1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause OR GPL-2.0
3  *
4  * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
5  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
6  * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
7  * Copyright (c) 2009 HNR Consulting. All rights reserved.
8  * Copyright (c) 2014 Intel Corporation.  All rights reserved.
9  *
10  * This software is available to you under a choice of one of two
11  * licenses.  You may choose to be licensed under the terms of the GNU
12  * General Public License (GPL) Version 2, available from the file
13  * COPYING in the main directory of this source tree, or the
14  * OpenIB.org BSD license below:
15  *
16  *     Redistribution and use in source and binary forms, with or
17  *     without modification, are permitted provided that the following
18  *     conditions are met:
19  *
20  *      - Redistributions of source code must retain the above
21  *        copyright notice, this list of conditions and the following
22  *        disclaimer.
23  *
24  *      - Redistributions in binary form must reproduce the above
25  *        copyright notice, this list of conditions and the following
26  *        disclaimer in the documentation and/or other materials
27  *        provided with the distribution.
28  *
29  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
30  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
31  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
32  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
33  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
34  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
35  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36  * SOFTWARE.
37  */
38 
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41 
42 #define	LINUXKPI_PARAM_PREFIX ibcore_
43 #define	KBUILD_MODNAME "ibcore"
44 
45 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
46 
47 #include <linux/dma-mapping.h>
48 #include <linux/slab.h>
49 #include <linux/module.h>
50 #include <rdma/ib_cache.h>
51 
52 #include "mad_priv.h"
53 #include "mad_rmpp.h"
54 #include "smi.h"
55 #include "opa_smi.h"
56 #include "agent.h"
57 #include "core_priv.h"
58 
59 static int mad_sendq_size = IB_MAD_QP_SEND_SIZE;
60 static int mad_recvq_size = IB_MAD_QP_RECV_SIZE;
61 
62 module_param_named(send_queue_size, mad_sendq_size, int, 0444);
63 MODULE_PARM_DESC(send_queue_size, "Size of send queue in number of work requests");
64 module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
65 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
66 
67 static struct list_head ib_mad_port_list;
68 static u32 ib_mad_client_id = 0;
69 
70 /* Port list lock */
71 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
72 
73 /* Forward declarations */
74 static int method_in_use(struct ib_mad_mgmt_method_table **method,
75 			 struct ib_mad_reg_req *mad_reg_req);
76 static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
77 static struct ib_mad_agent_private *find_mad_agent(
78 					struct ib_mad_port_private *port_priv,
79 					const struct ib_mad_hdr *mad);
80 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
81 				    struct ib_mad_private *mad);
82 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
83 static void timeout_sends(struct work_struct *work);
84 static void local_completions(struct work_struct *work);
85 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
86 			      struct ib_mad_agent_private *agent_priv,
87 			      u8 mgmt_class);
88 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
89 			   struct ib_mad_agent_private *agent_priv);
90 static bool ib_mad_send_error(struct ib_mad_port_private *port_priv,
91 			      struct ib_wc *wc);
92 static void ib_mad_send_done(struct ib_cq *cq, struct ib_wc *wc);
93 
94 /*
95  * Returns a ib_mad_port_private structure or NULL for a device/port
96  * Assumes ib_mad_port_list_lock is being held
97  */
98 static inline struct ib_mad_port_private *
99 __ib_get_mad_port(struct ib_device *device, int port_num)
100 {
101 	struct ib_mad_port_private *entry;
102 
103 	list_for_each_entry(entry, &ib_mad_port_list, port_list) {
104 		if (entry->device == device && entry->port_num == port_num)
105 			return entry;
106 	}
107 	return NULL;
108 }
109 
110 /*
111  * Wrapper function to return a ib_mad_port_private structure or NULL
112  * for a device/port
113  */
114 static inline struct ib_mad_port_private *
115 ib_get_mad_port(struct ib_device *device, int port_num)
116 {
117 	struct ib_mad_port_private *entry;
118 	unsigned long flags;
119 
120 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
121 	entry = __ib_get_mad_port(device, port_num);
122 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
123 
124 	return entry;
125 }
126 
127 static inline u8 convert_mgmt_class(u8 mgmt_class)
128 {
129 	/* Alias IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE to 0 */
130 	return mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE ?
131 		0 : mgmt_class;
132 }
133 
134 static int get_spl_qp_index(enum ib_qp_type qp_type)
135 {
136 	switch (qp_type)
137 	{
138 	case IB_QPT_SMI:
139 		return 0;
140 	case IB_QPT_GSI:
141 		return 1;
142 	default:
143 		return -1;
144 	}
145 }
146 
147 static int vendor_class_index(u8 mgmt_class)
148 {
149 	return mgmt_class - IB_MGMT_CLASS_VENDOR_RANGE2_START;
150 }
151 
152 static int is_vendor_class(u8 mgmt_class)
153 {
154 	if ((mgmt_class < IB_MGMT_CLASS_VENDOR_RANGE2_START) ||
155 	    (mgmt_class > IB_MGMT_CLASS_VENDOR_RANGE2_END))
156 		return 0;
157 	return 1;
158 }
159 
160 static int is_vendor_oui(char *oui)
161 {
162 	if (oui[0] || oui[1] || oui[2])
163 		return 1;
164 	return 0;
165 }
166 
167 static int is_vendor_method_in_use(
168 		struct ib_mad_mgmt_vendor_class *vendor_class,
169 		struct ib_mad_reg_req *mad_reg_req)
170 {
171 	struct ib_mad_mgmt_method_table *method;
172 	int i;
173 
174 	for (i = 0; i < MAX_MGMT_OUI; i++) {
175 		if (!memcmp(vendor_class->oui[i], mad_reg_req->oui, 3)) {
176 			method = vendor_class->method_table[i];
177 			if (method) {
178 				if (method_in_use(&method, mad_reg_req))
179 					return 1;
180 				else
181 					break;
182 			}
183 		}
184 	}
185 	return 0;
186 }
187 
188 int ib_response_mad(const struct ib_mad_hdr *hdr)
189 {
190 	return ((hdr->method & IB_MGMT_METHOD_RESP) ||
191 		(hdr->method == IB_MGMT_METHOD_TRAP_REPRESS) ||
192 		((hdr->mgmt_class == IB_MGMT_CLASS_BM) &&
193 		 (hdr->attr_mod & IB_BM_ATTR_MOD_RESP)));
194 }
195 EXPORT_SYMBOL(ib_response_mad);
196 
197 /*
198  * ib_register_mad_agent - Register to send/receive MADs
199  */
200 struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
201 					   u8 port_num,
202 					   enum ib_qp_type qp_type,
203 					   struct ib_mad_reg_req *mad_reg_req,
204 					   u8 rmpp_version,
205 					   ib_mad_send_handler send_handler,
206 					   ib_mad_recv_handler recv_handler,
207 					   void *context,
208 					   u32 registration_flags)
209 {
210 	struct ib_mad_port_private *port_priv;
211 	struct ib_mad_agent *ret = ERR_PTR(-EINVAL);
212 	struct ib_mad_agent_private *mad_agent_priv;
213 	struct ib_mad_reg_req *reg_req = NULL;
214 	struct ib_mad_mgmt_class_table *class;
215 	struct ib_mad_mgmt_vendor_class_table *vendor;
216 	struct ib_mad_mgmt_vendor_class *vendor_class;
217 	struct ib_mad_mgmt_method_table *method;
218 	int ret2, qpn;
219 	unsigned long flags;
220 	u8 mgmt_class, vclass;
221 
222 	/* Validate parameters */
223 	qpn = get_spl_qp_index(qp_type);
224 	if (qpn == -1) {
225 		dev_notice(&device->dev,
226 			   "ib_register_mad_agent: invalid QP Type %d\n",
227 			   qp_type);
228 		goto error1;
229 	}
230 
231 	if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
232 		dev_notice(&device->dev,
233 			   "ib_register_mad_agent: invalid RMPP Version %u\n",
234 			   rmpp_version);
235 		goto error1;
236 	}
237 
238 	/* Validate MAD registration request if supplied */
239 	if (mad_reg_req) {
240 		if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
241 			dev_notice(&device->dev,
242 				   "ib_register_mad_agent: invalid Class Version %u\n",
243 				   mad_reg_req->mgmt_class_version);
244 			goto error1;
245 		}
246 		if (!recv_handler) {
247 			dev_notice(&device->dev,
248 				   "ib_register_mad_agent: no recv_handler\n");
249 			goto error1;
250 		}
251 		if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
252 			/*
253 			 * IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE is the only
254 			 * one in this range currently allowed
255 			 */
256 			if (mad_reg_req->mgmt_class !=
257 			    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
258 				dev_notice(&device->dev,
259 					   "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
260 					   mad_reg_req->mgmt_class);
261 				goto error1;
262 			}
263 		} else if (mad_reg_req->mgmt_class == 0) {
264 			/*
265 			 * Class 0 is reserved in IBA and is used for
266 			 * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
267 			 */
268 			dev_notice(&device->dev,
269 				   "ib_register_mad_agent: Invalid Mgmt Class 0\n");
270 			goto error1;
271 		} else if (is_vendor_class(mad_reg_req->mgmt_class)) {
272 			/*
273 			 * If class is in "new" vendor range,
274 			 * ensure supplied OUI is not zero
275 			 */
276 			if (!is_vendor_oui(mad_reg_req->oui)) {
277 				dev_notice(&device->dev,
278 					   "ib_register_mad_agent: No OUI specified for class 0x%x\n",
279 					   mad_reg_req->mgmt_class);
280 				goto error1;
281 			}
282 		}
283 		/* Make sure class supplied is consistent with RMPP */
284 		if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
285 			if (rmpp_version) {
286 				dev_notice(&device->dev,
287 					   "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
288 					   mad_reg_req->mgmt_class);
289 				goto error1;
290 			}
291 		}
292 
293 		/* Make sure class supplied is consistent with QP type */
294 		if (qp_type == IB_QPT_SMI) {
295 			if ((mad_reg_req->mgmt_class !=
296 					IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
297 			    (mad_reg_req->mgmt_class !=
298 					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
299 				dev_notice(&device->dev,
300 					   "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
301 					   mad_reg_req->mgmt_class);
302 				goto error1;
303 			}
304 		} else {
305 			if ((mad_reg_req->mgmt_class ==
306 					IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
307 			    (mad_reg_req->mgmt_class ==
308 					IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
309 				dev_notice(&device->dev,
310 					   "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
311 					   mad_reg_req->mgmt_class);
312 				goto error1;
313 			}
314 		}
315 	} else {
316 		/* No registration request supplied */
317 		if (!send_handler)
318 			goto error1;
319 		if (registration_flags & IB_MAD_USER_RMPP)
320 			goto error1;
321 	}
322 
323 	/* Validate device and port */
324 	port_priv = ib_get_mad_port(device, port_num);
325 	if (!port_priv) {
326 		dev_notice(&device->dev, "ib_register_mad_agent: Invalid port\n");
327 		ret = ERR_PTR(-ENODEV);
328 		goto error1;
329 	}
330 
331 	/* Verify the QP requested is supported.  For example, Ethernet devices
332 	 * will not have QP0 */
333 	if (!port_priv->qp_info[qpn].qp) {
334 		dev_notice(&device->dev,
335 			   "ib_register_mad_agent: QP %d not supported\n", qpn);
336 		ret = ERR_PTR(-EPROTONOSUPPORT);
337 		goto error1;
338 	}
339 
340 	/* Allocate structures */
341 	mad_agent_priv = kzalloc(sizeof *mad_agent_priv, GFP_KERNEL);
342 	if (!mad_agent_priv) {
343 		ret = ERR_PTR(-ENOMEM);
344 		goto error1;
345 	}
346 
347 	if (mad_reg_req) {
348 		reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
349 		if (!reg_req) {
350 			ret = ERR_PTR(-ENOMEM);
351 			goto error3;
352 		}
353 	}
354 
355 	/* Now, fill in the various structures */
356 	mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
357 	mad_agent_priv->reg_req = reg_req;
358 	mad_agent_priv->agent.rmpp_version = rmpp_version;
359 	mad_agent_priv->agent.device = device;
360 	mad_agent_priv->agent.recv_handler = recv_handler;
361 	mad_agent_priv->agent.send_handler = send_handler;
362 	mad_agent_priv->agent.context = context;
363 	mad_agent_priv->agent.qp = port_priv->qp_info[qpn].qp;
364 	mad_agent_priv->agent.port_num = port_num;
365 	mad_agent_priv->agent.flags = registration_flags;
366 	spin_lock_init(&mad_agent_priv->lock);
367 	INIT_LIST_HEAD(&mad_agent_priv->send_list);
368 	INIT_LIST_HEAD(&mad_agent_priv->wait_list);
369 	INIT_LIST_HEAD(&mad_agent_priv->done_list);
370 	INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
371 	INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
372 	INIT_LIST_HEAD(&mad_agent_priv->local_list);
373 	INIT_WORK(&mad_agent_priv->local_work, local_completions);
374 	atomic_set(&mad_agent_priv->refcount, 1);
375 	init_completion(&mad_agent_priv->comp);
376 
377 	spin_lock_irqsave(&port_priv->reg_lock, flags);
378 	mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
379 
380 	/*
381 	 * Make sure MAD registration (if supplied)
382 	 * is non overlapping with any existing ones
383 	 */
384 	if (mad_reg_req) {
385 		mgmt_class = convert_mgmt_class(mad_reg_req->mgmt_class);
386 		if (!is_vendor_class(mgmt_class)) {
387 			class = port_priv->version[mad_reg_req->
388 						   mgmt_class_version].class;
389 			if (class) {
390 				method = class->method_table[mgmt_class];
391 				if (method) {
392 					if (method_in_use(&method,
393 							   mad_reg_req))
394 						goto error4;
395 				}
396 			}
397 			ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
398 						  mgmt_class);
399 		} else {
400 			/* "New" vendor class range */
401 			vendor = port_priv->version[mad_reg_req->
402 						    mgmt_class_version].vendor;
403 			if (vendor) {
404 				vclass = vendor_class_index(mgmt_class);
405 				vendor_class = vendor->vendor_class[vclass];
406 				if (vendor_class) {
407 					if (is_vendor_method_in_use(
408 							vendor_class,
409 							mad_reg_req))
410 						goto error4;
411 				}
412 			}
413 			ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
414 		}
415 		if (ret2) {
416 			ret = ERR_PTR(ret2);
417 			goto error4;
418 		}
419 	}
420 
421 	/* Add mad agent into port's agent list */
422 	list_add_tail(&mad_agent_priv->agent_list, &port_priv->agent_list);
423 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
424 
425 	return &mad_agent_priv->agent;
426 
427 error4:
428 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
429 	kfree(reg_req);
430 error3:
431 	kfree(mad_agent_priv);
432 error1:
433 	return ret;
434 }
435 EXPORT_SYMBOL(ib_register_mad_agent);
436 
437 static inline int is_snooping_sends(int mad_snoop_flags)
438 {
439 	return (mad_snoop_flags &
440 		(/*IB_MAD_SNOOP_POSTED_SENDS |
441 		 IB_MAD_SNOOP_RMPP_SENDS |*/
442 		 IB_MAD_SNOOP_SEND_COMPLETIONS /*|
443 		 IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS*/));
444 }
445 
446 static inline int is_snooping_recvs(int mad_snoop_flags)
447 {
448 	return (mad_snoop_flags &
449 		(IB_MAD_SNOOP_RECVS /*|
450 		 IB_MAD_SNOOP_RMPP_RECVS*/));
451 }
452 
453 static int register_snoop_agent(struct ib_mad_qp_info *qp_info,
454 				struct ib_mad_snoop_private *mad_snoop_priv)
455 {
456 	struct ib_mad_snoop_private **new_snoop_table;
457 	unsigned long flags;
458 	int i;
459 
460 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
461 	/* Check for empty slot in array. */
462 	for (i = 0; i < qp_info->snoop_table_size; i++)
463 		if (!qp_info->snoop_table[i])
464 			break;
465 
466 	if (i == qp_info->snoop_table_size) {
467 		/* Grow table. */
468 		new_snoop_table = krealloc(qp_info->snoop_table,
469 					   sizeof mad_snoop_priv *
470 					   (qp_info->snoop_table_size + 1),
471 					   GFP_ATOMIC);
472 		if (!new_snoop_table) {
473 			i = -ENOMEM;
474 			goto out;
475 		}
476 
477 		qp_info->snoop_table = new_snoop_table;
478 		qp_info->snoop_table_size++;
479 	}
480 	qp_info->snoop_table[i] = mad_snoop_priv;
481 	atomic_inc(&qp_info->snoop_count);
482 out:
483 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
484 	return i;
485 }
486 
487 struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
488 					   u8 port_num,
489 					   enum ib_qp_type qp_type,
490 					   int mad_snoop_flags,
491 					   ib_mad_snoop_handler snoop_handler,
492 					   ib_mad_recv_handler recv_handler,
493 					   void *context)
494 {
495 	struct ib_mad_port_private *port_priv;
496 	struct ib_mad_agent *ret;
497 	struct ib_mad_snoop_private *mad_snoop_priv;
498 	int qpn;
499 
500 	/* Validate parameters */
501 	if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) ||
502 	    (is_snooping_recvs(mad_snoop_flags) && !recv_handler)) {
503 		ret = ERR_PTR(-EINVAL);
504 		goto error1;
505 	}
506 	qpn = get_spl_qp_index(qp_type);
507 	if (qpn == -1) {
508 		ret = ERR_PTR(-EINVAL);
509 		goto error1;
510 	}
511 	port_priv = ib_get_mad_port(device, port_num);
512 	if (!port_priv) {
513 		ret = ERR_PTR(-ENODEV);
514 		goto error1;
515 	}
516 	/* Allocate structures */
517 	mad_snoop_priv = kzalloc(sizeof *mad_snoop_priv, GFP_KERNEL);
518 	if (!mad_snoop_priv) {
519 		ret = ERR_PTR(-ENOMEM);
520 		goto error1;
521 	}
522 
523 	/* Now, fill in the various structures */
524 	mad_snoop_priv->qp_info = &port_priv->qp_info[qpn];
525 	mad_snoop_priv->agent.device = device;
526 	mad_snoop_priv->agent.recv_handler = recv_handler;
527 	mad_snoop_priv->agent.snoop_handler = snoop_handler;
528 	mad_snoop_priv->agent.context = context;
529 	mad_snoop_priv->agent.qp = port_priv->qp_info[qpn].qp;
530 	mad_snoop_priv->agent.port_num = port_num;
531 	mad_snoop_priv->mad_snoop_flags = mad_snoop_flags;
532 	init_completion(&mad_snoop_priv->comp);
533 	mad_snoop_priv->snoop_index = register_snoop_agent(
534 						&port_priv->qp_info[qpn],
535 						mad_snoop_priv);
536 	if (mad_snoop_priv->snoop_index < 0) {
537 		ret = ERR_PTR(mad_snoop_priv->snoop_index);
538 		goto error2;
539 	}
540 
541 	atomic_set(&mad_snoop_priv->refcount, 1);
542 	return &mad_snoop_priv->agent;
543 
544 error2:
545 	kfree(mad_snoop_priv);
546 error1:
547 	return ret;
548 }
549 EXPORT_SYMBOL(ib_register_mad_snoop);
550 
551 static inline void deref_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
552 {
553 	if (atomic_dec_and_test(&mad_agent_priv->refcount))
554 		complete(&mad_agent_priv->comp);
555 }
556 
557 static inline void deref_snoop_agent(struct ib_mad_snoop_private *mad_snoop_priv)
558 {
559 	if (atomic_dec_and_test(&mad_snoop_priv->refcount))
560 		complete(&mad_snoop_priv->comp);
561 }
562 
563 static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
564 {
565 	struct ib_mad_port_private *port_priv;
566 	unsigned long flags;
567 
568 	/* Note that we could still be handling received MADs */
569 
570 	/*
571 	 * Canceling all sends results in dropping received response
572 	 * MADs, preventing us from queuing additional work
573 	 */
574 	cancel_mads(mad_agent_priv);
575 	port_priv = mad_agent_priv->qp_info->port_priv;
576 	cancel_delayed_work_sync(&mad_agent_priv->timed_work);
577 
578 	spin_lock_irqsave(&port_priv->reg_lock, flags);
579 	remove_mad_reg_req(mad_agent_priv);
580 	list_del(&mad_agent_priv->agent_list);
581 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
582 
583 	flush_workqueue(port_priv->wq);
584 	ib_cancel_rmpp_recvs(mad_agent_priv);
585 
586 	deref_mad_agent(mad_agent_priv);
587 	wait_for_completion(&mad_agent_priv->comp);
588 
589 	kfree(mad_agent_priv->reg_req);
590 	kfree(mad_agent_priv);
591 }
592 
593 static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv)
594 {
595 	struct ib_mad_qp_info *qp_info;
596 	unsigned long flags;
597 
598 	qp_info = mad_snoop_priv->qp_info;
599 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
600 	qp_info->snoop_table[mad_snoop_priv->snoop_index] = NULL;
601 	atomic_dec(&qp_info->snoop_count);
602 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
603 
604 	deref_snoop_agent(mad_snoop_priv);
605 	wait_for_completion(&mad_snoop_priv->comp);
606 
607 	kfree(mad_snoop_priv);
608 }
609 
610 /*
611  * ib_unregister_mad_agent - Unregisters a client from using MAD services
612  */
613 int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
614 {
615 	struct ib_mad_agent_private *mad_agent_priv;
616 	struct ib_mad_snoop_private *mad_snoop_priv;
617 
618 	/* If the TID is zero, the agent can only snoop. */
619 	if (mad_agent->hi_tid) {
620 		mad_agent_priv = container_of(mad_agent,
621 					      struct ib_mad_agent_private,
622 					      agent);
623 		unregister_mad_agent(mad_agent_priv);
624 	} else {
625 		mad_snoop_priv = container_of(mad_agent,
626 					      struct ib_mad_snoop_private,
627 					      agent);
628 		unregister_mad_snoop(mad_snoop_priv);
629 	}
630 	return 0;
631 }
632 EXPORT_SYMBOL(ib_unregister_mad_agent);
633 
634 static void dequeue_mad(struct ib_mad_list_head *mad_list)
635 {
636 	struct ib_mad_queue *mad_queue;
637 	unsigned long flags;
638 
639 	BUG_ON(!mad_list->mad_queue);
640 	mad_queue = mad_list->mad_queue;
641 	spin_lock_irqsave(&mad_queue->lock, flags);
642 	list_del(&mad_list->list);
643 	mad_queue->count--;
644 	spin_unlock_irqrestore(&mad_queue->lock, flags);
645 }
646 
647 static void snoop_send(struct ib_mad_qp_info *qp_info,
648 		       struct ib_mad_send_buf *send_buf,
649 		       struct ib_mad_send_wc *mad_send_wc,
650 		       int mad_snoop_flags)
651 {
652 	struct ib_mad_snoop_private *mad_snoop_priv;
653 	unsigned long flags;
654 	int i;
655 
656 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
657 	for (i = 0; i < qp_info->snoop_table_size; i++) {
658 		mad_snoop_priv = qp_info->snoop_table[i];
659 		if (!mad_snoop_priv ||
660 		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
661 			continue;
662 
663 		atomic_inc(&mad_snoop_priv->refcount);
664 		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
665 		mad_snoop_priv->agent.snoop_handler(&mad_snoop_priv->agent,
666 						    send_buf, mad_send_wc);
667 		deref_snoop_agent(mad_snoop_priv);
668 		spin_lock_irqsave(&qp_info->snoop_lock, flags);
669 	}
670 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
671 }
672 
673 static void snoop_recv(struct ib_mad_qp_info *qp_info,
674 		       struct ib_mad_recv_wc *mad_recv_wc,
675 		       int mad_snoop_flags)
676 {
677 	struct ib_mad_snoop_private *mad_snoop_priv;
678 	unsigned long flags;
679 	int i;
680 
681 	spin_lock_irqsave(&qp_info->snoop_lock, flags);
682 	for (i = 0; i < qp_info->snoop_table_size; i++) {
683 		mad_snoop_priv = qp_info->snoop_table[i];
684 		if (!mad_snoop_priv ||
685 		    !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
686 			continue;
687 
688 		atomic_inc(&mad_snoop_priv->refcount);
689 		spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
690 		mad_snoop_priv->agent.recv_handler(&mad_snoop_priv->agent, NULL,
691 						   mad_recv_wc);
692 		deref_snoop_agent(mad_snoop_priv);
693 		spin_lock_irqsave(&qp_info->snoop_lock, flags);
694 	}
695 	spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
696 }
697 
698 static void build_smp_wc(struct ib_qp *qp, struct ib_cqe *cqe, u16 slid,
699 		u16 pkey_index, u8 port_num, struct ib_wc *wc)
700 {
701 	memset(wc, 0, sizeof *wc);
702 	wc->wr_cqe = cqe;
703 	wc->status = IB_WC_SUCCESS;
704 	wc->opcode = IB_WC_RECV;
705 	wc->pkey_index = pkey_index;
706 	wc->byte_len = sizeof(struct ib_mad) + sizeof(struct ib_grh);
707 	wc->src_qp = IB_QP0;
708 	wc->qp = qp;
709 	wc->slid = slid;
710 	wc->sl = 0;
711 	wc->dlid_path_bits = 0;
712 	wc->port_num = port_num;
713 }
714 
715 static size_t mad_priv_size(const struct ib_mad_private *mp)
716 {
717 	return sizeof(struct ib_mad_private) + mp->mad_size;
718 }
719 
720 static struct ib_mad_private *alloc_mad_private(size_t mad_size, gfp_t flags)
721 {
722 	size_t size = sizeof(struct ib_mad_private) + mad_size;
723 	struct ib_mad_private *ret = kzalloc(size, flags);
724 
725 	if (ret)
726 		ret->mad_size = mad_size;
727 
728 	return ret;
729 }
730 
731 static size_t port_mad_size(const struct ib_mad_port_private *port_priv)
732 {
733 	return rdma_max_mad_size(port_priv->device, port_priv->port_num);
734 }
735 
736 static size_t mad_priv_dma_size(const struct ib_mad_private *mp)
737 {
738 	return sizeof(struct ib_grh) + mp->mad_size;
739 }
740 
741 /*
742  * Return 0 if SMP is to be sent
743  * Return 1 if SMP was consumed locally (whether or not solicited)
744  * Return < 0 if error
745  */
746 static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
747 				  struct ib_mad_send_wr_private *mad_send_wr)
748 {
749 	int ret = 0;
750 	struct ib_smp *smp = mad_send_wr->send_buf.mad;
751 	struct opa_smp *opa_smp = (struct opa_smp *)smp;
752 	unsigned long flags;
753 	struct ib_mad_local_private *local;
754 	struct ib_mad_private *mad_priv;
755 	struct ib_mad_port_private *port_priv;
756 	struct ib_mad_agent_private *recv_mad_agent = NULL;
757 	struct ib_device *device = mad_agent_priv->agent.device;
758 	u8 port_num;
759 	struct ib_wc mad_wc;
760 	struct ib_ud_wr *send_wr = &mad_send_wr->send_wr;
761 	size_t mad_size = port_mad_size(mad_agent_priv->qp_info->port_priv);
762 	u16 out_mad_pkey_index = 0;
763 	u16 drslid;
764 	bool opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
765 				    mad_agent_priv->qp_info->port_priv->port_num);
766 
767 	if (rdma_cap_ib_switch(device) &&
768 	    smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
769 		port_num = send_wr->port_num;
770 	else
771 		port_num = mad_agent_priv->agent.port_num;
772 
773 	/*
774 	 * Directed route handling starts if the initial LID routed part of
775 	 * a request or the ending LID routed part of a response is empty.
776 	 * If we are at the start of the LID routed part, don't update the
777 	 * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
778 	 */
779 	if (opa && smp->class_version == OPA_SMP_CLASS_VERSION) {
780 		u32 opa_drslid;
781 
782 		if ((opa_get_smp_direction(opa_smp)
783 		     ? opa_smp->route.dr.dr_dlid : opa_smp->route.dr.dr_slid) ==
784 		     OPA_LID_PERMISSIVE &&
785 		     opa_smi_handle_dr_smp_send(opa_smp,
786 						rdma_cap_ib_switch(device),
787 						port_num) == IB_SMI_DISCARD) {
788 			ret = -EINVAL;
789 			dev_err(&device->dev, "OPA Invalid directed route\n");
790 			goto out;
791 		}
792 		opa_drslid = be32_to_cpu(opa_smp->route.dr.dr_slid);
793 		if (opa_drslid != be32_to_cpu(OPA_LID_PERMISSIVE) &&
794 		    opa_drslid & 0xffff0000) {
795 			ret = -EINVAL;
796 			dev_err(&device->dev, "OPA Invalid dr_slid 0x%x\n",
797 			       opa_drslid);
798 			goto out;
799 		}
800 		drslid = (u16)(opa_drslid & 0x0000ffff);
801 
802 		/* Check to post send on QP or process locally */
803 		if (opa_smi_check_local_smp(opa_smp, device) == IB_SMI_DISCARD &&
804 		    opa_smi_check_local_returning_smp(opa_smp, device) == IB_SMI_DISCARD)
805 			goto out;
806 	} else {
807 		if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
808 		     IB_LID_PERMISSIVE &&
809 		     smi_handle_dr_smp_send(smp, rdma_cap_ib_switch(device), port_num) ==
810 		     IB_SMI_DISCARD) {
811 			ret = -EINVAL;
812 			dev_err(&device->dev, "Invalid directed route\n");
813 			goto out;
814 		}
815 		drslid = be16_to_cpu(smp->dr_slid);
816 
817 		/* Check to post send on QP or process locally */
818 		if (smi_check_local_smp(smp, device) == IB_SMI_DISCARD &&
819 		    smi_check_local_returning_smp(smp, device) == IB_SMI_DISCARD)
820 			goto out;
821 	}
822 
823 	local = kmalloc(sizeof *local, GFP_ATOMIC);
824 	if (!local) {
825 		ret = -ENOMEM;
826 		dev_err(&device->dev, "No memory for ib_mad_local_private\n");
827 		goto out;
828 	}
829 	local->mad_priv = NULL;
830 	local->recv_mad_agent = NULL;
831 	mad_priv = alloc_mad_private(mad_size, GFP_ATOMIC);
832 	if (!mad_priv) {
833 		ret = -ENOMEM;
834 		dev_err(&device->dev, "No memory for local response MAD\n");
835 		kfree(local);
836 		goto out;
837 	}
838 
839 	build_smp_wc(mad_agent_priv->agent.qp,
840 		     send_wr->wr.wr_cqe, drslid,
841 		     send_wr->pkey_index,
842 		     send_wr->port_num, &mad_wc);
843 
844 	if (opa && smp->base_version == OPA_MGMT_BASE_VERSION) {
845 		mad_wc.byte_len = mad_send_wr->send_buf.hdr_len
846 					+ mad_send_wr->send_buf.data_len
847 					+ sizeof(struct ib_grh);
848 	}
849 
850 	/* No GRH for DR SMP */
851 	ret = device->process_mad(device, 0, port_num, &mad_wc, NULL,
852 				  (const struct ib_mad_hdr *)smp, mad_size,
853 				  (struct ib_mad_hdr *)mad_priv->mad,
854 				  &mad_size, &out_mad_pkey_index);
855 	switch (ret)
856 	{
857 	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
858 		if (ib_response_mad((const struct ib_mad_hdr *)mad_priv->mad) &&
859 		    mad_agent_priv->agent.recv_handler) {
860 			local->mad_priv = mad_priv;
861 			local->recv_mad_agent = mad_agent_priv;
862 			/*
863 			 * Reference MAD agent until receive
864 			 * side of local completion handled
865 			 */
866 			atomic_inc(&mad_agent_priv->refcount);
867 		} else
868 			kfree(mad_priv);
869 		break;
870 	case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
871 		kfree(mad_priv);
872 		break;
873 	case IB_MAD_RESULT_SUCCESS:
874 		/* Treat like an incoming receive MAD */
875 		port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
876 					    mad_agent_priv->agent.port_num);
877 		if (port_priv) {
878 			memcpy(mad_priv->mad, smp, mad_priv->mad_size);
879 			recv_mad_agent = find_mad_agent(port_priv,
880 						        (const struct ib_mad_hdr *)mad_priv->mad);
881 		}
882 		if (!port_priv || !recv_mad_agent) {
883 			/*
884 			 * No receiving agent so drop packet and
885 			 * generate send completion.
886 			 */
887 			kfree(mad_priv);
888 			break;
889 		}
890 		local->mad_priv = mad_priv;
891 		local->recv_mad_agent = recv_mad_agent;
892 		break;
893 	default:
894 		kfree(mad_priv);
895 		kfree(local);
896 		ret = -EINVAL;
897 		goto out;
898 	}
899 
900 	local->mad_send_wr = mad_send_wr;
901 	if (opa) {
902 		local->mad_send_wr->send_wr.pkey_index = out_mad_pkey_index;
903 		local->return_wc_byte_len = mad_size;
904 	}
905 	/* Reference MAD agent until send side of local completion handled */
906 	atomic_inc(&mad_agent_priv->refcount);
907 	/* Queue local completion to local list */
908 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
909 	list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
910 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
911 	queue_work(mad_agent_priv->qp_info->port_priv->wq,
912 		   &mad_agent_priv->local_work);
913 	ret = 1;
914 out:
915 	return ret;
916 }
917 
918 static int get_pad_size(int hdr_len, int data_len, size_t mad_size)
919 {
920 	int seg_size, pad;
921 
922 	seg_size = mad_size - hdr_len;
923 	if (data_len && seg_size) {
924 		pad = seg_size - data_len % seg_size;
925 		return pad == seg_size ? 0 : pad;
926 	} else
927 		return seg_size;
928 }
929 
930 static void free_send_rmpp_list(struct ib_mad_send_wr_private *mad_send_wr)
931 {
932 	struct ib_rmpp_segment *s, *t;
933 
934 	list_for_each_entry_safe(s, t, &mad_send_wr->rmpp_list, list) {
935 		list_del(&s->list);
936 		kfree(s);
937 	}
938 }
939 
940 static int alloc_send_rmpp_list(struct ib_mad_send_wr_private *send_wr,
941 				size_t mad_size, gfp_t gfp_mask)
942 {
943 	struct ib_mad_send_buf *send_buf = &send_wr->send_buf;
944 	struct ib_rmpp_mad *rmpp_mad = send_buf->mad;
945 	struct ib_rmpp_segment *seg = NULL;
946 	int left, seg_size, pad;
947 
948 	send_buf->seg_size = mad_size - send_buf->hdr_len;
949 	send_buf->seg_rmpp_size = mad_size - IB_MGMT_RMPP_HDR;
950 	seg_size = send_buf->seg_size;
951 	pad = send_wr->pad;
952 
953 	/* Allocate data segments. */
954 	for (left = send_buf->data_len + pad; left > 0; left -= seg_size) {
955 		seg = kmalloc(sizeof (*seg) + seg_size, gfp_mask);
956 		if (!seg) {
957 			dev_err(&send_buf->mad_agent->device->dev,
958 				"alloc_send_rmpp_segs: RMPP mem alloc failed for len %zd, gfp %#x\n",
959 				sizeof (*seg) + seg_size, gfp_mask);
960 			free_send_rmpp_list(send_wr);
961 			return -ENOMEM;
962 		}
963 		seg->num = ++send_buf->seg_count;
964 		list_add_tail(&seg->list, &send_wr->rmpp_list);
965 	}
966 
967 	/* Zero any padding */
968 	if (pad)
969 		memset(seg->data + seg_size - pad, 0, pad);
970 
971 	rmpp_mad->rmpp_hdr.rmpp_version = send_wr->mad_agent_priv->
972 					  agent.rmpp_version;
973 	rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
974 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
975 
976 	send_wr->cur_seg = container_of(send_wr->rmpp_list.next,
977 					struct ib_rmpp_segment, list);
978 	send_wr->last_ack_seg = send_wr->cur_seg;
979 	return 0;
980 }
981 
982 int ib_mad_kernel_rmpp_agent(const struct ib_mad_agent *agent)
983 {
984 	return agent->rmpp_version && !(agent->flags & IB_MAD_USER_RMPP);
985 }
986 EXPORT_SYMBOL(ib_mad_kernel_rmpp_agent);
987 
988 struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
989 					    u32 remote_qpn, u16 pkey_index,
990 					    int rmpp_active,
991 					    int hdr_len, int data_len,
992 					    gfp_t gfp_mask,
993 					    u8 base_version)
994 {
995 	struct ib_mad_agent_private *mad_agent_priv;
996 	struct ib_mad_send_wr_private *mad_send_wr;
997 	int pad, message_size, ret, size;
998 	void *buf;
999 	size_t mad_size;
1000 	bool opa;
1001 
1002 	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
1003 				      agent);
1004 
1005 	opa = rdma_cap_opa_mad(mad_agent->device, mad_agent->port_num);
1006 
1007 	if (opa && base_version == OPA_MGMT_BASE_VERSION)
1008 		mad_size = sizeof(struct opa_mad);
1009 	else
1010 		mad_size = sizeof(struct ib_mad);
1011 
1012 	pad = get_pad_size(hdr_len, data_len, mad_size);
1013 	message_size = hdr_len + data_len + pad;
1014 
1015 	if (ib_mad_kernel_rmpp_agent(mad_agent)) {
1016 		if (!rmpp_active && message_size > mad_size)
1017 			return ERR_PTR(-EINVAL);
1018 	} else
1019 		if (rmpp_active || message_size > mad_size)
1020 			return ERR_PTR(-EINVAL);
1021 
1022 	size = rmpp_active ? hdr_len : mad_size;
1023 	buf = kzalloc(sizeof *mad_send_wr + size, gfp_mask);
1024 	if (!buf)
1025 		return ERR_PTR(-ENOMEM);
1026 
1027 	mad_send_wr = (struct ib_mad_send_wr_private *)((char *)buf + size);
1028 	INIT_LIST_HEAD(&mad_send_wr->rmpp_list);
1029 	mad_send_wr->send_buf.mad = buf;
1030 	mad_send_wr->send_buf.hdr_len = hdr_len;
1031 	mad_send_wr->send_buf.data_len = data_len;
1032 	mad_send_wr->pad = pad;
1033 
1034 	mad_send_wr->mad_agent_priv = mad_agent_priv;
1035 	mad_send_wr->sg_list[0].length = hdr_len;
1036 	mad_send_wr->sg_list[0].lkey = mad_agent->qp->pd->local_dma_lkey;
1037 
1038 	/* OPA MADs don't have to be the full 2048 bytes */
1039 	if (opa && base_version == OPA_MGMT_BASE_VERSION &&
1040 	    data_len < mad_size - hdr_len)
1041 		mad_send_wr->sg_list[1].length = data_len;
1042 	else
1043 		mad_send_wr->sg_list[1].length = mad_size - hdr_len;
1044 
1045 	mad_send_wr->sg_list[1].lkey = mad_agent->qp->pd->local_dma_lkey;
1046 
1047 	mad_send_wr->mad_list.cqe.done = ib_mad_send_done;
1048 
1049 	mad_send_wr->send_wr.wr.wr_cqe = &mad_send_wr->mad_list.cqe;
1050 	mad_send_wr->send_wr.wr.sg_list = mad_send_wr->sg_list;
1051 	mad_send_wr->send_wr.wr.num_sge = 2;
1052 	mad_send_wr->send_wr.wr.opcode = IB_WR_SEND;
1053 	mad_send_wr->send_wr.wr.send_flags = IB_SEND_SIGNALED;
1054 	mad_send_wr->send_wr.remote_qpn = remote_qpn;
1055 	mad_send_wr->send_wr.remote_qkey = IB_QP_SET_QKEY;
1056 	mad_send_wr->send_wr.pkey_index = pkey_index;
1057 
1058 	if (rmpp_active) {
1059 		ret = alloc_send_rmpp_list(mad_send_wr, mad_size, gfp_mask);
1060 		if (ret) {
1061 			kfree(buf);
1062 			return ERR_PTR(ret);
1063 		}
1064 	}
1065 
1066 	mad_send_wr->send_buf.mad_agent = mad_agent;
1067 	atomic_inc(&mad_agent_priv->refcount);
1068 	return &mad_send_wr->send_buf;
1069 }
1070 EXPORT_SYMBOL(ib_create_send_mad);
1071 
1072 int ib_get_mad_data_offset(u8 mgmt_class)
1073 {
1074 	if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
1075 		return IB_MGMT_SA_HDR;
1076 	else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1077 		 (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1078 		 (mgmt_class == IB_MGMT_CLASS_BIS))
1079 		return IB_MGMT_DEVICE_HDR;
1080 	else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1081 		 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
1082 		return IB_MGMT_VENDOR_HDR;
1083 	else
1084 		return IB_MGMT_MAD_HDR;
1085 }
1086 EXPORT_SYMBOL(ib_get_mad_data_offset);
1087 
1088 int ib_is_mad_class_rmpp(u8 mgmt_class)
1089 {
1090 	if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
1091 	    (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1092 	    (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1093 	    (mgmt_class == IB_MGMT_CLASS_BIS) ||
1094 	    ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1095 	     (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
1096 		return 1;
1097 	return 0;
1098 }
1099 EXPORT_SYMBOL(ib_is_mad_class_rmpp);
1100 
1101 void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
1102 {
1103 	struct ib_mad_send_wr_private *mad_send_wr;
1104 	struct list_head *list;
1105 
1106 	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1107 				   send_buf);
1108 	list = &mad_send_wr->cur_seg->list;
1109 
1110 	if (mad_send_wr->cur_seg->num < seg_num) {
1111 		list_for_each_entry(mad_send_wr->cur_seg, list, list)
1112 			if (mad_send_wr->cur_seg->num == seg_num)
1113 				break;
1114 	} else if (mad_send_wr->cur_seg->num > seg_num) {
1115 		list_for_each_entry_reverse(mad_send_wr->cur_seg, list, list)
1116 			if (mad_send_wr->cur_seg->num == seg_num)
1117 				break;
1118 	}
1119 	return mad_send_wr->cur_seg->data;
1120 }
1121 EXPORT_SYMBOL(ib_get_rmpp_segment);
1122 
1123 static inline void *ib_get_payload(struct ib_mad_send_wr_private *mad_send_wr)
1124 {
1125 	if (mad_send_wr->send_buf.seg_count)
1126 		return ib_get_rmpp_segment(&mad_send_wr->send_buf,
1127 					   mad_send_wr->seg_num);
1128 	else
1129 		return (char *)mad_send_wr->send_buf.mad +
1130 		       mad_send_wr->send_buf.hdr_len;
1131 }
1132 
1133 void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
1134 {
1135 	struct ib_mad_agent_private *mad_agent_priv;
1136 	struct ib_mad_send_wr_private *mad_send_wr;
1137 
1138 	mad_agent_priv = container_of(send_buf->mad_agent,
1139 				      struct ib_mad_agent_private, agent);
1140 	mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1141 				   send_buf);
1142 
1143 	free_send_rmpp_list(mad_send_wr);
1144 	kfree(send_buf->mad);
1145 	deref_mad_agent(mad_agent_priv);
1146 }
1147 EXPORT_SYMBOL(ib_free_send_mad);
1148 
1149 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
1150 {
1151 	struct ib_mad_qp_info *qp_info;
1152 	struct list_head *list;
1153 	struct ib_send_wr *bad_send_wr;
1154 	struct ib_mad_agent *mad_agent;
1155 	struct ib_sge *sge;
1156 	unsigned long flags;
1157 	int ret;
1158 
1159 	/* Set WR ID to find mad_send_wr upon completion */
1160 	qp_info = mad_send_wr->mad_agent_priv->qp_info;
1161 	mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
1162 	mad_send_wr->mad_list.cqe.done = ib_mad_send_done;
1163 	mad_send_wr->send_wr.wr.wr_cqe = &mad_send_wr->mad_list.cqe;
1164 
1165 	mad_agent = mad_send_wr->send_buf.mad_agent;
1166 	sge = mad_send_wr->sg_list;
1167 	sge[0].addr = ib_dma_map_single(mad_agent->device,
1168 					mad_send_wr->send_buf.mad,
1169 					sge[0].length,
1170 					DMA_TO_DEVICE);
1171 	if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[0].addr)))
1172 		return -ENOMEM;
1173 
1174 	mad_send_wr->header_mapping = sge[0].addr;
1175 
1176 	sge[1].addr = ib_dma_map_single(mad_agent->device,
1177 					ib_get_payload(mad_send_wr),
1178 					sge[1].length,
1179 					DMA_TO_DEVICE);
1180 	if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[1].addr))) {
1181 		ib_dma_unmap_single(mad_agent->device,
1182 				    mad_send_wr->header_mapping,
1183 				    sge[0].length, DMA_TO_DEVICE);
1184 		return -ENOMEM;
1185 	}
1186 	mad_send_wr->payload_mapping = sge[1].addr;
1187 
1188 	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
1189 	if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
1190 		ret = ib_post_send(mad_agent->qp, &mad_send_wr->send_wr.wr,
1191 				   &bad_send_wr);
1192 		list = &qp_info->send_queue.list;
1193 	} else {
1194 		ret = 0;
1195 		list = &qp_info->overflow_list;
1196 	}
1197 
1198 	if (!ret) {
1199 		qp_info->send_queue.count++;
1200 		list_add_tail(&mad_send_wr->mad_list.list, list);
1201 	}
1202 	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
1203 	if (ret) {
1204 		ib_dma_unmap_single(mad_agent->device,
1205 				    mad_send_wr->header_mapping,
1206 				    sge[0].length, DMA_TO_DEVICE);
1207 		ib_dma_unmap_single(mad_agent->device,
1208 				    mad_send_wr->payload_mapping,
1209 				    sge[1].length, DMA_TO_DEVICE);
1210 	}
1211 	return ret;
1212 }
1213 
1214 /*
1215  * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
1216  *  with the registered client
1217  */
1218 int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
1219 		     struct ib_mad_send_buf **bad_send_buf)
1220 {
1221 	struct ib_mad_agent_private *mad_agent_priv;
1222 	struct ib_mad_send_buf *next_send_buf;
1223 	struct ib_mad_send_wr_private *mad_send_wr;
1224 	unsigned long flags;
1225 	int ret = -EINVAL;
1226 
1227 	/* Walk list of send WRs and post each on send list */
1228 	for (; send_buf; send_buf = next_send_buf) {
1229 
1230 		mad_send_wr = container_of(send_buf,
1231 					   struct ib_mad_send_wr_private,
1232 					   send_buf);
1233 		mad_agent_priv = mad_send_wr->mad_agent_priv;
1234 
1235 		if (!send_buf->mad_agent->send_handler ||
1236 		    (send_buf->timeout_ms &&
1237 		     !send_buf->mad_agent->recv_handler)) {
1238 			ret = -EINVAL;
1239 			goto error;
1240 		}
1241 
1242 		if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
1243 			if (mad_agent_priv->agent.rmpp_version) {
1244 				ret = -EINVAL;
1245 				goto error;
1246 			}
1247 		}
1248 
1249 		/*
1250 		 * Save pointer to next work request to post in case the
1251 		 * current one completes, and the user modifies the work
1252 		 * request associated with the completion
1253 		 */
1254 		next_send_buf = send_buf->next;
1255 		mad_send_wr->send_wr.ah = send_buf->ah;
1256 
1257 		if (((struct ib_mad_hdr *) send_buf->mad)->mgmt_class ==
1258 		    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1259 			ret = handle_outgoing_dr_smp(mad_agent_priv,
1260 						     mad_send_wr);
1261 			if (ret < 0)		/* error */
1262 				goto error;
1263 			else if (ret == 1)	/* locally consumed */
1264 				continue;
1265 		}
1266 
1267 		mad_send_wr->tid = ((struct ib_mad_hdr *) send_buf->mad)->tid;
1268 		/* Timeout will be updated after send completes */
1269 		mad_send_wr->timeout = msecs_to_jiffies(send_buf->timeout_ms);
1270 		mad_send_wr->max_retries = send_buf->retries;
1271 		mad_send_wr->retries_left = send_buf->retries;
1272 		send_buf->retries = 0;
1273 		/* Reference for work request to QP + response */
1274 		mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
1275 		mad_send_wr->status = IB_WC_SUCCESS;
1276 
1277 		/* Reference MAD agent until send completes */
1278 		atomic_inc(&mad_agent_priv->refcount);
1279 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1280 		list_add_tail(&mad_send_wr->agent_list,
1281 			      &mad_agent_priv->send_list);
1282 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1283 
1284 		if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1285 			ret = ib_send_rmpp_mad(mad_send_wr);
1286 			if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
1287 				ret = ib_send_mad(mad_send_wr);
1288 		} else
1289 			ret = ib_send_mad(mad_send_wr);
1290 		if (ret < 0) {
1291 			/* Fail send request */
1292 			spin_lock_irqsave(&mad_agent_priv->lock, flags);
1293 			list_del(&mad_send_wr->agent_list);
1294 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1295 			atomic_dec(&mad_agent_priv->refcount);
1296 			goto error;
1297 		}
1298 	}
1299 	return 0;
1300 error:
1301 	if (bad_send_buf)
1302 		*bad_send_buf = send_buf;
1303 	return ret;
1304 }
1305 EXPORT_SYMBOL(ib_post_send_mad);
1306 
1307 /*
1308  * ib_free_recv_mad - Returns data buffers used to receive
1309  *  a MAD to the access layer
1310  */
1311 void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
1312 {
1313 	struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
1314 	struct ib_mad_private_header *mad_priv_hdr;
1315 	struct ib_mad_private *priv;
1316 	struct list_head free_list;
1317 
1318 	INIT_LIST_HEAD(&free_list);
1319 	list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
1320 
1321 	list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
1322 					&free_list, list) {
1323 		mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
1324 					   recv_buf);
1325 		mad_priv_hdr = container_of(mad_recv_wc,
1326 					    struct ib_mad_private_header,
1327 					    recv_wc);
1328 		priv = container_of(mad_priv_hdr, struct ib_mad_private,
1329 				    header);
1330 		kfree(priv);
1331 	}
1332 }
1333 EXPORT_SYMBOL(ib_free_recv_mad);
1334 
1335 struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
1336 					u8 rmpp_version,
1337 					ib_mad_send_handler send_handler,
1338 					ib_mad_recv_handler recv_handler,
1339 					void *context)
1340 {
1341 	return ERR_PTR(-EINVAL);	/* XXX: for now */
1342 }
1343 EXPORT_SYMBOL(ib_redirect_mad_qp);
1344 
1345 int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
1346 		      struct ib_wc *wc)
1347 {
1348 	dev_err(&mad_agent->device->dev,
1349 		"ib_process_mad_wc() not implemented yet\n");
1350 	return 0;
1351 }
1352 EXPORT_SYMBOL(ib_process_mad_wc);
1353 
1354 static int method_in_use(struct ib_mad_mgmt_method_table **method,
1355 			 struct ib_mad_reg_req *mad_reg_req)
1356 {
1357 	int i;
1358 
1359 	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS) {
1360 		if ((*method)->agent[i]) {
1361 			pr_err("Method %d already in use\n", i);
1362 			return -EINVAL;
1363 		}
1364 	}
1365 	return 0;
1366 }
1367 
1368 static int allocate_method_table(struct ib_mad_mgmt_method_table **method)
1369 {
1370 	/* Allocate management method table */
1371 	*method = kzalloc(sizeof **method, GFP_ATOMIC);
1372 	if (!*method) {
1373 		pr_err("No memory for ib_mad_mgmt_method_table\n");
1374 		return -ENOMEM;
1375 	}
1376 
1377 	return 0;
1378 }
1379 
1380 /*
1381  * Check to see if there are any methods still in use
1382  */
1383 static int check_method_table(struct ib_mad_mgmt_method_table *method)
1384 {
1385 	int i;
1386 
1387 	for (i = 0; i < IB_MGMT_MAX_METHODS; i++)
1388 		if (method->agent[i])
1389 			return 1;
1390 	return 0;
1391 }
1392 
1393 /*
1394  * Check to see if there are any method tables for this class still in use
1395  */
1396 static int check_class_table(struct ib_mad_mgmt_class_table *class)
1397 {
1398 	int i;
1399 
1400 	for (i = 0; i < MAX_MGMT_CLASS; i++)
1401 		if (class->method_table[i])
1402 			return 1;
1403 	return 0;
1404 }
1405 
1406 static int check_vendor_class(struct ib_mad_mgmt_vendor_class *vendor_class)
1407 {
1408 	int i;
1409 
1410 	for (i = 0; i < MAX_MGMT_OUI; i++)
1411 		if (vendor_class->method_table[i])
1412 			return 1;
1413 	return 0;
1414 }
1415 
1416 static int find_vendor_oui(struct ib_mad_mgmt_vendor_class *vendor_class,
1417 			   const char *oui)
1418 {
1419 	int i;
1420 
1421 	for (i = 0; i < MAX_MGMT_OUI; i++)
1422 		/* Is there matching OUI for this vendor class ? */
1423 		if (!memcmp(vendor_class->oui[i], oui, 3))
1424 			return i;
1425 
1426 	return -1;
1427 }
1428 
1429 static int check_vendor_table(struct ib_mad_mgmt_vendor_class_table *vendor)
1430 {
1431 	int i;
1432 
1433 	for (i = 0; i < MAX_MGMT_VENDOR_RANGE2; i++)
1434 		if (vendor->vendor_class[i])
1435 			return 1;
1436 
1437 	return 0;
1438 }
1439 
1440 static void remove_methods_mad_agent(struct ib_mad_mgmt_method_table *method,
1441 				     struct ib_mad_agent_private *agent)
1442 {
1443 	int i;
1444 
1445 	/* Remove any methods for this mad agent */
1446 	for (i = 0; i < IB_MGMT_MAX_METHODS; i++) {
1447 		if (method->agent[i] == agent) {
1448 			method->agent[i] = NULL;
1449 		}
1450 	}
1451 }
1452 
1453 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1454 			      struct ib_mad_agent_private *agent_priv,
1455 			      u8 mgmt_class)
1456 {
1457 	struct ib_mad_port_private *port_priv;
1458 	struct ib_mad_mgmt_class_table **class;
1459 	struct ib_mad_mgmt_method_table **method;
1460 	int i, ret;
1461 
1462 	port_priv = agent_priv->qp_info->port_priv;
1463 	class = &port_priv->version[mad_reg_req->mgmt_class_version].class;
1464 	if (!*class) {
1465 		/* Allocate management class table for "new" class version */
1466 		*class = kzalloc(sizeof **class, GFP_ATOMIC);
1467 		if (!*class) {
1468 			dev_err(&agent_priv->agent.device->dev,
1469 				"No memory for ib_mad_mgmt_class_table\n");
1470 			ret = -ENOMEM;
1471 			goto error1;
1472 		}
1473 
1474 		/* Allocate method table for this management class */
1475 		method = &(*class)->method_table[mgmt_class];
1476 		if ((ret = allocate_method_table(method)))
1477 			goto error2;
1478 	} else {
1479 		method = &(*class)->method_table[mgmt_class];
1480 		if (!*method) {
1481 			/* Allocate method table for this management class */
1482 			if ((ret = allocate_method_table(method)))
1483 				goto error1;
1484 		}
1485 	}
1486 
1487 	/* Now, make sure methods are not already in use */
1488 	if (method_in_use(method, mad_reg_req))
1489 		goto error3;
1490 
1491 	/* Finally, add in methods being registered */
1492 	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1493 		(*method)->agent[i] = agent_priv;
1494 
1495 	return 0;
1496 
1497 error3:
1498 	/* Remove any methods for this mad agent */
1499 	remove_methods_mad_agent(*method, agent_priv);
1500 	/* Now, check to see if there are any methods in use */
1501 	if (!check_method_table(*method)) {
1502 		/* If not, release management method table */
1503 		kfree(*method);
1504 		*method = NULL;
1505 	}
1506 	ret = -EINVAL;
1507 	goto error1;
1508 error2:
1509 	kfree(*class);
1510 	*class = NULL;
1511 error1:
1512 	return ret;
1513 }
1514 
1515 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1516 			   struct ib_mad_agent_private *agent_priv)
1517 {
1518 	struct ib_mad_port_private *port_priv;
1519 	struct ib_mad_mgmt_vendor_class_table **vendor_table;
1520 	struct ib_mad_mgmt_vendor_class_table *vendor = NULL;
1521 	struct ib_mad_mgmt_vendor_class *vendor_class = NULL;
1522 	struct ib_mad_mgmt_method_table **method;
1523 	int i, ret = -ENOMEM;
1524 	u8 vclass;
1525 
1526 	/* "New" vendor (with OUI) class */
1527 	vclass = vendor_class_index(mad_reg_req->mgmt_class);
1528 	port_priv = agent_priv->qp_info->port_priv;
1529 	vendor_table = &port_priv->version[
1530 				mad_reg_req->mgmt_class_version].vendor;
1531 	if (!*vendor_table) {
1532 		/* Allocate mgmt vendor class table for "new" class version */
1533 		vendor = kzalloc(sizeof *vendor, GFP_ATOMIC);
1534 		if (!vendor) {
1535 			dev_err(&agent_priv->agent.device->dev,
1536 				"No memory for ib_mad_mgmt_vendor_class_table\n");
1537 			goto error1;
1538 		}
1539 
1540 		*vendor_table = vendor;
1541 	}
1542 	if (!(*vendor_table)->vendor_class[vclass]) {
1543 		/* Allocate table for this management vendor class */
1544 		vendor_class = kzalloc(sizeof *vendor_class, GFP_ATOMIC);
1545 		if (!vendor_class) {
1546 			dev_err(&agent_priv->agent.device->dev,
1547 				"No memory for ib_mad_mgmt_vendor_class\n");
1548 			goto error2;
1549 		}
1550 
1551 		(*vendor_table)->vendor_class[vclass] = vendor_class;
1552 	}
1553 	for (i = 0; i < MAX_MGMT_OUI; i++) {
1554 		/* Is there matching OUI for this vendor class ? */
1555 		if (!memcmp((*vendor_table)->vendor_class[vclass]->oui[i],
1556 			    mad_reg_req->oui, 3)) {
1557 			method = &(*vendor_table)->vendor_class[
1558 						vclass]->method_table[i];
1559 			BUG_ON(!*method);
1560 			goto check_in_use;
1561 		}
1562 	}
1563 	for (i = 0; i < MAX_MGMT_OUI; i++) {
1564 		/* OUI slot available ? */
1565 		if (!is_vendor_oui((*vendor_table)->vendor_class[
1566 				vclass]->oui[i])) {
1567 			method = &(*vendor_table)->vendor_class[
1568 				vclass]->method_table[i];
1569 			BUG_ON(*method);
1570 			/* Allocate method table for this OUI */
1571 			if ((ret = allocate_method_table(method)))
1572 				goto error3;
1573 			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
1574 			       mad_reg_req->oui, 3);
1575 			goto check_in_use;
1576 		}
1577 	}
1578 	dev_err(&agent_priv->agent.device->dev, "All OUI slots in use\n");
1579 	goto error3;
1580 
1581 check_in_use:
1582 	/* Now, make sure methods are not already in use */
1583 	if (method_in_use(method, mad_reg_req))
1584 		goto error4;
1585 
1586 	/* Finally, add in methods being registered */
1587 	for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1588 		(*method)->agent[i] = agent_priv;
1589 
1590 	return 0;
1591 
1592 error4:
1593 	/* Remove any methods for this mad agent */
1594 	remove_methods_mad_agent(*method, agent_priv);
1595 	/* Now, check to see if there are any methods in use */
1596 	if (!check_method_table(*method)) {
1597 		/* If not, release management method table */
1598 		kfree(*method);
1599 		*method = NULL;
1600 	}
1601 	ret = -EINVAL;
1602 error3:
1603 	if (vendor_class) {
1604 		(*vendor_table)->vendor_class[vclass] = NULL;
1605 		kfree(vendor_class);
1606 	}
1607 error2:
1608 	if (vendor) {
1609 		*vendor_table = NULL;
1610 		kfree(vendor);
1611 	}
1612 error1:
1613 	return ret;
1614 }
1615 
1616 static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
1617 {
1618 	struct ib_mad_port_private *port_priv;
1619 	struct ib_mad_mgmt_class_table *class;
1620 	struct ib_mad_mgmt_method_table *method;
1621 	struct ib_mad_mgmt_vendor_class_table *vendor;
1622 	struct ib_mad_mgmt_vendor_class *vendor_class;
1623 	int index;
1624 	u8 mgmt_class;
1625 
1626 	/*
1627 	 * Was MAD registration request supplied
1628 	 * with original registration ?
1629 	 */
1630 	if (!agent_priv->reg_req) {
1631 		goto out;
1632 	}
1633 
1634 	port_priv = agent_priv->qp_info->port_priv;
1635 	mgmt_class = convert_mgmt_class(agent_priv->reg_req->mgmt_class);
1636 	class = port_priv->version[
1637 			agent_priv->reg_req->mgmt_class_version].class;
1638 	if (!class)
1639 		goto vendor_check;
1640 
1641 	method = class->method_table[mgmt_class];
1642 	if (method) {
1643 		/* Remove any methods for this mad agent */
1644 		remove_methods_mad_agent(method, agent_priv);
1645 		/* Now, check to see if there are any methods still in use */
1646 		if (!check_method_table(method)) {
1647 			/* If not, release management method table */
1648 			kfree(method);
1649 			class->method_table[mgmt_class] = NULL;
1650 			/* Any management classes left ? */
1651 			if (!check_class_table(class)) {
1652 				/* If not, release management class table */
1653 				kfree(class);
1654 				port_priv->version[
1655 					agent_priv->reg_req->
1656 					mgmt_class_version].class = NULL;
1657 			}
1658 		}
1659 	}
1660 
1661 vendor_check:
1662 	if (!is_vendor_class(mgmt_class))
1663 		goto out;
1664 
1665 	/* normalize mgmt_class to vendor range 2 */
1666 	mgmt_class = vendor_class_index(agent_priv->reg_req->mgmt_class);
1667 	vendor = port_priv->version[
1668 			agent_priv->reg_req->mgmt_class_version].vendor;
1669 
1670 	if (!vendor)
1671 		goto out;
1672 
1673 	vendor_class = vendor->vendor_class[mgmt_class];
1674 	if (vendor_class) {
1675 		index = find_vendor_oui(vendor_class, agent_priv->reg_req->oui);
1676 		if (index < 0)
1677 			goto out;
1678 		method = vendor_class->method_table[index];
1679 		if (method) {
1680 			/* Remove any methods for this mad agent */
1681 			remove_methods_mad_agent(method, agent_priv);
1682 			/*
1683 			 * Now, check to see if there are
1684 			 * any methods still in use
1685 			 */
1686 			if (!check_method_table(method)) {
1687 				/* If not, release management method table */
1688 				kfree(method);
1689 				vendor_class->method_table[index] = NULL;
1690 				memset(vendor_class->oui[index], 0, 3);
1691 				/* Any OUIs left ? */
1692 				if (!check_vendor_class(vendor_class)) {
1693 					/* If not, release vendor class table */
1694 					kfree(vendor_class);
1695 					vendor->vendor_class[mgmt_class] = NULL;
1696 					/* Any other vendor classes left ? */
1697 					if (!check_vendor_table(vendor)) {
1698 						kfree(vendor);
1699 						port_priv->version[
1700 							agent_priv->reg_req->
1701 							mgmt_class_version].
1702 							vendor = NULL;
1703 					}
1704 				}
1705 			}
1706 		}
1707 	}
1708 
1709 out:
1710 	return;
1711 }
1712 
1713 static struct ib_mad_agent_private *
1714 find_mad_agent(struct ib_mad_port_private *port_priv,
1715 	       const struct ib_mad_hdr *mad_hdr)
1716 {
1717 	struct ib_mad_agent_private *mad_agent = NULL;
1718 	unsigned long flags;
1719 
1720 	spin_lock_irqsave(&port_priv->reg_lock, flags);
1721 	if (ib_response_mad(mad_hdr)) {
1722 		u32 hi_tid;
1723 		struct ib_mad_agent_private *entry;
1724 
1725 		/*
1726 		 * Routing is based on high 32 bits of transaction ID
1727 		 * of MAD.
1728 		 */
1729 		hi_tid = be64_to_cpu(mad_hdr->tid) >> 32;
1730 		list_for_each_entry(entry, &port_priv->agent_list, agent_list) {
1731 			if (entry->agent.hi_tid == hi_tid) {
1732 				mad_agent = entry;
1733 				break;
1734 			}
1735 		}
1736 	} else {
1737 		struct ib_mad_mgmt_class_table *class;
1738 		struct ib_mad_mgmt_method_table *method;
1739 		struct ib_mad_mgmt_vendor_class_table *vendor;
1740 		struct ib_mad_mgmt_vendor_class *vendor_class;
1741 		const struct ib_vendor_mad *vendor_mad;
1742 		int index;
1743 
1744 		/*
1745 		 * Routing is based on version, class, and method
1746 		 * For "newer" vendor MADs, also based on OUI
1747 		 */
1748 		if (mad_hdr->class_version >= MAX_MGMT_VERSION)
1749 			goto out;
1750 		if (!is_vendor_class(mad_hdr->mgmt_class)) {
1751 			class = port_priv->version[
1752 					mad_hdr->class_version].class;
1753 			if (!class)
1754 				goto out;
1755 			if (convert_mgmt_class(mad_hdr->mgmt_class) >=
1756 			    ARRAY_SIZE(class->method_table))
1757 				goto out;
1758 			method = class->method_table[convert_mgmt_class(
1759 							mad_hdr->mgmt_class)];
1760 			if (method)
1761 				mad_agent = method->agent[mad_hdr->method &
1762 							  ~IB_MGMT_METHOD_RESP];
1763 		} else {
1764 			vendor = port_priv->version[
1765 					mad_hdr->class_version].vendor;
1766 			if (!vendor)
1767 				goto out;
1768 			vendor_class = vendor->vendor_class[vendor_class_index(
1769 						mad_hdr->mgmt_class)];
1770 			if (!vendor_class)
1771 				goto out;
1772 			/* Find matching OUI */
1773 			vendor_mad = (const struct ib_vendor_mad *)mad_hdr;
1774 			index = find_vendor_oui(vendor_class, vendor_mad->oui);
1775 			if (index == -1)
1776 				goto out;
1777 			method = vendor_class->method_table[index];
1778 			if (method) {
1779 				mad_agent = method->agent[mad_hdr->method &
1780 							  ~IB_MGMT_METHOD_RESP];
1781 			}
1782 		}
1783 	}
1784 
1785 	if (mad_agent) {
1786 		if (mad_agent->agent.recv_handler)
1787 			atomic_inc(&mad_agent->refcount);
1788 		else {
1789 			dev_notice(&port_priv->device->dev,
1790 				   "No receive handler for client %p on port %d\n",
1791 				   &mad_agent->agent, port_priv->port_num);
1792 			mad_agent = NULL;
1793 		}
1794 	}
1795 out:
1796 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
1797 
1798 	return mad_agent;
1799 }
1800 
1801 static int validate_mad(const struct ib_mad_hdr *mad_hdr,
1802 			const struct ib_mad_qp_info *qp_info,
1803 			bool opa)
1804 {
1805 	int valid = 0;
1806 	u32 qp_num = qp_info->qp->qp_num;
1807 
1808 	/* Make sure MAD base version is understood */
1809 	if (mad_hdr->base_version != IB_MGMT_BASE_VERSION &&
1810 	    (!opa || mad_hdr->base_version != OPA_MGMT_BASE_VERSION)) {
1811 		pr_err("MAD received with unsupported base version %d %s\n",
1812 		       mad_hdr->base_version, opa ? "(opa)" : "");
1813 		goto out;
1814 	}
1815 
1816 	/* Filter SMI packets sent to other than QP0 */
1817 	if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
1818 	    (mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
1819 		if (qp_num == 0)
1820 			valid = 1;
1821 	} else {
1822 		/* CM attributes other than ClassPortInfo only use Send method */
1823 		if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
1824 		    (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
1825 		    (mad_hdr->method != IB_MGMT_METHOD_SEND))
1826 			goto out;
1827 		/* Filter GSI packets sent to QP0 */
1828 		if (qp_num != 0)
1829 			valid = 1;
1830 	}
1831 
1832 out:
1833 	return valid;
1834 }
1835 
1836 static int is_rmpp_data_mad(const struct ib_mad_agent_private *mad_agent_priv,
1837 			    const struct ib_mad_hdr *mad_hdr)
1838 {
1839 	const struct ib_rmpp_mad *rmpp_mad;
1840 
1841 	rmpp_mad = (const struct ib_rmpp_mad *)mad_hdr;
1842 	return !mad_agent_priv->agent.rmpp_version ||
1843 		!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent) ||
1844 		!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
1845 				    IB_MGMT_RMPP_FLAG_ACTIVE) ||
1846 		(rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
1847 }
1848 
1849 static inline int rcv_has_same_class(const struct ib_mad_send_wr_private *wr,
1850 				     const struct ib_mad_recv_wc *rwc)
1851 {
1852 	return ((struct ib_mad_hdr *)(wr->send_buf.mad))->mgmt_class ==
1853 		rwc->recv_buf.mad->mad_hdr.mgmt_class;
1854 }
1855 
1856 static inline int rcv_has_same_gid(const struct ib_mad_agent_private *mad_agent_priv,
1857 				   const struct ib_mad_send_wr_private *wr,
1858 				   const struct ib_mad_recv_wc *rwc )
1859 {
1860 	struct ib_ah_attr attr;
1861 	u8 send_resp, rcv_resp;
1862 	union ib_gid sgid;
1863 	struct ib_device *device = mad_agent_priv->agent.device;
1864 	u8 port_num = mad_agent_priv->agent.port_num;
1865 	u8 lmc;
1866 
1867 	send_resp = ib_response_mad((struct ib_mad_hdr *)wr->send_buf.mad);
1868 	rcv_resp = ib_response_mad(&rwc->recv_buf.mad->mad_hdr);
1869 
1870 	if (send_resp == rcv_resp)
1871 		/* both requests, or both responses. GIDs different */
1872 		return 0;
1873 
1874 	if (ib_query_ah(wr->send_buf.ah, &attr))
1875 		/* Assume not equal, to avoid false positives. */
1876 		return 0;
1877 
1878 	if (!!(attr.ah_flags & IB_AH_GRH) !=
1879 	    !!(rwc->wc->wc_flags & IB_WC_GRH))
1880 		/* one has GID, other does not.  Assume different */
1881 		return 0;
1882 
1883 	if (!send_resp && rcv_resp) {
1884 		/* is request/response. */
1885 		if (!(attr.ah_flags & IB_AH_GRH)) {
1886 			if (ib_get_cached_lmc(device, port_num, &lmc))
1887 				return 0;
1888 			return (!lmc || !((attr.src_path_bits ^
1889 					   rwc->wc->dlid_path_bits) &
1890 					  ((1 << lmc) - 1)));
1891 		} else {
1892 			if (ib_get_cached_gid(device, port_num,
1893 					      attr.grh.sgid_index, &sgid, NULL))
1894 				return 0;
1895 			return !memcmp(sgid.raw, rwc->recv_buf.grh->dgid.raw,
1896 				       16);
1897 		}
1898 	}
1899 
1900 	if (!(attr.ah_flags & IB_AH_GRH))
1901 		return attr.dlid == rwc->wc->slid;
1902 	else
1903 		return !memcmp(attr.grh.dgid.raw, rwc->recv_buf.grh->sgid.raw,
1904 			       16);
1905 }
1906 
1907 static inline int is_direct(u8 class)
1908 {
1909 	return (class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE);
1910 }
1911 
1912 struct ib_mad_send_wr_private*
1913 ib_find_send_mad(const struct ib_mad_agent_private *mad_agent_priv,
1914 		 const struct ib_mad_recv_wc *wc)
1915 {
1916 	struct ib_mad_send_wr_private *wr;
1917 	const struct ib_mad_hdr *mad_hdr;
1918 
1919 	mad_hdr = &wc->recv_buf.mad->mad_hdr;
1920 
1921 	list_for_each_entry(wr, &mad_agent_priv->wait_list, agent_list) {
1922 		if ((wr->tid == mad_hdr->tid) &&
1923 		    rcv_has_same_class(wr, wc) &&
1924 		    /*
1925 		     * Don't check GID for direct routed MADs.
1926 		     * These might have permissive LIDs.
1927 		     */
1928 		    (is_direct(mad_hdr->mgmt_class) ||
1929 		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1930 			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1931 	}
1932 
1933 	/*
1934 	 * It's possible to receive the response before we've
1935 	 * been notified that the send has completed
1936 	 */
1937 	list_for_each_entry(wr, &mad_agent_priv->send_list, agent_list) {
1938 		if (is_rmpp_data_mad(mad_agent_priv, wr->send_buf.mad) &&
1939 		    wr->tid == mad_hdr->tid &&
1940 		    wr->timeout &&
1941 		    rcv_has_same_class(wr, wc) &&
1942 		    /*
1943 		     * Don't check GID for direct routed MADs.
1944 		     * These might have permissive LIDs.
1945 		     */
1946 		    (is_direct(mad_hdr->mgmt_class) ||
1947 		     rcv_has_same_gid(mad_agent_priv, wr, wc)))
1948 			/* Verify request has not been canceled */
1949 			return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1950 	}
1951 	return NULL;
1952 }
1953 
1954 void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
1955 {
1956 	mad_send_wr->timeout = 0;
1957 	if (mad_send_wr->refcount == 1)
1958 		list_move_tail(&mad_send_wr->agent_list,
1959 			      &mad_send_wr->mad_agent_priv->done_list);
1960 }
1961 
1962 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
1963 				 struct ib_mad_recv_wc *mad_recv_wc)
1964 {
1965 	struct ib_mad_send_wr_private *mad_send_wr;
1966 	struct ib_mad_send_wc mad_send_wc;
1967 	unsigned long flags;
1968 
1969 	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
1970 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
1971 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1972 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
1973 						      mad_recv_wc);
1974 		if (!mad_recv_wc) {
1975 			deref_mad_agent(mad_agent_priv);
1976 			return;
1977 		}
1978 	}
1979 
1980 	/* Complete corresponding request */
1981 	if (ib_response_mad(&mad_recv_wc->recv_buf.mad->mad_hdr)) {
1982 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
1983 		mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
1984 		if (!mad_send_wr) {
1985 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1986 			if (!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)
1987 			   && ib_is_mad_class_rmpp(mad_recv_wc->recv_buf.mad->mad_hdr.mgmt_class)
1988 			   && (ib_get_rmpp_flags(&((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr)
1989 					& IB_MGMT_RMPP_FLAG_ACTIVE)) {
1990 				/* user rmpp is in effect
1991 				 * and this is an active RMPP MAD
1992 				 */
1993 				mad_agent_priv->agent.recv_handler(
1994 						&mad_agent_priv->agent, NULL,
1995 						mad_recv_wc);
1996 				atomic_dec(&mad_agent_priv->refcount);
1997 			} else {
1998 				/* not user rmpp, revert to normal behavior and
1999 				 * drop the mad */
2000 				ib_free_recv_mad(mad_recv_wc);
2001 				deref_mad_agent(mad_agent_priv);
2002 				return;
2003 			}
2004 		} else {
2005 			ib_mark_mad_done(mad_send_wr);
2006 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2007 
2008 			/* Defined behavior is to complete response before request */
2009 			mad_agent_priv->agent.recv_handler(
2010 					&mad_agent_priv->agent,
2011 					&mad_send_wr->send_buf,
2012 					mad_recv_wc);
2013 			atomic_dec(&mad_agent_priv->refcount);
2014 
2015 			mad_send_wc.status = IB_WC_SUCCESS;
2016 			mad_send_wc.vendor_err = 0;
2017 			mad_send_wc.send_buf = &mad_send_wr->send_buf;
2018 			ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2019 		}
2020 	} else {
2021 		mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent, NULL,
2022 						   mad_recv_wc);
2023 		deref_mad_agent(mad_agent_priv);
2024 	}
2025 }
2026 
2027 static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv,
2028 				     const struct ib_mad_qp_info *qp_info,
2029 				     const struct ib_wc *wc,
2030 				     int port_num,
2031 				     struct ib_mad_private *recv,
2032 				     struct ib_mad_private *response)
2033 {
2034 	enum smi_forward_action retsmi;
2035 	struct ib_smp *smp = (struct ib_smp *)recv->mad;
2036 
2037 	if (smi_handle_dr_smp_recv(smp,
2038 				   rdma_cap_ib_switch(port_priv->device),
2039 				   port_num,
2040 				   port_priv->device->phys_port_cnt) ==
2041 				   IB_SMI_DISCARD)
2042 		return IB_SMI_DISCARD;
2043 
2044 	retsmi = smi_check_forward_dr_smp(smp);
2045 	if (retsmi == IB_SMI_LOCAL)
2046 		return IB_SMI_HANDLE;
2047 
2048 	if (retsmi == IB_SMI_SEND) { /* don't forward */
2049 		if (smi_handle_dr_smp_send(smp,
2050 					   rdma_cap_ib_switch(port_priv->device),
2051 					   port_num) == IB_SMI_DISCARD)
2052 			return IB_SMI_DISCARD;
2053 
2054 		if (smi_check_local_smp(smp, port_priv->device) == IB_SMI_DISCARD)
2055 			return IB_SMI_DISCARD;
2056 	} else if (rdma_cap_ib_switch(port_priv->device)) {
2057 		/* forward case for switches */
2058 		memcpy(response, recv, mad_priv_size(response));
2059 		response->header.recv_wc.wc = &response->header.wc;
2060 		response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2061 		response->header.recv_wc.recv_buf.grh = &response->grh;
2062 
2063 		agent_send_response((const struct ib_mad_hdr *)response->mad,
2064 				    &response->grh, wc,
2065 				    port_priv->device,
2066 				    smi_get_fwd_port(smp),
2067 				    qp_info->qp->qp_num,
2068 				    response->mad_size,
2069 				    false);
2070 
2071 		return IB_SMI_DISCARD;
2072 	}
2073 	return IB_SMI_HANDLE;
2074 }
2075 
2076 static bool generate_unmatched_resp(const struct ib_mad_private *recv,
2077 				    struct ib_mad_private *response,
2078 				    size_t *resp_len, bool opa)
2079 {
2080 	const struct ib_mad_hdr *recv_hdr = (const struct ib_mad_hdr *)recv->mad;
2081 	struct ib_mad_hdr *resp_hdr = (struct ib_mad_hdr *)response->mad;
2082 
2083 	if (recv_hdr->method == IB_MGMT_METHOD_GET ||
2084 	    recv_hdr->method == IB_MGMT_METHOD_SET) {
2085 		memcpy(response, recv, mad_priv_size(response));
2086 		response->header.recv_wc.wc = &response->header.wc;
2087 		response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2088 		response->header.recv_wc.recv_buf.grh = &response->grh;
2089 		resp_hdr->method = IB_MGMT_METHOD_GET_RESP;
2090 		resp_hdr->status = cpu_to_be16(IB_MGMT_MAD_STATUS_UNSUPPORTED_METHOD_ATTRIB);
2091 		if (recv_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2092 			resp_hdr->status |= IB_SMP_DIRECTION;
2093 
2094 		if (opa && recv_hdr->base_version == OPA_MGMT_BASE_VERSION) {
2095 			if (recv_hdr->mgmt_class ==
2096 			    IB_MGMT_CLASS_SUBN_LID_ROUTED ||
2097 			    recv_hdr->mgmt_class ==
2098 			    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2099 				*resp_len = opa_get_smp_header_size(
2100 							(const struct opa_smp *)recv->mad);
2101 			else
2102 				*resp_len = sizeof(struct ib_mad_hdr);
2103 		}
2104 
2105 		return true;
2106 	} else {
2107 		return false;
2108 	}
2109 }
2110 
2111 static enum smi_action
2112 handle_opa_smi(struct ib_mad_port_private *port_priv,
2113 	       struct ib_mad_qp_info *qp_info,
2114 	       struct ib_wc *wc,
2115 	       int port_num,
2116 	       struct ib_mad_private *recv,
2117 	       struct ib_mad_private *response)
2118 {
2119 	enum smi_forward_action retsmi;
2120 	struct opa_smp *smp = (struct opa_smp *)recv->mad;
2121 
2122 	if (opa_smi_handle_dr_smp_recv(smp,
2123 				   rdma_cap_ib_switch(port_priv->device),
2124 				   port_num,
2125 				   port_priv->device->phys_port_cnt) ==
2126 				   IB_SMI_DISCARD)
2127 		return IB_SMI_DISCARD;
2128 
2129 	retsmi = opa_smi_check_forward_dr_smp(smp);
2130 	if (retsmi == IB_SMI_LOCAL)
2131 		return IB_SMI_HANDLE;
2132 
2133 	if (retsmi == IB_SMI_SEND) { /* don't forward */
2134 		if (opa_smi_handle_dr_smp_send(smp,
2135 					   rdma_cap_ib_switch(port_priv->device),
2136 					   port_num) == IB_SMI_DISCARD)
2137 			return IB_SMI_DISCARD;
2138 
2139 		if (opa_smi_check_local_smp(smp, port_priv->device) ==
2140 		    IB_SMI_DISCARD)
2141 			return IB_SMI_DISCARD;
2142 
2143 	} else if (rdma_cap_ib_switch(port_priv->device)) {
2144 		/* forward case for switches */
2145 		memcpy(response, recv, mad_priv_size(response));
2146 		response->header.recv_wc.wc = &response->header.wc;
2147 		response->header.recv_wc.recv_buf.opa_mad =
2148 				(struct opa_mad *)response->mad;
2149 		response->header.recv_wc.recv_buf.grh = &response->grh;
2150 
2151 		agent_send_response((const struct ib_mad_hdr *)response->mad,
2152 				    &response->grh, wc,
2153 				    port_priv->device,
2154 				    opa_smi_get_fwd_port(smp),
2155 				    qp_info->qp->qp_num,
2156 				    recv->header.wc.byte_len,
2157 				    true);
2158 
2159 		return IB_SMI_DISCARD;
2160 	}
2161 
2162 	return IB_SMI_HANDLE;
2163 }
2164 
2165 static enum smi_action
2166 handle_smi(struct ib_mad_port_private *port_priv,
2167 	   struct ib_mad_qp_info *qp_info,
2168 	   struct ib_wc *wc,
2169 	   int port_num,
2170 	   struct ib_mad_private *recv,
2171 	   struct ib_mad_private *response,
2172 	   bool opa)
2173 {
2174 	struct ib_mad_hdr *mad_hdr = (struct ib_mad_hdr *)recv->mad;
2175 
2176 	if (opa && mad_hdr->base_version == OPA_MGMT_BASE_VERSION &&
2177 	    mad_hdr->class_version == OPA_SMI_CLASS_VERSION)
2178 		return handle_opa_smi(port_priv, qp_info, wc, port_num, recv,
2179 				      response);
2180 
2181 	return handle_ib_smi(port_priv, qp_info, wc, port_num, recv, response);
2182 }
2183 
2184 static void ib_mad_recv_done(struct ib_cq *cq, struct ib_wc *wc)
2185 {
2186 	struct ib_mad_port_private *port_priv = cq->cq_context;
2187 	struct ib_mad_list_head *mad_list =
2188 		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2189 	struct ib_mad_qp_info *qp_info;
2190 	struct ib_mad_private_header *mad_priv_hdr;
2191 	struct ib_mad_private *recv, *response = NULL;
2192 	struct ib_mad_agent_private *mad_agent;
2193 	int port_num;
2194 	int ret = IB_MAD_RESULT_SUCCESS;
2195 	size_t mad_size;
2196 	u16 resp_mad_pkey_index = 0;
2197 	bool opa;
2198 
2199 	if (list_empty_careful(&port_priv->port_list))
2200 		return;
2201 
2202 	if (wc->status != IB_WC_SUCCESS) {
2203 		/*
2204 		 * Receive errors indicate that the QP has entered the error
2205 		 * state - error handling/shutdown code will cleanup
2206 		 */
2207 		return;
2208 	}
2209 
2210 	qp_info = mad_list->mad_queue->qp_info;
2211 	dequeue_mad(mad_list);
2212 
2213 	opa = rdma_cap_opa_mad(qp_info->port_priv->device,
2214 			       qp_info->port_priv->port_num);
2215 
2216 	mad_priv_hdr = container_of(mad_list, struct ib_mad_private_header,
2217 				    mad_list);
2218 	recv = container_of(mad_priv_hdr, struct ib_mad_private, header);
2219 	ib_dma_unmap_single(port_priv->device,
2220 			    recv->header.mapping,
2221 			    mad_priv_dma_size(recv),
2222 			    DMA_FROM_DEVICE);
2223 
2224 	/* Setup MAD receive work completion from "normal" work completion */
2225 	recv->header.wc = *wc;
2226 	recv->header.recv_wc.wc = &recv->header.wc;
2227 
2228 	if (opa && ((struct ib_mad_hdr *)(recv->mad))->base_version == OPA_MGMT_BASE_VERSION) {
2229 		recv->header.recv_wc.mad_len = wc->byte_len - sizeof(struct ib_grh);
2230 		recv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2231 	} else {
2232 		recv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2233 		recv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2234 	}
2235 
2236 	recv->header.recv_wc.recv_buf.mad = (struct ib_mad *)recv->mad;
2237 	recv->header.recv_wc.recv_buf.grh = &recv->grh;
2238 
2239 	if (atomic_read(&qp_info->snoop_count))
2240 		snoop_recv(qp_info, &recv->header.recv_wc, IB_MAD_SNOOP_RECVS);
2241 
2242 	/* Validate MAD */
2243 	if (!validate_mad((const struct ib_mad_hdr *)recv->mad, qp_info, opa))
2244 		goto out;
2245 
2246 	mad_size = recv->mad_size;
2247 	response = alloc_mad_private(mad_size, GFP_KERNEL);
2248 	if (!response) {
2249 		dev_err(&port_priv->device->dev,
2250 			"%s: no memory for response buffer\n", __func__);
2251 		goto out;
2252 	}
2253 
2254 	if (rdma_cap_ib_switch(port_priv->device))
2255 		port_num = wc->port_num;
2256 	else
2257 		port_num = port_priv->port_num;
2258 
2259 	if (((struct ib_mad_hdr *)recv->mad)->mgmt_class ==
2260 	    IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
2261 		if (handle_smi(port_priv, qp_info, wc, port_num, recv,
2262 			       response, opa)
2263 		    == IB_SMI_DISCARD)
2264 			goto out;
2265 	}
2266 
2267 	/* Give driver "right of first refusal" on incoming MAD */
2268 	if (port_priv->device->process_mad) {
2269 		ret = port_priv->device->process_mad(port_priv->device, 0,
2270 						     port_priv->port_num,
2271 						     wc, &recv->grh,
2272 						     (const struct ib_mad_hdr *)recv->mad,
2273 						     recv->mad_size,
2274 						     (struct ib_mad_hdr *)response->mad,
2275 						     &mad_size, &resp_mad_pkey_index);
2276 
2277 		if (opa)
2278 			wc->pkey_index = resp_mad_pkey_index;
2279 
2280 		if (ret & IB_MAD_RESULT_SUCCESS) {
2281 			if (ret & IB_MAD_RESULT_CONSUMED)
2282 				goto out;
2283 			if (ret & IB_MAD_RESULT_REPLY) {
2284 				agent_send_response((const struct ib_mad_hdr *)response->mad,
2285 						    &recv->grh, wc,
2286 						    port_priv->device,
2287 						    port_num,
2288 						    qp_info->qp->qp_num,
2289 						    mad_size, opa);
2290 				goto out;
2291 			}
2292 		}
2293 	}
2294 
2295 	mad_agent = find_mad_agent(port_priv, (const struct ib_mad_hdr *)recv->mad);
2296 	if (mad_agent) {
2297 		ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
2298 		/*
2299 		 * recv is freed up in error cases in ib_mad_complete_recv
2300 		 * or via recv_handler in ib_mad_complete_recv()
2301 		 */
2302 		recv = NULL;
2303 	} else if ((ret & IB_MAD_RESULT_SUCCESS) &&
2304 		   generate_unmatched_resp(recv, response, &mad_size, opa)) {
2305 		agent_send_response((const struct ib_mad_hdr *)response->mad, &recv->grh, wc,
2306 				    port_priv->device, port_num,
2307 				    qp_info->qp->qp_num, mad_size, opa);
2308 	}
2309 
2310 out:
2311 	/* Post another receive request for this QP */
2312 	if (response) {
2313 		ib_mad_post_receive_mads(qp_info, response);
2314 		kfree(recv);
2315 	} else
2316 		ib_mad_post_receive_mads(qp_info, recv);
2317 }
2318 
2319 static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
2320 {
2321 	struct ib_mad_send_wr_private *mad_send_wr;
2322 	unsigned long delay;
2323 
2324 	if (list_empty(&mad_agent_priv->wait_list)) {
2325 		cancel_delayed_work(&mad_agent_priv->timed_work);
2326 	} else {
2327 		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2328 					 struct ib_mad_send_wr_private,
2329 					 agent_list);
2330 
2331 		if (time_after(mad_agent_priv->timeout,
2332 			       mad_send_wr->timeout)) {
2333 			mad_agent_priv->timeout = mad_send_wr->timeout;
2334 			delay = mad_send_wr->timeout - jiffies;
2335 			if ((long)delay <= 0)
2336 				delay = 1;
2337 			mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2338 					 &mad_agent_priv->timed_work, delay);
2339 		}
2340 	}
2341 }
2342 
2343 static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
2344 {
2345 	struct ib_mad_agent_private *mad_agent_priv;
2346 	struct ib_mad_send_wr_private *temp_mad_send_wr;
2347 	struct list_head *list_item;
2348 	unsigned long delay;
2349 
2350 	mad_agent_priv = mad_send_wr->mad_agent_priv;
2351 	list_del(&mad_send_wr->agent_list);
2352 
2353 	delay = mad_send_wr->timeout;
2354 	mad_send_wr->timeout += jiffies;
2355 
2356 	if (delay) {
2357 		list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
2358 			temp_mad_send_wr = list_entry(list_item,
2359 						struct ib_mad_send_wr_private,
2360 						agent_list);
2361 			if (time_after(mad_send_wr->timeout,
2362 				       temp_mad_send_wr->timeout))
2363 				break;
2364 		}
2365 	}
2366 	else
2367 		list_item = &mad_agent_priv->wait_list;
2368 	list_add(&mad_send_wr->agent_list, list_item);
2369 
2370 	/* Reschedule a work item if we have a shorter timeout */
2371 	if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list)
2372 		mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2373 				 &mad_agent_priv->timed_work, delay);
2374 }
2375 
2376 void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
2377 			  int timeout_ms)
2378 {
2379 	mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2380 	wait_for_response(mad_send_wr);
2381 }
2382 
2383 /*
2384  * Process a send work completion
2385  */
2386 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
2387 			     struct ib_mad_send_wc *mad_send_wc)
2388 {
2389 	struct ib_mad_agent_private	*mad_agent_priv;
2390 	unsigned long			flags;
2391 	int				ret;
2392 
2393 	mad_agent_priv = mad_send_wr->mad_agent_priv;
2394 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2395 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
2396 		ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
2397 		if (ret == IB_RMPP_RESULT_CONSUMED)
2398 			goto done;
2399 	} else
2400 		ret = IB_RMPP_RESULT_UNHANDLED;
2401 
2402 	if (mad_send_wc->status != IB_WC_SUCCESS &&
2403 	    mad_send_wr->status == IB_WC_SUCCESS) {
2404 		mad_send_wr->status = mad_send_wc->status;
2405 		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2406 	}
2407 
2408 	if (--mad_send_wr->refcount > 0) {
2409 		if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
2410 		    mad_send_wr->status == IB_WC_SUCCESS) {
2411 			wait_for_response(mad_send_wr);
2412 		}
2413 		goto done;
2414 	}
2415 
2416 	/* Remove send from MAD agent and notify client of completion */
2417 	list_del(&mad_send_wr->agent_list);
2418 	adjust_timeout(mad_agent_priv);
2419 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2420 
2421 	if (mad_send_wr->status != IB_WC_SUCCESS )
2422 		mad_send_wc->status = mad_send_wr->status;
2423 	if (ret == IB_RMPP_RESULT_INTERNAL)
2424 		ib_rmpp_send_handler(mad_send_wc);
2425 	else
2426 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2427 						   mad_send_wc);
2428 
2429 	/* Release reference on agent taken when sending */
2430 	deref_mad_agent(mad_agent_priv);
2431 	return;
2432 done:
2433 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2434 }
2435 
2436 static void ib_mad_send_done(struct ib_cq *cq, struct ib_wc *wc)
2437 {
2438 	struct ib_mad_port_private *port_priv = cq->cq_context;
2439 	struct ib_mad_list_head *mad_list =
2440 		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2441 	struct ib_mad_send_wr_private	*mad_send_wr, *queued_send_wr;
2442 	struct ib_mad_qp_info		*qp_info;
2443 	struct ib_mad_queue		*send_queue;
2444 	struct ib_send_wr		*bad_send_wr;
2445 	struct ib_mad_send_wc		mad_send_wc;
2446 	unsigned long flags;
2447 	int ret;
2448 
2449 	if (list_empty_careful(&port_priv->port_list))
2450 		return;
2451 
2452 	if (wc->status != IB_WC_SUCCESS) {
2453 		if (!ib_mad_send_error(port_priv, wc))
2454 			return;
2455 	}
2456 
2457 	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2458 				   mad_list);
2459 	send_queue = mad_list->mad_queue;
2460 	qp_info = send_queue->qp_info;
2461 
2462 retry:
2463 	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2464 			    mad_send_wr->header_mapping,
2465 			    mad_send_wr->sg_list[0].length, DMA_TO_DEVICE);
2466 	ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2467 			    mad_send_wr->payload_mapping,
2468 			    mad_send_wr->sg_list[1].length, DMA_TO_DEVICE);
2469 	queued_send_wr = NULL;
2470 	spin_lock_irqsave(&send_queue->lock, flags);
2471 	list_del(&mad_list->list);
2472 
2473 	/* Move queued send to the send queue */
2474 	if (send_queue->count-- > send_queue->max_active) {
2475 		mad_list = container_of(qp_info->overflow_list.next,
2476 					struct ib_mad_list_head, list);
2477 		queued_send_wr = container_of(mad_list,
2478 					struct ib_mad_send_wr_private,
2479 					mad_list);
2480 		list_move_tail(&mad_list->list, &send_queue->list);
2481 	}
2482 	spin_unlock_irqrestore(&send_queue->lock, flags);
2483 
2484 	mad_send_wc.send_buf = &mad_send_wr->send_buf;
2485 	mad_send_wc.status = wc->status;
2486 	mad_send_wc.vendor_err = wc->vendor_err;
2487 	if (atomic_read(&qp_info->snoop_count))
2488 		snoop_send(qp_info, &mad_send_wr->send_buf, &mad_send_wc,
2489 			   IB_MAD_SNOOP_SEND_COMPLETIONS);
2490 	ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2491 
2492 	if (queued_send_wr) {
2493 		ret = ib_post_send(qp_info->qp, &queued_send_wr->send_wr.wr,
2494 				   &bad_send_wr);
2495 		if (ret) {
2496 			dev_err(&port_priv->device->dev,
2497 				"ib_post_send failed: %d\n", ret);
2498 			mad_send_wr = queued_send_wr;
2499 			wc->status = IB_WC_LOC_QP_OP_ERR;
2500 			goto retry;
2501 		}
2502 	}
2503 }
2504 
2505 static void mark_sends_for_retry(struct ib_mad_qp_info *qp_info)
2506 {
2507 	struct ib_mad_send_wr_private *mad_send_wr;
2508 	struct ib_mad_list_head *mad_list;
2509 	unsigned long flags;
2510 
2511 	spin_lock_irqsave(&qp_info->send_queue.lock, flags);
2512 	list_for_each_entry(mad_list, &qp_info->send_queue.list, list) {
2513 		mad_send_wr = container_of(mad_list,
2514 					   struct ib_mad_send_wr_private,
2515 					   mad_list);
2516 		mad_send_wr->retry = 1;
2517 	}
2518 	spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
2519 }
2520 
2521 static bool ib_mad_send_error(struct ib_mad_port_private *port_priv,
2522 		struct ib_wc *wc)
2523 {
2524 	struct ib_mad_list_head *mad_list =
2525 		container_of(wc->wr_cqe, struct ib_mad_list_head, cqe);
2526 	struct ib_mad_qp_info *qp_info = mad_list->mad_queue->qp_info;
2527 	struct ib_mad_send_wr_private *mad_send_wr;
2528 	int ret;
2529 
2530 	/*
2531 	 * Send errors will transition the QP to SQE - move
2532 	 * QP to RTS and repost flushed work requests
2533 	 */
2534 	mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2535 				   mad_list);
2536 	if (wc->status == IB_WC_WR_FLUSH_ERR) {
2537 		if (mad_send_wr->retry) {
2538 			/* Repost send */
2539 			struct ib_send_wr *bad_send_wr;
2540 
2541 			mad_send_wr->retry = 0;
2542 			ret = ib_post_send(qp_info->qp, &mad_send_wr->send_wr.wr,
2543 					&bad_send_wr);
2544 			if (!ret)
2545 				return false;
2546 		}
2547 	} else {
2548 		struct ib_qp_attr *attr;
2549 
2550 		/* Transition QP to RTS and fail offending send */
2551 		attr = kmalloc(sizeof *attr, GFP_KERNEL);
2552 		if (attr) {
2553 			attr->qp_state = IB_QPS_RTS;
2554 			attr->cur_qp_state = IB_QPS_SQE;
2555 			ret = ib_modify_qp(qp_info->qp, attr,
2556 					   IB_QP_STATE | IB_QP_CUR_STATE);
2557 			kfree(attr);
2558 			if (ret)
2559 				dev_err(&port_priv->device->dev,
2560 					"%s - ib_modify_qp to RTS: %d\n",
2561 					__func__, ret);
2562 			else
2563 				mark_sends_for_retry(qp_info);
2564 		}
2565 	}
2566 
2567 	return true;
2568 }
2569 
2570 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
2571 {
2572 	unsigned long flags;
2573 	struct ib_mad_send_wr_private *mad_send_wr, *temp_mad_send_wr;
2574 	struct ib_mad_send_wc mad_send_wc;
2575 	struct list_head cancel_list;
2576 
2577 	INIT_LIST_HEAD(&cancel_list);
2578 
2579 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2580 	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2581 				 &mad_agent_priv->send_list, agent_list) {
2582 		if (mad_send_wr->status == IB_WC_SUCCESS) {
2583 			mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2584 			mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2585 		}
2586 	}
2587 
2588 	/* Empty wait list to prevent receives from finding a request */
2589 	list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
2590 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2591 
2592 	/* Report all cancelled requests */
2593 	mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
2594 	mad_send_wc.vendor_err = 0;
2595 
2596 	list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2597 				 &cancel_list, agent_list) {
2598 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2599 		list_del(&mad_send_wr->agent_list);
2600 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2601 						   &mad_send_wc);
2602 		atomic_dec(&mad_agent_priv->refcount);
2603 	}
2604 }
2605 
2606 static struct ib_mad_send_wr_private*
2607 find_send_wr(struct ib_mad_agent_private *mad_agent_priv,
2608 	     struct ib_mad_send_buf *send_buf)
2609 {
2610 	struct ib_mad_send_wr_private *mad_send_wr;
2611 
2612 	list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
2613 			    agent_list) {
2614 		if (&mad_send_wr->send_buf == send_buf)
2615 			return mad_send_wr;
2616 	}
2617 
2618 	list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
2619 			    agent_list) {
2620 		if (is_rmpp_data_mad(mad_agent_priv,
2621 				     mad_send_wr->send_buf.mad) &&
2622 		    &mad_send_wr->send_buf == send_buf)
2623 			return mad_send_wr;
2624 	}
2625 	return NULL;
2626 }
2627 
2628 int ib_modify_mad(struct ib_mad_agent *mad_agent,
2629 		  struct ib_mad_send_buf *send_buf, u32 timeout_ms)
2630 {
2631 	struct ib_mad_agent_private *mad_agent_priv;
2632 	struct ib_mad_send_wr_private *mad_send_wr;
2633 	unsigned long flags;
2634 	int active;
2635 
2636 	mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
2637 				      agent);
2638 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2639 	mad_send_wr = find_send_wr(mad_agent_priv, send_buf);
2640 	if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
2641 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2642 		return -EINVAL;
2643 	}
2644 
2645 	active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
2646 	if (!timeout_ms) {
2647 		mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2648 		mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2649 	}
2650 
2651 	mad_send_wr->send_buf.timeout_ms = timeout_ms;
2652 	if (active)
2653 		mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2654 	else
2655 		ib_reset_mad_timeout(mad_send_wr, timeout_ms);
2656 
2657 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2658 	return 0;
2659 }
2660 EXPORT_SYMBOL(ib_modify_mad);
2661 
2662 void ib_cancel_mad(struct ib_mad_agent *mad_agent,
2663 		   struct ib_mad_send_buf *send_buf)
2664 {
2665 	ib_modify_mad(mad_agent, send_buf, 0);
2666 }
2667 EXPORT_SYMBOL(ib_cancel_mad);
2668 
2669 static void local_completions(struct work_struct *work)
2670 {
2671 	struct ib_mad_agent_private *mad_agent_priv;
2672 	struct ib_mad_local_private *local;
2673 	struct ib_mad_agent_private *recv_mad_agent;
2674 	unsigned long flags;
2675 	int free_mad;
2676 	struct ib_wc wc;
2677 	struct ib_mad_send_wc mad_send_wc;
2678 	bool opa;
2679 
2680 	mad_agent_priv =
2681 		container_of(work, struct ib_mad_agent_private, local_work);
2682 
2683 	opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
2684 			       mad_agent_priv->qp_info->port_priv->port_num);
2685 
2686 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2687 	while (!list_empty(&mad_agent_priv->local_list)) {
2688 		local = list_entry(mad_agent_priv->local_list.next,
2689 				   struct ib_mad_local_private,
2690 				   completion_list);
2691 		list_del(&local->completion_list);
2692 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2693 		free_mad = 0;
2694 		if (local->mad_priv) {
2695 			u8 base_version;
2696 			recv_mad_agent = local->recv_mad_agent;
2697 			if (!recv_mad_agent) {
2698 				dev_err(&mad_agent_priv->agent.device->dev,
2699 					"No receive MAD agent for local completion\n");
2700 				free_mad = 1;
2701 				goto local_send_completion;
2702 			}
2703 
2704 			/*
2705 			 * Defined behavior is to complete response
2706 			 * before request
2707 			 */
2708 			build_smp_wc(recv_mad_agent->agent.qp,
2709 				     local->mad_send_wr->send_wr.wr.wr_cqe,
2710 				     be16_to_cpu(IB_LID_PERMISSIVE),
2711 				     local->mad_send_wr->send_wr.pkey_index,
2712 				     recv_mad_agent->agent.port_num, &wc);
2713 
2714 			local->mad_priv->header.recv_wc.wc = &wc;
2715 
2716 			base_version = ((struct ib_mad_hdr *)(local->mad_priv->mad))->base_version;
2717 			if (opa && base_version == OPA_MGMT_BASE_VERSION) {
2718 				local->mad_priv->header.recv_wc.mad_len = local->return_wc_byte_len;
2719 				local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2720 			} else {
2721 				local->mad_priv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2722 				local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2723 			}
2724 
2725 			INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
2726 			list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
2727 				 &local->mad_priv->header.recv_wc.rmpp_list);
2728 			local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
2729 			local->mad_priv->header.recv_wc.recv_buf.mad =
2730 						(struct ib_mad *)local->mad_priv->mad;
2731 			if (atomic_read(&recv_mad_agent->qp_info->snoop_count))
2732 				snoop_recv(recv_mad_agent->qp_info,
2733 					  &local->mad_priv->header.recv_wc,
2734 					   IB_MAD_SNOOP_RECVS);
2735 			recv_mad_agent->agent.recv_handler(
2736 						&recv_mad_agent->agent,
2737 						&local->mad_send_wr->send_buf,
2738 						&local->mad_priv->header.recv_wc);
2739 			spin_lock_irqsave(&recv_mad_agent->lock, flags);
2740 			atomic_dec(&recv_mad_agent->refcount);
2741 			spin_unlock_irqrestore(&recv_mad_agent->lock, flags);
2742 		}
2743 
2744 local_send_completion:
2745 		/* Complete send */
2746 		mad_send_wc.status = IB_WC_SUCCESS;
2747 		mad_send_wc.vendor_err = 0;
2748 		mad_send_wc.send_buf = &local->mad_send_wr->send_buf;
2749 		if (atomic_read(&mad_agent_priv->qp_info->snoop_count))
2750 			snoop_send(mad_agent_priv->qp_info,
2751 				   &local->mad_send_wr->send_buf,
2752 				   &mad_send_wc, IB_MAD_SNOOP_SEND_COMPLETIONS);
2753 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2754 						   &mad_send_wc);
2755 
2756 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2757 		atomic_dec(&mad_agent_priv->refcount);
2758 		if (free_mad)
2759 			kfree(local->mad_priv);
2760 		kfree(local);
2761 	}
2762 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2763 }
2764 
2765 static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
2766 {
2767 	int ret;
2768 
2769 	if (!mad_send_wr->retries_left)
2770 		return -ETIMEDOUT;
2771 
2772 	mad_send_wr->retries_left--;
2773 	mad_send_wr->send_buf.retries++;
2774 
2775 	mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
2776 
2777 	if (ib_mad_kernel_rmpp_agent(&mad_send_wr->mad_agent_priv->agent)) {
2778 		ret = ib_retry_rmpp(mad_send_wr);
2779 		switch (ret) {
2780 		case IB_RMPP_RESULT_UNHANDLED:
2781 			ret = ib_send_mad(mad_send_wr);
2782 			break;
2783 		case IB_RMPP_RESULT_CONSUMED:
2784 			ret = 0;
2785 			break;
2786 		default:
2787 			ret = -ECOMM;
2788 			break;
2789 		}
2790 	} else
2791 		ret = ib_send_mad(mad_send_wr);
2792 
2793 	if (!ret) {
2794 		mad_send_wr->refcount++;
2795 		list_add_tail(&mad_send_wr->agent_list,
2796 			      &mad_send_wr->mad_agent_priv->send_list);
2797 	}
2798 	return ret;
2799 }
2800 
2801 static void timeout_sends(struct work_struct *work)
2802 {
2803 	struct ib_mad_agent_private *mad_agent_priv;
2804 	struct ib_mad_send_wr_private *mad_send_wr;
2805 	struct ib_mad_send_wc mad_send_wc;
2806 	unsigned long flags, delay;
2807 
2808 	mad_agent_priv = container_of(work, struct ib_mad_agent_private,
2809 				      timed_work.work);
2810 	mad_send_wc.vendor_err = 0;
2811 
2812 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
2813 	while (!list_empty(&mad_agent_priv->wait_list)) {
2814 		mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2815 					 struct ib_mad_send_wr_private,
2816 					 agent_list);
2817 
2818 		if (time_after(mad_send_wr->timeout, jiffies)) {
2819 			delay = mad_send_wr->timeout - jiffies;
2820 			if ((long)delay <= 0)
2821 				delay = 1;
2822 			queue_delayed_work(mad_agent_priv->qp_info->
2823 					   port_priv->wq,
2824 					   &mad_agent_priv->timed_work, delay);
2825 			break;
2826 		}
2827 
2828 		list_del(&mad_send_wr->agent_list);
2829 		if (mad_send_wr->status == IB_WC_SUCCESS &&
2830 		    !retry_send(mad_send_wr))
2831 			continue;
2832 
2833 		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2834 
2835 		if (mad_send_wr->status == IB_WC_SUCCESS)
2836 			mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
2837 		else
2838 			mad_send_wc.status = mad_send_wr->status;
2839 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
2840 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2841 						   &mad_send_wc);
2842 
2843 		atomic_dec(&mad_agent_priv->refcount);
2844 		spin_lock_irqsave(&mad_agent_priv->lock, flags);
2845 	}
2846 	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2847 }
2848 
2849 /*
2850  * Allocate receive MADs and post receive WRs for them
2851  */
2852 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
2853 				    struct ib_mad_private *mad)
2854 {
2855 	unsigned long flags;
2856 	int post, ret;
2857 	struct ib_mad_private *mad_priv;
2858 	struct ib_sge sg_list;
2859 	struct ib_recv_wr recv_wr, *bad_recv_wr;
2860 	struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
2861 
2862 	/* Initialize common scatter list fields */
2863 	sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
2864 
2865 	/* Initialize common receive WR fields */
2866 	recv_wr.next = NULL;
2867 	recv_wr.sg_list = &sg_list;
2868 	recv_wr.num_sge = 1;
2869 
2870 	do {
2871 		/* Allocate and map receive buffer */
2872 		if (mad) {
2873 			mad_priv = mad;
2874 			mad = NULL;
2875 		} else {
2876 			mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),
2877 						     GFP_ATOMIC);
2878 			if (!mad_priv) {
2879 				dev_err(&qp_info->port_priv->device->dev,
2880 					"No memory for receive buffer\n");
2881 				ret = -ENOMEM;
2882 				break;
2883 			}
2884 		}
2885 		sg_list.length = mad_priv_dma_size(mad_priv);
2886 		sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
2887 						 &mad_priv->grh,
2888 						 mad_priv_dma_size(mad_priv),
2889 						 DMA_FROM_DEVICE);
2890 		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
2891 						  sg_list.addr))) {
2892 			ret = -ENOMEM;
2893 			break;
2894 		}
2895 		mad_priv->header.mapping = sg_list.addr;
2896 		mad_priv->header.mad_list.mad_queue = recv_queue;
2897 		mad_priv->header.mad_list.cqe.done = ib_mad_recv_done;
2898 		recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe;
2899 
2900 		/* Post receive WR */
2901 		spin_lock_irqsave(&recv_queue->lock, flags);
2902 		post = (++recv_queue->count < recv_queue->max_active);
2903 		list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
2904 		spin_unlock_irqrestore(&recv_queue->lock, flags);
2905 		ret = ib_post_recv(qp_info->qp, &recv_wr, &bad_recv_wr);
2906 		if (ret) {
2907 			spin_lock_irqsave(&recv_queue->lock, flags);
2908 			list_del(&mad_priv->header.mad_list.list);
2909 			recv_queue->count--;
2910 			spin_unlock_irqrestore(&recv_queue->lock, flags);
2911 			ib_dma_unmap_single(qp_info->port_priv->device,
2912 					    mad_priv->header.mapping,
2913 					    mad_priv_dma_size(mad_priv),
2914 					    DMA_FROM_DEVICE);
2915 			kfree(mad_priv);
2916 			dev_err(&qp_info->port_priv->device->dev,
2917 				"ib_post_recv failed: %d\n", ret);
2918 			break;
2919 		}
2920 	} while (post);
2921 
2922 	return ret;
2923 }
2924 
2925 /*
2926  * Return all the posted receive MADs
2927  */
2928 static void cleanup_recv_queue(struct ib_mad_qp_info *qp_info)
2929 {
2930 	struct ib_mad_private_header *mad_priv_hdr;
2931 	struct ib_mad_private *recv;
2932 	struct ib_mad_list_head *mad_list;
2933 
2934 	if (!qp_info->qp)
2935 		return;
2936 
2937 	while (!list_empty(&qp_info->recv_queue.list)) {
2938 
2939 		mad_list = list_entry(qp_info->recv_queue.list.next,
2940 				      struct ib_mad_list_head, list);
2941 		mad_priv_hdr = container_of(mad_list,
2942 					    struct ib_mad_private_header,
2943 					    mad_list);
2944 		recv = container_of(mad_priv_hdr, struct ib_mad_private,
2945 				    header);
2946 
2947 		/* Remove from posted receive MAD list */
2948 		list_del(&mad_list->list);
2949 
2950 		ib_dma_unmap_single(qp_info->port_priv->device,
2951 				    recv->header.mapping,
2952 				    mad_priv_dma_size(recv),
2953 				    DMA_FROM_DEVICE);
2954 		kfree(recv);
2955 	}
2956 
2957 	qp_info->recv_queue.count = 0;
2958 }
2959 
2960 /*
2961  * Start the port
2962  */
2963 static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
2964 {
2965 	int ret, i;
2966 	struct ib_qp_attr *attr;
2967 	struct ib_qp *qp;
2968 	u16 pkey_index;
2969 
2970 	attr = kmalloc(sizeof *attr, GFP_KERNEL);
2971 	if (!attr) {
2972 		dev_err(&port_priv->device->dev,
2973 			"Couldn't kmalloc ib_qp_attr\n");
2974 		return -ENOMEM;
2975 	}
2976 
2977 	ret = ib_find_pkey(port_priv->device, port_priv->port_num,
2978 			   IB_DEFAULT_PKEY_FULL, &pkey_index);
2979 	if (ret)
2980 		pkey_index = 0;
2981 
2982 	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2983 		qp = port_priv->qp_info[i].qp;
2984 		if (!qp)
2985 			continue;
2986 
2987 		/*
2988 		 * PKey index for QP1 is irrelevant but
2989 		 * one is needed for the Reset to Init transition
2990 		 */
2991 		attr->qp_state = IB_QPS_INIT;
2992 		attr->pkey_index = pkey_index;
2993 		attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
2994 		ret = ib_modify_qp(qp, attr, IB_QP_STATE |
2995 					     IB_QP_PKEY_INDEX | IB_QP_QKEY);
2996 		if (ret) {
2997 			dev_err(&port_priv->device->dev,
2998 				"Couldn't change QP%d state to INIT: %d\n",
2999 				i, ret);
3000 			goto out;
3001 		}
3002 
3003 		attr->qp_state = IB_QPS_RTR;
3004 		ret = ib_modify_qp(qp, attr, IB_QP_STATE);
3005 		if (ret) {
3006 			dev_err(&port_priv->device->dev,
3007 				"Couldn't change QP%d state to RTR: %d\n",
3008 				i, ret);
3009 			goto out;
3010 		}
3011 
3012 		attr->qp_state = IB_QPS_RTS;
3013 		attr->sq_psn = IB_MAD_SEND_Q_PSN;
3014 		ret = ib_modify_qp(qp, attr, IB_QP_STATE | IB_QP_SQ_PSN);
3015 		if (ret) {
3016 			dev_err(&port_priv->device->dev,
3017 				"Couldn't change QP%d state to RTS: %d\n",
3018 				i, ret);
3019 			goto out;
3020 		}
3021 	}
3022 
3023 	ret = ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
3024 	if (ret) {
3025 		dev_err(&port_priv->device->dev,
3026 			"Failed to request completion notification: %d\n",
3027 			ret);
3028 		goto out;
3029 	}
3030 
3031 	for (i = 0; i < IB_MAD_QPS_CORE; i++) {
3032 		if (!port_priv->qp_info[i].qp)
3033 			continue;
3034 
3035 		ret = ib_mad_post_receive_mads(&port_priv->qp_info[i], NULL);
3036 		if (ret) {
3037 			dev_err(&port_priv->device->dev,
3038 				"Couldn't post receive WRs\n");
3039 			goto out;
3040 		}
3041 	}
3042 out:
3043 	kfree(attr);
3044 	return ret;
3045 }
3046 
3047 static void qp_event_handler(struct ib_event *event, void *qp_context)
3048 {
3049 	struct ib_mad_qp_info	*qp_info = qp_context;
3050 
3051 	/* It's worse than that! He's dead, Jim! */
3052 	dev_err(&qp_info->port_priv->device->dev,
3053 		"Fatal error (%d) on MAD QP (%d)\n",
3054 		event->event, qp_info->qp->qp_num);
3055 }
3056 
3057 static void init_mad_queue(struct ib_mad_qp_info *qp_info,
3058 			   struct ib_mad_queue *mad_queue)
3059 {
3060 	mad_queue->qp_info = qp_info;
3061 	mad_queue->count = 0;
3062 	spin_lock_init(&mad_queue->lock);
3063 	INIT_LIST_HEAD(&mad_queue->list);
3064 }
3065 
3066 static void init_mad_qp(struct ib_mad_port_private *port_priv,
3067 			struct ib_mad_qp_info *qp_info)
3068 {
3069 	qp_info->port_priv = port_priv;
3070 	init_mad_queue(qp_info, &qp_info->send_queue);
3071 	init_mad_queue(qp_info, &qp_info->recv_queue);
3072 	INIT_LIST_HEAD(&qp_info->overflow_list);
3073 	spin_lock_init(&qp_info->snoop_lock);
3074 	qp_info->snoop_table = NULL;
3075 	qp_info->snoop_table_size = 0;
3076 	atomic_set(&qp_info->snoop_count, 0);
3077 }
3078 
3079 static int create_mad_qp(struct ib_mad_qp_info *qp_info,
3080 			 enum ib_qp_type qp_type)
3081 {
3082 	struct ib_qp_init_attr	qp_init_attr;
3083 	int ret;
3084 
3085 	memset(&qp_init_attr, 0, sizeof qp_init_attr);
3086 	qp_init_attr.send_cq = qp_info->port_priv->cq;
3087 	qp_init_attr.recv_cq = qp_info->port_priv->cq;
3088 	qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
3089 	qp_init_attr.cap.max_send_wr = mad_sendq_size;
3090 	qp_init_attr.cap.max_recv_wr = mad_recvq_size;
3091 	qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
3092 	qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
3093 	qp_init_attr.qp_type = qp_type;
3094 	qp_init_attr.port_num = qp_info->port_priv->port_num;
3095 	qp_init_attr.qp_context = qp_info;
3096 	qp_init_attr.event_handler = qp_event_handler;
3097 	qp_info->qp = ib_create_qp(qp_info->port_priv->pd, &qp_init_attr);
3098 	if (IS_ERR(qp_info->qp)) {
3099 		dev_err(&qp_info->port_priv->device->dev,
3100 			"Couldn't create ib_mad QP%d\n",
3101 			get_spl_qp_index(qp_type));
3102 		ret = PTR_ERR(qp_info->qp);
3103 		goto error;
3104 	}
3105 	/* Use minimum queue sizes unless the CQ is resized */
3106 	qp_info->send_queue.max_active = mad_sendq_size;
3107 	qp_info->recv_queue.max_active = mad_recvq_size;
3108 	return 0;
3109 
3110 error:
3111 	return ret;
3112 }
3113 
3114 static void destroy_mad_qp(struct ib_mad_qp_info *qp_info)
3115 {
3116 	if (!qp_info->qp)
3117 		return;
3118 
3119 	ib_destroy_qp(qp_info->qp);
3120 	kfree(qp_info->snoop_table);
3121 }
3122 
3123 /*
3124  * Open the port
3125  * Create the QP, PD, MR, and CQ if needed
3126  */
3127 static int ib_mad_port_open(struct ib_device *device,
3128 			    int port_num)
3129 {
3130 	int ret, cq_size;
3131 	struct ib_mad_port_private *port_priv;
3132 	unsigned long flags;
3133 	char name[sizeof "ib_mad123"];
3134 	int has_smi;
3135 
3136 	if (WARN_ON(rdma_max_mad_size(device, port_num) < IB_MGMT_MAD_SIZE))
3137 		return -EFAULT;
3138 
3139 	if (WARN_ON(rdma_cap_opa_mad(device, port_num) &&
3140 		    rdma_max_mad_size(device, port_num) < OPA_MGMT_MAD_SIZE))
3141 		return -EFAULT;
3142 
3143 	/* Create new device info */
3144 	port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
3145 	if (!port_priv) {
3146 		dev_err(&device->dev, "No memory for ib_mad_port_private\n");
3147 		return -ENOMEM;
3148 	}
3149 
3150 	port_priv->device = device;
3151 	port_priv->port_num = port_num;
3152 	spin_lock_init(&port_priv->reg_lock);
3153 	INIT_LIST_HEAD(&port_priv->agent_list);
3154 	init_mad_qp(port_priv, &port_priv->qp_info[0]);
3155 	init_mad_qp(port_priv, &port_priv->qp_info[1]);
3156 
3157 	cq_size = mad_sendq_size + mad_recvq_size;
3158 	has_smi = rdma_cap_ib_smi(device, port_num);
3159 	if (has_smi)
3160 		cq_size *= 2;
3161 
3162 	port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
3163 			IB_POLL_WORKQUEUE);
3164 	if (IS_ERR(port_priv->cq)) {
3165 		dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
3166 		ret = PTR_ERR(port_priv->cq);
3167 		goto error3;
3168 	}
3169 
3170 	port_priv->pd = ib_alloc_pd(device, 0);
3171 	if (IS_ERR(port_priv->pd)) {
3172 		dev_err(&device->dev, "Couldn't create ib_mad PD\n");
3173 		ret = PTR_ERR(port_priv->pd);
3174 		goto error4;
3175 	}
3176 
3177 	if (has_smi) {
3178 		ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
3179 		if (ret)
3180 			goto error6;
3181 	}
3182 	ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
3183 	if (ret)
3184 		goto error7;
3185 
3186 	snprintf(name, sizeof name, "ib_mad%d", port_num);
3187 	port_priv->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
3188 	if (!port_priv->wq) {
3189 		ret = -ENOMEM;
3190 		goto error8;
3191 	}
3192 
3193 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3194 	list_add_tail(&port_priv->port_list, &ib_mad_port_list);
3195 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3196 
3197 	ret = ib_mad_port_start(port_priv);
3198 	if (ret) {
3199 		dev_err(&device->dev, "Couldn't start port\n");
3200 		goto error9;
3201 	}
3202 
3203 	return 0;
3204 
3205 error9:
3206 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3207 	list_del_init(&port_priv->port_list);
3208 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3209 
3210 	destroy_workqueue(port_priv->wq);
3211 error8:
3212 	destroy_mad_qp(&port_priv->qp_info[1]);
3213 error7:
3214 	destroy_mad_qp(&port_priv->qp_info[0]);
3215 error6:
3216 	ib_dealloc_pd(port_priv->pd);
3217 error4:
3218 	ib_free_cq(port_priv->cq);
3219 	cleanup_recv_queue(&port_priv->qp_info[1]);
3220 	cleanup_recv_queue(&port_priv->qp_info[0]);
3221 error3:
3222 	kfree(port_priv);
3223 
3224 	return ret;
3225 }
3226 
3227 /*
3228  * Close the port
3229  * If there are no classes using the port, free the port
3230  * resources (CQ, MR, PD, QP) and remove the port's info structure
3231  */
3232 static int ib_mad_port_close(struct ib_device *device, int port_num)
3233 {
3234 	struct ib_mad_port_private *port_priv;
3235 	unsigned long flags;
3236 
3237 	spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3238 	port_priv = __ib_get_mad_port(device, port_num);
3239 	if (port_priv == NULL) {
3240 		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3241 		dev_err(&device->dev, "Port %d not found\n", port_num);
3242 		return -ENODEV;
3243 	}
3244 	list_del_init(&port_priv->port_list);
3245 	spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3246 
3247 	destroy_workqueue(port_priv->wq);
3248 	destroy_mad_qp(&port_priv->qp_info[1]);
3249 	destroy_mad_qp(&port_priv->qp_info[0]);
3250 	ib_dealloc_pd(port_priv->pd);
3251 	ib_free_cq(port_priv->cq);
3252 	cleanup_recv_queue(&port_priv->qp_info[1]);
3253 	cleanup_recv_queue(&port_priv->qp_info[0]);
3254 	/* XXX: Handle deallocation of MAD registration tables */
3255 
3256 	kfree(port_priv);
3257 
3258 	return 0;
3259 }
3260 
3261 static void ib_mad_init_device(struct ib_device *device)
3262 {
3263 	int start, i;
3264 
3265 	start = rdma_start_port(device);
3266 
3267 	for (i = start; i <= rdma_end_port(device); i++) {
3268 		if (!rdma_cap_ib_mad(device, i))
3269 			continue;
3270 
3271 		if (ib_mad_port_open(device, i)) {
3272 			dev_err(&device->dev, "Couldn't open port %d\n", i);
3273 			goto error;
3274 		}
3275 		if (ib_agent_port_open(device, i)) {
3276 			dev_err(&device->dev,
3277 				"Couldn't open port %d for agents\n", i);
3278 			goto error_agent;
3279 		}
3280 	}
3281 	return;
3282 
3283 error_agent:
3284 	if (ib_mad_port_close(device, i))
3285 		dev_err(&device->dev, "Couldn't close port %d\n", i);
3286 
3287 error:
3288 	while (--i >= start) {
3289 		if (!rdma_cap_ib_mad(device, i))
3290 			continue;
3291 
3292 		if (ib_agent_port_close(device, i))
3293 			dev_err(&device->dev,
3294 				"Couldn't close port %d for agents\n", i);
3295 		if (ib_mad_port_close(device, i))
3296 			dev_err(&device->dev, "Couldn't close port %d\n", i);
3297 	}
3298 }
3299 
3300 static void ib_mad_remove_device(struct ib_device *device, void *client_data)
3301 {
3302 	int i;
3303 
3304 	for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
3305 		if (!rdma_cap_ib_mad(device, i))
3306 			continue;
3307 
3308 		if (ib_agent_port_close(device, i))
3309 			dev_err(&device->dev,
3310 				"Couldn't close port %d for agents\n", i);
3311 		if (ib_mad_port_close(device, i))
3312 			dev_err(&device->dev, "Couldn't close port %d\n", i);
3313 	}
3314 }
3315 
3316 static struct ib_client mad_client = {
3317 	.name   = "mad",
3318 	.add = ib_mad_init_device,
3319 	.remove = ib_mad_remove_device
3320 };
3321 
3322 int ib_mad_init(void)
3323 {
3324 	mad_recvq_size = min(mad_recvq_size, IB_MAD_QP_MAX_SIZE);
3325 	mad_recvq_size = max(mad_recvq_size, IB_MAD_QP_MIN_SIZE);
3326 
3327 	mad_sendq_size = min(mad_sendq_size, IB_MAD_QP_MAX_SIZE);
3328 	mad_sendq_size = max(mad_sendq_size, IB_MAD_QP_MIN_SIZE);
3329 
3330 	INIT_LIST_HEAD(&ib_mad_port_list);
3331 
3332 	if (ib_register_client(&mad_client)) {
3333 		pr_err("Couldn't register ib_mad client\n");
3334 		return -EINVAL;
3335 	}
3336 
3337 	return 0;
3338 }
3339 
3340 void ib_mad_cleanup(void)
3341 {
3342 	ib_unregister_client(&mad_client);
3343 }
3344