drivers/infiniband/core/mad.c

   1 /*
   2  * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
   3  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
   4  * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
   5  * Copyright (c) 2009 HNR Consulting. All rights reserved.
   6  * Copyright (c) 2014 Intel Corporation.  All rights reserved.
   7  *
   8  * This software is available to you under a choice of one of two
   9  * licenses.  You may choose to be licensed under the terms of the GNU
  10  * General Public License (GPL) Version 2, available from the file
  11  * COPYING in the main directory of this source tree, or the
  12  * OpenIB.org BSD license below:
  13  *
  14  *     Redistribution and use in source and binary forms, with or
  15  *     without modification, are permitted provided that the following
  16  *     conditions are met:
  17  *
  18  *      - Redistributions of source code must retain the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer.
  21  *
  22  *      - Redistributions in binary form must reproduce the above
  23  *        copyright notice, this list of conditions and the following
  24  *        disclaimer in the documentation and/or other materials
  25  *        provided with the distribution.
  26  *
  27  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  28  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  29  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  30  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  31  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  32  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  33  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  34  * SOFTWARE.
  35  *
  36  */
  37
  38 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  39
  40 #include <linux/dma-mapping.h>
  41 #include <linux/slab.h>
  42 #include <linux/module.h>
  43 #include <rdma/ib_cache.h>
  44
  45 #include "mad_priv.h"
  46 #include "mad_rmpp.h"
  47 #include "smi.h"
  48 #include "opa_smi.h"
  49 #include "agent.h"
  50
  51 MODULE_LICENSE("Dual BSD/GPL");
  52 MODULE_DESCRIPTION("kernel IB MAD API");
  53 MODULE_AUTHOR("Hal Rosenstock");
  54 MODULE_AUTHOR("Sean Hefty");
  55
  56 static int mad_sendq_size = IB_MAD_QP_SEND_SIZE;
  57 static int mad_recvq_size = IB_MAD_QP_RECV_SIZE;
  58
  59 module_param_named(send_queue_size, mad_sendq_size, int, 0444);
  60 MODULE_PARM_DESC(send_queue_size, "Size of send queue in number of work requests");
  61 module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
  62 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
  63
  64 static struct list_head ib_mad_port_list;
  65 static u32 ib_mad_client_id = 0;
  66
  67 /* Port list lock */
  68 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
  69
  70 /* Forward declarations */
  71 static int method_in_use(struct ib_mad_mgmt_method_table **method,
  72                          struct ib_mad_reg_req *mad_reg_req);
  73 static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
  74 static struct ib_mad_agent_private *find_mad_agent(
  75                                         struct ib_mad_port_private *port_priv,
  76                                         const struct ib_mad_hdr *mad);
  77 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
  78                                     struct ib_mad_private *mad);
  79 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
  80 static void timeout_sends(struct work_struct *work);
  81 static void local_completions(struct work_struct *work);
  82 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
  83                               struct ib_mad_agent_private *agent_priv,
  84                               u8 mgmt_class);
  85 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
  86                            struct ib_mad_agent_private *agent_priv);
  87
  88 /*
  89  * Returns a ib_mad_port_private structure or NULL for a device/port
  90  * Assumes ib_mad_port_list_lock is being held
  91  */
  92 static inline struct ib_mad_port_private *
  93 __ib_get_mad_port(struct ib_device *device, int port_num)
  94 {
  95         struct ib_mad_port_private *entry;
  96
  97         list_for_each_entry(entry, &ib_mad_port_list, port_list) {
  98                 if (entry->device == device && entry->port_num == port_num)
  99                         return entry;
 100         }
 101         return NULL;
 102 }
 103
 104 /*
 105  * Wrapper function to return a ib_mad_port_private structure or NULL
 106  * for a device/port
 107  */
 108 static inline struct ib_mad_port_private *
 109 ib_get_mad_port(struct ib_device *device, int port_num)
 110 {
 111         struct ib_mad_port_private *entry;
 112         unsigned long flags;
 113
 114         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
 115         entry = __ib_get_mad_port(device, port_num);
 116         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
 117
 118         return entry;
 119 }
 120
 121 static inline u8 convert_mgmt_class(u8 mgmt_class)
 122 {
 123         /* Alias IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE to 0 */
 124         return mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE ?
 125                 0 : mgmt_class;
 126 }
 127
 128 static int get_spl_qp_index(enum ib_qp_type qp_type)
 129 {
 130         switch (qp_type)
 131         {
 132         case IB_QPT_SMI:
 133                 return 0;
 134         case IB_QPT_GSI:
 135                 return 1;
 136         default:
 137                 return -1;
 138         }
 139 }
 140
 141 static int vendor_class_index(u8 mgmt_class)
 142 {
 143         return mgmt_class - IB_MGMT_CLASS_VENDOR_RANGE2_START;
 144 }
 145
 146 static int is_vendor_class(u8 mgmt_class)
 147 {
 148         if ((mgmt_class < IB_MGMT_CLASS_VENDOR_RANGE2_START) ||
 149             (mgmt_class > IB_MGMT_CLASS_VENDOR_RANGE2_END))
 150                 return 0;
 151         return 1;
 152 }
 153
 154 static int is_vendor_oui(char *oui)
 155 {
 156         if (oui[0] || oui[1] || oui[2])
 157                 return 1;
 158         return 0;
 159 }
 160
 161 static int is_vendor_method_in_use(
 162                 struct ib_mad_mgmt_vendor_class *vendor_class,
 163                 struct ib_mad_reg_req *mad_reg_req)
 164 {
 165         struct ib_mad_mgmt_method_table *method;
 166         int i;
 167
 168         for (i = 0; i < MAX_MGMT_OUI; i++) {
 169                 if (!memcmp(vendor_class->oui[i], mad_reg_req->oui, 3)) {
 170                         method = vendor_class->method_table[i];
 171                         if (method) {
 172                                 if (method_in_use(&method, mad_reg_req))
 173                                         return 1;
 174                                 else
 175                                         break;
 176                         }
 177                 }
 178         }
 179         return 0;
 180 }
 181
 182 int ib_response_mad(const struct ib_mad_hdr *hdr)
 183 {
 184         return ((hdr->method & IB_MGMT_METHOD_RESP) ||
 185                 (hdr->method == IB_MGMT_METHOD_TRAP_REPRESS) ||
 186                 ((hdr->mgmt_class == IB_MGMT_CLASS_BM) &&
 187                  (hdr->attr_mod & IB_BM_ATTR_MOD_RESP)));
 188 }
 189 EXPORT_SYMBOL(ib_response_mad);
 190
 191 /*
 192  * ib_register_mad_agent - Register to send/receive MADs
 193  */
 194 struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
 195                                            u8 port_num,
 196                                            enum ib_qp_type qp_type,
 197                                            struct ib_mad_reg_req *mad_reg_req,
 198                                            u8 rmpp_version,
 199                                            ib_mad_send_handler send_handler,
 200                                            ib_mad_recv_handler recv_handler,
 201                                            void *context,
 202                                            u32 registration_flags)
 203 {
 204         struct ib_mad_port_private *port_priv;
 205         struct ib_mad_agent *ret = ERR_PTR(-EINVAL);
 206         struct ib_mad_agent_private *mad_agent_priv;
 207         struct ib_mad_reg_req *reg_req = NULL;
 208         struct ib_mad_mgmt_class_table *class;
 209         struct ib_mad_mgmt_vendor_class_table *vendor;
 210         struct ib_mad_mgmt_vendor_class *vendor_class;
 211         struct ib_mad_mgmt_method_table *method;
 212         int ret2, qpn;
 213         unsigned long flags;
 214         u8 mgmt_class, vclass;
 215
 216         /* Validate parameters */
 217         qpn = get_spl_qp_index(qp_type);
 218         if (qpn == -1) {
 219                 dev_notice(&device->dev,
 220                            "ib_register_mad_agent: invalid QP Type %d\n",
 221                            qp_type);
 222                 goto error1;
 223         }
 224
 225         if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
 226                 dev_notice(&device->dev,
 227                            "ib_register_mad_agent: invalid RMPP Version %u\n",
 228                            rmpp_version);
 229                 goto error1;
 230         }
 231
 232         /* Validate MAD registration request if supplied */
 233         if (mad_reg_req) {
 234                 if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
 235                         dev_notice(&device->dev,
 236                                    "ib_register_mad_agent: invalid Class Version %u\n",
 237                                    mad_reg_req->mgmt_class_version);
 238                         goto error1;
 239                 }
 240                 if (!recv_handler) {
 241                         dev_notice(&device->dev,
 242                                    "ib_register_mad_agent: no recv_handler\n");
 243                         goto error1;
 244                 }
 245                 if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
 246                         /*
 247                          * IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE is the only
 248                          * one in this range currently allowed
 249                          */
 250                         if (mad_reg_req->mgmt_class !=
 251                             IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
 252                                 dev_notice(&device->dev,
 253                                            "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
 254                                            mad_reg_req->mgmt_class);
 255                                 goto error1;
 256                         }
 257                 } else if (mad_reg_req->mgmt_class == 0) {
 258                         /*
 259                          * Class 0 is reserved in IBA and is used for
 260                          * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
 261                          */
 262                         dev_notice(&device->dev,
 263                                    "ib_register_mad_agent: Invalid Mgmt Class 0\n");
 264                         goto error1;
 265                 } else if (is_vendor_class(mad_reg_req->mgmt_class)) {
 266                         /*
 267                          * If class is in "new" vendor range,
 268                          * ensure supplied OUI is not zero
 269                          */
 270                         if (!is_vendor_oui(mad_reg_req->oui)) {
 271                                 dev_notice(&device->dev,
 272                                            "ib_register_mad_agent: No OUI specified for class 0x%x\n",
 273                                            mad_reg_req->mgmt_class);
 274                                 goto error1;
 275                         }
 276                 }
 277                 /* Make sure class supplied is consistent with RMPP */
 278                 if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
 279                         if (rmpp_version) {
 280                                 dev_notice(&device->dev,
 281                                            "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
 282                                            mad_reg_req->mgmt_class);
 283                                 goto error1;
 284                         }
 285                 }
 286
 287                 /* Make sure class supplied is consistent with QP type */
 288                 if (qp_type == IB_QPT_SMI) {
 289                         if ((mad_reg_req->mgmt_class !=
 290                                         IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
 291                             (mad_reg_req->mgmt_class !=
 292                                         IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
 293                                 dev_notice(&device->dev,
 294                                            "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
 295                                            mad_reg_req->mgmt_class);
 296                                 goto error1;
 297                         }
 298                 } else {
 299                         if ((mad_reg_req->mgmt_class ==
 300                                         IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
 301                             (mad_reg_req->mgmt_class ==
 302                                         IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
 303                                 dev_notice(&device->dev,
 304                                            "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
 305                                            mad_reg_req->mgmt_class);
 306                                 goto error1;
 307                         }
 308                 }
 309         } else {
 310                 /* No registration request supplied */
 311                 if (!send_handler)
 312                         goto error1;
 313                 if (registration_flags & IB_MAD_USER_RMPP)
 314                         goto error1;
 315         }
 316
 317         /* Validate device and port */
 318         port_priv = ib_get_mad_port(device, port_num);
 319         if (!port_priv) {
 320                 dev_notice(&device->dev, "ib_register_mad_agent: Invalid port\n");
 321                 ret = ERR_PTR(-ENODEV);
 322                 goto error1;
 323         }
 324
 325         /* Verify the QP requested is supported.  For example, Ethernet devices
 326          * will not have QP0 */
 327         if (!port_priv->qp_info[qpn].qp) {
 328                 dev_notice(&device->dev,
 329                            "ib_register_mad_agent: QP %d not supported\n", qpn);
 330                 ret = ERR_PTR(-EPROTONOSUPPORT);
 331                 goto error1;
 332         }
 333
 334         /* Allocate structures */
 335         mad_agent_priv = kzalloc(sizeof *mad_agent_priv, GFP_KERNEL);
 336         if (!mad_agent_priv) {
 337                 ret = ERR_PTR(-ENOMEM);
 338                 goto error1;
 339         }
 340
 341         if (mad_reg_req) {
 342                 reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
 343                 if (!reg_req) {
 344                         ret = ERR_PTR(-ENOMEM);
 345                         goto error3;
 346                 }
 347         }
 348
 349         /* Now, fill in the various structures */
 350         mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
 351         mad_agent_priv->reg_req = reg_req;
 352         mad_agent_priv->agent.rmpp_version = rmpp_version;
 353         mad_agent_priv->agent.device = device;
 354         mad_agent_priv->agent.recv_handler = recv_handler;
 355         mad_agent_priv->agent.send_handler = send_handler;
 356         mad_agent_priv->agent.context = context;
 357         mad_agent_priv->agent.qp = port_priv->qp_info[qpn].qp;
 358         mad_agent_priv->agent.port_num = port_num;
 359         mad_agent_priv->agent.flags = registration_flags;
 360         spin_lock_init(&mad_agent_priv->lock);
 361         INIT_LIST_HEAD(&mad_agent_priv->send_list);
 362         INIT_LIST_HEAD(&mad_agent_priv->wait_list);
 363         INIT_LIST_HEAD(&mad_agent_priv->done_list);
 364         INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
 365         INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
 366         INIT_LIST_HEAD(&mad_agent_priv->local_list);
 367         INIT_WORK(&mad_agent_priv->local_work, local_completions);
 368         atomic_set(&mad_agent_priv->refcount, 1);
 369         init_completion(&mad_agent_priv->comp);
 370
 371         spin_lock_irqsave(&port_priv->reg_lock, flags);
 372         mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
 373
 374         /*
 375          * Make sure MAD registration (if supplied)
 376          * is non overlapping with any existing ones
 377          */
 378         if (mad_reg_req) {
 379                 mgmt_class = convert_mgmt_class(mad_reg_req->mgmt_class);
 380                 if (!is_vendor_class(mgmt_class)) {
 381                         class = port_priv->version[mad_reg_req->
 382                                                    mgmt_class_version].class;
 383                         if (class) {
 384                                 method = class->method_table[mgmt_class];
 385                                 if (method) {
 386                                         if (method_in_use(&method,
 387                                                            mad_reg_req))
 388                                                 goto error4;
 389                                 }
 390                         }
 391                         ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
 392                                                   mgmt_class);
 393                 } else {
 394                         /* "New" vendor class range */
 395                         vendor = port_priv->version[mad_reg_req->
 396                                                     mgmt_class_version].vendor;
 397                         if (vendor) {
 398                                 vclass = vendor_class_index(mgmt_class);
 399                                 vendor_class = vendor->vendor_class[vclass];
 400                                 if (vendor_class) {
 401                                         if (is_vendor_method_in_use(
 402                                                         vendor_class,
 403                                                         mad_reg_req))
 404                                                 goto error4;
 405                                 }
 406                         }
 407                         ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
 408                 }
 409                 if (ret2) {
 410                         ret = ERR_PTR(ret2);
 411                         goto error4;
 412                 }
 413         }
 414
 415         /* Add mad agent into port's agent list */
 416         list_add_tail(&mad_agent_priv->agent_list, &port_priv->agent_list);
 417         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 418
 419         return &mad_agent_priv->agent;
 420
 421 error4:
 422         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 423         kfree(reg_req);
 424 error3:
 425         kfree(mad_agent_priv);
 426 error1:
 427         return ret;
 428 }
 429 EXPORT_SYMBOL(ib_register_mad_agent);
 430
 431 static inline int is_snooping_sends(int mad_snoop_flags)
 432 {
 433         return (mad_snoop_flags &
 434                 (/*IB_MAD_SNOOP_POSTED_SENDS |
 435                  IB_MAD_SNOOP_RMPP_SENDS |*/
 436                  IB_MAD_SNOOP_SEND_COMPLETIONS /*|
 437                  IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS*/));
 438 }
 439
 440 static inline int is_snooping_recvs(int mad_snoop_flags)
 441 {
 442         return (mad_snoop_flags &
 443                 (IB_MAD_SNOOP_RECVS /*|
 444                  IB_MAD_SNOOP_RMPP_RECVS*/));
 445 }
 446
 447 static int register_snoop_agent(struct ib_mad_qp_info *qp_info,
 448                                 struct ib_mad_snoop_private *mad_snoop_priv)
 449 {
 450         struct ib_mad_snoop_private **new_snoop_table;
 451         unsigned long flags;
 452         int i;
 453
 454         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 455         /* Check for empty slot in array. */
 456         for (i = 0; i < qp_info->snoop_table_size; i++)
 457                 if (!qp_info->snoop_table[i])
 458                         break;
 459
 460         if (i == qp_info->snoop_table_size) {
 461                 /* Grow table. */
 462                 new_snoop_table = krealloc(qp_info->snoop_table,
 463                                            sizeof mad_snoop_priv *
 464                                            (qp_info->snoop_table_size + 1),
 465                                            GFP_ATOMIC);
 466                 if (!new_snoop_table) {
 467                         i = -ENOMEM;
 468                         goto out;
 469                 }
 470
 471                 qp_info->snoop_table = new_snoop_table;
 472                 qp_info->snoop_table_size++;
 473         }
 474         qp_info->snoop_table[i] = mad_snoop_priv;
 475         atomic_inc(&qp_info->snoop_count);
 476 out:
 477         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 478         return i;
 479 }
 480
 481 struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
 482                                            u8 port_num,
 483                                            enum ib_qp_type qp_type,
 484                                            int mad_snoop_flags,
 485                                            ib_mad_snoop_handler snoop_handler,
 486                                            ib_mad_recv_handler recv_handler,
 487                                            void *context)
 488 {
 489         struct ib_mad_port_private *port_priv;
 490         struct ib_mad_agent *ret;
 491         struct ib_mad_snoop_private *mad_snoop_priv;
 492         int qpn;
 493
 494         /* Validate parameters */
 495         if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) ||
 496             (is_snooping_recvs(mad_snoop_flags) && !recv_handler)) {
 497                 ret = ERR_PTR(-EINVAL);
 498                 goto error1;
 499         }
 500         qpn = get_spl_qp_index(qp_type);
 501         if (qpn == -1) {
 502                 ret = ERR_PTR(-EINVAL);
 503                 goto error1;
 504         }
 505         port_priv = ib_get_mad_port(device, port_num);
 506         if (!port_priv) {
 507                 ret = ERR_PTR(-ENODEV);
 508                 goto error1;
 509         }
 510         /* Allocate structures */
 511         mad_snoop_priv = kzalloc(sizeof *mad_snoop_priv, GFP_KERNEL);
 512         if (!mad_snoop_priv) {
 513                 ret = ERR_PTR(-ENOMEM);
 514                 goto error1;
 515         }
 516
 517         /* Now, fill in the various structures */
 518         mad_snoop_priv->qp_info = &port_priv->qp_info[qpn];
 519         mad_snoop_priv->agent.device = device;
 520         mad_snoop_priv->agent.recv_handler = recv_handler;
 521         mad_snoop_priv->agent.snoop_handler = snoop_handler;
 522         mad_snoop_priv->agent.context = context;
 523         mad_snoop_priv->agent.qp = port_priv->qp_info[qpn].qp;
 524         mad_snoop_priv->agent.port_num = port_num;
 525         mad_snoop_priv->mad_snoop_flags = mad_snoop_flags;
 526         init_completion(&mad_snoop_priv->comp);
 527         mad_snoop_priv->snoop_index = register_snoop_agent(
 528                                                 &port_priv->qp_info[qpn],
 529                                                 mad_snoop_priv);
 530         if (mad_snoop_priv->snoop_index < 0) {
 531                 ret = ERR_PTR(mad_snoop_priv->snoop_index);
 532                 goto error2;
 533         }
 534
 535         atomic_set(&mad_snoop_priv->refcount, 1);
 536         return &mad_snoop_priv->agent;
 537
 538 error2:
 539         kfree(mad_snoop_priv);
 540 error1:
 541         return ret;
 542 }
 543 EXPORT_SYMBOL(ib_register_mad_snoop);
 544
 545 static inline void deref_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
 546 {
 547         if (atomic_dec_and_test(&mad_agent_priv->refcount))
 548                 complete(&mad_agent_priv->comp);
 549 }
 550
 551 static inline void deref_snoop_agent(struct ib_mad_snoop_private *mad_snoop_priv)
 552 {
 553         if (atomic_dec_and_test(&mad_snoop_priv->refcount))
 554                 complete(&mad_snoop_priv->comp);
 555 }
 556
 557 static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
 558 {
 559         struct ib_mad_port_private *port_priv;
 560         unsigned long flags;
 561
 562         /* Note that we could still be handling received MADs */
 563
 564         /*
 565          * Canceling all sends results in dropping received response
 566          * MADs, preventing us from queuing additional work
 567          */
 568         cancel_mads(mad_agent_priv);
 569         port_priv = mad_agent_priv->qp_info->port_priv;
 570         cancel_delayed_work(&mad_agent_priv->timed_work);
 571
 572         spin_lock_irqsave(&port_priv->reg_lock, flags);
 573         remove_mad_reg_req(mad_agent_priv);
 574         list_del(&mad_agent_priv->agent_list);
 575         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 576
 577         flush_workqueue(port_priv->wq);
 578         ib_cancel_rmpp_recvs(mad_agent_priv);
 579
 580         deref_mad_agent(mad_agent_priv);
 581         wait_for_completion(&mad_agent_priv->comp);
 582
 583         kfree(mad_agent_priv->reg_req);
 584         kfree(mad_agent_priv);
 585 }
 586
 587 static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv)
 588 {
 589         struct ib_mad_qp_info *qp_info;
 590         unsigned long flags;
 591
 592         qp_info = mad_snoop_priv->qp_info;
 593         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 594         qp_info->snoop_table[mad_snoop_priv->snoop_index] = NULL;
 595         atomic_dec(&qp_info->snoop_count);
 596         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 597
 598         deref_snoop_agent(mad_snoop_priv);
 599         wait_for_completion(&mad_snoop_priv->comp);
 600
 601         kfree(mad_snoop_priv);
 602 }
 603
 604 /*
 605  * ib_unregister_mad_agent - Unregisters a client from using MAD services
 606  */
 607 int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
 608 {
 609         struct ib_mad_agent_private *mad_agent_priv;
 610         struct ib_mad_snoop_private *mad_snoop_priv;
 611
 612         /* If the TID is zero, the agent can only snoop. */
 613         if (mad_agent->hi_tid) {
 614                 mad_agent_priv = container_of(mad_agent,
 615                                               struct ib_mad_agent_private,
 616                                               agent);
 617                 unregister_mad_agent(mad_agent_priv);
 618         } else {
 619                 mad_snoop_priv = container_of(mad_agent,
 620                                               struct ib_mad_snoop_private,
 621                                               agent);
 622                 unregister_mad_snoop(mad_snoop_priv);
 623         }
 624         return 0;
 625 }
 626 EXPORT_SYMBOL(ib_unregister_mad_agent);
 627
 628 static void dequeue_mad(struct ib_mad_list_head *mad_list)
 629 {
 630         struct ib_mad_queue *mad_queue;
 631         unsigned long flags;
 632
 633         BUG_ON(!mad_list->mad_queue);
 634         mad_queue = mad_list->mad_queue;
 635         spin_lock_irqsave(&mad_queue->lock, flags);
 636         list_del(&mad_list->list);
 637         mad_queue->count--;
 638         spin_unlock_irqrestore(&mad_queue->lock, flags);
 639 }
 640
 641 static void snoop_send(struct ib_mad_qp_info *qp_info,
 642                        struct ib_mad_send_buf *send_buf,
 643                        struct ib_mad_send_wc *mad_send_wc,
 644                        int mad_snoop_flags)
 645 {
 646         struct ib_mad_snoop_private *mad_snoop_priv;
 647         unsigned long flags;
 648         int i;
 649
 650         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 651         for (i = 0; i < qp_info->snoop_table_size; i++) {
 652                 mad_snoop_priv = qp_info->snoop_table[i];
 653                 if (!mad_snoop_priv ||
 654                     !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
 655                         continue;
 656
 657                 atomic_inc(&mad_snoop_priv->refcount);
 658                 spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 659                 mad_snoop_priv->agent.snoop_handler(&mad_snoop_priv->agent,
 660                                                     send_buf, mad_send_wc);
 661                 deref_snoop_agent(mad_snoop_priv);
 662                 spin_lock_irqsave(&qp_info->snoop_lock, flags);
 663         }
 664         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 665 }
 666
 667 static void snoop_recv(struct ib_mad_qp_info *qp_info,
 668                        struct ib_mad_recv_wc *mad_recv_wc,
 669                        int mad_snoop_flags)
 670 {
 671         struct ib_mad_snoop_private *mad_snoop_priv;
 672         unsigned long flags;
 673         int i;
 674
 675         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 676         for (i = 0; i < qp_info->snoop_table_size; i++) {
 677                 mad_snoop_priv = qp_info->snoop_table[i];
 678                 if (!mad_snoop_priv ||
 679                     !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
 680                         continue;
 681
 682                 atomic_inc(&mad_snoop_priv->refcount);
 683                 spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 684                 mad_snoop_priv->agent.recv_handler(&mad_snoop_priv->agent,
 685                                                    mad_recv_wc);
 686                 deref_snoop_agent(mad_snoop_priv);
 687                 spin_lock_irqsave(&qp_info->snoop_lock, flags);
 688         }
 689         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 690 }
 691
 692 static void build_smp_wc(struct ib_qp *qp,
 693                          u64 wr_id, u16 slid, u16 pkey_index, u8 port_num,
 694                          struct ib_wc *wc)
 695 {
 696         memset(wc, 0, sizeof *wc);
 697         wc->wr_id = wr_id;
 698         wc->status = IB_WC_SUCCESS;
 699         wc->opcode = IB_WC_RECV;
 700         wc->pkey_index = pkey_index;
 701         wc->byte_len = sizeof(struct ib_mad) + sizeof(struct ib_grh);
 702         wc->src_qp = IB_QP0;
 703         wc->qp = qp;
 704         wc->slid = slid;
 705         wc->sl = 0;
 706         wc->dlid_path_bits = 0;
 707         wc->port_num = port_num;
 708 }
 709
 710 static size_t mad_priv_size(const struct ib_mad_private *mp)
 711 {
 712         return sizeof(struct ib_mad_private) + mp->mad_size;
 713 }
 714
 715 static struct ib_mad_private *alloc_mad_private(size_t mad_size, gfp_t flags)
 716 {
 717         size_t size = sizeof(struct ib_mad_private) + mad_size;
 718         struct ib_mad_private *ret = kzalloc(size, flags);
 719
 720         if (ret)
 721                 ret->mad_size = mad_size;
 722
 723         return ret;
 724 }
 725
 726 static size_t port_mad_size(const struct ib_mad_port_private *port_priv)
 727 {
 728         return rdma_max_mad_size(port_priv->device, port_priv->port_num);
 729 }
 730
 731 static size_t mad_priv_dma_size(const struct ib_mad_private *mp)
 732 {
 733         return sizeof(struct ib_grh) + mp->mad_size;
 734 }
 735
 736 /*
 737  * Return 0 if SMP is to be sent
 738  * Return 1 if SMP was consumed locally (whether or not solicited)
 739  * Return < 0 if error
 740  */
 741 static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
 742                                   struct ib_mad_send_wr_private *mad_send_wr)
 743 {
 744         int ret = 0;
 745         struct ib_smp *smp = mad_send_wr->send_buf.mad;
 746         struct opa_smp *opa_smp = (struct opa_smp *)smp;
 747         unsigned long flags;
 748         struct ib_mad_local_private *local;
 749         struct ib_mad_private *mad_priv;
 750         struct ib_mad_port_private *port_priv;
 751         struct ib_mad_agent_private *recv_mad_agent = NULL;
 752         struct ib_device *device = mad_agent_priv->agent.device;
 753         u8 port_num;
 754         struct ib_wc mad_wc;
 755         struct ib_ud_wr *send_wr = &mad_send_wr->send_wr;
 756         size_t mad_size = port_mad_size(mad_agent_priv->qp_info->port_priv);
 757         u16 out_mad_pkey_index = 0;
 758         u16 drslid;
 759         bool opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
 760                                     mad_agent_priv->qp_info->port_priv->port_num);
 761
 762         if (rdma_cap_ib_switch(device) &&
 763             smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
 764                 port_num = send_wr->port_num;
 765         else
 766                 port_num = mad_agent_priv->agent.port_num;
 767
 768         /*
 769          * Directed route handling starts if the initial LID routed part of
 770          * a request or the ending LID routed part of a response is empty.
 771          * If we are at the start of the LID routed part, don't update the
 772          * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
 773          */
 774         if (opa && smp->class_version == OPA_SMP_CLASS_VERSION) {
 775                 u32 opa_drslid;
 776
 777                 if ((opa_get_smp_direction(opa_smp)
 778                      ? opa_smp->route.dr.dr_dlid : opa_smp->route.dr.dr_slid) ==
 779                      OPA_LID_PERMISSIVE &&
 780                      opa_smi_handle_dr_smp_send(opa_smp,
 781                                                 rdma_cap_ib_switch(device),
 782                                                 port_num) == IB_SMI_DISCARD) {
 783                         ret = -EINVAL;
 784                         dev_err(&device->dev, "OPA Invalid directed route\n");
 785                         goto out;
 786                 }
 787                 opa_drslid = be32_to_cpu(opa_smp->route.dr.dr_slid);
 788                 if (opa_drslid != be32_to_cpu(OPA_LID_PERMISSIVE) &&
 789                     opa_drslid & 0xffff0000) {
 790                         ret = -EINVAL;
 791                         dev_err(&device->dev, "OPA Invalid dr_slid 0x%x\n",
 792                                opa_drslid);
 793                         goto out;
 794                 }
 795                 drslid = (u16)(opa_drslid & 0x0000ffff);
 796
 797                 /* Check to post send on QP or process locally */
 798                 if (opa_smi_check_local_smp(opa_smp, device) == IB_SMI_DISCARD &&
 799                     opa_smi_check_local_returning_smp(opa_smp, device) == IB_SMI_DISCARD)
 800                         goto out;
 801         } else {
 802                 if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
 803                      IB_LID_PERMISSIVE &&
 804                      smi_handle_dr_smp_send(smp, rdma_cap_ib_switch(device), port_num) ==
 805                      IB_SMI_DISCARD) {
 806                         ret = -EINVAL;
 807                         dev_err(&device->dev, "Invalid directed route\n");
 808                         goto out;
 809                 }
 810                 drslid = be16_to_cpu(smp->dr_slid);
 811
 812                 /* Check to post send on QP or process locally */
 813                 if (smi_check_local_smp(smp, device) == IB_SMI_DISCARD &&
 814                     smi_check_local_returning_smp(smp, device) == IB_SMI_DISCARD)
 815                         goto out;
 816         }
 817
 818         local = kmalloc(sizeof *local, GFP_ATOMIC);
 819         if (!local) {
 820                 ret = -ENOMEM;
 821                 dev_err(&device->dev, "No memory for ib_mad_local_private\n");
 822                 goto out;
 823         }
 824         local->mad_priv = NULL;
 825         local->recv_mad_agent = NULL;
 826         mad_priv = alloc_mad_private(mad_size, GFP_ATOMIC);
 827         if (!mad_priv) {
 828                 ret = -ENOMEM;
 829                 dev_err(&device->dev, "No memory for local response MAD\n");
 830                 kfree(local);
 831                 goto out;
 832         }
 833
 834         build_smp_wc(mad_agent_priv->agent.qp,
 835                      send_wr->wr.wr_id, drslid,
 836                      send_wr->pkey_index,
 837                      send_wr->port_num, &mad_wc);
 838
 839         if (opa && smp->base_version == OPA_MGMT_BASE_VERSION) {
 840                 mad_wc.byte_len = mad_send_wr->send_buf.hdr_len
 841                                         + mad_send_wr->send_buf.data_len
 842                                         + sizeof(struct ib_grh);
 843         }
 844
 845         /* No GRH for DR SMP */
 846         ret = device->process_mad(device, 0, port_num, &mad_wc, NULL,
 847                                   (const struct ib_mad_hdr *)smp, mad_size,
 848                                   (struct ib_mad_hdr *)mad_priv->mad,
 849                                   &mad_size, &out_mad_pkey_index);
 850         switch (ret)
 851         {
 852         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
 853                 if (ib_response_mad((const struct ib_mad_hdr *)mad_priv->mad) &&
 854                     mad_agent_priv->agent.recv_handler) {
 855                         local->mad_priv = mad_priv;
 856                         local->recv_mad_agent = mad_agent_priv;
 857                         /*
 858                          * Reference MAD agent until receive
 859                          * side of local completion handled
 860                          */
 861                         atomic_inc(&mad_agent_priv->refcount);
 862                 } else
 863                         kfree(mad_priv);
 864                 break;
 865         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
 866                 kfree(mad_priv);
 867                 break;
 868         case IB_MAD_RESULT_SUCCESS:
 869                 /* Treat like an incoming receive MAD */
 870                 port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
 871                                             mad_agent_priv->agent.port_num);
 872                 if (port_priv) {
 873                         memcpy(mad_priv->mad, smp, mad_priv->mad_size);
 874                         recv_mad_agent = find_mad_agent(port_priv,
 875                                                         (const struct ib_mad_hdr *)mad_priv->mad);
 876                 }
 877                 if (!port_priv || !recv_mad_agent) {
 878                         /*
 879                          * No receiving agent so drop packet and
 880                          * generate send completion.
 881                          */
 882                         kfree(mad_priv);
 883                         break;
 884                 }
 885                 local->mad_priv = mad_priv;
 886                 local->recv_mad_agent = recv_mad_agent;
 887                 break;
 888         default:
 889                 kfree(mad_priv);
 890                 kfree(local);
 891                 ret = -EINVAL;
 892                 goto out;
 893         }
 894
 895         local->mad_send_wr = mad_send_wr;
 896         if (opa) {
 897                 local->mad_send_wr->send_wr.pkey_index = out_mad_pkey_index;
 898                 local->return_wc_byte_len = mad_size;
 899         }
 900         /* Reference MAD agent until send side of local completion handled */
 901         atomic_inc(&mad_agent_priv->refcount);
 902         /* Queue local completion to local list */
 903         spin_lock_irqsave(&mad_agent_priv->lock, flags);
 904         list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
 905         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 906         queue_work(mad_agent_priv->qp_info->port_priv->wq,
 907                    &mad_agent_priv->local_work);
 908         ret = 1;
 909 out:
 910         return ret;
 911 }
 912
 913 static int get_pad_size(int hdr_len, int data_len, size_t mad_size)
 914 {
 915         int seg_size, pad;
 916
 917         seg_size = mad_size - hdr_len;
 918         if (data_len && seg_size) {
 919                 pad = seg_size - data_len % seg_size;
 920                 return pad == seg_size ? 0 : pad;
 921         } else
 922                 return seg_size;
 923 }
 924
 925 static void free_send_rmpp_list(struct ib_mad_send_wr_private *mad_send_wr)
 926 {
 927         struct ib_rmpp_segment *s, *t;
 928
 929         list_for_each_entry_safe(s, t, &mad_send_wr->rmpp_list, list) {
 930                 list_del(&s->list);
 931                 kfree(s);
 932         }
 933 }
 934
 935 static int alloc_send_rmpp_list(struct ib_mad_send_wr_private *send_wr,
 936                                 size_t mad_size, gfp_t gfp_mask)
 937 {
 938         struct ib_mad_send_buf *send_buf = &send_wr->send_buf;
 939         struct ib_rmpp_mad *rmpp_mad = send_buf->mad;
 940         struct ib_rmpp_segment *seg = NULL;
 941         int left, seg_size, pad;
 942
 943         send_buf->seg_size = mad_size - send_buf->hdr_len;
 944         send_buf->seg_rmpp_size = mad_size - IB_MGMT_RMPP_HDR;
 945         seg_size = send_buf->seg_size;
 946         pad = send_wr->pad;
 947
 948         /* Allocate data segments. */
 949         for (left = send_buf->data_len + pad; left > 0; left -= seg_size) {
 950                 seg = kmalloc(sizeof (*seg) + seg_size, gfp_mask);
 951                 if (!seg) {
 952                         dev_err(&send_buf->mad_agent->device->dev,
 953                                 "alloc_send_rmpp_segs: RMPP mem alloc failed for len %zd, gfp %#x\n",
 954                                 sizeof (*seg) + seg_size, gfp_mask);
 955                         free_send_rmpp_list(send_wr);
 956                         return -ENOMEM;
 957                 }
 958                 seg->num = ++send_buf->seg_count;
 959                 list_add_tail(&seg->list, &send_wr->rmpp_list);
 960         }
 961
 962         /* Zero any padding */
 963         if (pad)
 964                 memset(seg->data + seg_size - pad, 0, pad);
 965
 966         rmpp_mad->rmpp_hdr.rmpp_version = send_wr->mad_agent_priv->
 967                                           agent.rmpp_version;
 968         rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
 969         ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
 970
 971         send_wr->cur_seg = container_of(send_wr->rmpp_list.next,
 972                                         struct ib_rmpp_segment, list);
 973         send_wr->last_ack_seg = send_wr->cur_seg;
 974         return 0;
 975 }
 976
 977 int ib_mad_kernel_rmpp_agent(const struct ib_mad_agent *agent)
 978 {
 979         return agent->rmpp_version && !(agent->flags & IB_MAD_USER_RMPP);
 980 }
 981 EXPORT_SYMBOL(ib_mad_kernel_rmpp_agent);
 982
 983 struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
 984                                             u32 remote_qpn, u16 pkey_index,
 985                                             int rmpp_active,
 986                                             int hdr_len, int data_len,
 987                                             gfp_t gfp_mask,
 988                                             u8 base_version)
 989 {
 990         struct ib_mad_agent_private *mad_agent_priv;
 991         struct ib_mad_send_wr_private *mad_send_wr;
 992         int pad, message_size, ret, size;
 993         void *buf;
 994         size_t mad_size;
 995         bool opa;
 996
 997         mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
 998                                       agent);
 999
1000         opa = rdma_cap_opa_mad(mad_agent->device, mad_agent->port_num);
1001
1002         if (opa && base_version == OPA_MGMT_BASE_VERSION)
1003                 mad_size = sizeof(struct opa_mad);
1004         else
1005                 mad_size = sizeof(struct ib_mad);
1006
1007         pad = get_pad_size(hdr_len, data_len, mad_size);
1008         message_size = hdr_len + data_len + pad;
1009
1010         if (ib_mad_kernel_rmpp_agent(mad_agent)) {
1011                 if (!rmpp_active && message_size > mad_size)
1012                         return ERR_PTR(-EINVAL);
1013         } else
1014                 if (rmpp_active || message_size > mad_size)
1015                         return ERR_PTR(-EINVAL);
1016
1017         size = rmpp_active ? hdr_len : mad_size;
1018         buf = kzalloc(sizeof *mad_send_wr + size, gfp_mask);
1019         if (!buf)
1020                 return ERR_PTR(-ENOMEM);
1021
1022         mad_send_wr = buf + size;
1023         INIT_LIST_HEAD(&mad_send_wr->rmpp_list);
1024         mad_send_wr->send_buf.mad = buf;
1025         mad_send_wr->send_buf.hdr_len = hdr_len;
1026         mad_send_wr->send_buf.data_len = data_len;
1027         mad_send_wr->pad = pad;
1028
1029         mad_send_wr->mad_agent_priv = mad_agent_priv;
1030         mad_send_wr->sg_list[0].length = hdr_len;
1031         mad_send_wr->sg_list[0].lkey = mad_agent->qp->pd->local_dma_lkey;
1032
1033         /* OPA MADs don't have to be the full 2048 bytes */
1034         if (opa && base_version == OPA_MGMT_BASE_VERSION &&
1035             data_len < mad_size - hdr_len)
1036                 mad_send_wr->sg_list[1].length = data_len;
1037         else
1038                 mad_send_wr->sg_list[1].length = mad_size - hdr_len;
1039
1040         mad_send_wr->sg_list[1].lkey = mad_agent->qp->pd->local_dma_lkey;
1041
1042         mad_send_wr->send_wr.wr.wr_id = (unsigned long) mad_send_wr;
1043         mad_send_wr->send_wr.wr.sg_list = mad_send_wr->sg_list;
1044         mad_send_wr->send_wr.wr.num_sge = 2;
1045         mad_send_wr->send_wr.wr.opcode = IB_WR_SEND;
1046         mad_send_wr->send_wr.wr.send_flags = IB_SEND_SIGNALED;
1047         mad_send_wr->send_wr.remote_qpn = remote_qpn;
1048         mad_send_wr->send_wr.remote_qkey = IB_QP_SET_QKEY;
1049         mad_send_wr->send_wr.pkey_index = pkey_index;
1050
1051         if (rmpp_active) {
1052                 ret = alloc_send_rmpp_list(mad_send_wr, mad_size, gfp_mask);
1053                 if (ret) {
1054                         kfree(buf);
1055                         return ERR_PTR(ret);
1056                 }
1057         }
1058
1059         mad_send_wr->send_buf.mad_agent = mad_agent;
1060         atomic_inc(&mad_agent_priv->refcount);
1061         return &mad_send_wr->send_buf;
1062 }
1063 EXPORT_SYMBOL(ib_create_send_mad);
1064
1065 int ib_get_mad_data_offset(u8 mgmt_class)
1066 {
1067         if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
1068                 return IB_MGMT_SA_HDR;
1069         else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1070                  (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1071                  (mgmt_class == IB_MGMT_CLASS_BIS))
1072                 return IB_MGMT_DEVICE_HDR;
1073         else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1074                  (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
1075                 return IB_MGMT_VENDOR_HDR;
1076         else
1077                 return IB_MGMT_MAD_HDR;
1078 }
1079 EXPORT_SYMBOL(ib_get_mad_data_offset);
1080
1081 int ib_is_mad_class_rmpp(u8 mgmt_class)
1082 {
1083         if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
1084             (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1085             (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1086             (mgmt_class == IB_MGMT_CLASS_BIS) ||
1087             ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1088              (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
1089                 return 1;
1090         return 0;
1091 }
1092 EXPORT_SYMBOL(ib_is_mad_class_rmpp);
1093
1094 void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
1095 {
1096         struct ib_mad_send_wr_private *mad_send_wr;
1097         struct list_head *list;
1098
1099         mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1100                                    send_buf);
1101         list = &mad_send_wr->cur_seg->list;
1102
1103         if (mad_send_wr->cur_seg->num < seg_num) {
1104                 list_for_each_entry(mad_send_wr->cur_seg, list, list)
1105                         if (mad_send_wr->cur_seg->num == seg_num)
1106                                 break;
1107         } else if (mad_send_wr->cur_seg->num > seg_num) {
1108                 list_for_each_entry_reverse(mad_send_wr->cur_seg, list, list)
1109                         if (mad_send_wr->cur_seg->num == seg_num)
1110                                 break;
1111         }
1112         return mad_send_wr->cur_seg->data;
1113 }
1114 EXPORT_SYMBOL(ib_get_rmpp_segment);
1115
1116 static inline void *ib_get_payload(struct ib_mad_send_wr_private *mad_send_wr)
1117 {
1118         if (mad_send_wr->send_buf.seg_count)
1119                 return ib_get_rmpp_segment(&mad_send_wr->send_buf,
1120                                            mad_send_wr->seg_num);
1121         else
1122                 return mad_send_wr->send_buf.mad +
1123                        mad_send_wr->send_buf.hdr_len;
1124 }
1125
1126 void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
1127 {
1128         struct ib_mad_agent_private *mad_agent_priv;
1129         struct ib_mad_send_wr_private *mad_send_wr;
1130
1131         mad_agent_priv = container_of(send_buf->mad_agent,
1132                                       struct ib_mad_agent_private, agent);
1133         mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1134                                    send_buf);
1135
1136         free_send_rmpp_list(mad_send_wr);
1137         kfree(send_buf->mad);
1138         deref_mad_agent(mad_agent_priv);
1139 }
1140 EXPORT_SYMBOL(ib_free_send_mad);
1141
1142 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
1143 {
1144         struct ib_mad_qp_info *qp_info;
1145         struct list_head *list;
1146         struct ib_send_wr *bad_send_wr;
1147         struct ib_mad_agent *mad_agent;
1148         struct ib_sge *sge;
1149         unsigned long flags;
1150         int ret;
1151
1152         /* Set WR ID to find mad_send_wr upon completion */
1153         qp_info = mad_send_wr->mad_agent_priv->qp_info;
1154         mad_send_wr->send_wr.wr.wr_id = (unsigned long)&mad_send_wr->mad_list;
1155         mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
1156
1157         mad_agent = mad_send_wr->send_buf.mad_agent;
1158         sge = mad_send_wr->sg_list;
1159         sge[0].addr = ib_dma_map_single(mad_agent->device,
1160                                         mad_send_wr->send_buf.mad,
1161                                         sge[0].length,
1162                                         DMA_TO_DEVICE);
1163         if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[0].addr)))
1164                 return -ENOMEM;
1165
1166         mad_send_wr->header_mapping = sge[0].addr;
1167
1168         sge[1].addr = ib_dma_map_single(mad_agent->device,
1169                                         ib_get_payload(mad_send_wr),
1170                                         sge[1].length,
1171                                         DMA_TO_DEVICE);
1172         if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[1].addr))) {
1173                 ib_dma_unmap_single(mad_agent->device,
1174                                     mad_send_wr->header_mapping,
1175                                     sge[0].length, DMA_TO_DEVICE);
1176                 return -ENOMEM;
1177         }
1178         mad_send_wr->payload_mapping = sge[1].addr;
1179
1180         spin_lock_irqsave(&qp_info->send_queue.lock, flags);
1181         if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
1182                 ret = ib_post_send(mad_agent->qp, &mad_send_wr->send_wr.wr,
1183                                    &bad_send_wr);
1184                 list = &qp_info->send_queue.list;
1185         } else {
1186                 ret = 0;
1187                 list = &qp_info->overflow_list;
1188         }
1189
1190         if (!ret) {
1191                 qp_info->send_queue.count++;
1192                 list_add_tail(&mad_send_wr->mad_list.list, list);
1193         }
1194         spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
1195         if (ret) {
1196                 ib_dma_unmap_single(mad_agent->device,
1197                                     mad_send_wr->header_mapping,
1198                                     sge[0].length, DMA_TO_DEVICE);
1199                 ib_dma_unmap_single(mad_agent->device,
1200                                     mad_send_wr->payload_mapping,
1201                                     sge[1].length, DMA_TO_DEVICE);
1202         }
1203         return ret;
1204 }
1205
1206 /*
1207  * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
1208  *  with the registered client
1209  */
1210 int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
1211                      struct ib_mad_send_buf **bad_send_buf)
1212 {
1213         struct ib_mad_agent_private *mad_agent_priv;
1214         struct ib_mad_send_buf *next_send_buf;
1215         struct ib_mad_send_wr_private *mad_send_wr;
1216         unsigned long flags;
1217         int ret = -EINVAL;
1218
1219         /* Walk list of send WRs and post each on send list */
1220         for (; send_buf; send_buf = next_send_buf) {
1221
1222                 mad_send_wr = container_of(send_buf,
1223                                            struct ib_mad_send_wr_private,
1224                                            send_buf);
1225                 mad_agent_priv = mad_send_wr->mad_agent_priv;
1226
1227                 if (!send_buf->mad_agent->send_handler ||
1228                     (send_buf->timeout_ms &&
1229                      !send_buf->mad_agent->recv_handler)) {
1230                         ret = -EINVAL;
1231                         goto error;
1232                 }
1233
1234                 if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
1235                         if (mad_agent_priv->agent.rmpp_version) {
1236                                 ret = -EINVAL;
1237                                 goto error;
1238                         }
1239                 }
1240
1241                 /*
1242                  * Save pointer to next work request to post in case the
1243                  * current one completes, and the user modifies the work
1244                  * request associated with the completion
1245                  */
1246                 next_send_buf = send_buf->next;
1247                 mad_send_wr->send_wr.ah = send_buf->ah;
1248
1249                 if (((struct ib_mad_hdr *) send_buf->mad)->mgmt_class ==
1250                     IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1251                         ret = handle_outgoing_dr_smp(mad_agent_priv,
1252                                                      mad_send_wr);
1253                         if (ret < 0)            /* error */
1254                                 goto error;
1255                         else if (ret == 1)      /* locally consumed */
1256                                 continue;
1257                 }
1258
1259                 mad_send_wr->tid = ((struct ib_mad_hdr *) send_buf->mad)->tid;
1260                 /* Timeout will be updated after send completes */
1261                 mad_send_wr->timeout = msecs_to_jiffies(send_buf->timeout_ms);
1262                 mad_send_wr->max_retries = send_buf->retries;
1263                 mad_send_wr->retries_left = send_buf->retries;
1264                 send_buf->retries = 0;
1265                 /* Reference for work request to QP + response */
1266                 mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
1267                 mad_send_wr->status = IB_WC_SUCCESS;
1268
1269                 /* Reference MAD agent until send completes */
1270                 atomic_inc(&mad_agent_priv->refcount);
1271                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
1272                 list_add_tail(&mad_send_wr->agent_list,
1273                               &mad_agent_priv->send_list);
1274                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1275
1276                 if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1277                         ret = ib_send_rmpp_mad(mad_send_wr);
1278                         if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
1279                                 ret = ib_send_mad(mad_send_wr);
1280                 } else
1281                         ret = ib_send_mad(mad_send_wr);
1282                 if (ret < 0) {
1283                         /* Fail send request */
1284                         spin_lock_irqsave(&mad_agent_priv->lock, flags);
1285                         list_del(&mad_send_wr->agent_list);
1286                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1287                         atomic_dec(&mad_agent_priv->refcount);
1288                         goto error;
1289                 }
1290         }
1291         return 0;
1292 error:
1293         if (bad_send_buf)
1294                 *bad_send_buf = send_buf;
1295         return ret;
1296 }
1297 EXPORT_SYMBOL(ib_post_send_mad);
1298
1299 /*
1300  * ib_free_recv_mad - Returns data buffers used to receive
1301  *  a MAD to the access layer
1302  */
1303 void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
1304 {
1305         struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
1306         struct ib_mad_private_header *mad_priv_hdr;
1307         struct ib_mad_private *priv;
1308         struct list_head free_list;
1309
1310         INIT_LIST_HEAD(&free_list);
1311         list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
1312
1313         list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
1314                                         &free_list, list) {
1315                 mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
1316                                            recv_buf);
1317                 mad_priv_hdr = container_of(mad_recv_wc,
1318                                             struct ib_mad_private_header,
1319                                             recv_wc);
1320                 priv = container_of(mad_priv_hdr, struct ib_mad_private,
1321                                     header);
1322                 kfree(priv);
1323         }
1324 }
1325 EXPORT_SYMBOL(ib_free_recv_mad);
1326
1327 struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
1328                                         u8 rmpp_version,
1329                                         ib_mad_send_handler send_handler,
1330                                         ib_mad_recv_handler recv_handler,
1331                                         void *context)
1332 {
1333         return ERR_PTR(-EINVAL);        /* XXX: for now */
1334 }
1335 EXPORT_SYMBOL(ib_redirect_mad_qp);
1336
1337 int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
1338                       struct ib_wc *wc)
1339 {
1340         dev_err(&mad_agent->device->dev,
1341                 "ib_process_mad_wc() not implemented yet\n");
1342         return 0;
1343 }
1344 EXPORT_SYMBOL(ib_process_mad_wc);
1345
1346 static int method_in_use(struct ib_mad_mgmt_method_table **method,
1347                          struct ib_mad_reg_req *mad_reg_req)
1348 {
1349         int i;
1350
1351         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS) {
1352                 if ((*method)->agent[i]) {
1353                         pr_err("Method %d already in use\n", i);
1354                         return -EINVAL;
1355                 }
1356         }
1357         return 0;
1358 }
1359
1360 static int allocate_method_table(struct ib_mad_mgmt_method_table **method)
1361 {
1362         /* Allocate management method table */
1363         *method = kzalloc(sizeof **method, GFP_ATOMIC);
1364         if (!*method) {
1365                 pr_err("No memory for ib_mad_mgmt_method_table\n");
1366                 return -ENOMEM;
1367         }
1368
1369         return 0;
1370 }
1371
1372 /*
1373  * Check to see if there are any methods still in use
1374  */
1375 static int check_method_table(struct ib_mad_mgmt_method_table *method)
1376 {
1377         int i;
1378
1379         for (i = 0; i < IB_MGMT_MAX_METHODS; i++)
1380                 if (method->agent[i])
1381                         return 1;
1382         return 0;
1383 }
1384
1385 /*
1386  * Check to see if there are any method tables for this class still in use
1387  */
1388 static int check_class_table(struct ib_mad_mgmt_class_table *class)
1389 {
1390         int i;
1391
1392         for (i = 0; i < MAX_MGMT_CLASS; i++)
1393                 if (class->method_table[i])
1394                         return 1;
1395         return 0;
1396 }
1397
1398 static int check_vendor_class(struct ib_mad_mgmt_vendor_class *vendor_class)
1399 {
1400         int i;
1401
1402         for (i = 0; i < MAX_MGMT_OUI; i++)
1403                 if (vendor_class->method_table[i])
1404                         return 1;
1405         return 0;
1406 }
1407
1408 static int find_vendor_oui(struct ib_mad_mgmt_vendor_class *vendor_class,
1409                            const char *oui)
1410 {
1411         int i;
1412
1413         for (i = 0; i < MAX_MGMT_OUI; i++)
1414                 /* Is there matching OUI for this vendor class ? */
1415                 if (!memcmp(vendor_class->oui[i], oui, 3))
1416                         return i;
1417
1418         return -1;
1419 }
1420
1421 static int check_vendor_table(struct ib_mad_mgmt_vendor_class_table *vendor)
1422 {
1423         int i;
1424
1425         for (i = 0; i < MAX_MGMT_VENDOR_RANGE2; i++)
1426                 if (vendor->vendor_class[i])
1427                         return 1;
1428
1429         return 0;
1430 }
1431
1432 static void remove_methods_mad_agent(struct ib_mad_mgmt_method_table *method,
1433                                      struct ib_mad_agent_private *agent)
1434 {
1435         int i;
1436
1437         /* Remove any methods for this mad agent */
1438         for (i = 0; i < IB_MGMT_MAX_METHODS; i++) {
1439                 if (method->agent[i] == agent) {
1440                         method->agent[i] = NULL;
1441                 }
1442         }
1443 }
1444
1445 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1446                               struct ib_mad_agent_private *agent_priv,
1447                               u8 mgmt_class)
1448 {
1449         struct ib_mad_port_private *port_priv;
1450         struct ib_mad_mgmt_class_table **class;
1451         struct ib_mad_mgmt_method_table **method;
1452         int i, ret;
1453
1454         port_priv = agent_priv->qp_info->port_priv;
1455         class = &port_priv->version[mad_reg_req->mgmt_class_version].class;
1456         if (!*class) {
1457                 /* Allocate management class table for "new" class version */
1458                 *class = kzalloc(sizeof **class, GFP_ATOMIC);
1459                 if (!*class) {
1460                         dev_err(&agent_priv->agent.device->dev,
1461                                 "No memory for ib_mad_mgmt_class_table\n");
1462                         ret = -ENOMEM;
1463                         goto error1;
1464                 }
1465
1466                 /* Allocate method table for this management class */
1467                 method = &(*class)->method_table[mgmt_class];
1468                 if ((ret = allocate_method_table(method)))
1469                         goto error2;
1470         } else {
1471                 method = &(*class)->method_table[mgmt_class];
1472                 if (!*method) {
1473                         /* Allocate method table for this management class */
1474                         if ((ret = allocate_method_table(method)))
1475                                 goto error1;
1476                 }
1477         }
1478
1479         /* Now, make sure methods are not already in use */
1480         if (method_in_use(method, mad_reg_req))
1481                 goto error3;
1482
1483         /* Finally, add in methods being registered */
1484         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1485                 (*method)->agent[i] = agent_priv;
1486
1487         return 0;
1488
1489 error3:
1490         /* Remove any methods for this mad agent */
1491         remove_methods_mad_agent(*method, agent_priv);
1492         /* Now, check to see if there are any methods in use */
1493         if (!check_method_table(*method)) {
1494                 /* If not, release management method table */
1495                 kfree(*method);
1496                 *method = NULL;
1497         }
1498         ret = -EINVAL;
1499         goto error1;
1500 error2:
1501         kfree(*class);
1502         *class = NULL;
1503 error1:
1504         return ret;
1505 }
1506
1507 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1508                            struct ib_mad_agent_private *agent_priv)
1509 {
1510         struct ib_mad_port_private *port_priv;
1511         struct ib_mad_mgmt_vendor_class_table **vendor_table;
1512         struct ib_mad_mgmt_vendor_class_table *vendor = NULL;
1513         struct ib_mad_mgmt_vendor_class *vendor_class = NULL;
1514         struct ib_mad_mgmt_method_table **method;
1515         int i, ret = -ENOMEM;
1516         u8 vclass;
1517
1518         /* "New" vendor (with OUI) class */
1519         vclass = vendor_class_index(mad_reg_req->mgmt_class);
1520         port_priv = agent_priv->qp_info->port_priv;
1521         vendor_table = &port_priv->version[
1522                                 mad_reg_req->mgmt_class_version].vendor;
1523         if (!*vendor_table) {
1524                 /* Allocate mgmt vendor class table for "new" class version */
1525                 vendor = kzalloc(sizeof *vendor, GFP_ATOMIC);
1526                 if (!vendor) {
1527                         dev_err(&agent_priv->agent.device->dev,
1528                                 "No memory for ib_mad_mgmt_vendor_class_table\n");
1529                         goto error1;
1530                 }
1531
1532                 *vendor_table = vendor;
1533         }
1534         if (!(*vendor_table)->vendor_class[vclass]) {
1535                 /* Allocate table for this management vendor class */
1536                 vendor_class = kzalloc(sizeof *vendor_class, GFP_ATOMIC);
1537                 if (!vendor_class) {
1538                         dev_err(&agent_priv->agent.device->dev,
1539                                 "No memory for ib_mad_mgmt_vendor_class\n");
1540                         goto error2;
1541                 }
1542
1543                 (*vendor_table)->vendor_class[vclass] = vendor_class;
1544         }
1545         for (i = 0; i < MAX_MGMT_OUI; i++) {
1546                 /* Is there matching OUI for this vendor class ? */
1547                 if (!memcmp((*vendor_table)->vendor_class[vclass]->oui[i],
1548                             mad_reg_req->oui, 3)) {
1549                         method = &(*vendor_table)->vendor_class[
1550                                                 vclass]->method_table[i];
1551                         if (!*method)
1552                                 goto error3;
1553                         goto check_in_use;
1554                 }
1555         }
1556         for (i = 0; i < MAX_MGMT_OUI; i++) {
1557                 /* OUI slot available ? */
1558                 if (!is_vendor_oui((*vendor_table)->vendor_class[
1559                                 vclass]->oui[i])) {
1560                         method = &(*vendor_table)->vendor_class[
1561                                 vclass]->method_table[i];
1562                         /* Allocate method table for this OUI */
1563                         if (!*method) {
1564                                 ret = allocate_method_table(method);
1565                                 if (ret)
1566                                         goto error3;
1567                         }
1568                         memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
1569                                mad_reg_req->oui, 3);
1570                         goto check_in_use;
1571                 }
1572         }
1573         dev_err(&agent_priv->agent.device->dev, "All OUI slots in use\n");
1574         goto error3;
1575
1576 check_in_use:
1577         /* Now, make sure methods are not already in use */
1578         if (method_in_use(method, mad_reg_req))
1579                 goto error4;
1580
1581         /* Finally, add in methods being registered */
1582         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1583                 (*method)->agent[i] = agent_priv;
1584
1585         return 0;
1586
1587 error4:
1588         /* Remove any methods for this mad agent */
1589         remove_methods_mad_agent(*method, agent_priv);
1590         /* Now, check to see if there are any methods in use */
1591         if (!check_method_table(*method)) {
1592                 /* If not, release management method table */
1593                 kfree(*method);
1594                 *method = NULL;
1595         }
1596         ret = -EINVAL;
1597 error3:
1598         if (vendor_class) {
1599                 (*vendor_table)->vendor_class[vclass] = NULL;
1600                 kfree(vendor_class);
1601         }
1602 error2:
1603         if (vendor) {
1604                 *vendor_table = NULL;
1605                 kfree(vendor);
1606         }
1607 error1:
1608         return ret;
1609 }
1610
1611 static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
1612 {
1613         struct ib_mad_port_private *port_priv;
1614         struct ib_mad_mgmt_class_table *class;
1615         struct ib_mad_mgmt_method_table *method;
1616         struct ib_mad_mgmt_vendor_class_table *vendor;
1617         struct ib_mad_mgmt_vendor_class *vendor_class;
1618         int index;
1619         u8 mgmt_class;
1620
1621         /*
1622          * Was MAD registration request supplied
1623          * with original registration ?
1624          */
1625         if (!agent_priv->reg_req) {
1626                 goto out;
1627         }
1628
1629         port_priv = agent_priv->qp_info->port_priv;
1630         mgmt_class = convert_mgmt_class(agent_priv->reg_req->mgmt_class);
1631         class = port_priv->version[
1632                         agent_priv->reg_req->mgmt_class_version].class;
1633         if (!class)
1634                 goto vendor_check;
1635
1636         method = class->method_table[mgmt_class];
1637         if (method) {
1638                 /* Remove any methods for this mad agent */
1639                 remove_methods_mad_agent(method, agent_priv);
1640                 /* Now, check to see if there are any methods still in use */
1641                 if (!check_method_table(method)) {
1642                         /* If not, release management method table */
1643                          kfree(method);
1644                          class->method_table[mgmt_class] = NULL;
1645                          /* Any management classes left ? */
1646                         if (!check_class_table(class)) {
1647                                 /* If not, release management class table */
1648                                 kfree(class);
1649                                 port_priv->version[
1650                                         agent_priv->reg_req->
1651                                         mgmt_class_version].class = NULL;
1652                         }
1653                 }
1654         }
1655
1656 vendor_check:
1657         if (!is_vendor_class(mgmt_class))
1658                 goto out;
1659
1660         /* normalize mgmt_class to vendor range 2 */
1661         mgmt_class = vendor_class_index(agent_priv->reg_req->mgmt_class);
1662         vendor = port_priv->version[
1663                         agent_priv->reg_req->mgmt_class_version].vendor;
1664
1665         if (!vendor)
1666                 goto out;
1667
1668         vendor_class = vendor->vendor_class[mgmt_class];
1669         if (vendor_class) {
1670                 index = find_vendor_oui(vendor_class, agent_priv->reg_req->oui);
1671                 if (index < 0)
1672                         goto out;
1673                 method = vendor_class->method_table[index];
1674                 if (method) {
1675                         /* Remove any methods for this mad agent */
1676                         remove_methods_mad_agent(method, agent_priv);
1677                         /*
1678                          * Now, check to see if there are
1679                          * any methods still in use
1680                          */
1681                         if (!check_method_table(method)) {
1682                                 /* If not, release management method table */
1683                                 kfree(method);
1684                                 vendor_class->method_table[index] = NULL;
1685                                 memset(vendor_class->oui[index], 0, 3);
1686                                 /* Any OUIs left ? */
1687                                 if (!check_vendor_class(vendor_class)) {
1688                                         /* If not, release vendor class table */
1689                                         kfree(vendor_class);
1690                                         vendor->vendor_class[mgmt_class] = NULL;
1691                                         /* Any other vendor classes left ? */
1692                                         if (!check_vendor_table(vendor)) {
1693                                                 kfree(vendor);
1694                                                 port_priv->version[
1695                                                         agent_priv->reg_req->
1696                                                         mgmt_class_version].
1697                                                         vendor = NULL;
1698                                         }
1699                                 }
1700                         }
1701                 }
1702         }
1703
1704 out:
1705         return;
1706 }
1707
1708 static struct ib_mad_agent_private *
1709 find_mad_agent(struct ib_mad_port_private *port_priv,
1710                const struct ib_mad_hdr *mad_hdr)
1711 {
1712         struct ib_mad_agent_private *mad_agent = NULL;
1713         unsigned long flags;
1714
1715         spin_lock_irqsave(&port_priv->reg_lock, flags);
1716         if (ib_response_mad(mad_hdr)) {
1717                 u32 hi_tid;
1718                 struct ib_mad_agent_private *entry;
1719
1720                 /*
1721                  * Routing is based on high 32 bits of transaction ID
1722                  * of MAD.
1723                  */
1724                 hi_tid = be64_to_cpu(mad_hdr->tid) >> 32;
1725                 list_for_each_entry(entry, &port_priv->agent_list, agent_list) {
1726                         if (entry->agent.hi_tid == hi_tid) {
1727                                 mad_agent = entry;
1728                                 break;
1729                         }
1730                 }
1731         } else {
1732                 struct ib_mad_mgmt_class_table *class;
1733                 struct ib_mad_mgmt_method_table *method;
1734                 struct ib_mad_mgmt_vendor_class_table *vendor;
1735                 struct ib_mad_mgmt_vendor_class *vendor_class;
1736                 const struct ib_vendor_mad *vendor_mad;
1737                 int index;
1738
1739                 /*
1740                  * Routing is based on version, class, and method
1741                  * For "newer" vendor MADs, also based on OUI
1742                  */
1743                 if (mad_hdr->class_version >= MAX_MGMT_VERSION)
1744                         goto out;
1745                 if (!is_vendor_class(mad_hdr->mgmt_class)) {
1746                         class = port_priv->version[
1747                                         mad_hdr->class_version].class;
1748                         if (!class)
1749                                 goto out;
1750                         if (convert_mgmt_class(mad_hdr->mgmt_class) >=
1751                             ARRAY_SIZE(class->method_table))
1752                                 goto out;
1753                         method = class->method_table[convert_mgmt_class(
1754                                                         mad_hdr->mgmt_class)];
1755                         if (method)
1756                                 mad_agent = method->agent[mad_hdr->method &
1757                                                           ~IB_MGMT_METHOD_RESP];
1758                 } else {
1759                         vendor = port_priv->version[
1760                                         mad_hdr->class_version].vendor;
1761                         if (!vendor)
1762                                 goto out;
1763                         vendor_class = vendor->vendor_class[vendor_class_index(
1764                                                 mad_hdr->mgmt_class)];
1765                         if (!vendor_class)
1766                                 goto out;
1767                         /* Find matching OUI */
1768                         vendor_mad = (const struct ib_vendor_mad *)mad_hdr;
1769                         index = find_vendor_oui(vendor_class, vendor_mad->oui);
1770                         if (index == -1)
1771                                 goto out;
1772                         method = vendor_class->method_table[index];
1773                         if (method) {
1774                                 mad_agent = method->agent[mad_hdr->method &
1775                                                           ~IB_MGMT_METHOD_RESP];
1776                         }
1777                 }
1778         }
1779
1780         if (mad_agent) {
1781                 if (mad_agent->agent.recv_handler)
1782                         atomic_inc(&mad_agent->refcount);
1783                 else {
1784                         dev_notice(&port_priv->device->dev,
1785                                    "No receive handler for client %p on port %d\n",
1786                                    &mad_agent->agent, port_priv->port_num);
1787                         mad_agent = NULL;
1788                 }
1789         }
1790 out:
1791         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
1792
1793         return mad_agent;
1794 }
1795
1796 static int validate_mad(const struct ib_mad_hdr *mad_hdr,
1797                         const struct ib_mad_qp_info *qp_info,
1798                         bool opa)
1799 {
1800         int valid = 0;
1801         u32 qp_num = qp_info->qp->qp_num;
1802
1803         /* Make sure MAD base version is understood */
1804         if (mad_hdr->base_version != IB_MGMT_BASE_VERSION &&
1805             (!opa || mad_hdr->base_version != OPA_MGMT_BASE_VERSION)) {
1806                 pr_err("MAD received with unsupported base version %d %s\n",
1807                        mad_hdr->base_version, opa ? "(opa)" : "");
1808                 goto out;
1809         }
1810
1811         /* Filter SMI packets sent to other than QP0 */
1812         if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
1813             (mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
1814                 if (qp_num == 0)
1815                         valid = 1;
1816         } else {
1817                 /* CM attributes other than ClassPortInfo only use Send method */
1818                 if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
1819                     (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
1820                     (mad_hdr->method != IB_MGMT_METHOD_SEND))
1821                         goto out;
1822                 /* Filter GSI packets sent to QP0 */
1823                 if (qp_num != 0)
1824                         valid = 1;
1825         }
1826
1827 out:
1828         return valid;
1829 }
1830
1831 static int is_rmpp_data_mad(const struct ib_mad_agent_private *mad_agent_priv,
1832                             const struct ib_mad_hdr *mad_hdr)
1833 {
1834         struct ib_rmpp_mad *rmpp_mad;
1835
1836         rmpp_mad = (struct ib_rmpp_mad *)mad_hdr;
1837         return !mad_agent_priv->agent.rmpp_version ||
1838                 !ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent) ||
1839                 !(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
1840                                     IB_MGMT_RMPP_FLAG_ACTIVE) ||
1841                 (rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
1842 }
1843
1844 static inline int rcv_has_same_class(const struct ib_mad_send_wr_private *wr,
1845                                      const struct ib_mad_recv_wc *rwc)
1846 {
1847         return ((struct ib_mad_hdr *)(wr->send_buf.mad))->mgmt_class ==
1848                 rwc->recv_buf.mad->mad_hdr.mgmt_class;
1849 }
1850
1851 static inline int rcv_has_same_gid(const struct ib_mad_agent_private *mad_agent_priv,
1852                                    const struct ib_mad_send_wr_private *wr,
1853                                    const struct ib_mad_recv_wc *rwc )
1854 {
1855         struct ib_ah_attr attr;
1856         u8 send_resp, rcv_resp;
1857         union ib_gid sgid;
1858         struct ib_device *device = mad_agent_priv->agent.device;
1859         u8 port_num = mad_agent_priv->agent.port_num;
1860         u8 lmc;
1861
1862         send_resp = ib_response_mad((struct ib_mad_hdr *)wr->send_buf.mad);
1863         rcv_resp = ib_response_mad(&rwc->recv_buf.mad->mad_hdr);
1864
1865         if (send_resp == rcv_resp)
1866                 /* both requests, or both responses. GIDs different */
1867                 return 0;
1868
1869         if (ib_query_ah(wr->send_buf.ah, &attr))
1870                 /* Assume not equal, to avoid false positives. */
1871                 return 0;
1872
1873         if (!!(attr.ah_flags & IB_AH_GRH) !=
1874             !!(rwc->wc->wc_flags & IB_WC_GRH))
1875                 /* one has GID, other does not.  Assume different */
1876                 return 0;
1877
1878         if (!send_resp && rcv_resp) {
1879                 /* is request/response. */
1880                 if (!(attr.ah_flags & IB_AH_GRH)) {
1881                         if (ib_get_cached_lmc(device, port_num, &lmc))
1882                                 return 0;
1883                         return (!lmc || !((attr.src_path_bits ^
1884                                            rwc->wc->dlid_path_bits) &
1885                                           ((1 << lmc) - 1)));
1886                 } else {
1887                         if (ib_get_cached_gid(device, port_num,
1888                                               attr.grh.sgid_index, &sgid, NULL))
1889                                 return 0;
1890                         return !memcmp(sgid.raw, rwc->recv_buf.grh->dgid.raw,
1891                                        16);
1892                 }
1893         }
1894
1895         if (!(attr.ah_flags & IB_AH_GRH))
1896                 return attr.dlid == rwc->wc->slid;
1897         else
1898                 return !memcmp(attr.grh.dgid.raw, rwc->recv_buf.grh->sgid.raw,
1899                                16);
1900 }
1901
1902 static inline int is_direct(u8 class)
1903 {
1904         return (class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE);
1905 }
1906
1907 struct ib_mad_send_wr_private*
1908 ib_find_send_mad(const struct ib_mad_agent_private *mad_agent_priv,
1909                  const struct ib_mad_recv_wc *wc)
1910 {
1911         struct ib_mad_send_wr_private *wr;
1912         const struct ib_mad_hdr *mad_hdr;
1913
1914         mad_hdr = &wc->recv_buf.mad->mad_hdr;
1915
1916         list_for_each_entry(wr, &mad_agent_priv->wait_list, agent_list) {
1917                 if ((wr->tid == mad_hdr->tid) &&
1918                     rcv_has_same_class(wr, wc) &&
1919                     /*
1920                      * Don't check GID for direct routed MADs.
1921                      * These might have permissive LIDs.
1922                      */
1923                     (is_direct(mad_hdr->mgmt_class) ||
1924                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
1925                         return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1926         }
1927
1928         /*
1929          * It's possible to receive the response before we've
1930          * been notified that the send has completed
1931          */
1932         list_for_each_entry(wr, &mad_agent_priv->send_list, agent_list) {
1933                 if (is_rmpp_data_mad(mad_agent_priv, wr->send_buf.mad) &&
1934                     wr->tid == mad_hdr->tid &&
1935                     wr->timeout &&
1936                     rcv_has_same_class(wr, wc) &&
1937                     /*
1938                      * Don't check GID for direct routed MADs.
1939                      * These might have permissive LIDs.
1940                      */
1941                     (is_direct(mad_hdr->mgmt_class) ||
1942                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
1943                         /* Verify request has not been canceled */
1944                         return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1945         }
1946         return NULL;
1947 }
1948
1949 void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
1950 {
1951         mad_send_wr->timeout = 0;
1952         if (mad_send_wr->refcount == 1)
1953                 list_move_tail(&mad_send_wr->agent_list,
1954                               &mad_send_wr->mad_agent_priv->done_list);
1955 }
1956
1957 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
1958                                  struct ib_mad_recv_wc *mad_recv_wc)
1959 {
1960         struct ib_mad_send_wr_private *mad_send_wr;
1961         struct ib_mad_send_wc mad_send_wc;
1962         unsigned long flags;
1963
1964         INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
1965         list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
1966         if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1967                 mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
1968                                                       mad_recv_wc);
1969                 if (!mad_recv_wc) {
1970                         deref_mad_agent(mad_agent_priv);
1971                         return;
1972                 }
1973         }
1974
1975         /* Complete corresponding request */
1976         if (ib_response_mad(&mad_recv_wc->recv_buf.mad->mad_hdr)) {
1977                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
1978                 mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
1979                 if (!mad_send_wr) {
1980                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1981                         if (!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)
1982                            && ib_is_mad_class_rmpp(mad_recv_wc->recv_buf.mad->mad_hdr.mgmt_class)
1983                            && (ib_get_rmpp_flags(&((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr)
1984                                         & IB_MGMT_RMPP_FLAG_ACTIVE)) {
1985                                 /* user rmpp is in effect
1986                                  * and this is an active RMPP MAD
1987                                  */
1988                                 mad_recv_wc->wc->wr_id = 0;
1989                                 mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1990                                                                    mad_recv_wc);
1991                                 atomic_dec(&mad_agent_priv->refcount);
1992                         } else {
1993                                 /* not user rmpp, revert to normal behavior and
1994                                  * drop the mad */
1995                                 ib_free_recv_mad(mad_recv_wc);
1996                                 deref_mad_agent(mad_agent_priv);
1997                                 return;
1998                         }
1999                 } else {
2000                         ib_mark_mad_done(mad_send_wr);
2001                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2002
2003                         /* Defined behavior is to complete response before request */
2004                         mad_recv_wc->wc->wr_id = (unsigned long) &mad_send_wr->send_buf;
2005                         mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
2006                                                            mad_recv_wc);
2007                         atomic_dec(&mad_agent_priv->refcount);
2008
2009                         mad_send_wc.status = IB_WC_SUCCESS;
2010                         mad_send_wc.vendor_err = 0;
2011                         mad_send_wc.send_buf = &mad_send_wr->send_buf;
2012                         ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2013                 }
2014         } else {
2015                 mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
2016                                                    mad_recv_wc);
2017                 deref_mad_agent(mad_agent_priv);
2018         }
2019 }
2020
2021 static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv,
2022                                      const struct ib_mad_qp_info *qp_info,
2023                                      const struct ib_wc *wc,
2024                                      int port_num,
2025                                      struct ib_mad_private *recv,
2026                                      struct ib_mad_private *response)
2027 {
2028         enum smi_forward_action retsmi;
2029         struct ib_smp *smp = (struct ib_smp *)recv->mad;
2030
2031         if (smi_handle_dr_smp_recv(smp,
2032                                    rdma_cap_ib_switch(port_priv->device),
2033                                    port_num,
2034                                    port_priv->device->phys_port_cnt) ==
2035                                    IB_SMI_DISCARD)
2036                 return IB_SMI_DISCARD;
2037
2038         retsmi = smi_check_forward_dr_smp(smp);
2039         if (retsmi == IB_SMI_LOCAL)
2040                 return IB_SMI_HANDLE;
2041
2042         if (retsmi == IB_SMI_SEND) { /* don't forward */
2043                 if (smi_handle_dr_smp_send(smp,
2044                                            rdma_cap_ib_switch(port_priv->device),
2045                                            port_num) == IB_SMI_DISCARD)
2046                         return IB_SMI_DISCARD;
2047
2048                 if (smi_check_local_smp(smp, port_priv->device) == IB_SMI_DISCARD)
2049                         return IB_SMI_DISCARD;
2050         } else if (rdma_cap_ib_switch(port_priv->device)) {
2051                 /* forward case for switches */
2052                 memcpy(response, recv, mad_priv_size(response));
2053                 response->header.recv_wc.wc = &response->header.wc;
2054                 response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2055                 response->header.recv_wc.recv_buf.grh = &response->grh;
2056
2057                 agent_send_response((const struct ib_mad_hdr *)response->mad,
2058                                     &response->grh, wc,
2059                                     port_priv->device,
2060                                     smi_get_fwd_port(smp),
2061                                     qp_info->qp->qp_num,
2062                                     response->mad_size,
2063                                     false);
2064
2065                 return IB_SMI_DISCARD;
2066         }
2067         return IB_SMI_HANDLE;
2068 }
2069
2070 static bool generate_unmatched_resp(const struct ib_mad_private *recv,
2071                                     struct ib_mad_private *response,
2072                                     size_t *resp_len, bool opa)
2073 {
2074         const struct ib_mad_hdr *recv_hdr = (const struct ib_mad_hdr *)recv->mad;
2075         struct ib_mad_hdr *resp_hdr = (struct ib_mad_hdr *)response->mad;
2076
2077         if (recv_hdr->method == IB_MGMT_METHOD_GET ||
2078             recv_hdr->method == IB_MGMT_METHOD_SET) {
2079                 memcpy(response, recv, mad_priv_size(response));
2080                 response->header.recv_wc.wc = &response->header.wc;
2081                 response->header.recv_wc.recv_buf.mad = (struct ib_mad *)response->mad;
2082                 response->header.recv_wc.recv_buf.grh = &response->grh;
2083                 resp_hdr->method = IB_MGMT_METHOD_GET_RESP;
2084                 resp_hdr->status = cpu_to_be16(IB_MGMT_MAD_STATUS_UNSUPPORTED_METHOD_ATTRIB);
2085                 if (recv_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2086                         resp_hdr->status |= IB_SMP_DIRECTION;
2087
2088                 if (opa && recv_hdr->base_version == OPA_MGMT_BASE_VERSION) {
2089                         if (recv_hdr->mgmt_class ==
2090                             IB_MGMT_CLASS_SUBN_LID_ROUTED ||
2091                             recv_hdr->mgmt_class ==
2092                             IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
2093                                 *resp_len = opa_get_smp_header_size(
2094                                                         (struct opa_smp *)recv->mad);
2095                         else
2096                                 *resp_len = sizeof(struct ib_mad_hdr);
2097                 }
2098
2099                 return true;
2100         } else {
2101                 return false;
2102         }
2103 }
2104
2105 static enum smi_action
2106 handle_opa_smi(struct ib_mad_port_private *port_priv,
2107                struct ib_mad_qp_info *qp_info,
2108                struct ib_wc *wc,
2109                int port_num,
2110                struct ib_mad_private *recv,
2111                struct ib_mad_private *response)
2112 {
2113         enum smi_forward_action retsmi;
2114         struct opa_smp *smp = (struct opa_smp *)recv->mad;
2115
2116         if (opa_smi_handle_dr_smp_recv(smp,
2117                                    rdma_cap_ib_switch(port_priv->device),
2118                                    port_num,
2119                                    port_priv->device->phys_port_cnt) ==
2120                                    IB_SMI_DISCARD)
2121                 return IB_SMI_DISCARD;
2122
2123         retsmi = opa_smi_check_forward_dr_smp(smp);
2124         if (retsmi == IB_SMI_LOCAL)
2125                 return IB_SMI_HANDLE;
2126
2127         if (retsmi == IB_SMI_SEND) { /* don't forward */
2128                 if (opa_smi_handle_dr_smp_send(smp,
2129                                            rdma_cap_ib_switch(port_priv->device),
2130                                            port_num) == IB_SMI_DISCARD)
2131                         return IB_SMI_DISCARD;
2132
2133                 if (opa_smi_check_local_smp(smp, port_priv->device) ==
2134                     IB_SMI_DISCARD)
2135                         return IB_SMI_DISCARD;
2136
2137         } else if (rdma_cap_ib_switch(port_priv->device)) {
2138                 /* forward case for switches */
2139                 memcpy(response, recv, mad_priv_size(response));
2140                 response->header.recv_wc.wc = &response->header.wc;
2141                 response->header.recv_wc.recv_buf.opa_mad =
2142                                 (struct opa_mad *)response->mad;
2143                 response->header.recv_wc.recv_buf.grh = &response->grh;
2144
2145                 agent_send_response((const struct ib_mad_hdr *)response->mad,
2146                                     &response->grh, wc,
2147                                     port_priv->device,
2148                                     opa_smi_get_fwd_port(smp),
2149                                     qp_info->qp->qp_num,
2150                                     recv->header.wc.byte_len,
2151                                     true);
2152
2153                 return IB_SMI_DISCARD;
2154         }
2155
2156         return IB_SMI_HANDLE;
2157 }
2158
2159 static enum smi_action
2160 handle_smi(struct ib_mad_port_private *port_priv,
2161            struct ib_mad_qp_info *qp_info,
2162            struct ib_wc *wc,
2163            int port_num,
2164            struct ib_mad_private *recv,
2165            struct ib_mad_private *response,
2166            bool opa)
2167 {
2168         struct ib_mad_hdr *mad_hdr = (struct ib_mad_hdr *)recv->mad;
2169
2170         if (opa && mad_hdr->base_version == OPA_MGMT_BASE_VERSION &&
2171             mad_hdr->class_version == OPA_SMI_CLASS_VERSION)
2172                 return handle_opa_smi(port_priv, qp_info, wc, port_num, recv,
2173                                       response);
2174
2175         return handle_ib_smi(port_priv, qp_info, wc, port_num, recv, response);
2176 }
2177
2178 static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
2179                                      struct ib_wc *wc)
2180 {
2181         struct ib_mad_qp_info *qp_info;
2182         struct ib_mad_private_header *mad_priv_hdr;
2183         struct ib_mad_private *recv, *response = NULL;
2184         struct ib_mad_list_head *mad_list;
2185         struct ib_mad_agent_private *mad_agent;
2186         int port_num;
2187         int ret = IB_MAD_RESULT_SUCCESS;
2188         size_t mad_size;
2189         u16 resp_mad_pkey_index = 0;
2190         bool opa;
2191
2192         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2193         qp_info = mad_list->mad_queue->qp_info;
2194         dequeue_mad(mad_list);
2195
2196         opa = rdma_cap_opa_mad(qp_info->port_priv->device,
2197                                qp_info->port_priv->port_num);
2198
2199         mad_priv_hdr = container_of(mad_list, struct ib_mad_private_header,
2200                                     mad_list);
2201         recv = container_of(mad_priv_hdr, struct ib_mad_private, header);
2202         ib_dma_unmap_single(port_priv->device,
2203                             recv->header.mapping,
2204                             mad_priv_dma_size(recv),
2205                             DMA_FROM_DEVICE);
2206
2207         /* Setup MAD receive work completion from "normal" work completion */
2208         recv->header.wc = *wc;
2209         recv->header.recv_wc.wc = &recv->header.wc;
2210
2211         if (opa && ((struct ib_mad_hdr *)(recv->mad))->base_version == OPA_MGMT_BASE_VERSION) {
2212                 recv->header.recv_wc.mad_len = wc->byte_len - sizeof(struct ib_grh);
2213                 recv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2214         } else {
2215                 recv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2216                 recv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2217         }
2218
2219         recv->header.recv_wc.recv_buf.mad = (struct ib_mad *)recv->mad;
2220         recv->header.recv_wc.recv_buf.grh = &recv->grh;
2221
2222         if (atomic_read(&qp_info->snoop_count))
2223                 snoop_recv(qp_info, &recv->header.recv_wc, IB_MAD_SNOOP_RECVS);
2224
2225         /* Validate MAD */
2226         if (!validate_mad((const struct ib_mad_hdr *)recv->mad, qp_info, opa))
2227                 goto out;
2228
2229         mad_size = recv->mad_size;
2230         response = alloc_mad_private(mad_size, GFP_KERNEL);
2231         if (!response) {
2232                 dev_err(&port_priv->device->dev,
2233                         "ib_mad_recv_done_handler no memory for response buffer\n");
2234                 goto out;
2235         }
2236
2237         if (rdma_cap_ib_switch(port_priv->device))
2238                 port_num = wc->port_num;
2239         else
2240                 port_num = port_priv->port_num;
2241
2242         if (((struct ib_mad_hdr *)recv->mad)->mgmt_class ==
2243             IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
2244                 if (handle_smi(port_priv, qp_info, wc, port_num, recv,
2245                                response, opa)
2246                     == IB_SMI_DISCARD)
2247                         goto out;
2248         }
2249
2250         /* Give driver "right of first refusal" on incoming MAD */
2251         if (port_priv->device->process_mad) {
2252                 ret = port_priv->device->process_mad(port_priv->device, 0,
2253                                                      port_priv->port_num,
2254                                                      wc, &recv->grh,
2255                                                      (const struct ib_mad_hdr *)recv->mad,
2256                                                      recv->mad_size,
2257                                                      (struct ib_mad_hdr *)response->mad,
2258                                                      &mad_size, &resp_mad_pkey_index);
2259
2260                 if (opa)
2261                         wc->pkey_index = resp_mad_pkey_index;
2262
2263                 if (ret & IB_MAD_RESULT_SUCCESS) {
2264                         if (ret & IB_MAD_RESULT_CONSUMED)
2265                                 goto out;
2266                         if (ret & IB_MAD_RESULT_REPLY) {
2267                                 agent_send_response((const struct ib_mad_hdr *)response->mad,
2268                                                     &recv->grh, wc,
2269                                                     port_priv->device,
2270                                                     port_num,
2271                                                     qp_info->qp->qp_num,
2272                                                     mad_size, opa);
2273                                 goto out;
2274                         }
2275                 }
2276         }
2277
2278         mad_agent = find_mad_agent(port_priv, (const struct ib_mad_hdr *)recv->mad);
2279         if (mad_agent) {
2280                 ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
2281                 /*
2282                  * recv is freed up in error cases in ib_mad_complete_recv
2283                  * or via recv_handler in ib_mad_complete_recv()
2284                  */
2285                 recv = NULL;
2286         } else if ((ret & IB_MAD_RESULT_SUCCESS) &&
2287                    generate_unmatched_resp(recv, response, &mad_size, opa)) {
2288                 agent_send_response((const struct ib_mad_hdr *)response->mad, &recv->grh, wc,
2289                                     port_priv->device, port_num,
2290                                     qp_info->qp->qp_num, mad_size, opa);
2291         }
2292
2293 out:
2294         /* Post another receive request for this QP */
2295         if (response) {
2296                 ib_mad_post_receive_mads(qp_info, response);
2297                 kfree(recv);
2298         } else
2299                 ib_mad_post_receive_mads(qp_info, recv);
2300 }
2301
2302 static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
2303 {
2304         struct ib_mad_send_wr_private *mad_send_wr;
2305         unsigned long delay;
2306
2307         if (list_empty(&mad_agent_priv->wait_list)) {
2308                 cancel_delayed_work(&mad_agent_priv->timed_work);
2309         } else {
2310                 mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2311                                          struct ib_mad_send_wr_private,
2312                                          agent_list);
2313
2314                 if (time_after(mad_agent_priv->timeout,
2315                                mad_send_wr->timeout)) {
2316                         mad_agent_priv->timeout = mad_send_wr->timeout;
2317                         delay = mad_send_wr->timeout - jiffies;
2318                         if ((long)delay <= 0)
2319                                 delay = 1;
2320                         mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2321                                          &mad_agent_priv->timed_work, delay);
2322                 }
2323         }
2324 }
2325
2326 static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
2327 {
2328         struct ib_mad_agent_private *mad_agent_priv;
2329         struct ib_mad_send_wr_private *temp_mad_send_wr;
2330         struct list_head *list_item;
2331         unsigned long delay;
2332
2333         mad_agent_priv = mad_send_wr->mad_agent_priv;
2334         list_del(&mad_send_wr->agent_list);
2335
2336         delay = mad_send_wr->timeout;
2337         mad_send_wr->timeout += jiffies;
2338
2339         if (delay) {
2340                 list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
2341                         temp_mad_send_wr = list_entry(list_item,
2342                                                 struct ib_mad_send_wr_private,
2343                                                 agent_list);
2344                         if (time_after(mad_send_wr->timeout,
2345                                        temp_mad_send_wr->timeout))
2346                                 break;
2347                 }
2348         }
2349         else
2350                 list_item = &mad_agent_priv->wait_list;
2351         list_add(&mad_send_wr->agent_list, list_item);
2352
2353         /* Reschedule a work item if we have a shorter timeout */
2354         if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list)
2355                 mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2356                                  &mad_agent_priv->timed_work, delay);
2357 }
2358
2359 void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
2360                           int timeout_ms)
2361 {
2362         mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2363         wait_for_response(mad_send_wr);
2364 }
2365
2366 /*
2367  * Process a send work completion
2368  */
2369 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
2370                              struct ib_mad_send_wc *mad_send_wc)
2371 {
2372         struct ib_mad_agent_private     *mad_agent_priv;
2373         unsigned long                   flags;
2374         int                             ret;
2375
2376         mad_agent_priv = mad_send_wr->mad_agent_priv;
2377         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2378         if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
2379                 ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
2380                 if (ret == IB_RMPP_RESULT_CONSUMED)
2381                         goto done;
2382         } else
2383                 ret = IB_RMPP_RESULT_UNHANDLED;
2384
2385         if (mad_send_wc->status != IB_WC_SUCCESS &&
2386             mad_send_wr->status == IB_WC_SUCCESS) {
2387                 mad_send_wr->status = mad_send_wc->status;
2388                 mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2389         }
2390
2391         if (--mad_send_wr->refcount > 0) {
2392                 if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
2393                     mad_send_wr->status == IB_WC_SUCCESS) {
2394                         wait_for_response(mad_send_wr);
2395                 }
2396                 goto done;
2397         }
2398
2399         /* Remove send from MAD agent and notify client of completion */
2400         list_del(&mad_send_wr->agent_list);
2401         adjust_timeout(mad_agent_priv);
2402         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2403
2404         if (mad_send_wr->status != IB_WC_SUCCESS )
2405                 mad_send_wc->status = mad_send_wr->status;
2406         if (ret == IB_RMPP_RESULT_INTERNAL)
2407                 ib_rmpp_send_handler(mad_send_wc);
2408         else
2409                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2410                                                    mad_send_wc);
2411
2412         /* Release reference on agent taken when sending */
2413         deref_mad_agent(mad_agent_priv);
2414         return;
2415 done:
2416         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2417 }
2418
2419 static void ib_mad_send_done_handler(struct ib_mad_port_private *port_priv,
2420                                      struct ib_wc *wc)
2421 {
2422         struct ib_mad_send_wr_private   *mad_send_wr, *queued_send_wr;
2423         struct ib_mad_list_head         *mad_list;
2424         struct ib_mad_qp_info           *qp_info;
2425         struct ib_mad_queue             *send_queue;
2426         struct ib_send_wr               *bad_send_wr;
2427         struct ib_mad_send_wc           mad_send_wc;
2428         unsigned long flags;
2429         int ret;
2430
2431         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2432         mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2433                                    mad_list);
2434         send_queue = mad_list->mad_queue;
2435         qp_info = send_queue->qp_info;
2436
2437 retry:
2438         ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2439                             mad_send_wr->header_mapping,
2440                             mad_send_wr->sg_list[0].length, DMA_TO_DEVICE);
2441         ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2442                             mad_send_wr->payload_mapping,
2443                             mad_send_wr->sg_list[1].length, DMA_TO_DEVICE);
2444         queued_send_wr = NULL;
2445         spin_lock_irqsave(&send_queue->lock, flags);
2446         list_del(&mad_list->list);
2447
2448         /* Move queued send to the send queue */
2449         if (send_queue->count-- > send_queue->max_active) {
2450                 mad_list = container_of(qp_info->overflow_list.next,
2451                                         struct ib_mad_list_head, list);
2452                 queued_send_wr = container_of(mad_list,
2453                                         struct ib_mad_send_wr_private,
2454                                         mad_list);
2455                 list_move_tail(&mad_list->list, &send_queue->list);
2456         }
2457         spin_unlock_irqrestore(&send_queue->lock, flags);
2458
2459         mad_send_wc.send_buf = &mad_send_wr->send_buf;
2460         mad_send_wc.status = wc->status;
2461         mad_send_wc.vendor_err = wc->vendor_err;
2462         if (atomic_read(&qp_info->snoop_count))
2463                 snoop_send(qp_info, &mad_send_wr->send_buf, &mad_send_wc,
2464                            IB_MAD_SNOOP_SEND_COMPLETIONS);
2465         ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2466
2467         if (queued_send_wr) {
2468                 ret = ib_post_send(qp_info->qp, &queued_send_wr->send_wr.wr,
2469                                    &bad_send_wr);
2470                 if (ret) {
2471                         dev_err(&port_priv->device->dev,
2472                                 "ib_post_send failed: %d\n", ret);
2473                         mad_send_wr = queued_send_wr;
2474                         wc->status = IB_WC_LOC_QP_OP_ERR;
2475                         goto retry;
2476                 }
2477         }
2478 }
2479
2480 static void mark_sends_for_retry(struct ib_mad_qp_info *qp_info)
2481 {
2482         struct ib_mad_send_wr_private *mad_send_wr;
2483         struct ib_mad_list_head *mad_list;
2484         unsigned long flags;
2485
2486         spin_lock_irqsave(&qp_info->send_queue.lock, flags);
2487         list_for_each_entry(mad_list, &qp_info->send_queue.list, list) {
2488                 mad_send_wr = container_of(mad_list,
2489                                            struct ib_mad_send_wr_private,
2490                                            mad_list);
2491                 mad_send_wr->retry = 1;
2492         }
2493         spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
2494 }
2495
2496 static void mad_error_handler(struct ib_mad_port_private *port_priv,
2497                               struct ib_wc *wc)
2498 {
2499         struct ib_mad_list_head *mad_list;
2500         struct ib_mad_qp_info *qp_info;
2501         struct ib_mad_send_wr_private *mad_send_wr;
2502         int ret;
2503
2504         /* Determine if failure was a send or receive */
2505         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2506         qp_info = mad_list->mad_queue->qp_info;
2507         if (mad_list->mad_queue == &qp_info->recv_queue)
2508                 /*
2509                  * Receive errors indicate that the QP has entered the error
2510                  * state - error handling/shutdown code will cleanup
2511                  */
2512                 return;
2513
2514         /*
2515          * Send errors will transition the QP to SQE - move
2516          * QP to RTS and repost flushed work requests
2517          */
2518         mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2519                                    mad_list);
2520         if (wc->status == IB_WC_WR_FLUSH_ERR) {
2521                 if (mad_send_wr->retry) {
2522                         /* Repost send */
2523                         struct ib_send_wr *bad_send_wr;
2524
2525                         mad_send_wr->retry = 0;
2526                         ret = ib_post_send(qp_info->qp, &mad_send_wr->send_wr.wr,
2527                                         &bad_send_wr);
2528                         if (ret)
2529                                 ib_mad_send_done_handler(port_priv, wc);
2530                 } else
2531                         ib_mad_send_done_handler(port_priv, wc);
2532         } else {
2533                 struct ib_qp_attr *attr;
2534
2535                 /* Transition QP to RTS and fail offending send */
2536                 attr = kmalloc(sizeof *attr, GFP_KERNEL);
2537                 if (attr) {
2538                         attr->qp_state = IB_QPS_RTS;
2539                         attr->cur_qp_state = IB_QPS_SQE;
2540                         ret = ib_modify_qp(qp_info->qp, attr,
2541                                            IB_QP_STATE | IB_QP_CUR_STATE);
2542                         kfree(attr);
2543                         if (ret)
2544                                 dev_err(&port_priv->device->dev,
2545                                         "mad_error_handler - ib_modify_qp to RTS : %d\n",
2546                                         ret);
2547                         else
2548                                 mark_sends_for_retry(qp_info);
2549                 }
2550                 ib_mad_send_done_handler(port_priv, wc);
2551         }
2552 }
2553
2554 /*
2555  * IB MAD completion callback
2556  */
2557 static void ib_mad_completion_handler(struct work_struct *work)
2558 {
2559         struct ib_mad_port_private *port_priv;
2560         struct ib_wc wc;
2561
2562         port_priv = container_of(work, struct ib_mad_port_private, work);
2563         ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
2564
2565         while (ib_poll_cq(port_priv->cq, 1, &wc) == 1) {
2566                 if (wc.status == IB_WC_SUCCESS) {
2567                         switch (wc.opcode) {
2568                         case IB_WC_SEND:
2569                                 ib_mad_send_done_handler(port_priv, &wc);
2570                                 break;
2571                         case IB_WC_RECV:
2572                                 ib_mad_recv_done_handler(port_priv, &wc);
2573                                 break;
2574                         default:
2575                                 BUG_ON(1);
2576                                 break;
2577                         }
2578                 } else
2579                         mad_error_handler(port_priv, &wc);
2580         }
2581 }
2582
2583 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
2584 {
2585         unsigned long flags;
2586         struct ib_mad_send_wr_private *mad_send_wr, *temp_mad_send_wr;
2587         struct ib_mad_send_wc mad_send_wc;
2588         struct list_head cancel_list;
2589
2590         INIT_LIST_HEAD(&cancel_list);
2591
2592         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2593         list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2594                                  &mad_agent_priv->send_list, agent_list) {
2595                 if (mad_send_wr->status == IB_WC_SUCCESS) {
2596                         mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2597                         mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2598                 }
2599         }
2600
2601         /* Empty wait list to prevent receives from finding a request */
2602         list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
2603         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2604
2605         /* Report all cancelled requests */
2606         mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
2607         mad_send_wc.vendor_err = 0;
2608
2609         list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2610                                  &cancel_list, agent_list) {
2611                 mad_send_wc.send_buf = &mad_send_wr->send_buf;
2612                 list_del(&mad_send_wr->agent_list);
2613                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2614                                                    &mad_send_wc);
2615                 atomic_dec(&mad_agent_priv->refcount);
2616         }
2617 }
2618
2619 static struct ib_mad_send_wr_private*
2620 find_send_wr(struct ib_mad_agent_private *mad_agent_priv,
2621              struct ib_mad_send_buf *send_buf)
2622 {
2623         struct ib_mad_send_wr_private *mad_send_wr;
2624
2625         list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
2626                             agent_list) {
2627                 if (&mad_send_wr->send_buf == send_buf)
2628                         return mad_send_wr;
2629         }
2630
2631         list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
2632                             agent_list) {
2633                 if (is_rmpp_data_mad(mad_agent_priv,
2634                                      mad_send_wr->send_buf.mad) &&
2635                     &mad_send_wr->send_buf == send_buf)
2636                         return mad_send_wr;
2637         }
2638         return NULL;
2639 }
2640
2641 int ib_modify_mad(struct ib_mad_agent *mad_agent,
2642                   struct ib_mad_send_buf *send_buf, u32 timeout_ms)
2643 {
2644         struct ib_mad_agent_private *mad_agent_priv;
2645         struct ib_mad_send_wr_private *mad_send_wr;
2646         unsigned long flags;
2647         int active;
2648
2649         mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
2650                                       agent);
2651         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2652         mad_send_wr = find_send_wr(mad_agent_priv, send_buf);
2653         if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
2654                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2655                 return -EINVAL;
2656         }
2657
2658         active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
2659         if (!timeout_ms) {
2660                 mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2661                 mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2662         }
2663
2664         mad_send_wr->send_buf.timeout_ms = timeout_ms;
2665         if (active)
2666                 mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2667         else
2668                 ib_reset_mad_timeout(mad_send_wr, timeout_ms);
2669
2670         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2671         return 0;
2672 }
2673 EXPORT_SYMBOL(ib_modify_mad);
2674
2675 void ib_cancel_mad(struct ib_mad_agent *mad_agent,
2676                    struct ib_mad_send_buf *send_buf)
2677 {
2678         ib_modify_mad(mad_agent, send_buf, 0);
2679 }
2680 EXPORT_SYMBOL(ib_cancel_mad);
2681
2682 static void local_completions(struct work_struct *work)
2683 {
2684         struct ib_mad_agent_private *mad_agent_priv;
2685         struct ib_mad_local_private *local;
2686         struct ib_mad_agent_private *recv_mad_agent;
2687         unsigned long flags;
2688         int free_mad;
2689         struct ib_wc wc;
2690         struct ib_mad_send_wc mad_send_wc;
2691         bool opa;
2692
2693         mad_agent_priv =
2694                 container_of(work, struct ib_mad_agent_private, local_work);
2695
2696         opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
2697                                mad_agent_priv->qp_info->port_priv->port_num);
2698
2699         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2700         while (!list_empty(&mad_agent_priv->local_list)) {
2701                 local = list_entry(mad_agent_priv->local_list.next,
2702                                    struct ib_mad_local_private,
2703                                    completion_list);
2704                 list_del(&local->completion_list);
2705                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2706                 free_mad = 0;
2707                 if (local->mad_priv) {
2708                         u8 base_version;
2709                         recv_mad_agent = local->recv_mad_agent;
2710                         if (!recv_mad_agent) {
2711                                 dev_err(&mad_agent_priv->agent.device->dev,
2712                                         "No receive MAD agent for local completion\n");
2713                                 free_mad = 1;
2714                                 goto local_send_completion;
2715                         }
2716
2717                         /*
2718                          * Defined behavior is to complete response
2719                          * before request
2720                          */
2721                         build_smp_wc(recv_mad_agent->agent.qp,
2722                                      (unsigned long) local->mad_send_wr,
2723                                      be16_to_cpu(IB_LID_PERMISSIVE),
2724                                      local->mad_send_wr->send_wr.pkey_index,
2725                                      recv_mad_agent->agent.port_num, &wc);
2726
2727                         local->mad_priv->header.recv_wc.wc = &wc;
2728
2729                         base_version = ((struct ib_mad_hdr *)(local->mad_priv->mad))->base_version;
2730                         if (opa && base_version == OPA_MGMT_BASE_VERSION) {
2731                                 local->mad_priv->header.recv_wc.mad_len = local->return_wc_byte_len;
2732                                 local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct opa_mad);
2733                         } else {
2734                                 local->mad_priv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2735                                 local->mad_priv->header.recv_wc.mad_seg_size = sizeof(struct ib_mad);
2736                         }
2737
2738                         INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
2739                         list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
2740                                  &local->mad_priv->header.recv_wc.rmpp_list);
2741                         local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
2742                         local->mad_priv->header.recv_wc.recv_buf.mad =
2743                                                 (struct ib_mad *)local->mad_priv->mad;
2744                         if (atomic_read(&recv_mad_agent->qp_info->snoop_count))
2745                                 snoop_recv(recv_mad_agent->qp_info,
2746                                           &local->mad_priv->header.recv_wc,
2747                                            IB_MAD_SNOOP_RECVS);
2748                         recv_mad_agent->agent.recv_handler(
2749                                                 &recv_mad_agent->agent,
2750                                                 &local->mad_priv->header.recv_wc);
2751                         spin_lock_irqsave(&recv_mad_agent->lock, flags);
2752                         atomic_dec(&recv_mad_agent->refcount);
2753                         spin_unlock_irqrestore(&recv_mad_agent->lock, flags);
2754                 }
2755
2756 local_send_completion:
2757                 /* Complete send */
2758                 mad_send_wc.status = IB_WC_SUCCESS;
2759                 mad_send_wc.vendor_err = 0;
2760                 mad_send_wc.send_buf = &local->mad_send_wr->send_buf;
2761                 if (atomic_read(&mad_agent_priv->qp_info->snoop_count))
2762                         snoop_send(mad_agent_priv->qp_info,
2763                                    &local->mad_send_wr->send_buf,
2764                                    &mad_send_wc, IB_MAD_SNOOP_SEND_COMPLETIONS);
2765                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2766                                                    &mad_send_wc);
2767
2768                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
2769                 atomic_dec(&mad_agent_priv->refcount);
2770                 if (free_mad)
2771                         kfree(local->mad_priv);
2772                 kfree(local);
2773         }
2774         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2775 }
2776
2777 static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
2778 {
2779         int ret;
2780
2781         if (!mad_send_wr->retries_left)
2782                 return -ETIMEDOUT;
2783
2784         mad_send_wr->retries_left--;
2785         mad_send_wr->send_buf.retries++;
2786
2787         mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
2788
2789         if (ib_mad_kernel_rmpp_agent(&mad_send_wr->mad_agent_priv->agent)) {
2790                 ret = ib_retry_rmpp(mad_send_wr);
2791                 switch (ret) {
2792                 case IB_RMPP_RESULT_UNHANDLED:
2793                         ret = ib_send_mad(mad_send_wr);
2794                         break;
2795                 case IB_RMPP_RESULT_CONSUMED:
2796                         ret = 0;
2797                         break;
2798                 default:
2799                         ret = -ECOMM;
2800                         break;
2801                 }
2802         } else
2803                 ret = ib_send_mad(mad_send_wr);
2804
2805         if (!ret) {
2806                 mad_send_wr->refcount++;
2807                 list_add_tail(&mad_send_wr->agent_list,
2808                               &mad_send_wr->mad_agent_priv->send_list);
2809         }
2810         return ret;
2811 }
2812
2813 static void timeout_sends(struct work_struct *work)
2814 {
2815         struct ib_mad_agent_private *mad_agent_priv;
2816         struct ib_mad_send_wr_private *mad_send_wr;
2817         struct ib_mad_send_wc mad_send_wc;
2818         unsigned long flags, delay;
2819
2820         mad_agent_priv = container_of(work, struct ib_mad_agent_private,
2821                                       timed_work.work);
2822         mad_send_wc.vendor_err = 0;
2823
2824         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2825         while (!list_empty(&mad_agent_priv->wait_list)) {
2826                 mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2827                                          struct ib_mad_send_wr_private,
2828                                          agent_list);
2829
2830                 if (time_after(mad_send_wr->timeout, jiffies)) {
2831                         delay = mad_send_wr->timeout - jiffies;
2832                         if ((long)delay <= 0)
2833                                 delay = 1;
2834                         queue_delayed_work(mad_agent_priv->qp_info->
2835                                            port_priv->wq,
2836                                            &mad_agent_priv->timed_work, delay);
2837                         break;
2838                 }
2839
2840                 list_del(&mad_send_wr->agent_list);
2841                 if (mad_send_wr->status == IB_WC_SUCCESS &&
2842                     !retry_send(mad_send_wr))
2843                         continue;
2844
2845                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2846
2847                 if (mad_send_wr->status == IB_WC_SUCCESS)
2848                         mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
2849                 else
2850                         mad_send_wc.status = mad_send_wr->status;
2851                 mad_send_wc.send_buf = &mad_send_wr->send_buf;
2852                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2853                                                    &mad_send_wc);
2854
2855                 atomic_dec(&mad_agent_priv->refcount);
2856                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
2857         }
2858         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2859 }
2860
2861 static void ib_mad_thread_completion_handler(struct ib_cq *cq, void *arg)
2862 {
2863         struct ib_mad_port_private *port_priv = cq->cq_context;
2864         unsigned long flags;
2865
2866         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2867         if (!list_empty(&port_priv->port_list))
2868                 queue_work(port_priv->wq, &port_priv->work);
2869         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2870 }
2871
2872 /*
2873  * Allocate receive MADs and post receive WRs for them
2874  */
2875 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
2876                                     struct ib_mad_private *mad)
2877 {
2878         unsigned long flags;
2879         int post, ret;
2880         struct ib_mad_private *mad_priv;
2881         struct ib_sge sg_list;
2882         struct ib_recv_wr recv_wr, *bad_recv_wr;
2883         struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
2884
2885         /* Initialize common scatter list fields */
2886         sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
2887
2888         /* Initialize common receive WR fields */
2889         recv_wr.next = NULL;
2890         recv_wr.sg_list = &sg_list;
2891         recv_wr.num_sge = 1;
2892
2893         do {
2894                 /* Allocate and map receive buffer */
2895                 if (mad) {
2896                         mad_priv = mad;
2897                         mad = NULL;
2898                 } else {
2899                         mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),
2900                                                      GFP_ATOMIC);
2901                         if (!mad_priv) {
2902                                 dev_err(&qp_info->port_priv->device->dev,
2903                                         "No memory for receive buffer\n");
2904                                 ret = -ENOMEM;
2905                                 break;
2906                         }
2907                 }
2908                 sg_list.length = mad_priv_dma_size(mad_priv);
2909                 sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
2910                                                  &mad_priv->grh,
2911                                                  mad_priv_dma_size(mad_priv),
2912                                                  DMA_FROM_DEVICE);
2913                 if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
2914                                                   sg_list.addr))) {
2915                         kfree(mad_priv);
2916                         ret = -ENOMEM;
2917                         break;
2918                 }
2919                 mad_priv->header.mapping = sg_list.addr;
2920                 recv_wr.wr_id = (unsigned long)&mad_priv->header.mad_list;
2921                 mad_priv->header.mad_list.mad_queue = recv_queue;
2922
2923                 /* Post receive WR */
2924                 spin_lock_irqsave(&recv_queue->lock, flags);
2925                 post = (++recv_queue->count < recv_queue->max_active);
2926                 list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
2927                 spin_unlock_irqrestore(&recv_queue->lock, flags);
2928                 ret = ib_post_recv(qp_info->qp, &recv_wr, &bad_recv_wr);
2929                 if (ret) {
2930                         spin_lock_irqsave(&recv_queue->lock, flags);
2931                         list_del(&mad_priv->header.mad_list.list);
2932                         recv_queue->count--;
2933                         spin_unlock_irqrestore(&recv_queue->lock, flags);
2934                         ib_dma_unmap_single(qp_info->port_priv->device,
2935                                             mad_priv->header.mapping,
2936                                             mad_priv_dma_size(mad_priv),
2937                                             DMA_FROM_DEVICE);
2938                         kfree(mad_priv);
2939                         dev_err(&qp_info->port_priv->device->dev,
2940                                 "ib_post_recv failed: %d\n", ret);
2941                         break;
2942                 }
2943         } while (post);
2944
2945         return ret;
2946 }
2947
2948 /*
2949  * Return all the posted receive MADs
2950  */
2951 static void cleanup_recv_queue(struct ib_mad_qp_info *qp_info)
2952 {
2953         struct ib_mad_private_header *mad_priv_hdr;
2954         struct ib_mad_private *recv;
2955         struct ib_mad_list_head *mad_list;
2956
2957         if (!qp_info->qp)
2958                 return;
2959
2960         while (!list_empty(&qp_info->recv_queue.list)) {
2961
2962                 mad_list = list_entry(qp_info->recv_queue.list.next,
2963                                       struct ib_mad_list_head, list);
2964                 mad_priv_hdr = container_of(mad_list,
2965                                             struct ib_mad_private_header,
2966                                             mad_list);
2967                 recv = container_of(mad_priv_hdr, struct ib_mad_private,
2968                                     header);
2969
2970                 /* Remove from posted receive MAD list */
2971                 list_del(&mad_list->list);
2972
2973                 ib_dma_unmap_single(qp_info->port_priv->device,
2974                                     recv->header.mapping,
2975                                     mad_priv_dma_size(recv),
2976                                     DMA_FROM_DEVICE);
2977                 kfree(recv);
2978         }
2979
2980         qp_info->recv_queue.count = 0;
2981 }
2982
2983 /*
2984  * Start the port
2985  */
2986 static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
2987 {
2988         int ret, i;
2989         struct ib_qp_attr *attr;
2990         struct ib_qp *qp;
2991         u16 pkey_index;
2992
2993         attr = kmalloc(sizeof *attr, GFP_KERNEL);
2994         if (!attr) {
2995                 dev_err(&port_priv->device->dev,
2996                         "Couldn't kmalloc ib_qp_attr\n");
2997                 return -ENOMEM;
2998         }
2999
3000         ret = ib_find_pkey(port_priv->device, port_priv->port_num,
3001                            IB_DEFAULT_PKEY_FULL, &pkey_index);
3002         if (ret)
3003                 pkey_index = 0;
3004
3005         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
3006                 qp = port_priv->qp_info[i].qp;
3007                 if (!qp)
3008                         continue;
3009
3010                 /*
3011                  * PKey index for QP1 is irrelevant but
3012                  * one is needed for the Reset to Init transition
3013                  */
3014                 attr->qp_state = IB_QPS_INIT;
3015                 attr->pkey_index = pkey_index;
3016                 attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
3017                 ret = ib_modify_qp(qp, attr, IB_QP_STATE |
3018                                              IB_QP_PKEY_INDEX | IB_QP_QKEY);
3019                 if (ret) {
3020                         dev_err(&port_priv->device->dev,
3021                                 "Couldn't change QP%d state to INIT: %d\n",
3022                                 i, ret);
3023                         goto out;
3024                 }
3025
3026                 attr->qp_state = IB_QPS_RTR;
3027                 ret = ib_modify_qp(qp, attr, IB_QP_STATE);
3028                 if (ret) {
3029                         dev_err(&port_priv->device->dev,
3030                                 "Couldn't change QP%d state to RTR: %d\n",
3031                                 i, ret);
3032                         goto out;
3033                 }
3034
3035                 attr->qp_state = IB_QPS_RTS;
3036                 attr->sq_psn = IB_MAD_SEND_Q_PSN;
3037                 ret = ib_modify_qp(qp, attr, IB_QP_STATE | IB_QP_SQ_PSN);
3038                 if (ret) {
3039                         dev_err(&port_priv->device->dev,
3040                                 "Couldn't change QP%d state to RTS: %d\n",
3041                                 i, ret);
3042                         goto out;
3043                 }
3044         }
3045
3046         ret = ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
3047         if (ret) {
3048                 dev_err(&port_priv->device->dev,
3049                         "Failed to request completion notification: %d\n",
3050                         ret);
3051                 goto out;
3052         }
3053
3054         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
3055                 if (!port_priv->qp_info[i].qp)
3056                         continue;
3057
3058                 ret = ib_mad_post_receive_mads(&port_priv->qp_info[i], NULL);
3059                 if (ret) {
3060                         dev_err(&port_priv->device->dev,
3061                                 "Couldn't post receive WRs\n");
3062                         goto out;
3063                 }
3064         }
3065 out:
3066         kfree(attr);
3067         return ret;
3068 }
3069
3070 static void qp_event_handler(struct ib_event *event, void *qp_context)
3071 {
3072         struct ib_mad_qp_info   *qp_info = qp_context;
3073
3074         /* It's worse than that! He's dead, Jim! */
3075         dev_err(&qp_info->port_priv->device->dev,
3076                 "Fatal error (%d) on MAD QP (%d)\n",
3077                 event->event, qp_info->qp->qp_num);
3078 }
3079
3080 static void init_mad_queue(struct ib_mad_qp_info *qp_info,
3081                            struct ib_mad_queue *mad_queue)
3082 {
3083         mad_queue->qp_info = qp_info;
3084         mad_queue->count = 0;
3085         spin_lock_init(&mad_queue->lock);
3086         INIT_LIST_HEAD(&mad_queue->list);
3087 }
3088
3089 static void init_mad_qp(struct ib_mad_port_private *port_priv,
3090                         struct ib_mad_qp_info *qp_info)
3091 {
3092         qp_info->port_priv = port_priv;
3093         init_mad_queue(qp_info, &qp_info->send_queue);
3094         init_mad_queue(qp_info, &qp_info->recv_queue);
3095         INIT_LIST_HEAD(&qp_info->overflow_list);
3096         spin_lock_init(&qp_info->snoop_lock);
3097         qp_info->snoop_table = NULL;
3098         qp_info->snoop_table_size = 0;
3099         atomic_set(&qp_info->snoop_count, 0);
3100 }
3101
3102 static int create_mad_qp(struct ib_mad_qp_info *qp_info,
3103                          enum ib_qp_type qp_type)
3104 {
3105         struct ib_qp_init_attr  qp_init_attr;
3106         int ret;
3107
3108         memset(&qp_init_attr, 0, sizeof qp_init_attr);
3109         qp_init_attr.send_cq = qp_info->port_priv->cq;
3110         qp_init_attr.recv_cq = qp_info->port_priv->cq;
3111         qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
3112         qp_init_attr.cap.max_send_wr = mad_sendq_size;
3113         qp_init_attr.cap.max_recv_wr = mad_recvq_size;
3114         qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
3115         qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
3116         qp_init_attr.qp_type = qp_type;
3117         qp_init_attr.port_num = qp_info->port_priv->port_num;
3118         qp_init_attr.qp_context = qp_info;
3119         qp_init_attr.event_handler = qp_event_handler;
3120         qp_info->qp = ib_create_qp(qp_info->port_priv->pd, &qp_init_attr);
3121         if (IS_ERR(qp_info->qp)) {
3122                 dev_err(&qp_info->port_priv->device->dev,
3123                         "Couldn't create ib_mad QP%d\n",
3124                         get_spl_qp_index(qp_type));
3125                 ret = PTR_ERR(qp_info->qp);
3126                 goto error;
3127         }
3128         /* Use minimum queue sizes unless the CQ is resized */
3129         qp_info->send_queue.max_active = mad_sendq_size;
3130         qp_info->recv_queue.max_active = mad_recvq_size;
3131         return 0;
3132
3133 error:
3134         return ret;
3135 }
3136
3137 static void destroy_mad_qp(struct ib_mad_qp_info *qp_info)
3138 {
3139         if (!qp_info->qp)
3140                 return;
3141
3142         ib_destroy_qp(qp_info->qp);
3143         kfree(qp_info->snoop_table);
3144 }
3145
3146 /*
3147  * Open the port
3148  * Create the QP, PD, MR, and CQ if needed
3149  */
3150 static int ib_mad_port_open(struct ib_device *device,
3151                             int port_num)
3152 {
3153         int ret, cq_size;
3154         struct ib_mad_port_private *port_priv;
3155         unsigned long flags;
3156         char name[sizeof "ib_mad123"];
3157         int has_smi;
3158         struct ib_cq_init_attr cq_attr = {};
3159
3160         if (WARN_ON(rdma_max_mad_size(device, port_num) < IB_MGMT_MAD_SIZE))
3161                 return -EFAULT;
3162
3163         if (WARN_ON(rdma_cap_opa_mad(device, port_num) &&
3164                     rdma_max_mad_size(device, port_num) < OPA_MGMT_MAD_SIZE))
3165                 return -EFAULT;
3166
3167         /* Create new device info */
3168         port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
3169         if (!port_priv) {
3170                 dev_err(&device->dev, "No memory for ib_mad_port_private\n");
3171                 return -ENOMEM;
3172         }
3173
3174         port_priv->device = device;
3175         port_priv->port_num = port_num;
3176         spin_lock_init(&port_priv->reg_lock);
3177         INIT_LIST_HEAD(&port_priv->agent_list);
3178         init_mad_qp(port_priv, &port_priv->qp_info[0]);
3179         init_mad_qp(port_priv, &port_priv->qp_info[1]);
3180
3181         cq_size = mad_sendq_size + mad_recvq_size;
3182         has_smi = rdma_cap_ib_smi(device, port_num);
3183         if (has_smi)
3184                 cq_size *= 2;
3185
3186         cq_attr.cqe = cq_size;
3187         port_priv->cq = ib_create_cq(port_priv->device,
3188                                      ib_mad_thread_completion_handler,
3189                                      NULL, port_priv, &cq_attr);
3190         if (IS_ERR(port_priv->cq)) {
3191                 dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
3192                 ret = PTR_ERR(port_priv->cq);
3193                 goto error3;
3194         }
3195
3196         port_priv->pd = ib_alloc_pd(device);
3197         if (IS_ERR(port_priv->pd)) {
3198                 dev_err(&device->dev, "Couldn't create ib_mad PD\n");
3199                 ret = PTR_ERR(port_priv->pd);
3200                 goto error4;
3201         }
3202
3203         if (has_smi) {
3204                 ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
3205                 if (ret)
3206                         goto error6;
3207         }
3208         ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
3209         if (ret)
3210                 goto error7;
3211
3212         snprintf(name, sizeof name, "ib_mad%d", port_num);
3213         port_priv->wq = create_singlethread_workqueue(name);
3214         if (!port_priv->wq) {
3215                 ret = -ENOMEM;
3216                 goto error8;
3217         }
3218         INIT_WORK(&port_priv->work, ib_mad_completion_handler);
3219
3220         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3221         list_add_tail(&port_priv->port_list, &ib_mad_port_list);
3222         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3223
3224         ret = ib_mad_port_start(port_priv);
3225         if (ret) {
3226                 dev_err(&device->dev, "Couldn't start port\n");
3227                 goto error9;
3228         }
3229
3230         return 0;
3231
3232 error9:
3233         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3234         list_del_init(&port_priv->port_list);
3235         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3236
3237         destroy_workqueue(port_priv->wq);
3238 error8:
3239         destroy_mad_qp(&port_priv->qp_info[1]);
3240 error7:
3241         destroy_mad_qp(&port_priv->qp_info[0]);
3242 error6:
3243         ib_dealloc_pd(port_priv->pd);
3244 error4:
3245         ib_destroy_cq(port_priv->cq);
3246         cleanup_recv_queue(&port_priv->qp_info[1]);
3247         cleanup_recv_queue(&port_priv->qp_info[0]);
3248 error3:
3249         kfree(port_priv);
3250
3251         return ret;
3252 }
3253
3254 /*
3255  * Close the port
3256  * If there are no classes using the port, free the port
3257  * resources (CQ, MR, PD, QP) and remove the port's info structure
3258  */
3259 static int ib_mad_port_close(struct ib_device *device, int port_num)
3260 {
3261         struct ib_mad_port_private *port_priv;
3262         unsigned long flags;
3263
3264         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3265         port_priv = __ib_get_mad_port(device, port_num);
3266         if (port_priv == NULL) {
3267                 spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3268                 dev_err(&device->dev, "Port %d not found\n", port_num);
3269                 return -ENODEV;
3270         }
3271         list_del_init(&port_priv->port_list);
3272         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3273
3274         destroy_workqueue(port_priv->wq);
3275         destroy_mad_qp(&port_priv->qp_info[1]);
3276         destroy_mad_qp(&port_priv->qp_info[0]);
3277         ib_dealloc_pd(port_priv->pd);
3278         ib_destroy_cq(port_priv->cq);
3279         cleanup_recv_queue(&port_priv->qp_info[1]);
3280         cleanup_recv_queue(&port_priv->qp_info[0]);
3281         /* XXX: Handle deallocation of MAD registration tables */
3282
3283         kfree(port_priv);
3284
3285         return 0;
3286 }
3287
3288 static void ib_mad_init_device(struct ib_device *device)
3289 {
3290         int start, i;
3291
3292         start = rdma_start_port(device);
3293
3294         for (i = start; i <= rdma_end_port(device); i++) {
3295                 if (!rdma_cap_ib_mad(device, i))
3296                         continue;
3297
3298                 if (ib_mad_port_open(device, i)) {
3299                         dev_err(&device->dev, "Couldn't open port %d\n", i);
3300                         goto error;
3301                 }
3302                 if (ib_agent_port_open(device, i)) {
3303                         dev_err(&device->dev,
3304                                 "Couldn't open port %d for agents\n", i);
3305                         goto error_agent;
3306                 }
3307         }
3308         return;
3309
3310 error_agent:
3311         if (ib_mad_port_close(device, i))
3312                 dev_err(&device->dev, "Couldn't close port %d\n", i);
3313
3314 error:
3315         while (--i >= start) {
3316                 if (!rdma_cap_ib_mad(device, i))
3317                         continue;
3318
3319                 if (ib_agent_port_close(device, i))
3320                         dev_err(&device->dev,
3321                                 "Couldn't close port %d for agents\n", i);
3322                 if (ib_mad_port_close(device, i))
3323                         dev_err(&device->dev, "Couldn't close port %d\n", i);
3324         }
3325 }
3326
3327 static void ib_mad_remove_device(struct ib_device *device, void *client_data)
3328 {
3329         int i;
3330
3331         for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
3332                 if (!rdma_cap_ib_mad(device, i))
3333                         continue;
3334
3335                 if (ib_agent_port_close(device, i))
3336                         dev_err(&device->dev,
3337                                 "Couldn't close port %d for agents\n", i);
3338                 if (ib_mad_port_close(device, i))
3339                         dev_err(&device->dev, "Couldn't close port %d\n", i);
3340         }
3341 }
3342
3343 static struct ib_client mad_client = {
3344         .name   = "mad",
3345         .add = ib_mad_init_device,
3346         .remove = ib_mad_remove_device
3347 };
3348
3349 static int __init ib_mad_init_module(void)
3350 {
3351         mad_recvq_size = min(mad_recvq_size, IB_MAD_QP_MAX_SIZE);
3352         mad_recvq_size = max(mad_recvq_size, IB_MAD_QP_MIN_SIZE);
3353
3354         mad_sendq_size = min(mad_sendq_size, IB_MAD_QP_MAX_SIZE);
3355         mad_sendq_size = max(mad_sendq_size, IB_MAD_QP_MIN_SIZE);
3356
3357         INIT_LIST_HEAD(&ib_mad_port_list);
3358
3359         if (ib_register_client(&mad_client)) {
3360                 pr_err("Couldn't register ib_mad client\n");
3361                 return -EINVAL;
3362         }
3363
3364         return 0;
3365 }
3366
3367 static void __exit ib_mad_cleanup_module(void)
3368 {
3369         ib_unregister_client(&mad_client);
3370 }
3371
3372 module_init(ib_mad_init_module);
3373 module_exit(ib_mad_cleanup_module);