qp_info, opa))
2244		goto out;
2245
2246	mad_size = recv->mad_size;
2247	response = alloc_mad_private(mad_size, GFP_KERNEL);
2248	if (!response) {
2249		dev_err(&port_priv->device->dev,
2250			"%s: no memory for response buffer\n", __func__);
2251		goto out;
2252	}
2253
2254	if (rdma_cap_ib_switch(port_priv->device))
2255		port_num = wc->port_num;
2256	else
2257		port_num = port_priv->port_num;
2258
2259	if (((struct ib_mad_hdr *)recv->mad)->mgmt_class ==
2260	    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
2261		if (handle_smi(port_priv, qp_info, wc, port_num, recv,
2262			       response, opa)
2263		    == IB_SMI_DISCARD)
2264			goto out;
2265	}
2266
2267	/* Give driver "right of first refusal" on incoming MAD */
2268	if (port_priv->device->process_mad) {
2269		ret = port_priv->device->process_mad(port_priv->device, 0,
2270						     port_priv->port_num,
2271						     wc, &recv->grh,
2272						     (const struct ib_mad_hdr *)recv->mad,
2273						     recv->mad_size,
2274						     (struct ib_mad_hdr *)response->mad,
2275						     &mad_size, &resp_mad_pkey_index);
2276
2277		if (opa)
2278			wc->pkey_index = resp_mad_pkey_index;
2279
2280		if (ret & IB_MAD_RESULT_SUCCESS) {
2281			if (ret & IB_MAD_RESULT_CONSUMED)
2282				goto out;
2283			if (ret & IB_MAD_RESULT_REPLY) {
2284				agent_send_response((const struct ib_mad_hdr *)response->mad,
2285						    &recv->grh, wc,
2286						    port_priv->device,
2287						    port_num,
2288						    qp_info->qp->qp_num,
2289						    mad_size, opa);
2290				goto out;
2291			}
2292		}
2293	}
2294
2295	mad_agent = find_mad_agent(port_priv, (const struct ib_mad_hdr *)recv->mad);
2296	if (mad_agent) {
2297		ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
2298		/*
2299		 * recv is freed up in error cases in ib_mad_complete_recv
2300		 * or via recv_handler in ib_mad_complete_recv()
2301		 */
2302		recv = NULL;
2303	} else if ((ret & IB_MAD_RESULT_SUCCESS) &&
2304		   generate_unmatched_resp(recv, response, &mad_size, opa)) {
2305		agent_send_response((const struct ib_mad_hdr *)response->mad, &recv->grh, wc,
2306				    port_priv->device, port_num,
2307				    qp_info->qp->qp_num, mad_size, opa);
2308	}
2309
2310out:
2311	/* Post another receive request for this QP */
2312	if (response) {
2313		ib_mad_post_receive_mads(qp_info, response);
2314		kfree(recv);
2315	} else
2316		ib_mad_post_receive_mads(qp_info, recv);
2317}
2318
2319static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
2320{
2321	struct ib_mad_send_wr_private *mad_send_wr;
2322	unsigned long delay;
2323
2324	if (list_empty(&mad_agent_priv->wait_list)) {
2325		cancel_delayed_work(&mad_agent_priv->timed_work);
2326	} else {
2327		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2328					 struct ib_mad_send_wr_private,
2329					 agent_list);
2330
2331		if (time_after(mad_agent_priv->timeout,
2332			       mad_send_wr->timeout)) {
2333			mad_agent_priv->timeout = mad_send_wr->timeout;
2334			delay = mad_send_wr->timeout - jiffies;
2335			if ((long)delay <= 0)
2336				delay = 1;
2337			mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2338					 &mad_agent_priv->timed_work, delay);
2339		}
2340	}
2341}
2342
2343static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
2344{
2345	struct ib_mad_agent_private *mad_agent_priv;
2346	struct ib_mad_send_wr_private *temp_mad_send_wr;
2347	struct list_head *list_item;
2348	unsigned long delay;
2349
2350	mad_agent_priv = mad_send_wr->mad_agent_priv;
2351	list_del(&mad_send_wr->agent_list);
2352
2353	delay = mad_send_wr->timeout;
2354	mad_send_wr->timeout += jiffies;
2355
2356	if (delay) {
2357		list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
2358			temp_mad_send_wr = list_entry(list_item,
2359						struct ib_mad_send_wr_private,
2360						agent_list);
2361			if (time_after(mad_send_wr->timeout,
2362				       temp_mad_send_wr->timeout))
2363				break;
2364		}
2365	}
2366	else
2367		list_item = &mad_agent_priv->wait_list;
2368	list_add(&mad_send_wr->agent_list, list_item);
2369
2370	/* Reschedule a work item if we have a shorter timeout */
2371	if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list)
2372		mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2373				 &mad_agent_priv->timed_work, delay);
2374}
2375
2376void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
2377			  int timeout_ms)
2378{
2379	mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2380	wait_for_response(mad_send_wr);
2381}
2382
2383/*
2384 * Process a send work completion
2385 */
2386void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
2387			     struct ib_mad_send_wc *mad_send_wc)
2388{
2389	struct ib_mad_agent_private	*mad_agent_priv;
2390	unsigned long			flags;
2391	int				ret;
2392
2393	mad_agent_priv = mad_send_wr->mad_agent_priv;
2394	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2395	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
2396		ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
2397		if (ret == IB_RMPP_RESULT_CONSUMED)
2398			goto done;
2399	} else
2400		ret = IB_RMPP_RESULT_UNHANDLED;
2401
2402	if (mad_send_wc->status != IB_WC_SUCCESS &&
2403	    mad_send_wr->status == IB_WC_SUCCESS) {
2404		mad_send_wr->status = mad_send_wc->status;
2405		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2406	}
2407
2408	if (--mad_send_wr->refcount > 0) {
2409		if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
2410		    mad_send_wr->status == IB_WC_SUCCESS) {
2411			wait_for_response(mad_send_wr);
2412		}
2413		goto done;
2414	}
2415
2416	/* Remove send from MAD agent and notify client of completion */
2417	list_del(&mad_send_wr->agent_list);
2418	adjust_timeout(mad_agent_priv);
2419	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2420
2421	if (mad_send_wr->status != IB_WC_SUCCESS )
2422		mad_send_wc->status = mad_send_wr->status;
2423	if (ret == IB_RMPP_RESULT_INTERNAL)
2424		ib_rmpp_send_handler(mad_send_wc);
2425	else
2426		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2427						   mad_send_wc);
2428
2429	/* Release reference on agent taken when sending */
2430	deref_mad_agent(mad_agent_priv);
2431	return;
2432done:
2433	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2434}
2435
2436static void ib_mad_send_done(struct ib_cq *cq, struct ib_wc *wc)
2437{
2438	struct ib_mad_port_private *port_priv = cq->cq_context;
2439	struct ib_mad_list_head *mad_list =
2440		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2441	struct ib_mad_send_wr_private	*mad_send_wr, *queued_send_wr;
2442	struct ib_mad_qp_info		*qp_info;
2443	struct ib_mad_queue		*send_queue;
2444	struct ib_send_wr		*bad_send_wr;
2445	struct ib_mad_send_wc		mad_send_wc;
2446	unsigned long flags;
2447	int ret;
2448
2449	if (list_empty_careful(&port_priv->port_list))
2450		return;
2451
2452	if (wc->status != IB_WC_SUCCESS) {
2453		if (!ib_mad_send_error(port_priv, wc))
2454			return;
2455	}
2456
2457	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2458				   mad_list);
2459	send_queue = mad_list->mad_queue;
2460	qp_info = send_queue->qp_info;
2461
2462retry:
2463	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2464			    mad_send_wr->header_mapping,
2465			    mad_send_wr->sg_list[0].length, DMA_TO_DEVICE);
2466	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2467			    mad_send_wr->payload_mapping,
2468			    mad_send_wr->sg_list[1].length, DMA_TO_DEVICE);
2469	queued_send_wr = NULL;
2470	spin_lock_irqsave(&send_queue->lock, flags);
2471	list_del(&mad_list->list);
2472
2473	/* Move queued send to the send queue */
2474	if (send_queue->count-- > send_queue->max_active) {
2475		mad_list = container_of(qp_info->overflow_list.next,
2476					struct ib_mad_list_head, list);
2477		queued_send_wr = container_of(mad_list,
2478					struct ib_mad_send_wr_private,
2479					mad_list);
2480		list_move_tail(&mad_list->list, &send_queue->list);
2481	}
2482	spin_unlock_irqrestore(&send_queue->lock, flags);
2483
2484	mad_send_wc.send_buf = &mad_send_wr->send_buf;
2485	mad_send_wc.status = wc->status;
2486	mad_send_wc.vendor_err = wc->vendor_err;
2487	if (atomic_read(&qp_info->snoop_count))
2488		snoop_send(qp_info, &mad_send_wr->send_buf, &mad_send_wc,
2489			   IB_MAD_SNOOP_SEND_COMPLETIONS);
2490	ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2491
2492	if (queued_send_wr) {
2493		ret = ib_post_send(qp_info->qp, &queued_send_wr->send_wr.wr,
2494				   &bad_send_wr);
2495		if (ret) {
2496			dev_err(&port_priv->device->dev,
2497				"ib_post_send failed: %d\n", ret);
2498			mad_send_wr = queued_send_wr;
2499			wc->status = IB_WC_LOC_QP_OP_ERR;
2500			goto retry;
2501		}
2502	}
2503}
2504
2505static void mark_sends_for_retry(struct ib_mad_qp_info *qp_info)
2506{
2507	struct ib_mad_send_wr_private *mad_send_wr;
2508	struct ib_mad_list_head *mad_list;
2509	unsigned long flags;
2510
2511	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
2512	list_for_each_entry(mad_list, &qp_info->send_queue.list, list) {
2513		mad_send_wr = container_of(mad_list,
2514					   struct ib_mad_send_wr_private,
2515					   mad_list);
2516		mad_send_wr->retry = 1;
2517	}
2518	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
2519}
2520
2521static bool ib_mad_send_error(struct ib_mad_port_private *port_priv,
2522		struct ib_wc *wc)
2523{
2524	struct ib_mad_list_head *mad_list =
2525		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2526	struct ib_mad_qp_info *qp_info = mad_list->mad_queue->qp_info;
2527	struct ib_mad_send_wr_private *mad_send_wr;
2528	int ret;
2529
2530	/*
2531	 * Send errors will transition the QP to SQE - move
2532	 * QP to RTS and repost flushed work requests
2533	 */
2534	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2535				   mad_list);
2536	if (wc->status == IB_WC_WR_FLUSH_ERR) {
2537		if (mad_send_wr->retry) {
2538			/* Repost send */
2539			struct ib_send_wr *bad_send_wr;
2540
2541			mad_send_wr->retry = 0;
2542			ret = ib_post_send(qp_info->qp, &mad_send_wr->send_wr.wr,
2543					&bad_send_wr);
2544			if (!ret)
2545				return false;
2546		}
2547	} else {
2548		struct ib_qp_attr *attr;
2549
2550		/* Transition QP to RTS and fail offending send */
2551		attr = kmalloc(sizeof *attr, GFP_KERNEL);
2552		if (attr) {
2553			attr->qp_state = IB_QPS_RTS;
2554			attr->cur_qp_state = IB_QPS_SQE;
2555			ret = ib_modify_qp(qp_info->qp, attr,
2556					   IB_QP_STATE | IB_QP_CUR_STATE);
2557			kfree(attr);
2558			if (ret)
2559				dev_err(&port_priv->device->dev,
2560					"%s - ib_modify_qp to RTS: %d\n",
2561					__func__, ret);
2562			else
2563				mark_sends_for_retry(qp_info);
2564		}
2565	}
2566
2567	return true;
2568}
2569
2570static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
2571{
2572	unsigned long flags;
2573	struct ib_mad_send_wr_private *mad_send_wr, *temp_mad_send_wr;
2574	struct ib_mad_send_wc mad_send_wc;
2575	struct list_head cancel_list;
2576
2577	INIT_LIST_HEAD(&cancel_list);
2578
2579	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2580	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2581				 &mad_agent_priv->send_list, agent_list) {
2582		if (mad_send_wr->status == IB_WC_SUCCESS) {
2583			mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2584			mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2585		}
2586	}
2587
2588	/* Empty wait list to prevent receives from finding a request */
2589	list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
2590	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2591
2592	/* Report all cancelled requests */
2593	mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
2594	mad_send_wc.vendor_err = 0;
2595
2596	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2597				 &cancel_list, agent_list) {
2598		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2599		list_del(&mad_send_wr->agent_list);
2600		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2601						   &mad_send_wc);
2602		atomic_dec(&mad_agent_priv->refcount);
2603	}
2604}
2605
2606static struct ib_mad_send_wr_private*
2607find_send_wr(struct ib_mad_agent_private *mad_agent_priv,
2608	     struct ib_mad_send_buf *send_buf)
2609{
2610	struct ib_mad_send_wr_private *mad_send_wr;
2611
2612	list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
2613			    agent_list) {
2614		if (&mad_send_wr->send_buf == send_buf)
2615			return mad_send_wr;
2616	}
2617
2618	list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
2619			    agent_list) {
2620		if (is_rmpp_data_mad(mad_agent_priv,
2621				     mad_send_wr->send_buf.mad) &&
2622		    &mad_send_wr->send_buf == send_buf)
2623			return mad_send_wr;
2624	}
2625	return NULL;
2626}
2627
2628int ib_modify_mad(struct ib_mad_agent *mad_agent,
2629		  struct ib_mad_send_buf *send_buf, u32 timeout_ms)
2630{
2631	struct ib_mad_agent_private *mad_agent_priv;
2632	struct ib_mad_send_wr_private *mad_send_wr;
2633	unsigned long flags;
2634	int active;
2635
2636	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
2637				      agent);
2638	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2639	mad_send_wr = find_send_wr(mad_agent_priv, send_buf);
2640	if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
2641		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2642		return -EINVAL;
2643	}
2644
2645	active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
2646	if (!timeout_ms) {
2647		mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2648		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2649	}
2650
2651	mad_send_wr->send_buf.timeout_ms = timeout_ms;
2652	if (active)
2653		mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2654	else
2655		ib_reset_mad_timeout(mad_send_wr, timeout_ms);
2656
2657	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2658	return 0;
2659}
2660EXPORT_SYMBOL(ib_modify_mad);
2661
2662void ib_cancel_mad(struct ib_mad_agent *mad_agent,
2663		   struct ib_mad_send_buf *send_buf)
2664{
2665	ib_modify_mad(mad_agent, send_buf, 0);
2666}
2667EXPORT_SYMBOL(ib_cancel_mad);
2668
2669static void local_completions(struct work_struct *work)
2670{
2671	struct ib_mad_agent_private *mad_agent_priv;
2672	struct ib_mad_local_private *local;
2673	struct ib_mad_agent_private *recv_mad_agent;
2674	unsigned long flags;
2675	int free_mad;
2676	struct ib_wc wc;
2677	struct ib_mad_send_wc mad_send_wc;
2678	bool opa;
2679
2680	mad_agent_priv =
2681		container_of(work, struct ib_mad_agent_private, local_work);
2682
2683	opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
2684			       mad_agent_priv->qp_info->port_priv->port_num);
2685
2686	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2687	while (!list_empty(&mad_agent_priv->local_list)) {
2688		local = list_entry(mad_agent_priv->local_list.next,
2689				   struct ib_mad_local_private,
2690				   completion_list);
2691		list_del(&local->completion_list);
2692		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2693		free_mad = 0;
2694		if (local->mad_priv) {
2695			u8 base_version;
2696			recv_mad_agent = local->recv_mad_agent;
2697			if (!recv_mad_agent) {
2698				dev_err(&mad_agent_priv->agent.device->dev,
2699					"No receive MAD agent for local completion\n");
2700				free_mad = 1;
2701				goto local_send_completion;
2702			}
2703
2704			/*
2705			 * Defined behavior is to complete response
2706			 * before request
2707			 */
2708			build_smp_wc(recv_mad_agent->agent.qp,
2709				     local->mad_send_wr->send_wr.wr.wr_cqe,
2710				     be16_to_cpu(IB_LID_PERMISSIVE),
2711				     local->mad_send_wr->send_wr.pkey_index,
2712				     recv_mad_agent->agent.port_num, &wc);
2713
2714			local->mad_priv->header.recv_wc.wc = &wc;
2715
2716			base_version = ((struct ib_mad_hdr *)(local->mad_priv->mad))->base_version;
2717			if (opa && base_version == OPA_MGMT_BASE_VERSION) {
2718				local->mad_priv->header.recv_wc.mad_len = local->return_wc_byte_len;
2719				local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2720			} else {
2721				local->mad_priv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2722				local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2723			}
2724
2725			INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
2726			list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
2727				 &local->mad_priv->header.recv_wc.rmpp_list);
2728			local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
2729			local->mad_priv->header.recv_wc.recv_buf.mad =
2730						(struct ib_mad *)local->mad_priv->mad;
2731			if (atomic_read(&recv_mad_agent->qp_info->snoop_count))
2732				snoop_recv(recv_mad_agent->qp_info,
2733					  &local->mad_priv->header.recv_wc,
2734					   IB_MAD_SNOOP_RECVS);
2735			recv_mad_agent->agent.recv_handler(
2736						&recv_mad_agent->agent,
2737						&local->mad_send_wr->send_buf,
2738						&local->mad_priv->header.recv_wc);
2739			spin_lock_irqsave(&recv_mad_agent->lock, flags);
2740			atomic_dec(&recv_mad_agent->refcount);
2741			spin_unlock_irqrestore(&recv_mad_agent->lock, flags);
2742		}
2743
2744local_send_completion:
2745		/* Complete send */
2746		mad_send_wc.status = IB_WC_SUCCESS;
2747		mad_send_wc.vendor_err = 0;
2748		mad_send_wc.send_buf = &local->mad_send_wr->send_buf;
2749		if (atomic_read(&mad_agent_priv->qp_info->snoop_count))
2750			snoop_send(mad_agent_priv->qp_info,
2751				   &local->mad_send_wr->send_buf,
2752				   &mad_send_wc, IB_MAD_SNOOP_SEND_COMPLETIONS);
2753		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2754						   &mad_send_wc);
2755
2756		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2757		atomic_dec(&mad_agent_priv->refcount);
2758		if (free_mad)
2759			kfree(local->mad_priv);
2760		kfree(local);
2761	}
2762	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2763}
2764
2765static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
2766{
2767	int ret;
2768
2769	if (!mad_send_wr->retries_left)
2770		return -ETIMEDOUT;
2771
2772	mad_send_wr->retries_left--;
2773	mad_send_wr->send_buf.retries++;
2774
2775	mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
2776
2777	if (ib_mad_kernel_rmpp_agent(&mad_send_wr->mad_agent_priv->agent)) {
2778		ret = ib_retry_rmpp(mad_send_wr);
2779		switch (ret) {
2780		case IB_RMPP_RESULT_UNHANDLED:
2781			ret = ib_send_mad(mad_send_wr);
2782			break;
2783		case IB_RMPP_RESULT_CONSUMED:
2784			ret = 0;
2785			break;
2786		default:
2787			ret = -ECOMM;
2788			break;
2789		}
2790	} else
2791		ret = ib_send_mad(mad_send_wr);
2792
2793	if (!ret) {
2794		mad_send_wr->refcount++;
2795		list_add_tail(&mad_send_wr->agent_list,
2796			      &mad_send_wr->mad_agent_priv->send_list);
2797	}
2798	return ret;
2799}
2800
2801static void timeout_sends(struct work_struct *work)
2802{
2803	struct ib_mad_agent_private *mad_agent_priv;
2804	struct ib_mad_send_wr_private *mad_send_wr;
2805	struct ib_mad_send_wc mad_send_wc;
2806	unsigned long flags, delay;
2807
2808	mad_agent_priv = container_of(work, struct ib_mad_agent_private,
2809				      timed_work.work);
2810	mad_send_wc.vendor_err = 0;
2811
2812	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2813	while (!list_empty(&mad_agent_priv->wait_list)) {
2814		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2815					 struct ib_mad_send_wr_private,
2816					 agent_list);
2817
2818		if (time_after(mad_send_wr->timeout, jiffies)) {
2819			delay = mad_send_wr->timeout - jiffies;
2820			if ((long)delay <= 0)
2821				delay = 1;
2822			queue_delayed_work(mad_agent_priv->qp_info->
2823					   port_priv->wq,
2824					   &mad_agent_priv->timed_work, delay);
2825			break;
2826		}
2827
2828		list_del(&mad_send_wr->agent_list);
2829		if (mad_send_wr->status == IB_WC_SUCCESS &&
2830		    !retry_send(mad_send_wr))
2831			continue;
2832
2833		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2834
2835		if (mad_send_wr->status == IB_WC_SUCCESS)
2836			mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
2837		else
2838			mad_send_wc.status = mad_send_wr->status;
2839		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2840		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2841						   &mad_send_wc);
2842
2843		atomic_dec(&mad_agent_priv->refcount);
2844		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2845	}
2846	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2847}
2848
2849/*
2850 * Allocate receive MADs and post receive WRs for them
2851 */
2852static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
2853				    struct ib_mad_private *mad)
2854{
2855	unsigned long flags;
2856	int post, ret;
2857	struct ib_mad_private *mad_priv;
2858	struct ib_sge sg_list;
2859	struct ib_recv_wr recv_wr, *bad_recv_wr;
2860	struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
2861
2862	/* Initialize common scatter list fields */
2863	sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
2864
2865	/* Initialize common receive WR fields */
2866	recv_wr.next = NULL;
2867	recv_wr.sg_list = &sg_list;
2868	recv_wr.num_sge = 1;
2869
2870	do {
2871		/* Allocate and map receive buffer */
2872		if (mad) {
2873			mad_priv = mad;
2874			mad = NULL;
2875		} else {
2876			mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),
2877						     GFP_ATOMIC);
2878			if (!mad_priv) {
2879				dev_err(&qp_info->port_priv->device->dev,
2880					"No memory for receive buffer\n");
2881				ret = -ENOMEM;
2882				break;
2883			}
2884		}
2885		sg_list.length = mad_priv_dma_size(mad_priv);
2886		sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
2887						 &mad_priv->grh,
2888						 mad_priv_dma_size(mad_priv),
2889						 DMA_FROM_DEVICE);
2890		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
2891						  sg_list.addr))) {
2892			ret = -ENOMEM;
2893			break;
2894		}
2895		mad_priv->header.mapping = sg_list.addr;
2896		mad_priv->header.mad_list.mad_queue = recv_queue;
2897		mad_priv->header.mad_list.cqe.done = ib_mad_recv_done;
2898		recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe;
2899
2900		/* Post receive WR */
2901		spin_lock_irqsave(&recv_queue->lock, flags);
2902		post = (++recv_queue->count < recv_queue->max_active);
2903		list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
2904		spin_unlock_irqrestore(&recv_queue->lock, flags);
2905		ret = ib_post_recv(qp_info->qp, &recv_wr, &bad_recv_wr);
2906		if (ret) {
2907			spin_lock_irqsave(&recv_queue->lock, flags);
2908			list_del(&mad_priv->header.mad_list.list);
2909			recv_queue->count--;
2910			spin_unlock_irqrestore(&recv_queue->lock, flags);
2911			ib_dma_unmap_single(qp_info->port_priv->device,
2912					    mad_priv->header.mapping,
2913					    mad_priv_dma_size(mad_priv),
2914					    DMA_FROM_DEVICE);
2915			kfree(mad_priv);
2916			dev_err(&qp_info->port_priv->device->dev,
2917				"ib_post_recv failed: %d\n", ret);
2918			break;
2919		}
2920	} while (post);
2921
2922	return ret;
2923}
2924
2925/*
2926 * Return all the posted receive MADs
2927 */
2928static void cleanup_recv_queue(struct ib_mad_qp_info *qp_info)
2929{
2930	struct ib_mad_private_header *mad_priv_hdr;
2931	struct ib_mad_private *recv;
2932	struct ib_mad_list_head *mad_list;
2933
2934	if (!qp_info->qp)
2935		return;
2936
2937	while (!list_empty(&qp_info->recv_queue.list)) {
2938
2939		mad_list = list_entry(qp_info->recv_queue.list.next,
2940				      struct ib_mad_list_head, list);
2941		mad_priv_hdr = container_of(mad_list,
2942					    struct ib_mad_private_header,
2943					    mad_list);
2944		recv = container_of(mad_priv_hdr, struct ib_mad_private,
2945				    header);
2946
2947		/* Remove from posted receive MAD list */
2948		list_del(&mad_list->list);
2949
2950		ib_dma_unmap_single(qp_info->port_priv->device,
2951				    recv->header.mapping,
2952				    mad_priv_dma_size(recv),
2953				    DMA_FROM_DEVICE);
2954		kfree(recv);
2955	}
2956
2957	qp_info->recv_queue.count = 0;
2958}
2959
2960/*
2961 * Start the port
2962 */
2963static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
2964{
2965	int ret, i;
2966	struct ib_qp_attr *attr;
2967	struct ib_qp *qp;
2968	u16 pkey_index;
2969
2970	attr = kmalloc(sizeof *attr, GFP_KERNEL);
2971	if (!attr) {
2972		dev_err(&port_priv->device->dev,
2973			"Couldn't kmalloc ib_qp_attr\n");
2974		return -ENOMEM;
2975	}
2976
2977	ret = ib_find_pkey(port_priv->device, port_priv->port_num,
2978			   IB_DEFAULT_PKEY_FULL, &pkey_index);
2979	if (ret)
2980		pkey_index = 0;
2981
2982	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2983		qp = port_priv->qp_info[i].qp;
2984		if (!qp)
2985			continue;
2986
2987		/*
2988		 * PKey index for QP1 is irrelevant but
2989		 * one is needed for the Reset to Init transition
2990		 */
2991		attr->qp_state = IB_QPS_INIT;
2992		attr->pkey_index = pkey_index;
2993		attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
2994		ret = ib_modify_qp(qp, attr, IB_QP_STATE |
2995					     IB_QP_PKEY_INDEX | IB_QP_QKEY);
2996		if (ret) {
2997			dev_err(&port_priv->device->dev,
2998				"Couldn't change QP%d state to INIT: %d\n",
2999				i, ret);
3000			goto out;
3001		}
3002
3003		attr->qp_state = IB_QPS_RTR;
3004		ret = ib_modify_qp(qp, attr, IB_QP_STATE);
3005		if (ret) {
3006			dev_err(&port_priv->device->dev,
3007				"Couldn't change QP%d state to RTR: %d\n",
3008				i, ret);
3009			goto out;
3010		}
3011
3012		attr->qp_state = IB_QPS_RTS;
3013		attr->sq_psn = IB_MAD_SEND_Q_PSN;
3014		ret = ib_modify_qp(qp, attr, IB_QP_STATE | IB_QP_SQ_PSN);
3015		if (ret) {
3016			dev_err(&port_priv->device->dev,
3017				"Couldn't change QP%d state to RTS: %d\n",
3018				i, ret);
3019			goto out;
3020		}
3021	}
3022
3023	ret = ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
3024	if (ret) {
3025		dev_err(&port_priv->device->dev,
3026			"Failed to request completion notification: %d\n",
3027			ret);
3028		goto out;
3029	}
3030
3031	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
3032		if (!port_priv->qp_info[i].qp)
3033			continue;
3034
3035		ret = ib_mad_post_receive_mads(&port_priv->qp_info[i], NULL);
3036		if (ret) {
3037			dev_err(&port_priv->device->dev,
3038				"Couldn't post receive WRs\n");
3039			goto out;
3040		}
3041	}
3042out:
3043	kfree(attr);
3044	return ret;
3045}
3046
3047static void qp_event_handler(struct ib_event *event, void *qp_context)
3048{
3049	struct ib_mad_qp_info	*qp_info = qp_context;
3050
3051	/* It's worse than that! He's dead, Jim! */
3052	dev_err(&qp_info->port_priv->device->dev,
3053		"Fatal error (%d) on MAD QP (%d)\n",
3054		event->event, qp_info->qp->qp_num);
3055}
3056
3057static void init_mad_queue(struct ib_mad_qp_info *qp_info,
3058			   struct ib_mad_queue *mad_queue)
3059{
3060	mad_queue->qp_info = qp_info;
3061	mad_queue->count = 0;
3062	spin_lock_init(&mad_queue->lock);
3063	INIT_LIST_HEAD(&mad_queue->list);
3064}
3065
3066static void init_mad_qp(struct ib_mad_port_private *port_priv,
3067			struct ib_mad_qp_info *qp_info)
3068{
3069	qp_info->port_priv = port_priv;
3070	init_mad_queue(qp_info, &qp_info->send_queue);
3071	init_mad_queue(qp_info, &qp_info->recv_queue);
3072	INIT_LIST_HEAD(&qp_info->overflow_list);
3073	spin_lock_init(&qp_info->snoop_lock);
3074	qp_info->snoop_table = NULL;
3075	qp_info->snoop_table_size = 0;
3076	atomic_set(&qp_info->snoop_count, 0);
3077}
3078
3079static int create_mad_qp(struct ib_mad_qp_info *qp_info,
3080			 enum ib_qp_type qp_type)
3081{
3082	struct ib_qp_init_attr	qp_init_attr;
3083	int ret;
3084
3085	memset(&qp_init_attr, 0, sizeof qp_init_attr);
3086	qp_init_attr.send_cq = qp_info->port_priv->cq;
3087	qp_init_attr.recv_cq = qp_info->port_priv->cq;
3088	qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
3089	qp_init_attr.cap.max_send_wr = mad_sendq_size;
3090	qp_init_attr.cap.max_recv_wr = mad_recvq_size;
3091	qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
3092	qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
3093	qp_init_attr.qp_type = qp_type;
3094	qp_init_attr.port_num = qp_info->port_priv->port_num;
3095	qp_init_attr.qp_context = qp_info;
3096	qp_init_attr.event_handler = qp_event_handler;
3097	qp_info->qp = ib_create_qp(qp_info->port_priv->pd, &qp_init_attr);
3098	if (IS_ERR(qp_info->qp)) {
3099		dev_err(&qp_info->port_priv->device->dev,
3100			"Couldn't create ib_mad QP%d\n",
3101			get_spl_qp_index(qp_type));
3102		ret = PTR_ERR(qp_info->qp);
3103		goto error;
3104	}
3105	/* Use minimum queue sizes unless the CQ is resized */
3106	qp_info->send_queue.max_active = mad_sendq_size;
3107	qp_info->recv_queue.max_active = mad_recvq_size;
3108	return 0;
3109
3110error:
3111	return ret;
3112}
3113
3114static void destroy_mad_qp(struct ib_mad_qp_info *qp_info)
3115{
3116	if (!qp_info->qp)
3117		return;
3118
3119	ib_destroy_qp(qp_info->qp);
3120	kfree(qp_info->snoop_table);
3121}
3122
3123/*
3124 * Open the port
3125 * Create the QP, PD, MR, and CQ if needed
3126 */
3127static int ib_mad_port_open(struct ib_device *device,
3128			    int port_num)
3129{
3130	int ret, cq_size;
3131	struct ib_mad_port_private *port_priv;
3132	unsigned long flags;
3133	char name[sizeof "ib_mad123"];
3134	int has_smi;
3135
3136	if (WARN_ON(rdma_max_mad_size(device, port_num) < IB_MGMT_MAD_SIZE))
3137		return -EFAULT;
3138
3139	if (WARN_ON(rdma_cap_opa_mad(device, port_num) &&
3140		    rdma_max_mad_size(device, port_num) < OPA_MGMT_MAD_SIZE))
3141		return -EFAULT;
3142
3143	/* Create new device info */
3144	port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
3145	if (!port_priv) {
3146		dev_err(&device->dev, "No memory for ib_mad_port_private\n");
3147		return -ENOMEM;
3148	}
3149
3150	port_priv->device = device;
3151	port_priv->port_num = port_num;
3152	spin_lock_init(&port_priv->reg_lock);
3153	INIT_LIST_HEAD(&port_priv->agent_list);
3154	init_mad_qp(port_priv, &port_priv->qp_info[0]);
3155	init_mad_qp(port_priv, &port_priv->qp_info[1]);
3156
3157	cq_size = mad_sendq_size + mad_recvq_size;
3158	has_smi = rdma_cap_ib_smi(device, port_num);
3159	if (has_smi)
3160		cq_size *= 2;
3161
3162	port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
3163			IB_POLL_WORKQUEUE);
3164	if (IS_ERR(port_priv->cq)) {
3165		dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
3166		ret = PTR_ERR(port_priv->cq);
3167		goto error3;
3168	}
3169
3170	port_priv->pd = ib_alloc_pd(device, 0);
3171	if (IS_ERR(port_priv->pd)) {
3172		dev_err(&device->dev, "Couldn't create ib_mad PD\n");
3173		ret = PTR_ERR(port_priv->pd);
3174		goto error4;
3175	}
3176
3177	if (has_smi) {
3178		ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
3179		if (ret)
3180			goto error6;
3181	}
3182	ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
3183	if (ret)
3184		goto error7;
3185
3186	snprintf(name, sizeof name, "ib_mad%d", port_num);
3187	port_priv->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
3188	if (!port_priv->wq) {
3189		ret = -ENOMEM;
3190		goto error8;
3191	}
3192
3193	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3194	list_add_tail(&port_priv->port_list, &ib_mad_port_list);
3195	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3196
3197	ret = ib_mad_port_start(port_priv);
3198	if (ret) {
3199		dev_err(&device->dev, "Couldn't start port\n");
3200		goto error9;
3201	}
3202
3203	return 0;
3204
3205error9:
3206	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3207	list_del_init(&port_priv->port_list);
3208	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3209
3210	destroy_workqueue(port_priv->wq);
3211error8:
3212	destroy_mad_qp(&port_priv->qp_info[1]);
3213error7:
3214	destroy_mad_qp(&port_priv->qp_info[0]);
3215error6:
3216	ib_dealloc_pd(port_priv->pd);
3217error4:
3218	ib_free_cq(port_priv->cq);
3219	cleanup_recv_queue(&port_priv->qp_info[1]);
3220	cleanup_recv_queue(&port_priv->qp_info[0]);
3221error3:
3222	kfree(port_priv);
3223
3224	return ret;
3225}
3226
3227/*
3228 * Close the port
3229 * If there are no classes using the port, free the port
3230 * resources (CQ, MR, PD, QP) and remove the port's info structure
3231 */
3232static int ib_mad_port_close(struct ib_device *device, int port_num)
3233{
3234	struct ib_mad_port_private *port_priv;
3235	unsigned long flags;
3236
3237	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3238	port_priv = __ib_get_mad_port(device, port_num);
3239	if (port_priv == NULL) {
3240		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3241		dev_err(&device->dev, "Port %d not found\n", port_num);
3242		return -ENODEV;
3243	}
3244	list_del_init(&port_priv->port_list);
3245	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3246
3247	destroy_workqueue(port_priv->wq);
3248	destroy_mad_qp(&port_priv->qp_info[1]);
3249	destroy_mad_qp(&port_priv->qp_info[0]);
3250	ib_dealloc_pd(port_priv->pd);
3251	ib_free_cq(port_priv->cq);
3252	cleanup_recv_queue(&port_priv->qp_info[1]);
3253	cleanup_recv_queue(&port_priv->qp_info[0]);
3254	/* XXX: Handle deallocation of MAD registration tables */
3255
3256	kfree(port_priv);
3257
3258	return 0;
3259}
3260
3261static void ib_mad_init_device(struct ib_device *device)
3262{
3263	int start, i;
3264
3265	start = rdma_start_port(device);
3266
3267	for (i = start; i <= rdma_end_port(device); i++) {
3268		if (!rdma_cap_ib_mad(device, i))
3269			continue;
3270
3271		if (ib_mad_port_open(device, i)) {
3272			dev_err(&device->dev, "Couldn't open port %d\n", i);
3273			goto error;
3274		}
3275		if (ib_agent_port_open(device, i)) {
3276			dev_err(&device->dev,
3277				"Couldn't open port %d for agents\n", i);
3278			goto error_agent;
3279		}
3280	}
3281	return;
3282
3283error_agent:
3284	if (ib_mad_port_close(device, i))
3285		dev_err(&device->dev, "Couldn't close port %d\n", i);
3286
3287error:
3288	while (--i >= start) {
3289		if (!rdma_cap_ib_mad(device, i))
3290			continue;
3291
3292		if (ib_agent_port_close(device, i))
3293			dev_err(&device->dev,
3294				"Couldn't close port %d for agents\n", i);
3295		if (ib_mad_port_close(device, i))
3296			dev_err(&device->dev, "Couldn't close port %d\n", i);
3297	}
3298}
3299
3300static void ib_mad_remove_device(struct ib_device *device, void *client_data)
3301{
3302	int i;
3303
3304	for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
3305		if (!rdma_cap_ib_mad(device, i))
3306			continue;
3307
3308		if (ib_agent_port_close(device, i))
3309			dev_err(&device->dev,
3310				"Couldn't close port %d for agents\n", i);
3311		if (ib_mad_port_close(device, i))
3312			dev_err(&device->dev, "Couldn't close port %d\n", i);
3313	}
3314}
3315
3316static struct ib_client mad_client = {
3317	.name   = "mad",
3318	.add = ib_mad_init_device,
3319	.remove = ib_mad_remove_device
3320};
3321
3322int ib_mad_init(void)
3323{
3324	mad_recvq_size = min(mad_recvq_size, IB_MAD_QP_MAX_SIZE);
3325	mad_recvq_size = max(mad_recvq_size, IB_MAD_QP_MIN_SIZE);
3326
3327	mad_sendq_size = min(mad_sendq_size, IB_MAD_QP_MAX_SIZE);
3328	mad_sendq_size = max(mad_sendq_size, IB_MAD_QP_MIN_SIZE);
3329
3330	INIT_LIST_HEAD(&ib_mad_port_list);
3331
3332	if (ib_register_client(&mad_client)) {
3333		pr_err("Couldn't register ib_mad client\n");
3334		return -EINVAL;
3335	}
3336
3337	return 0;
3338}
3339
3340void ib_mad_cleanup(void)
3341{
3342	ib_unregister_client(&mad_client);
3343}
3344