1/*-
2 * Copyright (c) 2012 Chelsio Communications, Inc.
3 * All rights reserved.
4 * Written by: Navdeep Parhar <np@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD$");
30
31#include "opt_inet.h"
32
33#ifdef TCP_OFFLOAD
34#include <sys/param.h>
35#include <sys/types.h>
36#include <sys/kernel.h>
37#include <sys/ktr.h>
38#include <sys/module.h>
39#include <sys/protosw.h>
40#include <sys/domain.h>
41#include <sys/socket.h>
42#include <sys/socketvar.h>
43#include <sys/sglist.h>
44#include <netinet/in.h>
45#include <netinet/in_pcb.h>
46#include <netinet/ip.h>
47#include <netinet/tcp_var.h>
48#define TCPSTATES
49#include <netinet/tcp_fsm.h>
50#include <netinet/tcp_seq.h>
51#include <netinet/toecore.h>
52
53#include "common/common.h"
54#include "common/t4_msg.h"
55#include "common/t4_regs.h"
56#include "common/t4_tcb.h"
57#include "tom/t4_tom_l2t.h"
58#include "tom/t4_tom.h"
59
60VNET_DECLARE(int, tcp_do_autosndbuf);
61#define V_tcp_do_autosndbuf VNET(tcp_do_autosndbuf)
62VNET_DECLARE(int, tcp_autosndbuf_inc);
63#define V_tcp_autosndbuf_inc VNET(tcp_autosndbuf_inc)
64VNET_DECLARE(int, tcp_autosndbuf_max);
65#define V_tcp_autosndbuf_max VNET(tcp_autosndbuf_max)
66VNET_DECLARE(int, tcp_do_autorcvbuf);
67#define V_tcp_do_autorcvbuf VNET(tcp_do_autorcvbuf)
68VNET_DECLARE(int, tcp_autorcvbuf_inc);
69#define V_tcp_autorcvbuf_inc VNET(tcp_autorcvbuf_inc)
70VNET_DECLARE(int, tcp_autorcvbuf_max);
71#define V_tcp_autorcvbuf_max VNET(tcp_autorcvbuf_max)
72
73void
74send_flowc_wr(struct toepcb *toep, struct flowc_tx_params *ftxp)
75{
76	struct wrqe *wr;
77	struct fw_flowc_wr *flowc;
78	unsigned int nparams = ftxp ? 8 : 6, flowclen;
79	struct port_info *pi = toep->port;
80	struct adapter *sc = pi->adapter;
81	unsigned int pfvf = G_FW_VIID_PFN(pi->viid) << S_FW_VIID_PFN;
82	struct ofld_tx_sdesc *txsd = &toep->txsd[toep->txsd_pidx];
83
84	KASSERT(!(toep->flags & TPF_FLOWC_WR_SENT),
85	    ("%s: flowc for tid %u sent already", __func__, toep->tid));
86
87	CTR2(KTR_CXGBE, "%s: tid %u", __func__, toep->tid);
88
89	flowclen = sizeof(*flowc) + nparams * sizeof(struct fw_flowc_mnemval);
90
91	wr = alloc_wrqe(roundup2(flowclen, 16), toep->ofld_txq);
92	if (wr == NULL) {
93		/* XXX */
94		panic("%s: allocation failure.", __func__);
95	}
96	flowc = wrtod(wr);
97	memset(flowc, 0, wr->wr_len);
98
99	flowc->op_to_nparams = htobe32(V_FW_WR_OP(FW_FLOWC_WR) |
100	    V_FW_FLOWC_WR_NPARAMS(nparams));
101	flowc->flowid_len16 = htonl(V_FW_WR_LEN16(howmany(flowclen, 16)) |
102	    V_FW_WR_FLOWID(toep->tid));
103
104	flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
105	flowc->mnemval[0].val = htobe32(pfvf);
106	flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
107	flowc->mnemval[1].val = htobe32(pi->tx_chan);
108	flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
109	flowc->mnemval[2].val = htobe32(pi->tx_chan);
110	flowc->mnemval[3].mnemonic = FW_FLOWC_MNEM_IQID;
111	flowc->mnemval[3].val = htobe32(toep->ofld_rxq->iq.abs_id);
112	if (ftxp) {
113		uint32_t sndbuf = min(ftxp->snd_space, sc->tt.sndbuf);
114
115		flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDNXT;
116		flowc->mnemval[4].val = htobe32(ftxp->snd_nxt);
117		flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_RCVNXT;
118		flowc->mnemval[5].val = htobe32(ftxp->rcv_nxt);
119		flowc->mnemval[6].mnemonic = FW_FLOWC_MNEM_SNDBUF;
120		flowc->mnemval[6].val = htobe32(sndbuf);
121		flowc->mnemval[7].mnemonic = FW_FLOWC_MNEM_MSS;
122		flowc->mnemval[7].val = htobe32(ftxp->mss);
123	} else {
124		flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDBUF;
125		flowc->mnemval[4].val = htobe32(512);
126		flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_MSS;
127		flowc->mnemval[5].val = htobe32(512);
128	}
129
130	txsd->tx_credits = howmany(flowclen, 16);
131	txsd->plen = 0;
132	KASSERT(toep->tx_credits >= txsd->tx_credits && toep->txsd_avail > 0,
133	    ("%s: not enough credits (%d)", __func__, toep->tx_credits));
134	toep->tx_credits -= txsd->tx_credits;
135	if (__predict_false(++toep->txsd_pidx == toep->txsd_total))
136		toep->txsd_pidx = 0;
137	toep->txsd_avail--;
138
139	toep->flags |= TPF_FLOWC_WR_SENT;
140        t4_wrq_tx(sc, wr);
141}
142
143void
144send_reset(struct adapter *sc, struct toepcb *toep, uint32_t snd_nxt)
145{
146	struct wrqe *wr;
147	struct cpl_abort_req *req;
148	int tid = toep->tid;
149	struct inpcb *inp = toep->inp;
150	struct tcpcb *tp = intotcpcb(inp);	/* don't use if INP_DROPPED */
151
152	INP_WLOCK_ASSERT(inp);
153
154	CTR6(KTR_CXGBE, "%s: tid %d (%s), toep_flags 0x%x, inp_flags 0x%x%s",
155	    __func__, toep->tid,
156	    inp->inp_flags & INP_DROPPED ? "inp dropped" :
157	    tcpstates[tp->t_state],
158	    toep->flags, inp->inp_flags,
159	    toep->flags & TPF_ABORT_SHUTDOWN ?
160	    " (abort already in progress)" : "");
161
162	if (toep->flags & TPF_ABORT_SHUTDOWN)
163		return;	/* abort already in progress */
164
165	toep->flags |= TPF_ABORT_SHUTDOWN;
166
167	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
168	    ("%s: flowc_wr not sent for tid %d.", __func__, tid));
169
170	wr = alloc_wrqe(sizeof(*req), toep->ofld_txq);
171	if (wr == NULL) {
172		/* XXX */
173		panic("%s: allocation failure.", __func__);
174	}
175	req = wrtod(wr);
176
177	INIT_TP_WR_MIT_CPL(req, CPL_ABORT_REQ, tid);
178	if (inp->inp_flags & INP_DROPPED)
179		req->rsvd0 = htobe32(snd_nxt);
180	else
181		req->rsvd0 = htobe32(tp->snd_nxt);
182	req->rsvd1 = !(toep->flags & TPF_TX_DATA_SENT);
183	req->cmd = CPL_ABORT_SEND_RST;
184
185	/*
186	 * XXX: What's the correct way to tell that the inp hasn't been detached
187	 * from its socket?  Should I even be flushing the snd buffer here?
188	 */
189	if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) == 0) {
190		struct socket *so = inp->inp_socket;
191
192		if (so != NULL)	/* because I'm not sure.  See comment above */
193			sbflush(&so->so_snd);
194	}
195
196	t4_l2t_send(sc, wr, toep->l2te);
197}
198
199/*
200 * Called when a connection is established to translate the TCP options
201 * reported by HW to FreeBSD's native format.
202 */
203static void
204assign_rxopt(struct tcpcb *tp, unsigned int opt)
205{
206	struct toepcb *toep = tp->t_toe;
207	struct adapter *sc = td_adapter(toep->td);
208
209	INP_LOCK_ASSERT(tp->t_inpcb);
210
211	tp->t_maxseg = tp->t_maxopd = sc->params.mtus[G_TCPOPT_MSS(opt)] - 40;
212
213	if (G_TCPOPT_TSTAMP(opt)) {
214		tp->t_flags |= TF_RCVD_TSTMP;	/* timestamps ok */
215		tp->ts_recent = 0;		/* hmmm */
216		tp->ts_recent_age = tcp_ts_getticks();
217		tp->t_maxseg -= TCPOLEN_TSTAMP_APPA;
218	}
219
220	if (G_TCPOPT_SACK(opt))
221		tp->t_flags |= TF_SACK_PERMIT;	/* should already be set */
222	else
223		tp->t_flags &= ~TF_SACK_PERMIT;	/* sack disallowed by peer */
224
225	if (G_TCPOPT_WSCALE_OK(opt))
226		tp->t_flags |= TF_RCVD_SCALE;
227
228	/* Doing window scaling? */
229	if ((tp->t_flags & (TF_RCVD_SCALE | TF_REQ_SCALE)) ==
230	    (TF_RCVD_SCALE | TF_REQ_SCALE)) {
231		tp->rcv_scale = tp->request_r_scale;
232		tp->snd_scale = G_TCPOPT_SND_WSCALE(opt);
233	}
234}
235
236/*
237 * Completes some final bits of initialization for just established connections
238 * and changes their state to TCPS_ESTABLISHED.
239 *
240 * The ISNs are from after the exchange of SYNs.  i.e., the true ISN + 1.
241 */
242void
243make_established(struct toepcb *toep, uint32_t snd_isn, uint32_t rcv_isn,
244    uint16_t opt)
245{
246	struct inpcb *inp = toep->inp;
247	struct socket *so = inp->inp_socket;
248	struct tcpcb *tp = intotcpcb(inp);
249	long bufsize;
250	uint32_t iss = be32toh(snd_isn) - 1;	/* true ISS */
251	uint32_t irs = be32toh(rcv_isn) - 1;	/* true IRS */
252	uint16_t tcpopt = be16toh(opt);
253	struct flowc_tx_params ftxp;
254
255	INP_WLOCK_ASSERT(inp);
256	KASSERT(tp->t_state == TCPS_SYN_SENT ||
257	    tp->t_state == TCPS_SYN_RECEIVED,
258	    ("%s: TCP state %s", __func__, tcpstates[tp->t_state]));
259
260	CTR4(KTR_CXGBE, "%s: tid %d, toep %p, inp %p",
261	    __func__, toep->tid, toep, inp);
262
263	tp->t_state = TCPS_ESTABLISHED;
264	tp->t_starttime = ticks;
265	TCPSTAT_INC(tcps_connects);
266
267	tp->irs = irs;
268	tcp_rcvseqinit(tp);
269	tp->rcv_wnd = toep->rx_credits << 10;
270	tp->rcv_adv += tp->rcv_wnd;
271	tp->last_ack_sent = tp->rcv_nxt;
272
273	/*
274	 * If we were unable to send all rx credits via opt0, save the remainder
275	 * in rx_credits so that they can be handed over with the next credit
276	 * update.
277	 */
278	SOCKBUF_LOCK(&so->so_rcv);
279	bufsize = select_rcv_wnd(so);
280	SOCKBUF_UNLOCK(&so->so_rcv);
281	toep->rx_credits = bufsize - tp->rcv_wnd;
282
283	tp->iss = iss;
284	tcp_sendseqinit(tp);
285	tp->snd_una = iss + 1;
286	tp->snd_nxt = iss + 1;
287	tp->snd_max = iss + 1;
288
289	assign_rxopt(tp, tcpopt);
290
291	SOCKBUF_LOCK(&so->so_snd);
292	if (so->so_snd.sb_flags & SB_AUTOSIZE && V_tcp_do_autosndbuf)
293		bufsize = V_tcp_autosndbuf_max;
294	else
295		bufsize = sbspace(&so->so_snd);
296	SOCKBUF_UNLOCK(&so->so_snd);
297
298	ftxp.snd_nxt = tp->snd_nxt;
299	ftxp.rcv_nxt = tp->rcv_nxt;
300	ftxp.snd_space = bufsize;
301	ftxp.mss = tp->t_maxseg;
302	send_flowc_wr(toep, &ftxp);
303
304	soisconnected(so);
305}
306
307static int
308send_rx_credits(struct adapter *sc, struct toepcb *toep, int credits)
309{
310	struct wrqe *wr;
311	struct cpl_rx_data_ack *req;
312	uint32_t dack = F_RX_DACK_CHANGE | V_RX_DACK_MODE(1);
313
314	KASSERT(credits >= 0, ("%s: %d credits", __func__, credits));
315
316	wr = alloc_wrqe(sizeof(*req), toep->ctrlq);
317	if (wr == NULL)
318		return (0);
319	req = wrtod(wr);
320
321	INIT_TP_WR_MIT_CPL(req, CPL_RX_DATA_ACK, toep->tid);
322	req->credit_dack = htobe32(dack | V_RX_CREDITS(credits));
323
324	t4_wrq_tx(sc, wr);
325	return (credits);
326}
327
328void
329t4_rcvd(struct toedev *tod, struct tcpcb *tp)
330{
331	struct adapter *sc = tod->tod_softc;
332	struct inpcb *inp = tp->t_inpcb;
333	struct socket *so = inp->inp_socket;
334	struct sockbuf *sb = &so->so_rcv;
335	struct toepcb *toep = tp->t_toe;
336	int credits;
337
338	INP_WLOCK_ASSERT(inp);
339
340	SOCKBUF_LOCK(sb);
341	KASSERT(toep->sb_cc >= sb->sb_cc,
342	    ("%s: sb %p has more data (%d) than last time (%d).",
343	    __func__, sb, sb->sb_cc, toep->sb_cc));
344	toep->rx_credits += toep->sb_cc - sb->sb_cc;
345	toep->sb_cc = sb->sb_cc;
346	credits = toep->rx_credits;
347	SOCKBUF_UNLOCK(sb);
348
349	if (credits > 0 &&
350	    (credits + 16384 >= tp->rcv_wnd || credits >= 15 * 1024)) {
351
352		credits = send_rx_credits(sc, toep, credits);
353		SOCKBUF_LOCK(sb);
354		toep->rx_credits -= credits;
355		SOCKBUF_UNLOCK(sb);
356		tp->rcv_wnd += credits;
357		tp->rcv_adv += credits;
358	}
359}
360
361/*
362 * Close a connection by sending a CPL_CLOSE_CON_REQ message.
363 */
364static int
365close_conn(struct adapter *sc, struct toepcb *toep)
366{
367	struct wrqe *wr;
368	struct cpl_close_con_req *req;
369	unsigned int tid = toep->tid;
370
371	CTR3(KTR_CXGBE, "%s: tid %u%s", __func__, toep->tid,
372	    toep->flags & TPF_FIN_SENT ? ", IGNORED" : "");
373
374	if (toep->flags & TPF_FIN_SENT)
375		return (0);
376
377	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
378	    ("%s: flowc_wr not sent for tid %u.", __func__, tid));
379
380	wr = alloc_wrqe(sizeof(*req), toep->ofld_txq);
381	if (wr == NULL) {
382		/* XXX */
383		panic("%s: allocation failure.", __func__);
384	}
385	req = wrtod(wr);
386
387        req->wr.wr_hi = htonl(V_FW_WR_OP(FW_TP_WR) |
388	    V_FW_WR_IMMDLEN(sizeof(*req) - sizeof(req->wr)));
389	req->wr.wr_mid = htonl(V_FW_WR_LEN16(howmany(sizeof(*req), 16)) |
390	    V_FW_WR_FLOWID(tid));
391        req->wr.wr_lo = cpu_to_be64(0);
392        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_CLOSE_CON_REQ, tid));
393	req->rsvd = 0;
394
395	toep->flags |= TPF_FIN_SENT;
396	toep->flags &= ~TPF_SEND_FIN;
397	t4_l2t_send(sc, wr, toep->l2te);
398
399	return (0);
400}
401
402#define MAX_OFLD_TX_CREDITS (SGE_MAX_WR_LEN / 16)
403#define MIN_OFLD_TX_CREDITS (howmany(sizeof(struct fw_ofld_tx_data_wr) + 1, 16))
404
405/* Maximum amount of immediate data we could stuff in a WR */
406static inline int
407max_imm_payload(int tx_credits)
408{
409	const int n = 2;	/* Use only up to 2 desc for imm. data WR */
410
411	KASSERT(tx_credits >= 0 &&
412		tx_credits <= MAX_OFLD_TX_CREDITS,
413		("%s: %d credits", __func__, tx_credits));
414
415	if (tx_credits < MIN_OFLD_TX_CREDITS)
416		return (0);
417
418	if (tx_credits >= (n * EQ_ESIZE) / 16)
419		return ((n * EQ_ESIZE) - sizeof(struct fw_ofld_tx_data_wr));
420	else
421		return (tx_credits * 16 - sizeof(struct fw_ofld_tx_data_wr));
422}
423
424/* Maximum number of SGL entries we could stuff in a WR */
425static inline int
426max_dsgl_nsegs(int tx_credits)
427{
428	int nseg = 1;	/* ulptx_sgl has room for 1, rest ulp_tx_sge_pair */
429	int sge_pair_credits = tx_credits - MIN_OFLD_TX_CREDITS;
430
431	KASSERT(tx_credits >= 0 &&
432		tx_credits <= MAX_OFLD_TX_CREDITS,
433		("%s: %d credits", __func__, tx_credits));
434
435	if (tx_credits < MIN_OFLD_TX_CREDITS)
436		return (0);
437
438	nseg += 2 * (sge_pair_credits * 16 / 24);
439	if ((sge_pair_credits * 16) % 24 == 16)
440		nseg++;
441
442	return (nseg);
443}
444
445static inline void
446write_tx_wr(void *dst, struct toepcb *toep, unsigned int immdlen,
447    unsigned int plen, uint8_t credits, int shove)
448{
449	struct fw_ofld_tx_data_wr *txwr = dst;
450
451	txwr->op_to_immdlen = htobe32(V_WR_OP(FW_OFLD_TX_DATA_WR) |
452	    V_FW_WR_IMMDLEN(immdlen));
453	txwr->flowid_len16 = htobe32(V_FW_WR_FLOWID(toep->tid) |
454	    V_FW_WR_LEN16(credits));
455	txwr->lsodisable_to_proxy =
456	    htobe32(V_FW_OFLD_TX_DATA_WR_ULPMODE(toep->ulp_mode) |
457		V_FW_OFLD_TX_DATA_WR_URGENT(0) |	/* XXX */
458		V_FW_OFLD_TX_DATA_WR_SHOVE(shove));
459	txwr->plen = htobe32(plen);
460}
461
462/*
463 * Generate a DSGL from a starting mbuf.  The total number of segments and the
464 * maximum segments in any one mbuf are provided.
465 */
466static void
467write_tx_sgl(void *dst, struct mbuf *start, struct mbuf *stop, int nsegs, int n)
468{
469	struct mbuf *m;
470	struct ulptx_sgl *usgl = dst;
471	int i, j, rc;
472	struct sglist sg;
473	struct sglist_seg segs[n];
474
475	KASSERT(nsegs > 0, ("%s: nsegs 0", __func__));
476
477	sglist_init(&sg, n, segs);
478	usgl->cmd_nsge = htobe32(V_ULPTX_CMD(ULP_TX_SC_DSGL) |
479	    V_ULPTX_NSGE(nsegs));
480
481	i = -1;
482	for (m = start; m != stop; m = m->m_next) {
483		rc = sglist_append(&sg, mtod(m, void *), m->m_len);
484		if (__predict_false(rc != 0))
485			panic("%s: sglist_append %d", __func__, rc);
486
487		for (j = 0; j < sg.sg_nseg; i++, j++) {
488			if (i < 0) {
489				usgl->len0 = htobe32(segs[j].ss_len);
490				usgl->addr0 = htobe64(segs[j].ss_paddr);
491			} else {
492				usgl->sge[i / 2].len[i & 1] =
493				    htobe32(segs[j].ss_len);
494				usgl->sge[i / 2].addr[i & 1] =
495				    htobe64(segs[j].ss_paddr);
496			}
497#ifdef INVARIANTS
498			nsegs--;
499#endif
500		}
501		sglist_reset(&sg);
502	}
503	if (i & 1)
504		usgl->sge[i / 2].len[1] = htobe32(0);
505	KASSERT(nsegs == 0, ("%s: nsegs %d, start %p, stop %p",
506	    __func__, nsegs, start, stop));
507}
508
509/*
510 * Max number of SGL entries an offload tx work request can have.  This is 41
511 * (1 + 40) for a full 512B work request.
512 * fw_ofld_tx_data_wr(16B) + ulptx_sgl(16B, 1) + ulptx_sge_pair(480B, 40)
513 */
514#define OFLD_SGL_LEN (41)
515
516/*
517 * Send data and/or a FIN to the peer.
518 *
519 * The socket's so_snd buffer consists of a stream of data starting with sb_mb
520 * and linked together with m_next.  sb_sndptr, if set, is the last mbuf that
521 * was transmitted.
522 *
523 * drop indicates the number of bytes that should be dropped from the head of
524 * the send buffer.  It is an optimization that lets do_fw4_ack avoid creating
525 * contention on the send buffer lock (before this change it used to do
526 * sowwakeup and then t4_push_frames right after that when recovering from tx
527 * stalls).  When drop is set this function MUST drop the bytes and wake up any
528 * writers.
529 */
530static void
531t4_push_frames(struct adapter *sc, struct toepcb *toep, int drop)
532{
533	struct mbuf *sndptr, *m, *sb_sndptr;
534	struct fw_ofld_tx_data_wr *txwr;
535	struct wrqe *wr;
536	u_int plen, nsegs, credits, max_imm, max_nsegs, max_nsegs_1mbuf;
537	struct inpcb *inp = toep->inp;
538	struct tcpcb *tp = intotcpcb(inp);
539	struct socket *so = inp->inp_socket;
540	struct sockbuf *sb = &so->so_snd;
541	int tx_credits, shove, compl, space, sowwakeup;
542	struct ofld_tx_sdesc *txsd = &toep->txsd[toep->txsd_pidx];
543
544	INP_WLOCK_ASSERT(inp);
545	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
546	    ("%s: flowc_wr not sent for tid %u.", __func__, toep->tid));
547
548	if (__predict_false(toep->ulp_mode != ULP_MODE_NONE &&
549	    toep->ulp_mode != ULP_MODE_TCPDDP))
550		CXGBE_UNIMPLEMENTED("ulp_mode");
551
552	/*
553	 * This function doesn't resume by itself.  Someone else must clear the
554	 * flag and call this function.
555	 */
556	if (__predict_false(toep->flags & TPF_TX_SUSPENDED)) {
557		KASSERT(drop == 0,
558		    ("%s: drop (%d) != 0 but tx is suspended", __func__, drop));
559		return;
560	}
561
562	do {
563		tx_credits = min(toep->tx_credits, MAX_OFLD_TX_CREDITS);
564		max_imm = max_imm_payload(tx_credits);
565		max_nsegs = max_dsgl_nsegs(tx_credits);
566
567		SOCKBUF_LOCK(sb);
568		sowwakeup = drop;
569		if (drop) {
570			sbdrop_locked(sb, drop);
571			drop = 0;
572		}
573		sb_sndptr = sb->sb_sndptr;
574		sndptr = sb_sndptr ? sb_sndptr->m_next : sb->sb_mb;
575		plen = 0;
576		nsegs = 0;
577		max_nsegs_1mbuf = 0; /* max # of SGL segments in any one mbuf */
578		for (m = sndptr; m != NULL; m = m->m_next) {
579			int n = sglist_count(mtod(m, void *), m->m_len);
580
581			nsegs += n;
582			plen += m->m_len;
583
584			/* This mbuf sent us _over_ the nsegs limit, back out */
585			if (plen > max_imm && nsegs > max_nsegs) {
586				nsegs -= n;
587				plen -= m->m_len;
588				if (plen == 0) {
589					/* Too few credits */
590					toep->flags |= TPF_TX_SUSPENDED;
591					if (sowwakeup)
592						sowwakeup_locked(so);
593					else
594						SOCKBUF_UNLOCK(sb);
595					SOCKBUF_UNLOCK_ASSERT(sb);
596					return;
597				}
598				break;
599			}
600
601			if (max_nsegs_1mbuf < n)
602				max_nsegs_1mbuf = n;
603			sb_sndptr = m;	/* new sb->sb_sndptr if all goes well */
604
605			/* This mbuf put us right at the max_nsegs limit */
606			if (plen > max_imm && nsegs == max_nsegs) {
607				m = m->m_next;
608				break;
609			}
610		}
611
612		shove = m == NULL && !(tp->t_flags & TF_MORETOCOME);
613		space = sbspace(sb);
614
615		if (space <= sb->sb_hiwat * 3 / 8 &&
616		    toep->plen_nocompl + plen >= sb->sb_hiwat / 4)
617			compl = 1;
618		else
619			compl = 0;
620
621		if (sb->sb_flags & SB_AUTOSIZE &&
622		    V_tcp_do_autosndbuf &&
623		    sb->sb_hiwat < V_tcp_autosndbuf_max &&
624		    space < sb->sb_hiwat / 8) {
625			int newsize = min(sb->sb_hiwat + V_tcp_autosndbuf_inc,
626			    V_tcp_autosndbuf_max);
627
628			if (!sbreserve_locked(sb, newsize, so, NULL))
629				sb->sb_flags &= ~SB_AUTOSIZE;
630			else
631				sowwakeup = 1;	/* room available */
632		}
633		if (sowwakeup)
634			sowwakeup_locked(so);
635		else
636			SOCKBUF_UNLOCK(sb);
637		SOCKBUF_UNLOCK_ASSERT(sb);
638
639		/* nothing to send */
640		if (plen == 0) {
641			KASSERT(m == NULL,
642			    ("%s: nothing to send, but m != NULL", __func__));
643			break;
644		}
645
646		if (__predict_false(toep->flags & TPF_FIN_SENT))
647			panic("%s: excess tx.", __func__);
648
649		if (plen <= max_imm) {
650
651			/* Immediate data tx */
652
653			wr = alloc_wrqe(roundup2(sizeof(*txwr) + plen, 16),
654					toep->ofld_txq);
655			if (wr == NULL) {
656				/* XXX: how will we recover from this? */
657				toep->flags |= TPF_TX_SUSPENDED;
658				return;
659			}
660			txwr = wrtod(wr);
661			credits = howmany(wr->wr_len, 16);
662			write_tx_wr(txwr, toep, plen, plen, credits, shove);
663			m_copydata(sndptr, 0, plen, (void *)(txwr + 1));
664			nsegs = 0;
665		} else {
666			int wr_len;
667
668			/* DSGL tx */
669
670			wr_len = sizeof(*txwr) + sizeof(struct ulptx_sgl) +
671			    ((3 * (nsegs - 1)) / 2 + ((nsegs - 1) & 1)) * 8;
672			wr = alloc_wrqe(roundup2(wr_len, 16), toep->ofld_txq);
673			if (wr == NULL) {
674				/* XXX: how will we recover from this? */
675				toep->flags |= TPF_TX_SUSPENDED;
676				return;
677			}
678			txwr = wrtod(wr);
679			credits = howmany(wr_len, 16);
680			write_tx_wr(txwr, toep, 0, plen, credits, shove);
681			write_tx_sgl(txwr + 1, sndptr, m, nsegs,
682			    max_nsegs_1mbuf);
683			if (wr_len & 0xf) {
684				uint64_t *pad = (uint64_t *)
685				    ((uintptr_t)txwr + wr_len);
686				*pad = 0;
687			}
688		}
689
690		KASSERT(toep->tx_credits >= credits,
691			("%s: not enough credits", __func__));
692
693		toep->tx_credits -= credits;
694		toep->tx_nocompl += credits;
695		toep->plen_nocompl += plen;
696		if (toep->tx_credits <= toep->tx_total * 3 / 8 &&
697		    toep->tx_nocompl >= toep->tx_total / 4)
698			compl = 1;
699
700		if (compl) {
701			txwr->op_to_immdlen |= htobe32(F_FW_WR_COMPL);
702			toep->tx_nocompl = 0;
703			toep->plen_nocompl = 0;
704		}
705
706		tp->snd_nxt += plen;
707		tp->snd_max += plen;
708
709		SOCKBUF_LOCK(sb);
710		KASSERT(sb_sndptr, ("%s: sb_sndptr is NULL", __func__));
711		sb->sb_sndptr = sb_sndptr;
712		SOCKBUF_UNLOCK(sb);
713
714		toep->flags |= TPF_TX_DATA_SENT;
715		if (toep->tx_credits < MIN_OFLD_TX_CREDITS)
716			toep->flags |= TPF_TX_SUSPENDED;
717
718		KASSERT(toep->txsd_avail > 0, ("%s: no txsd", __func__));
719		txsd->plen = plen;
720		txsd->tx_credits = credits;
721		txsd++;
722		if (__predict_false(++toep->txsd_pidx == toep->txsd_total)) {
723			toep->txsd_pidx = 0;
724			txsd = &toep->txsd[0];
725		}
726		toep->txsd_avail--;
727
728		t4_l2t_send(sc, wr, toep->l2te);
729	} while (m != NULL);
730
731	/* Send a FIN if requested, but only if there's no more data to send */
732	if (m == NULL && toep->flags & TPF_SEND_FIN)
733		close_conn(sc, toep);
734}
735
736int
737t4_tod_output(struct toedev *tod, struct tcpcb *tp)
738{
739	struct adapter *sc = tod->tod_softc;
740#ifdef INVARIANTS
741	struct inpcb *inp = tp->t_inpcb;
742#endif
743	struct toepcb *toep = tp->t_toe;
744
745	INP_WLOCK_ASSERT(inp);
746	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
747	    ("%s: inp %p dropped.", __func__, inp));
748	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
749
750	t4_push_frames(sc, toep, 0);
751
752	return (0);
753}
754
755int
756t4_send_fin(struct toedev *tod, struct tcpcb *tp)
757{
758	struct adapter *sc = tod->tod_softc;
759#ifdef INVARIANTS
760	struct inpcb *inp = tp->t_inpcb;
761#endif
762	struct toepcb *toep = tp->t_toe;
763
764	INP_WLOCK_ASSERT(inp);
765	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
766	    ("%s: inp %p dropped.", __func__, inp));
767	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
768
769	toep->flags |= TPF_SEND_FIN;
770	if (tp->t_state >= TCPS_ESTABLISHED)
771		t4_push_frames(sc, toep, 0);
772
773	return (0);
774}
775
776int
777t4_send_rst(struct toedev *tod, struct tcpcb *tp)
778{
779	struct adapter *sc = tod->tod_softc;
780#if defined(INVARIANTS)
781	struct inpcb *inp = tp->t_inpcb;
782#endif
783	struct toepcb *toep = tp->t_toe;
784
785	INP_WLOCK_ASSERT(inp);
786	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
787	    ("%s: inp %p dropped.", __func__, inp));
788	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
789
790	/* hmmmm */
791	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
792	    ("%s: flowc for tid %u [%s] not sent already",
793	    __func__, toep->tid, tcpstates[tp->t_state]));
794
795	send_reset(sc, toep, 0);
796	return (0);
797}
798
799/*
800 * Peer has sent us a FIN.
801 */
802static int
803do_peer_close(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
804{
805	struct adapter *sc = iq->adapter;
806	const struct cpl_peer_close *cpl = (const void *)(rss + 1);
807	unsigned int tid = GET_TID(cpl);
808	struct toepcb *toep = lookup_tid(sc, tid);
809	struct inpcb *inp = toep->inp;
810	struct tcpcb *tp = NULL;
811	struct socket *so;
812	struct sockbuf *sb;
813#ifdef INVARIANTS
814	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
815#endif
816
817	KASSERT(opcode == CPL_PEER_CLOSE,
818	    ("%s: unexpected opcode 0x%x", __func__, opcode));
819	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
820
821	if (__predict_false(toep->flags & TPF_SYNQE)) {
822#ifdef INVARIANTS
823		struct synq_entry *synqe = (void *)toep;
824
825		INP_WLOCK(synqe->lctx->inp);
826		if (synqe->flags & TPF_SYNQE_HAS_L2TE) {
827			KASSERT(synqe->flags & TPF_ABORT_SHUTDOWN,
828			    ("%s: listen socket closed but tid %u not aborted.",
829			    __func__, tid));
830		} else {
831			/*
832			 * do_pass_accept_req is still running and will
833			 * eventually take care of this tid.
834			 */
835		}
836		INP_WUNLOCK(synqe->lctx->inp);
837#endif
838		CTR4(KTR_CXGBE, "%s: tid %u, synqe %p (0x%x)", __func__, tid,
839		    toep, toep->flags);
840		return (0);
841	}
842
843	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
844
845	INP_INFO_WLOCK(&V_tcbinfo);
846	INP_WLOCK(inp);
847	tp = intotcpcb(inp);
848
849	CTR5(KTR_CXGBE, "%s: tid %u (%s), toep_flags 0x%x, inp %p", __func__,
850	    tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags, inp);
851
852	if (toep->flags & TPF_ABORT_SHUTDOWN)
853		goto done;
854
855	tp->rcv_nxt++;	/* FIN */
856
857	so = inp->inp_socket;
858	sb = &so->so_rcv;
859	SOCKBUF_LOCK(sb);
860	if (__predict_false(toep->ddp_flags & (DDP_BUF0_ACTIVE | DDP_BUF1_ACTIVE))) {
861		m = get_ddp_mbuf(be32toh(cpl->rcv_nxt) - tp->rcv_nxt);
862		tp->rcv_nxt = be32toh(cpl->rcv_nxt);
863		toep->ddp_flags &= ~(DDP_BUF0_ACTIVE | DDP_BUF1_ACTIVE);
864
865		KASSERT(toep->sb_cc >= sb->sb_cc,
866		    ("%s: sb %p has more data (%d) than last time (%d).",
867		    __func__, sb, sb->sb_cc, toep->sb_cc));
868		toep->rx_credits += toep->sb_cc - sb->sb_cc;
869#ifdef USE_DDP_RX_FLOW_CONTROL
870		toep->rx_credits -= m->m_len;	/* adjust for F_RX_FC_DDP */
871#endif
872		sbappendstream_locked(sb, m);
873		toep->sb_cc = sb->sb_cc;
874	}
875	socantrcvmore_locked(so);	/* unlocks the sockbuf */
876
877	KASSERT(tp->rcv_nxt == be32toh(cpl->rcv_nxt),
878	    ("%s: rcv_nxt mismatch: %u %u", __func__, tp->rcv_nxt,
879	    be32toh(cpl->rcv_nxt)));
880
881	switch (tp->t_state) {
882	case TCPS_SYN_RECEIVED:
883		tp->t_starttime = ticks;
884		/* FALLTHROUGH */
885
886	case TCPS_ESTABLISHED:
887		tp->t_state = TCPS_CLOSE_WAIT;
888		break;
889
890	case TCPS_FIN_WAIT_1:
891		tp->t_state = TCPS_CLOSING;
892		break;
893
894	case TCPS_FIN_WAIT_2:
895		tcp_twstart(tp);
896		INP_UNLOCK_ASSERT(inp);	 /* safe, we have a ref on the inp */
897		INP_INFO_WUNLOCK(&V_tcbinfo);
898
899		INP_WLOCK(inp);
900		final_cpl_received(toep);
901		return (0);
902
903	default:
904		log(LOG_ERR, "%s: TID %u received CPL_PEER_CLOSE in state %d\n",
905		    __func__, tid, tp->t_state);
906	}
907done:
908	INP_WUNLOCK(inp);
909	INP_INFO_WUNLOCK(&V_tcbinfo);
910	return (0);
911}
912
913/*
914 * Peer has ACK'd our FIN.
915 */
916static int
917do_close_con_rpl(struct sge_iq *iq, const struct rss_header *rss,
918    struct mbuf *m)
919{
920	struct adapter *sc = iq->adapter;
921	const struct cpl_close_con_rpl *cpl = (const void *)(rss + 1);
922	unsigned int tid = GET_TID(cpl);
923	struct toepcb *toep = lookup_tid(sc, tid);
924	struct inpcb *inp = toep->inp;
925	struct tcpcb *tp = NULL;
926	struct socket *so = NULL;
927#ifdef INVARIANTS
928	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
929#endif
930
931	KASSERT(opcode == CPL_CLOSE_CON_RPL,
932	    ("%s: unexpected opcode 0x%x", __func__, opcode));
933	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
934	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
935
936	INP_INFO_WLOCK(&V_tcbinfo);
937	INP_WLOCK(inp);
938	tp = intotcpcb(inp);
939
940	CTR4(KTR_CXGBE, "%s: tid %u (%s), toep_flags 0x%x",
941	    __func__, tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags);
942
943	if (toep->flags & TPF_ABORT_SHUTDOWN)
944		goto done;
945
946	so = inp->inp_socket;
947	tp->snd_una = be32toh(cpl->snd_nxt) - 1;	/* exclude FIN */
948
949	switch (tp->t_state) {
950	case TCPS_CLOSING:	/* see TCPS_FIN_WAIT_2 in do_peer_close too */
951		tcp_twstart(tp);
952release:
953		INP_UNLOCK_ASSERT(inp);	/* safe, we have a ref on the  inp */
954		INP_INFO_WUNLOCK(&V_tcbinfo);
955
956		INP_WLOCK(inp);
957		final_cpl_received(toep);	/* no more CPLs expected */
958
959		return (0);
960	case TCPS_LAST_ACK:
961		if (tcp_close(tp))
962			INP_WUNLOCK(inp);
963		goto release;
964
965	case TCPS_FIN_WAIT_1:
966		if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
967			soisdisconnected(so);
968		tp->t_state = TCPS_FIN_WAIT_2;
969		break;
970
971	default:
972		log(LOG_ERR,
973		    "%s: TID %u received CPL_CLOSE_CON_RPL in state %s\n",
974		    __func__, tid, tcpstates[tp->t_state]);
975	}
976done:
977	INP_WUNLOCK(inp);
978	INP_INFO_WUNLOCK(&V_tcbinfo);
979	return (0);
980}
981
982void
983send_abort_rpl(struct adapter *sc, struct sge_wrq *ofld_txq, int tid,
984    int rst_status)
985{
986	struct wrqe *wr;
987	struct cpl_abort_rpl *cpl;
988
989	wr = alloc_wrqe(sizeof(*cpl), ofld_txq);
990	if (wr == NULL) {
991		/* XXX */
992		panic("%s: allocation failure.", __func__);
993	}
994	cpl = wrtod(wr);
995
996	INIT_TP_WR_MIT_CPL(cpl, CPL_ABORT_RPL, tid);
997	cpl->cmd = rst_status;
998
999	t4_wrq_tx(sc, wr);
1000}
1001
1002static int
1003abort_status_to_errno(struct tcpcb *tp, unsigned int abort_reason)
1004{
1005	switch (abort_reason) {
1006	case CPL_ERR_BAD_SYN:
1007	case CPL_ERR_CONN_RESET:
1008		return (tp->t_state == TCPS_CLOSE_WAIT ? EPIPE : ECONNRESET);
1009	case CPL_ERR_XMIT_TIMEDOUT:
1010	case CPL_ERR_PERSIST_TIMEDOUT:
1011	case CPL_ERR_FINWAIT2_TIMEDOUT:
1012	case CPL_ERR_KEEPALIVE_TIMEDOUT:
1013		return (ETIMEDOUT);
1014	default:
1015		return (EIO);
1016	}
1017}
1018
1019/*
1020 * TCP RST from the peer, timeout, or some other such critical error.
1021 */
1022static int
1023do_abort_req(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1024{
1025	struct adapter *sc = iq->adapter;
1026	const struct cpl_abort_req_rss *cpl = (const void *)(rss + 1);
1027	unsigned int tid = GET_TID(cpl);
1028	struct toepcb *toep = lookup_tid(sc, tid);
1029	struct sge_wrq *ofld_txq = toep->ofld_txq;
1030	struct inpcb *inp;
1031	struct tcpcb *tp;
1032#ifdef INVARIANTS
1033	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1034#endif
1035
1036	KASSERT(opcode == CPL_ABORT_REQ_RSS,
1037	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1038	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1039
1040	if (toep->flags & TPF_SYNQE)
1041		return (do_abort_req_synqe(iq, rss, m));
1042
1043	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1044
1045	if (negative_advice(cpl->status)) {
1046		CTR4(KTR_CXGBE, "%s: negative advice %d for tid %d (0x%x)",
1047		    __func__, cpl->status, tid, toep->flags);
1048		return (0);	/* Ignore negative advice */
1049	}
1050
1051	inp = toep->inp;
1052	INP_INFO_WLOCK(&V_tcbinfo);	/* for tcp_close */
1053	INP_WLOCK(inp);
1054
1055	tp = intotcpcb(inp);
1056
1057	CTR6(KTR_CXGBE,
1058	    "%s: tid %d (%s), toep_flags 0x%x, inp_flags 0x%x, status %d",
1059	    __func__, tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags,
1060	    inp->inp_flags, cpl->status);
1061
1062	/*
1063	 * If we'd initiated an abort earlier the reply to it is responsible for
1064	 * cleaning up resources.  Otherwise we tear everything down right here
1065	 * right now.  We owe the T4 a CPL_ABORT_RPL no matter what.
1066	 */
1067	if (toep->flags & TPF_ABORT_SHUTDOWN) {
1068		INP_WUNLOCK(inp);
1069		goto done;
1070	}
1071	toep->flags |= TPF_ABORT_SHUTDOWN;
1072
1073	if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) == 0) {
1074		struct socket *so = inp->inp_socket;
1075
1076		if (so != NULL)
1077			so_error_set(so, abort_status_to_errno(tp,
1078			    cpl->status));
1079		tp = tcp_close(tp);
1080		if (tp == NULL)
1081			INP_WLOCK(inp);	/* re-acquire */
1082	}
1083
1084	final_cpl_received(toep);
1085done:
1086	INP_INFO_WUNLOCK(&V_tcbinfo);
1087	send_abort_rpl(sc, ofld_txq, tid, CPL_ABORT_NO_RST);
1088	return (0);
1089}
1090
1091/*
1092 * Reply to the CPL_ABORT_REQ (send_reset)
1093 */
1094static int
1095do_abort_rpl(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1096{
1097	struct adapter *sc = iq->adapter;
1098	const struct cpl_abort_rpl_rss *cpl = (const void *)(rss + 1);
1099	unsigned int tid = GET_TID(cpl);
1100	struct toepcb *toep = lookup_tid(sc, tid);
1101	struct inpcb *inp = toep->inp;
1102#ifdef INVARIANTS
1103	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1104#endif
1105
1106	KASSERT(opcode == CPL_ABORT_RPL_RSS,
1107	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1108	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1109
1110	if (toep->flags & TPF_SYNQE)
1111		return (do_abort_rpl_synqe(iq, rss, m));
1112
1113	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1114
1115	CTR5(KTR_CXGBE, "%s: tid %u, toep %p, inp %p, status %d",
1116	    __func__, tid, toep, inp, cpl->status);
1117
1118	KASSERT(toep->flags & TPF_ABORT_SHUTDOWN,
1119	    ("%s: wasn't expecting abort reply", __func__));
1120
1121	INP_WLOCK(inp);
1122	final_cpl_received(toep);
1123
1124	return (0);
1125}
1126
1127static int
1128do_rx_data(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1129{
1130	struct adapter *sc = iq->adapter;
1131	const struct cpl_rx_data *cpl = mtod(m, const void *);
1132	unsigned int tid = GET_TID(cpl);
1133	struct toepcb *toep = lookup_tid(sc, tid);
1134	struct inpcb *inp = toep->inp;
1135	struct tcpcb *tp;
1136	struct socket *so;
1137	struct sockbuf *sb;
1138	int len;
1139	uint32_t ddp_placed = 0;
1140
1141	if (__predict_false(toep->flags & TPF_SYNQE)) {
1142#ifdef INVARIANTS
1143		struct synq_entry *synqe = (void *)toep;
1144
1145		INP_WLOCK(synqe->lctx->inp);
1146		if (synqe->flags & TPF_SYNQE_HAS_L2TE) {
1147			KASSERT(synqe->flags & TPF_ABORT_SHUTDOWN,
1148			    ("%s: listen socket closed but tid %u not aborted.",
1149			    __func__, tid));
1150		} else {
1151			/*
1152			 * do_pass_accept_req is still running and will
1153			 * eventually take care of this tid.
1154			 */
1155		}
1156		INP_WUNLOCK(synqe->lctx->inp);
1157#endif
1158		CTR4(KTR_CXGBE, "%s: tid %u, synqe %p (0x%x)", __func__, tid,
1159		    toep, toep->flags);
1160		m_freem(m);
1161		return (0);
1162	}
1163
1164	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1165
1166	/* strip off CPL header */
1167	m_adj(m, sizeof(*cpl));
1168	len = m->m_pkthdr.len;
1169
1170	INP_WLOCK(inp);
1171	if (inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) {
1172		CTR4(KTR_CXGBE, "%s: tid %u, rx (%d bytes), inp_flags 0x%x",
1173		    __func__, tid, len, inp->inp_flags);
1174		INP_WUNLOCK(inp);
1175		m_freem(m);
1176		return (0);
1177	}
1178
1179	tp = intotcpcb(inp);
1180
1181	if (__predict_false(tp->rcv_nxt != be32toh(cpl->seq)))
1182		ddp_placed = be32toh(cpl->seq) - tp->rcv_nxt;
1183
1184	tp->rcv_nxt += len;
1185	KASSERT(tp->rcv_wnd >= len, ("%s: negative window size", __func__));
1186	tp->rcv_wnd -= len;
1187	tp->t_rcvtime = ticks;
1188
1189	so = inp_inpcbtosocket(inp);
1190	sb = &so->so_rcv;
1191	SOCKBUF_LOCK(sb);
1192
1193	if (__predict_false(sb->sb_state & SBS_CANTRCVMORE)) {
1194		CTR3(KTR_CXGBE, "%s: tid %u, excess rx (%d bytes)",
1195		    __func__, tid, len);
1196		m_freem(m);
1197		SOCKBUF_UNLOCK(sb);
1198		INP_WUNLOCK(inp);
1199
1200		INP_INFO_WLOCK(&V_tcbinfo);
1201		INP_WLOCK(inp);
1202		tp = tcp_drop(tp, ECONNRESET);
1203		if (tp)
1204			INP_WUNLOCK(inp);
1205		INP_INFO_WUNLOCK(&V_tcbinfo);
1206
1207		return (0);
1208	}
1209
1210	/* receive buffer autosize */
1211	if (sb->sb_flags & SB_AUTOSIZE &&
1212	    V_tcp_do_autorcvbuf &&
1213	    sb->sb_hiwat < V_tcp_autorcvbuf_max &&
1214	    len > (sbspace(sb) / 8 * 7)) {
1215		unsigned int hiwat = sb->sb_hiwat;
1216		unsigned int newsize = min(hiwat + V_tcp_autorcvbuf_inc,
1217		    V_tcp_autorcvbuf_max);
1218
1219		if (!sbreserve_locked(sb, newsize, so, NULL))
1220			sb->sb_flags &= ~SB_AUTOSIZE;
1221		else
1222			toep->rx_credits += newsize - hiwat;
1223	}
1224
1225	if (toep->ulp_mode == ULP_MODE_TCPDDP) {
1226		int changed = !(toep->ddp_flags & DDP_ON) ^ cpl->ddp_off;
1227
1228		if (changed) {
1229			if (toep->ddp_flags & DDP_SC_REQ)
1230				toep->ddp_flags ^= DDP_ON | DDP_SC_REQ;
1231			else {
1232				KASSERT(cpl->ddp_off == 1,
1233				    ("%s: DDP switched on by itself.",
1234				    __func__));
1235
1236				/* Fell out of DDP mode */
1237				toep->ddp_flags &= ~(DDP_ON | DDP_BUF0_ACTIVE |
1238				    DDP_BUF1_ACTIVE);
1239
1240				if (ddp_placed)
1241					insert_ddp_data(toep, ddp_placed);
1242			}
1243		}
1244
1245		if ((toep->ddp_flags & DDP_OK) == 0 &&
1246		    time_uptime >= toep->ddp_disabled + DDP_RETRY_WAIT) {
1247			toep->ddp_score = DDP_LOW_SCORE;
1248			toep->ddp_flags |= DDP_OK;
1249			CTR3(KTR_CXGBE, "%s: tid %u DDP_OK @ %u",
1250			    __func__, tid, time_uptime);
1251		}
1252
1253		if (toep->ddp_flags & DDP_ON) {
1254
1255			/*
1256			 * CPL_RX_DATA with DDP on can only be an indicate.  Ask
1257			 * soreceive to post a buffer or disable DDP.  The
1258			 * payload that arrived in this indicate is appended to
1259			 * the socket buffer as usual.
1260			 */
1261
1262#if 0
1263			CTR5(KTR_CXGBE,
1264			    "%s: tid %u (0x%x) DDP indicate (seq 0x%x, len %d)",
1265			    __func__, tid, toep->flags, be32toh(cpl->seq), len);
1266#endif
1267			sb->sb_flags |= SB_DDP_INDICATE;
1268		} else if ((toep->ddp_flags & (DDP_OK|DDP_SC_REQ)) == DDP_OK &&
1269		    tp->rcv_wnd > DDP_RSVD_WIN && len >= sc->tt.ddp_thres) {
1270
1271			/*
1272			 * DDP allowed but isn't on (and a request to switch it
1273			 * on isn't pending either), and conditions are ripe for
1274			 * it to work.  Switch it on.
1275			 */
1276
1277			enable_ddp(sc, toep);
1278		}
1279	}
1280
1281	KASSERT(toep->sb_cc >= sb->sb_cc,
1282	    ("%s: sb %p has more data (%d) than last time (%d).",
1283	    __func__, sb, sb->sb_cc, toep->sb_cc));
1284	toep->rx_credits += toep->sb_cc - sb->sb_cc;
1285	sbappendstream_locked(sb, m);
1286	toep->sb_cc = sb->sb_cc;
1287	sorwakeup_locked(so);
1288	SOCKBUF_UNLOCK_ASSERT(sb);
1289
1290	INP_WUNLOCK(inp);
1291	return (0);
1292}
1293
1294#define S_CPL_FW4_ACK_OPCODE    24
1295#define M_CPL_FW4_ACK_OPCODE    0xff
1296#define V_CPL_FW4_ACK_OPCODE(x) ((x) << S_CPL_FW4_ACK_OPCODE)
1297#define G_CPL_FW4_ACK_OPCODE(x) \
1298    (((x) >> S_CPL_FW4_ACK_OPCODE) & M_CPL_FW4_ACK_OPCODE)
1299
1300#define S_CPL_FW4_ACK_FLOWID    0
1301#define M_CPL_FW4_ACK_FLOWID    0xffffff
1302#define V_CPL_FW4_ACK_FLOWID(x) ((x) << S_CPL_FW4_ACK_FLOWID)
1303#define G_CPL_FW4_ACK_FLOWID(x) \
1304    (((x) >> S_CPL_FW4_ACK_FLOWID) & M_CPL_FW4_ACK_FLOWID)
1305
1306#define S_CPL_FW4_ACK_CR        24
1307#define M_CPL_FW4_ACK_CR        0xff
1308#define V_CPL_FW4_ACK_CR(x)     ((x) << S_CPL_FW4_ACK_CR)
1309#define G_CPL_FW4_ACK_CR(x)     (((x) >> S_CPL_FW4_ACK_CR) & M_CPL_FW4_ACK_CR)
1310
1311#define S_CPL_FW4_ACK_SEQVAL    0
1312#define M_CPL_FW4_ACK_SEQVAL    0x1
1313#define V_CPL_FW4_ACK_SEQVAL(x) ((x) << S_CPL_FW4_ACK_SEQVAL)
1314#define G_CPL_FW4_ACK_SEQVAL(x) \
1315    (((x) >> S_CPL_FW4_ACK_SEQVAL) & M_CPL_FW4_ACK_SEQVAL)
1316#define F_CPL_FW4_ACK_SEQVAL    V_CPL_FW4_ACK_SEQVAL(1U)
1317
1318static int
1319do_fw4_ack(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1320{
1321	struct adapter *sc = iq->adapter;
1322	const struct cpl_fw4_ack *cpl = (const void *)(rss + 1);
1323	unsigned int tid = G_CPL_FW4_ACK_FLOWID(be32toh(OPCODE_TID(cpl)));
1324	struct toepcb *toep = lookup_tid(sc, tid);
1325	struct inpcb *inp;
1326	struct tcpcb *tp;
1327	struct socket *so;
1328	uint8_t credits = cpl->credits;
1329	struct ofld_tx_sdesc *txsd;
1330	int plen;
1331#ifdef INVARIANTS
1332	unsigned int opcode = G_CPL_FW4_ACK_OPCODE(be32toh(OPCODE_TID(cpl)));
1333#endif
1334
1335	/*
1336	 * Very unusual case: we'd sent a flowc + abort_req for a synq entry and
1337	 * now this comes back carrying the credits for the flowc.
1338	 */
1339	if (__predict_false(toep->flags & TPF_SYNQE)) {
1340		KASSERT(toep->flags & TPF_ABORT_SHUTDOWN,
1341		    ("%s: credits for a synq entry %p", __func__, toep));
1342		return (0);
1343	}
1344
1345	inp = toep->inp;
1346
1347	KASSERT(opcode == CPL_FW4_ACK,
1348	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1349	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1350	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1351
1352	INP_WLOCK(inp);
1353
1354	if (__predict_false(toep->flags & TPF_ABORT_SHUTDOWN)) {
1355		INP_WUNLOCK(inp);
1356		return (0);
1357	}
1358
1359	KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0,
1360	    ("%s: inp_flags 0x%x", __func__, inp->inp_flags));
1361
1362	tp = intotcpcb(inp);
1363
1364	if (cpl->flags & CPL_FW4_ACK_FLAGS_SEQVAL) {
1365		tcp_seq snd_una = be32toh(cpl->snd_una);
1366
1367#ifdef INVARIANTS
1368		if (__predict_false(SEQ_LT(snd_una, tp->snd_una))) {
1369			log(LOG_ERR,
1370			    "%s: unexpected seq# %x for TID %u, snd_una %x\n",
1371			    __func__, snd_una, toep->tid, tp->snd_una);
1372		}
1373#endif
1374
1375		if (tp->snd_una != snd_una) {
1376			tp->snd_una = snd_una;
1377			tp->ts_recent_age = tcp_ts_getticks();
1378		}
1379	}
1380
1381	so = inp->inp_socket;
1382	txsd = &toep->txsd[toep->txsd_cidx];
1383	plen = 0;
1384	while (credits) {
1385		KASSERT(credits >= txsd->tx_credits,
1386		    ("%s: too many (or partial) credits", __func__));
1387		credits -= txsd->tx_credits;
1388		toep->tx_credits += txsd->tx_credits;
1389		plen += txsd->plen;
1390		txsd++;
1391		toep->txsd_avail++;
1392		KASSERT(toep->txsd_avail <= toep->txsd_total,
1393		    ("%s: txsd avail > total", __func__));
1394		if (__predict_false(++toep->txsd_cidx == toep->txsd_total)) {
1395			txsd = &toep->txsd[0];
1396			toep->txsd_cidx = 0;
1397		}
1398	}
1399
1400	if (toep->tx_credits == toep->tx_total) {
1401		toep->tx_nocompl = 0;
1402		toep->plen_nocompl = 0;
1403	}
1404
1405	if (toep->flags & TPF_TX_SUSPENDED &&
1406	    toep->tx_credits >= toep->tx_total / 4) {
1407		toep->flags &= ~TPF_TX_SUSPENDED;
1408		t4_push_frames(sc, toep, plen);
1409	} else if (plen > 0) {
1410		struct sockbuf *sb = &so->so_snd;
1411
1412		SOCKBUF_LOCK(sb);
1413		sbdrop_locked(sb, plen);
1414		sowwakeup_locked(so);
1415		SOCKBUF_UNLOCK_ASSERT(sb);
1416	}
1417
1418	INP_WUNLOCK(inp);
1419
1420	return (0);
1421}
1422
1423static int
1424do_set_tcb_rpl(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1425{
1426	struct adapter *sc = iq->adapter;
1427	const struct cpl_set_tcb_rpl *cpl = (const void *)(rss + 1);
1428	unsigned int tid = GET_TID(cpl);
1429#ifdef INVARIANTS
1430	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1431#endif
1432
1433	KASSERT(opcode == CPL_SET_TCB_RPL,
1434	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1435	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1436
1437	if (is_ftid(sc, tid))
1438		return (t4_filter_rpl(iq, rss, m)); /* TCB is a filter */
1439
1440	CXGBE_UNIMPLEMENTED(__func__);
1441}
1442
1443void
1444t4_set_tcb_field(struct adapter *sc, struct toepcb *toep, int ctrl,
1445    uint16_t word, uint64_t mask, uint64_t val)
1446{
1447	struct wrqe *wr;
1448	struct cpl_set_tcb_field *req;
1449
1450	wr = alloc_wrqe(sizeof(*req), ctrl ? toep->ctrlq : toep->ofld_txq);
1451	if (wr == NULL) {
1452		/* XXX */
1453		panic("%s: allocation failure.", __func__);
1454	}
1455	req = wrtod(wr);
1456
1457	INIT_TP_WR_MIT_CPL(req, CPL_SET_TCB_FIELD, toep->tid);
1458	req->reply_ctrl = htobe16(V_NO_REPLY(1) |
1459	    V_QUEUENO(toep->ofld_rxq->iq.abs_id));
1460	req->word_cookie = htobe16(V_WORD(word) | V_COOKIE(0));
1461	req->mask = htobe64(mask);
1462	req->val = htobe64(val);
1463
1464	t4_wrq_tx(sc, wr);
1465}
1466
1467void
1468t4_init_cpl_io_handlers(struct adapter *sc)
1469{
1470
1471	t4_register_cpl_handler(sc, CPL_PEER_CLOSE, do_peer_close);
1472	t4_register_cpl_handler(sc, CPL_CLOSE_CON_RPL, do_close_con_rpl);
1473	t4_register_cpl_handler(sc, CPL_ABORT_REQ_RSS, do_abort_req);
1474	t4_register_cpl_handler(sc, CPL_ABORT_RPL_RSS, do_abort_rpl);
1475	t4_register_cpl_handler(sc, CPL_RX_DATA, do_rx_data);
1476	t4_register_cpl_handler(sc, CPL_FW4_ACK, do_fw4_ack);
1477	t4_register_cpl_handler(sc, CPL_SET_TCB_RPL, do_set_tcb_rpl);
1478}
1479
1480void
1481t4_uninit_cpl_io_handlers(struct adapter *sc)
1482{
1483
1484	t4_register_cpl_handler(sc, CPL_SET_TCB_RPL, t4_filter_rpl);
1485}
1486#endif
1487