1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause OR GPL-2.0
3  *
4  * Copyright (c) 2005 Intel Inc. All rights reserved.
5  * Copyright (c) 2005-2006 Voltaire, Inc. All rights reserved.
6  * Copyright (c) 2014 Intel Corporation.  All rights reserved.
7  *
8  * This software is available to you under a choice of one of two
9  * licenses.  You may choose to be licensed under the terms of the GNU
10  * General Public License (GPL) Version 2, available from the file
11  * COPYING in the main directory of this source tree, or the
12  * OpenIB.org BSD license below:
13  *
14  *     Redistribution and use in source and binary forms, with or
15  *     without modification, are permitted provided that the following
16  *     conditions are met:
17  *
18  *      - Redistributions of source code must retain the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer.
21  *
22  *      - Redistributions in binary form must reproduce the above
23  *        copyright notice, this list of conditions and the following
24  *        disclaimer in the documentation and/or other materials
25  *        provided with the distribution.
26  *
27  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
28  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
29  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
30  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
31  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
32  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
33  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
34  * SOFTWARE.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <linux/slab.h>
41 
42 #include "mad_priv.h"
43 #include "mad_rmpp.h"
44 
45 enum rmpp_state {
46 	RMPP_STATE_ACTIVE,
47 	RMPP_STATE_TIMEOUT,
48 	RMPP_STATE_COMPLETE,
49 	RMPP_STATE_CANCELING
50 };
51 
52 struct mad_rmpp_recv {
53 	struct ib_mad_agent_private *agent;
54 	struct list_head list;
55 	struct delayed_work timeout_work;
56 	struct delayed_work cleanup_work;
57 	struct completion comp;
58 	enum rmpp_state state;
59 	spinlock_t lock;
60 	atomic_t refcount;
61 
62 	struct ib_ah *ah;
63 	struct ib_mad_recv_wc *rmpp_wc;
64 	struct ib_mad_recv_buf *cur_seg_buf;
65 	int last_ack;
66 	int seg_num;
67 	int newwin;
68 	int repwin;
69 
70 	__be64 tid;
71 	u32 src_qp;
72 	u16 slid;
73 	u8 mgmt_class;
74 	u8 class_version;
75 	u8 method;
76 	u8 base_version;
77 };
78 
79 static inline void deref_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
80 {
81 	if (atomic_dec_and_test(&rmpp_recv->refcount))
82 		complete(&rmpp_recv->comp);
83 }
84 
85 static void destroy_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
86 {
87 	deref_rmpp_recv(rmpp_recv);
88 	wait_for_completion(&rmpp_recv->comp);
89 	ib_destroy_ah(rmpp_recv->ah, RDMA_DESTROY_AH_SLEEPABLE);
90 	kfree(rmpp_recv);
91 }
92 
93 void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent)
94 {
95 	struct mad_rmpp_recv *rmpp_recv, *temp_rmpp_recv;
96 	unsigned long flags;
97 
98 	spin_lock_irqsave(&agent->lock, flags);
99 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
100 		if (rmpp_recv->state != RMPP_STATE_COMPLETE)
101 			ib_free_recv_mad(rmpp_recv->rmpp_wc);
102 		rmpp_recv->state = RMPP_STATE_CANCELING;
103 	}
104 	spin_unlock_irqrestore(&agent->lock, flags);
105 
106 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
107 		cancel_delayed_work_sync(&rmpp_recv->timeout_work);
108 		cancel_delayed_work_sync(&rmpp_recv->cleanup_work);
109 	}
110 
111 	flush_workqueue(agent->qp_info->port_priv->wq);
112 
113 	list_for_each_entry_safe(rmpp_recv, temp_rmpp_recv,
114 				 &agent->rmpp_list, list) {
115 		list_del(&rmpp_recv->list);
116 		destroy_rmpp_recv(rmpp_recv);
117 	}
118 }
119 
120 static void format_ack(struct ib_mad_send_buf *msg,
121 		       struct ib_rmpp_mad *data,
122 		       struct mad_rmpp_recv *rmpp_recv)
123 {
124 	struct ib_rmpp_mad *ack = msg->mad;
125 	unsigned long flags;
126 
127 	memcpy(ack, &data->mad_hdr, msg->hdr_len);
128 
129 	ack->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
130 	ack->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ACK;
131 	ib_set_rmpp_flags(&ack->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
132 
133 	spin_lock_irqsave(&rmpp_recv->lock, flags);
134 	rmpp_recv->last_ack = rmpp_recv->seg_num;
135 	ack->rmpp_hdr.seg_num = cpu_to_be32(rmpp_recv->seg_num);
136 	ack->rmpp_hdr.paylen_newwin = cpu_to_be32(rmpp_recv->newwin);
137 	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
138 }
139 
140 static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
141 		     struct ib_mad_recv_wc *recv_wc)
142 {
143 	struct ib_mad_send_buf *msg;
144 	int ret, hdr_len;
145 
146 	hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
147 	msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
148 				 recv_wc->wc->pkey_index, 1, hdr_len,
149 				 0, GFP_KERNEL,
150 				 IB_MGMT_BASE_VERSION);
151 	if (IS_ERR(msg))
152 		return;
153 
154 	format_ack(msg, (struct ib_rmpp_mad *) recv_wc->recv_buf.mad, rmpp_recv);
155 	msg->ah = rmpp_recv->ah;
156 	ret = ib_post_send_mad(msg, NULL);
157 	if (ret)
158 		ib_free_send_mad(msg);
159 }
160 
161 static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
162 						  struct ib_mad_recv_wc *recv_wc)
163 {
164 	struct ib_mad_send_buf *msg;
165 	struct ib_ah *ah;
166 	int hdr_len;
167 
168 	ah = ib_create_ah_from_wc(agent->qp->pd, recv_wc->wc,
169 				  recv_wc->recv_buf.grh, agent->port_num);
170 	if (IS_ERR(ah))
171 		return (void *) ah;
172 
173 	hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
174 	msg = ib_create_send_mad(agent, recv_wc->wc->src_qp,
175 				 recv_wc->wc->pkey_index, 1,
176 				 hdr_len, 0, GFP_KERNEL,
177 				 IB_MGMT_BASE_VERSION);
178 	if (IS_ERR(msg))
179 		ib_destroy_ah(ah, RDMA_DESTROY_AH_SLEEPABLE);
180 	else {
181 		msg->ah = ah;
182 		msg->context[0] = ah;
183 	}
184 
185 	return msg;
186 }
187 
188 static void ack_ds_ack(struct ib_mad_agent_private *agent,
189 		       struct ib_mad_recv_wc *recv_wc)
190 {
191 	struct ib_mad_send_buf *msg;
192 	struct ib_rmpp_mad *rmpp_mad;
193 	int ret;
194 
195 	msg = alloc_response_msg(&agent->agent, recv_wc);
196 	if (IS_ERR(msg))
197 		return;
198 
199 	rmpp_mad = msg->mad;
200 	memcpy(rmpp_mad, recv_wc->recv_buf.mad, msg->hdr_len);
201 
202 	rmpp_mad->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
203 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
204 	rmpp_mad->rmpp_hdr.seg_num = 0;
205 	rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(1);
206 
207 	ret = ib_post_send_mad(msg, NULL);
208 	if (ret) {
209 		ib_destroy_ah(msg->ah, RDMA_DESTROY_AH_SLEEPABLE);
210 		ib_free_send_mad(msg);
211 	}
212 }
213 
214 void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)
215 {
216 	if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)
217 		ib_destroy_ah(mad_send_wc->send_buf->ah, RDMA_DESTROY_AH_SLEEPABLE);
218 	ib_free_send_mad(mad_send_wc->send_buf);
219 }
220 
221 static void nack_recv(struct ib_mad_agent_private *agent,
222 		      struct ib_mad_recv_wc *recv_wc, u8 rmpp_status)
223 {
224 	struct ib_mad_send_buf *msg;
225 	struct ib_rmpp_mad *rmpp_mad;
226 	int ret;
227 
228 	msg = alloc_response_msg(&agent->agent, recv_wc);
229 	if (IS_ERR(msg))
230 		return;
231 
232 	rmpp_mad = msg->mad;
233 	memcpy(rmpp_mad, recv_wc->recv_buf.mad, msg->hdr_len);
234 
235 	rmpp_mad->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
236 	rmpp_mad->rmpp_hdr.rmpp_version = IB_MGMT_RMPP_VERSION;
237 	rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ABORT;
238 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
239 	rmpp_mad->rmpp_hdr.rmpp_status = rmpp_status;
240 	rmpp_mad->rmpp_hdr.seg_num = 0;
241 	rmpp_mad->rmpp_hdr.paylen_newwin = 0;
242 
243 	ret = ib_post_send_mad(msg, NULL);
244 	if (ret) {
245 		ib_destroy_ah(msg->ah, RDMA_DESTROY_AH_SLEEPABLE);
246 		ib_free_send_mad(msg);
247 	}
248 }
249 
250 static void recv_timeout_handler(struct work_struct *work)
251 {
252 	struct mad_rmpp_recv *rmpp_recv =
253 		container_of(work, struct mad_rmpp_recv, timeout_work.work);
254 	struct ib_mad_recv_wc *rmpp_wc;
255 	unsigned long flags;
256 
257 	spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
258 	if (rmpp_recv->state != RMPP_STATE_ACTIVE) {
259 		spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
260 		return;
261 	}
262 	rmpp_recv->state = RMPP_STATE_TIMEOUT;
263 	list_del(&rmpp_recv->list);
264 	spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
265 
266 	rmpp_wc = rmpp_recv->rmpp_wc;
267 	nack_recv(rmpp_recv->agent, rmpp_wc, IB_MGMT_RMPP_STATUS_T2L);
268 	destroy_rmpp_recv(rmpp_recv);
269 	ib_free_recv_mad(rmpp_wc);
270 }
271 
272 static void recv_cleanup_handler(struct work_struct *work)
273 {
274 	struct mad_rmpp_recv *rmpp_recv =
275 		container_of(work, struct mad_rmpp_recv, cleanup_work.work);
276 	unsigned long flags;
277 
278 	spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
279 	if (rmpp_recv->state == RMPP_STATE_CANCELING) {
280 		spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
281 		return;
282 	}
283 	list_del(&rmpp_recv->list);
284 	spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
285 	destroy_rmpp_recv(rmpp_recv);
286 }
287 
288 static struct mad_rmpp_recv *
289 create_rmpp_recv(struct ib_mad_agent_private *agent,
290 		 struct ib_mad_recv_wc *mad_recv_wc)
291 {
292 	struct mad_rmpp_recv *rmpp_recv;
293 	struct ib_mad_hdr *mad_hdr;
294 
295 	rmpp_recv = kmalloc(sizeof *rmpp_recv, GFP_KERNEL);
296 	if (!rmpp_recv)
297 		return NULL;
298 
299 	rmpp_recv->ah = ib_create_ah_from_wc(agent->agent.qp->pd,
300 					     mad_recv_wc->wc,
301 					     mad_recv_wc->recv_buf.grh,
302 					     agent->agent.port_num);
303 	if (IS_ERR(rmpp_recv->ah))
304 		goto error;
305 
306 	rmpp_recv->agent = agent;
307 	init_completion(&rmpp_recv->comp);
308 	INIT_DELAYED_WORK(&rmpp_recv->timeout_work, recv_timeout_handler);
309 	INIT_DELAYED_WORK(&rmpp_recv->cleanup_work, recv_cleanup_handler);
310 	spin_lock_init(&rmpp_recv->lock);
311 	rmpp_recv->state = RMPP_STATE_ACTIVE;
312 	atomic_set(&rmpp_recv->refcount, 1);
313 
314 	rmpp_recv->rmpp_wc = mad_recv_wc;
315 	rmpp_recv->cur_seg_buf = &mad_recv_wc->recv_buf;
316 	rmpp_recv->newwin = 1;
317 	rmpp_recv->seg_num = 1;
318 	rmpp_recv->last_ack = 0;
319 	rmpp_recv->repwin = 1;
320 
321 	mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
322 	rmpp_recv->tid = mad_hdr->tid;
323 	rmpp_recv->src_qp = mad_recv_wc->wc->src_qp;
324 	rmpp_recv->slid = mad_recv_wc->wc->slid;
325 	rmpp_recv->mgmt_class = mad_hdr->mgmt_class;
326 	rmpp_recv->class_version = mad_hdr->class_version;
327 	rmpp_recv->method  = mad_hdr->method;
328 	rmpp_recv->base_version  = mad_hdr->base_version;
329 	return rmpp_recv;
330 
331 error:	kfree(rmpp_recv);
332 	return NULL;
333 }
334 
335 static struct mad_rmpp_recv *
336 find_rmpp_recv(struct ib_mad_agent_private *agent,
337 	       struct ib_mad_recv_wc *mad_recv_wc)
338 {
339 	struct mad_rmpp_recv *rmpp_recv;
340 	struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
341 
342 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
343 		if (rmpp_recv->tid == mad_hdr->tid &&
344 		    rmpp_recv->src_qp == mad_recv_wc->wc->src_qp &&
345 		    rmpp_recv->slid == mad_recv_wc->wc->slid &&
346 		    rmpp_recv->mgmt_class == mad_hdr->mgmt_class &&
347 		    rmpp_recv->class_version == mad_hdr->class_version &&
348 		    rmpp_recv->method == mad_hdr->method)
349 			return rmpp_recv;
350 	}
351 	return NULL;
352 }
353 
354 static struct mad_rmpp_recv *
355 acquire_rmpp_recv(struct ib_mad_agent_private *agent,
356 		  struct ib_mad_recv_wc *mad_recv_wc)
357 {
358 	struct mad_rmpp_recv *rmpp_recv;
359 	unsigned long flags;
360 
361 	spin_lock_irqsave(&agent->lock, flags);
362 	rmpp_recv = find_rmpp_recv(agent, mad_recv_wc);
363 	if (rmpp_recv)
364 		atomic_inc(&rmpp_recv->refcount);
365 	spin_unlock_irqrestore(&agent->lock, flags);
366 	return rmpp_recv;
367 }
368 
369 static struct mad_rmpp_recv *
370 insert_rmpp_recv(struct ib_mad_agent_private *agent,
371 		 struct mad_rmpp_recv *rmpp_recv)
372 {
373 	struct mad_rmpp_recv *cur_rmpp_recv;
374 
375 	cur_rmpp_recv = find_rmpp_recv(agent, rmpp_recv->rmpp_wc);
376 	if (!cur_rmpp_recv)
377 		list_add_tail(&rmpp_recv->list, &agent->rmpp_list);
378 
379 	return cur_rmpp_recv;
380 }
381 
382 static inline int get_last_flag(struct ib_mad_recv_buf *seg)
383 {
384 	struct ib_rmpp_mad *rmpp_mad;
385 
386 	rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
387 	return ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & IB_MGMT_RMPP_FLAG_LAST;
388 }
389 
390 static inline int get_seg_num(struct ib_mad_recv_buf *seg)
391 {
392 	struct ib_rmpp_mad *rmpp_mad;
393 
394 	rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
395 	return be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
396 }
397 
398 static inline struct ib_mad_recv_buf * get_next_seg(struct list_head *rmpp_list,
399 						    struct ib_mad_recv_buf *seg)
400 {
401 	if (seg->list.next == rmpp_list)
402 		return NULL;
403 
404 	return container_of(seg->list.next, struct ib_mad_recv_buf, list);
405 }
406 
407 static inline int window_size(struct ib_mad_agent_private *agent)
408 {
409 	return max(agent->qp_info->recv_queue.max_active >> 3, 1);
410 }
411 
412 static struct ib_mad_recv_buf * find_seg_location(struct list_head *rmpp_list,
413 						  int seg_num)
414 {
415 	struct ib_mad_recv_buf *seg_buf;
416 	int cur_seg_num;
417 
418 	list_for_each_entry_reverse(seg_buf, rmpp_list, list) {
419 		cur_seg_num = get_seg_num(seg_buf);
420 		if (seg_num > cur_seg_num)
421 			return seg_buf;
422 		if (seg_num == cur_seg_num)
423 			break;
424 	}
425 	return NULL;
426 }
427 
428 static void update_seg_num(struct mad_rmpp_recv *rmpp_recv,
429 			   struct ib_mad_recv_buf *new_buf)
430 {
431 	struct list_head *rmpp_list = &rmpp_recv->rmpp_wc->rmpp_list;
432 
433 	while (new_buf && (get_seg_num(new_buf) == rmpp_recv->seg_num + 1)) {
434 		rmpp_recv->cur_seg_buf = new_buf;
435 		rmpp_recv->seg_num++;
436 		new_buf = get_next_seg(rmpp_list, new_buf);
437 	}
438 }
439 
440 static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
441 {
442 	struct ib_rmpp_mad *rmpp_mad;
443 	int hdr_size, data_size, pad;
444 	bool opa = rdma_cap_opa_mad(rmpp_recv->agent->qp_info->port_priv->device,
445 				    rmpp_recv->agent->qp_info->port_priv->port_num);
446 
447 	rmpp_mad = (struct ib_rmpp_mad *)rmpp_recv->cur_seg_buf->mad;
448 
449 	hdr_size = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class);
450 	if (opa && rmpp_recv->base_version == OPA_MGMT_BASE_VERSION) {
451 		data_size = sizeof(struct opa_rmpp_mad) - hdr_size;
452 		pad = OPA_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
453 		if (pad > OPA_MGMT_RMPP_DATA || pad < 0)
454 			pad = 0;
455 	} else {
456 		data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
457 		pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
458 		if (pad > IB_MGMT_RMPP_DATA || pad < 0)
459 			pad = 0;
460 	}
461 
462 	return hdr_size + rmpp_recv->seg_num * data_size - pad;
463 }
464 
465 static struct ib_mad_recv_wc * complete_rmpp(struct mad_rmpp_recv *rmpp_recv)
466 {
467 	struct ib_mad_recv_wc *rmpp_wc;
468 
469 	ack_recv(rmpp_recv, rmpp_recv->rmpp_wc);
470 	if (rmpp_recv->seg_num > 1)
471 		cancel_delayed_work(&rmpp_recv->timeout_work);
472 
473 	rmpp_wc = rmpp_recv->rmpp_wc;
474 	rmpp_wc->mad_len = get_mad_len(rmpp_recv);
475 	/* 10 seconds until we can find the packet lifetime */
476 	queue_delayed_work(rmpp_recv->agent->qp_info->port_priv->wq,
477 			   &rmpp_recv->cleanup_work, msecs_to_jiffies(10000));
478 	return rmpp_wc;
479 }
480 
481 static struct ib_mad_recv_wc *
482 continue_rmpp(struct ib_mad_agent_private *agent,
483 	      struct ib_mad_recv_wc *mad_recv_wc)
484 {
485 	struct mad_rmpp_recv *rmpp_recv;
486 	struct ib_mad_recv_buf *prev_buf;
487 	struct ib_mad_recv_wc *done_wc;
488 	int seg_num;
489 	unsigned long flags;
490 
491 	rmpp_recv = acquire_rmpp_recv(agent, mad_recv_wc);
492 	if (!rmpp_recv)
493 		goto drop1;
494 
495 	seg_num = get_seg_num(&mad_recv_wc->recv_buf);
496 
497 	spin_lock_irqsave(&rmpp_recv->lock, flags);
498 	if ((rmpp_recv->state == RMPP_STATE_TIMEOUT) ||
499 	    (seg_num > rmpp_recv->newwin))
500 		goto drop3;
501 
502 	if ((seg_num <= rmpp_recv->last_ack) ||
503 	    (rmpp_recv->state == RMPP_STATE_COMPLETE)) {
504 		spin_unlock_irqrestore(&rmpp_recv->lock, flags);
505 		ack_recv(rmpp_recv, mad_recv_wc);
506 		goto drop2;
507 	}
508 
509 	prev_buf = find_seg_location(&rmpp_recv->rmpp_wc->rmpp_list, seg_num);
510 	if (!prev_buf)
511 		goto drop3;
512 
513 	done_wc = NULL;
514 	list_add(&mad_recv_wc->recv_buf.list, &prev_buf->list);
515 	if (rmpp_recv->cur_seg_buf == prev_buf) {
516 		update_seg_num(rmpp_recv, &mad_recv_wc->recv_buf);
517 		if (get_last_flag(rmpp_recv->cur_seg_buf)) {
518 			rmpp_recv->state = RMPP_STATE_COMPLETE;
519 			spin_unlock_irqrestore(&rmpp_recv->lock, flags);
520 			done_wc = complete_rmpp(rmpp_recv);
521 			goto out;
522 		} else if (rmpp_recv->seg_num == rmpp_recv->newwin) {
523 			rmpp_recv->newwin += window_size(agent);
524 			spin_unlock_irqrestore(&rmpp_recv->lock, flags);
525 			ack_recv(rmpp_recv, mad_recv_wc);
526 			goto out;
527 		}
528 	}
529 	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
530 out:
531 	deref_rmpp_recv(rmpp_recv);
532 	return done_wc;
533 
534 drop3:	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
535 drop2:	deref_rmpp_recv(rmpp_recv);
536 drop1:	ib_free_recv_mad(mad_recv_wc);
537 	return NULL;
538 }
539 
540 static struct ib_mad_recv_wc *
541 start_rmpp(struct ib_mad_agent_private *agent,
542 	   struct ib_mad_recv_wc *mad_recv_wc)
543 {
544 	struct mad_rmpp_recv *rmpp_recv;
545 	unsigned long flags;
546 
547 	rmpp_recv = create_rmpp_recv(agent, mad_recv_wc);
548 	if (!rmpp_recv) {
549 		ib_free_recv_mad(mad_recv_wc);
550 		return NULL;
551 	}
552 
553 	spin_lock_irqsave(&agent->lock, flags);
554 	if (insert_rmpp_recv(agent, rmpp_recv)) {
555 		spin_unlock_irqrestore(&agent->lock, flags);
556 		/* duplicate first MAD */
557 		destroy_rmpp_recv(rmpp_recv);
558 		return continue_rmpp(agent, mad_recv_wc);
559 	}
560 	atomic_inc(&rmpp_recv->refcount);
561 
562 	if (get_last_flag(&mad_recv_wc->recv_buf)) {
563 		rmpp_recv->state = RMPP_STATE_COMPLETE;
564 		spin_unlock_irqrestore(&agent->lock, flags);
565 		complete_rmpp(rmpp_recv);
566 	} else {
567 		spin_unlock_irqrestore(&agent->lock, flags);
568 		/* 40 seconds until we can find the packet lifetimes */
569 		queue_delayed_work(agent->qp_info->port_priv->wq,
570 				   &rmpp_recv->timeout_work,
571 				   msecs_to_jiffies(40000));
572 		rmpp_recv->newwin += window_size(agent);
573 		ack_recv(rmpp_recv, mad_recv_wc);
574 		mad_recv_wc = NULL;
575 	}
576 	deref_rmpp_recv(rmpp_recv);
577 	return mad_recv_wc;
578 }
579 
580 static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
581 {
582 	struct ib_rmpp_mad *rmpp_mad;
583 	int timeout;
584 	u32 paylen = 0;
585 
586 	rmpp_mad = mad_send_wr->send_buf.mad;
587 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
588 	rmpp_mad->rmpp_hdr.seg_num = cpu_to_be32(++mad_send_wr->seg_num);
589 
590 	if (mad_send_wr->seg_num == 1) {
591 		rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
592 		paylen = (mad_send_wr->send_buf.seg_count *
593 			  mad_send_wr->send_buf.seg_rmpp_size) -
594 			  mad_send_wr->pad;
595 	}
596 
597 	if (mad_send_wr->seg_num == mad_send_wr->send_buf.seg_count) {
598 		rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
599 		paylen = mad_send_wr->send_buf.seg_rmpp_size - mad_send_wr->pad;
600 	}
601 	rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
602 
603 	/* 2 seconds for an ACK until we can find the packet lifetime */
604 	timeout = mad_send_wr->send_buf.timeout_ms;
605 	if (!timeout || timeout > 2000)
606 		mad_send_wr->timeout = msecs_to_jiffies(2000);
607 
608 	return ib_send_mad(mad_send_wr);
609 }
610 
611 static void abort_send(struct ib_mad_agent_private *agent,
612 		       struct ib_mad_recv_wc *mad_recv_wc, u8 rmpp_status)
613 {
614 	struct ib_mad_send_wr_private *mad_send_wr;
615 	struct ib_mad_send_wc wc;
616 	unsigned long flags;
617 
618 	spin_lock_irqsave(&agent->lock, flags);
619 	mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
620 	if (!mad_send_wr)
621 		goto out;	/* Unmatched send */
622 
623 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) ||
624 	    (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
625 		goto out;	/* Send is already done */
626 
627 	ib_mark_mad_done(mad_send_wr);
628 	spin_unlock_irqrestore(&agent->lock, flags);
629 
630 	wc.status = IB_WC_REM_ABORT_ERR;
631 	wc.vendor_err = rmpp_status;
632 	wc.send_buf = &mad_send_wr->send_buf;
633 	ib_mad_complete_send_wr(mad_send_wr, &wc);
634 	return;
635 out:
636 	spin_unlock_irqrestore(&agent->lock, flags);
637 }
638 
639 static inline void adjust_last_ack(struct ib_mad_send_wr_private *wr,
640 				   int seg_num)
641 {
642 	struct list_head *list;
643 
644 	wr->last_ack = seg_num;
645 	list = &wr->last_ack_seg->list;
646 	list_for_each_entry(wr->last_ack_seg, list, list)
647 		if (wr->last_ack_seg->num == seg_num)
648 			break;
649 }
650 
651 static void process_ds_ack(struct ib_mad_agent_private *agent,
652 			   struct ib_mad_recv_wc *mad_recv_wc, int newwin)
653 {
654 	struct mad_rmpp_recv *rmpp_recv;
655 
656 	rmpp_recv = find_rmpp_recv(agent, mad_recv_wc);
657 	if (rmpp_recv && rmpp_recv->state == RMPP_STATE_COMPLETE)
658 		rmpp_recv->repwin = newwin;
659 }
660 
661 static void process_rmpp_ack(struct ib_mad_agent_private *agent,
662 			     struct ib_mad_recv_wc *mad_recv_wc)
663 {
664 	struct ib_mad_send_wr_private *mad_send_wr;
665 	struct ib_rmpp_mad *rmpp_mad;
666 	unsigned long flags;
667 	int seg_num, newwin, ret;
668 
669 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
670 	if (rmpp_mad->rmpp_hdr.rmpp_status) {
671 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
672 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
673 		return;
674 	}
675 
676 	seg_num = be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
677 	newwin = be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
678 	if (newwin < seg_num) {
679 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
680 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
681 		return;
682 	}
683 
684 	spin_lock_irqsave(&agent->lock, flags);
685 	mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
686 	if (!mad_send_wr) {
687 		if (!seg_num)
688 			process_ds_ack(agent, mad_recv_wc, newwin);
689 		goto out;	/* Unmatched or DS RMPP ACK */
690 	}
691 
692 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) &&
693 	    (mad_send_wr->timeout)) {
694 		spin_unlock_irqrestore(&agent->lock, flags);
695 		ack_ds_ack(agent, mad_recv_wc);
696 		return;		/* Repeated ACK for DS RMPP transaction */
697 	}
698 
699 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) ||
700 	    (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
701 		goto out;	/* Send is already done */
702 
703 	if (seg_num > mad_send_wr->send_buf.seg_count ||
704 	    seg_num > mad_send_wr->newwin) {
705 		spin_unlock_irqrestore(&agent->lock, flags);
706 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
707 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
708 		return;
709 	}
710 
711 	if (newwin < mad_send_wr->newwin || seg_num < mad_send_wr->last_ack)
712 		goto out;	/* Old ACK */
713 
714 	if (seg_num > mad_send_wr->last_ack) {
715 		adjust_last_ack(mad_send_wr, seg_num);
716 		mad_send_wr->retries_left = mad_send_wr->max_retries;
717 	}
718 	mad_send_wr->newwin = newwin;
719 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) {
720 		/* If no response is expected, the ACK completes the send */
721 		if (!mad_send_wr->send_buf.timeout_ms) {
722 			struct ib_mad_send_wc wc;
723 
724 			ib_mark_mad_done(mad_send_wr);
725 			spin_unlock_irqrestore(&agent->lock, flags);
726 
727 			wc.status = IB_WC_SUCCESS;
728 			wc.vendor_err = 0;
729 			wc.send_buf = &mad_send_wr->send_buf;
730 			ib_mad_complete_send_wr(mad_send_wr, &wc);
731 			return;
732 		}
733 		if (mad_send_wr->refcount == 1)
734 			ib_reset_mad_timeout(mad_send_wr,
735 					     mad_send_wr->send_buf.timeout_ms);
736 		spin_unlock_irqrestore(&agent->lock, flags);
737 		ack_ds_ack(agent, mad_recv_wc);
738 		return;
739 	} else if (mad_send_wr->refcount == 1 &&
740 		   mad_send_wr->seg_num < mad_send_wr->newwin &&
741 		   mad_send_wr->seg_num < mad_send_wr->send_buf.seg_count) {
742 		/* Send failure will just result in a timeout/retry */
743 		ret = send_next_seg(mad_send_wr);
744 		if (ret)
745 			goto out;
746 
747 		mad_send_wr->refcount++;
748 		list_move_tail(&mad_send_wr->agent_list,
749 			      &mad_send_wr->mad_agent_priv->send_list);
750 	}
751 out:
752 	spin_unlock_irqrestore(&agent->lock, flags);
753 }
754 
755 static struct ib_mad_recv_wc *
756 process_rmpp_data(struct ib_mad_agent_private *agent,
757 		  struct ib_mad_recv_wc *mad_recv_wc)
758 {
759 	struct ib_rmpp_hdr *rmpp_hdr;
760 	u8 rmpp_status;
761 
762 	rmpp_hdr = &((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr;
763 
764 	if (rmpp_hdr->rmpp_status) {
765 		rmpp_status = IB_MGMT_RMPP_STATUS_BAD_STATUS;
766 		goto bad;
767 	}
768 
769 	if (rmpp_hdr->seg_num == cpu_to_be32(1)) {
770 		if (!(ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST)) {
771 			rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
772 			goto bad;
773 		}
774 		return start_rmpp(agent, mad_recv_wc);
775 	} else {
776 		if (ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST) {
777 			rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
778 			goto bad;
779 		}
780 		return continue_rmpp(agent, mad_recv_wc);
781 	}
782 bad:
783 	nack_recv(agent, mad_recv_wc, rmpp_status);
784 	ib_free_recv_mad(mad_recv_wc);
785 	return NULL;
786 }
787 
788 static void process_rmpp_stop(struct ib_mad_agent_private *agent,
789 			      struct ib_mad_recv_wc *mad_recv_wc)
790 {
791 	struct ib_rmpp_mad *rmpp_mad;
792 
793 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
794 
795 	if (rmpp_mad->rmpp_hdr.rmpp_status != IB_MGMT_RMPP_STATUS_RESX) {
796 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
797 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
798 	} else
799 		abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
800 }
801 
802 static void process_rmpp_abort(struct ib_mad_agent_private *agent,
803 			       struct ib_mad_recv_wc *mad_recv_wc)
804 {
805 	struct ib_rmpp_mad *rmpp_mad;
806 
807 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
808 
809 	if (rmpp_mad->rmpp_hdr.rmpp_status < IB_MGMT_RMPP_STATUS_ABORT_MIN ||
810 	    rmpp_mad->rmpp_hdr.rmpp_status > IB_MGMT_RMPP_STATUS_ABORT_MAX) {
811 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
812 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
813 	} else
814 		abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
815 }
816 
817 struct ib_mad_recv_wc *
818 ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
819 			struct ib_mad_recv_wc *mad_recv_wc)
820 {
821 	struct ib_rmpp_mad *rmpp_mad;
822 
823 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
824 	if (!(rmpp_mad->rmpp_hdr.rmpp_rtime_flags & IB_MGMT_RMPP_FLAG_ACTIVE))
825 		return mad_recv_wc;
826 
827 	if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION) {
828 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
829 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
830 		goto out;
831 	}
832 
833 	switch (rmpp_mad->rmpp_hdr.rmpp_type) {
834 	case IB_MGMT_RMPP_TYPE_DATA:
835 		return process_rmpp_data(agent, mad_recv_wc);
836 	case IB_MGMT_RMPP_TYPE_ACK:
837 		process_rmpp_ack(agent, mad_recv_wc);
838 		break;
839 	case IB_MGMT_RMPP_TYPE_STOP:
840 		process_rmpp_stop(agent, mad_recv_wc);
841 		break;
842 	case IB_MGMT_RMPP_TYPE_ABORT:
843 		process_rmpp_abort(agent, mad_recv_wc);
844 		break;
845 	default:
846 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
847 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
848 		break;
849 	}
850 out:
851 	ib_free_recv_mad(mad_recv_wc);
852 	return NULL;
853 }
854 
855 static int init_newwin(struct ib_mad_send_wr_private *mad_send_wr)
856 {
857 	struct ib_mad_agent_private *agent = mad_send_wr->mad_agent_priv;
858 	struct ib_mad_hdr *mad_hdr = mad_send_wr->send_buf.mad;
859 	struct mad_rmpp_recv *rmpp_recv;
860 	struct ib_ah_attr ah_attr;
861 	unsigned long flags;
862 	int newwin = 1;
863 
864 	if (!(mad_hdr->method & IB_MGMT_METHOD_RESP))
865 		goto out;
866 
867 	spin_lock_irqsave(&agent->lock, flags);
868 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
869 		if (rmpp_recv->tid != mad_hdr->tid ||
870 		    rmpp_recv->mgmt_class != mad_hdr->mgmt_class ||
871 		    rmpp_recv->class_version != mad_hdr->class_version ||
872 		    (rmpp_recv->method & IB_MGMT_METHOD_RESP))
873 			continue;
874 
875 		if (ib_query_ah(mad_send_wr->send_buf.ah, &ah_attr))
876 			continue;
877 
878 		if (rmpp_recv->slid == ah_attr.dlid) {
879 			newwin = rmpp_recv->repwin;
880 			break;
881 		}
882 	}
883 	spin_unlock_irqrestore(&agent->lock, flags);
884 out:
885 	return newwin;
886 }
887 
888 int ib_send_rmpp_mad(struct ib_mad_send_wr_private *mad_send_wr)
889 {
890 	struct ib_rmpp_mad *rmpp_mad;
891 	int ret;
892 
893 	rmpp_mad = mad_send_wr->send_buf.mad;
894 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
895 	      IB_MGMT_RMPP_FLAG_ACTIVE))
896 		return IB_RMPP_RESULT_UNHANDLED;
897 
898 	if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA) {
899 		mad_send_wr->seg_num = 1;
900 		return IB_RMPP_RESULT_INTERNAL;
901 	}
902 
903 	mad_send_wr->newwin = init_newwin(mad_send_wr);
904 
905 	/* We need to wait for the final ACK even if there isn't a response */
906 	mad_send_wr->refcount += (mad_send_wr->timeout == 0);
907 	ret = send_next_seg(mad_send_wr);
908 	if (!ret)
909 		return IB_RMPP_RESULT_CONSUMED;
910 	return ret;
911 }
912 
913 int ib_process_rmpp_send_wc(struct ib_mad_send_wr_private *mad_send_wr,
914 			    struct ib_mad_send_wc *mad_send_wc)
915 {
916 	struct ib_rmpp_mad *rmpp_mad;
917 	int ret;
918 
919 	rmpp_mad = mad_send_wr->send_buf.mad;
920 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
921 	      IB_MGMT_RMPP_FLAG_ACTIVE))
922 		return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
923 
924 	if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA)
925 		return IB_RMPP_RESULT_INTERNAL;	 /* ACK, STOP, or ABORT */
926 
927 	if (mad_send_wc->status != IB_WC_SUCCESS ||
928 	    mad_send_wr->status != IB_WC_SUCCESS)
929 		return IB_RMPP_RESULT_PROCESSED; /* Canceled or send error */
930 
931 	if (!mad_send_wr->timeout)
932 		return IB_RMPP_RESULT_PROCESSED; /* Response received */
933 
934 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) {
935 		mad_send_wr->timeout =
936 			msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
937 		return IB_RMPP_RESULT_PROCESSED; /* Send done */
938 	}
939 
940 	if (mad_send_wr->seg_num == mad_send_wr->newwin ||
941 	    mad_send_wr->seg_num == mad_send_wr->send_buf.seg_count)
942 		return IB_RMPP_RESULT_PROCESSED; /* Wait for ACK */
943 
944 	ret = send_next_seg(mad_send_wr);
945 	if (ret) {
946 		mad_send_wc->status = IB_WC_GENERAL_ERR;
947 		return IB_RMPP_RESULT_PROCESSED;
948 	}
949 	return IB_RMPP_RESULT_CONSUMED;
950 }
951 
952 int ib_retry_rmpp(struct ib_mad_send_wr_private *mad_send_wr)
953 {
954 	struct ib_rmpp_mad *rmpp_mad;
955 	int ret;
956 
957 	rmpp_mad = mad_send_wr->send_buf.mad;
958 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
959 	      IB_MGMT_RMPP_FLAG_ACTIVE))
960 		return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
961 
962 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count)
963 		return IB_RMPP_RESULT_PROCESSED;
964 
965 	mad_send_wr->seg_num = mad_send_wr->last_ack;
966 	mad_send_wr->cur_seg = mad_send_wr->last_ack_seg;
967 
968 	ret = send_next_seg(mad_send_wr);
969 	if (ret)
970 		return IB_RMPP_RESULT_PROCESSED;
971 
972 	return IB_RMPP_RESULT_CONSUMED;
973 }
974