drivers/infiniband/core/mad.c

   1 /*
   2  * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
   3  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
   4  * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
   5  * Copyright (c) 2009 HNR Consulting. All rights reserved.
   6  *
   7  * This software is available to you under a choice of one of two
   8  * licenses.  You may choose to be licensed under the terms of the GNU
   9  * General Public License (GPL) Version 2, available from the file
  10  * COPYING in the main directory of this source tree, or the
  11  * OpenIB.org BSD license below:
  12  *
  13  *     Redistribution and use in source and binary forms, with or
  14  *     without modification, are permitted provided that the following
  15  *     conditions are met:
  16  *
  17  *      - Redistributions of source code must retain the above
  18  *        copyright notice, this list of conditions and the following
  19  *        disclaimer.
  20  *
  21  *      - Redistributions in binary form must reproduce the above
  22  *        copyright notice, this list of conditions and the following
  23  *        disclaimer in the documentation and/or other materials
  24  *        provided with the distribution.
  25  *
  26  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  27  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  28  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  29  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  30  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  31  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  32  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  33  * SOFTWARE.
  34  *
  35  */
  36
  37 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  38
  39 #include <linux/dma-mapping.h>
  40 #include <linux/slab.h>
  41 #include <linux/module.h>
  42 #include <rdma/ib_cache.h>
  43
  44 #include "mad_priv.h"
  45 #include "mad_rmpp.h"
  46 #include "smi.h"
  47 #include "agent.h"
  48
  49 MODULE_LICENSE("Dual BSD/GPL");
  50 MODULE_DESCRIPTION("kernel IB MAD API");
  51 MODULE_AUTHOR("Hal Rosenstock");
  52 MODULE_AUTHOR("Sean Hefty");
  53
  54 static int mad_sendq_size = IB_MAD_QP_SEND_SIZE;
  55 static int mad_recvq_size = IB_MAD_QP_RECV_SIZE;
  56
  57 module_param_named(send_queue_size, mad_sendq_size, int, 0444);
  58 MODULE_PARM_DESC(send_queue_size, "Size of send queue in number of work requests");
  59 module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
  60 MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
  61
  62 static struct kmem_cache *ib_mad_cache;
  63
  64 static struct list_head ib_mad_port_list;
  65 static u32 ib_mad_client_id = 0;
  66
  67 /* Port list lock */
  68 static DEFINE_SPINLOCK(ib_mad_port_list_lock);
  69
  70 /* Forward declarations */
  71 static int method_in_use(struct ib_mad_mgmt_method_table **method,
  72                          struct ib_mad_reg_req *mad_reg_req);
  73 static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
  74 static struct ib_mad_agent_private *find_mad_agent(
  75                                         struct ib_mad_port_private *port_priv,
  76                                         const struct ib_mad_hdr *mad);
  77 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
  78                                     struct ib_mad_private *mad);
  79 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
  80 static void timeout_sends(struct work_struct *work);
  81 static void local_completions(struct work_struct *work);
  82 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
  83                               struct ib_mad_agent_private *agent_priv,
  84                               u8 mgmt_class);
  85 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
  86                            struct ib_mad_agent_private *agent_priv);
  87
  88 /*
  89  * Returns a ib_mad_port_private structure or NULL for a device/port
  90  * Assumes ib_mad_port_list_lock is being held
  91  */
  92 static inline struct ib_mad_port_private *
  93 __ib_get_mad_port(struct ib_device *device, int port_num)
  94 {
  95         struct ib_mad_port_private *entry;
  96
  97         list_for_each_entry(entry, &ib_mad_port_list, port_list) {
  98                 if (entry->device == device && entry->port_num == port_num)
  99                         return entry;
 100         }
 101         return NULL;
 102 }
 103
 104 /*
 105  * Wrapper function to return a ib_mad_port_private structure or NULL
 106  * for a device/port
 107  */
 108 static inline struct ib_mad_port_private *
 109 ib_get_mad_port(struct ib_device *device, int port_num)
 110 {
 111         struct ib_mad_port_private *entry;
 112         unsigned long flags;
 113
 114         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
 115         entry = __ib_get_mad_port(device, port_num);
 116         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
 117
 118         return entry;
 119 }
 120
 121 static inline u8 convert_mgmt_class(u8 mgmt_class)
 122 {
 123         /* Alias IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE to 0 */
 124         return mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE ?
 125                 0 : mgmt_class;
 126 }
 127
 128 static int get_spl_qp_index(enum ib_qp_type qp_type)
 129 {
 130         switch (qp_type)
 131         {
 132         case IB_QPT_SMI:
 133                 return 0;
 134         case IB_QPT_GSI:
 135                 return 1;
 136         default:
 137                 return -1;
 138         }
 139 }
 140
 141 static int vendor_class_index(u8 mgmt_class)
 142 {
 143         return mgmt_class - IB_MGMT_CLASS_VENDOR_RANGE2_START;
 144 }
 145
 146 static int is_vendor_class(u8 mgmt_class)
 147 {
 148         if ((mgmt_class < IB_MGMT_CLASS_VENDOR_RANGE2_START) ||
 149             (mgmt_class > IB_MGMT_CLASS_VENDOR_RANGE2_END))
 150                 return 0;
 151         return 1;
 152 }
 153
 154 static int is_vendor_oui(char *oui)
 155 {
 156         if (oui[0] || oui[1] || oui[2])
 157                 return 1;
 158         return 0;
 159 }
 160
 161 static int is_vendor_method_in_use(
 162                 struct ib_mad_mgmt_vendor_class *vendor_class,
 163                 struct ib_mad_reg_req *mad_reg_req)
 164 {
 165         struct ib_mad_mgmt_method_table *method;
 166         int i;
 167
 168         for (i = 0; i < MAX_MGMT_OUI; i++) {
 169                 if (!memcmp(vendor_class->oui[i], mad_reg_req->oui, 3)) {
 170                         method = vendor_class->method_table[i];
 171                         if (method) {
 172                                 if (method_in_use(&method, mad_reg_req))
 173                                         return 1;
 174                                 else
 175                                         break;
 176                         }
 177                 }
 178         }
 179         return 0;
 180 }
 181
 182 int ib_response_mad(const struct ib_mad_hdr *hdr)
 183 {
 184         return ((hdr->method & IB_MGMT_METHOD_RESP) ||
 185                 (hdr->method == IB_MGMT_METHOD_TRAP_REPRESS) ||
 186                 ((hdr->mgmt_class == IB_MGMT_CLASS_BM) &&
 187                  (hdr->attr_mod & IB_BM_ATTR_MOD_RESP)));
 188 }
 189 EXPORT_SYMBOL(ib_response_mad);
 190
 191 /*
 192  * ib_register_mad_agent - Register to send/receive MADs
 193  */
 194 struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
 195                                            u8 port_num,
 196                                            enum ib_qp_type qp_type,
 197                                            struct ib_mad_reg_req *mad_reg_req,
 198                                            u8 rmpp_version,
 199                                            ib_mad_send_handler send_handler,
 200                                            ib_mad_recv_handler recv_handler,
 201                                            void *context,
 202                                            u32 registration_flags)
 203 {
 204         struct ib_mad_port_private *port_priv;
 205         struct ib_mad_agent *ret = ERR_PTR(-EINVAL);
 206         struct ib_mad_agent_private *mad_agent_priv;
 207         struct ib_mad_reg_req *reg_req = NULL;
 208         struct ib_mad_mgmt_class_table *class;
 209         struct ib_mad_mgmt_vendor_class_table *vendor;
 210         struct ib_mad_mgmt_vendor_class *vendor_class;
 211         struct ib_mad_mgmt_method_table *method;
 212         int ret2, qpn;
 213         unsigned long flags;
 214         u8 mgmt_class, vclass;
 215
 216         /* Validate parameters */
 217         qpn = get_spl_qp_index(qp_type);
 218         if (qpn == -1) {
 219                 dev_notice(&device->dev,
 220                            "ib_register_mad_agent: invalid QP Type %d\n",
 221                            qp_type);
 222                 goto error1;
 223         }
 224
 225         if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
 226                 dev_notice(&device->dev,
 227                            "ib_register_mad_agent: invalid RMPP Version %u\n",
 228                            rmpp_version);
 229                 goto error1;
 230         }
 231
 232         /* Validate MAD registration request if supplied */
 233         if (mad_reg_req) {
 234                 if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
 235                         dev_notice(&device->dev,
 236                                    "ib_register_mad_agent: invalid Class Version %u\n",
 237                                    mad_reg_req->mgmt_class_version);
 238                         goto error1;
 239                 }
 240                 if (!recv_handler) {
 241                         dev_notice(&device->dev,
 242                                    "ib_register_mad_agent: no recv_handler\n");
 243                         goto error1;
 244                 }
 245                 if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
 246                         /*
 247                          * IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE is the only
 248                          * one in this range currently allowed
 249                          */
 250                         if (mad_reg_req->mgmt_class !=
 251                             IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
 252                                 dev_notice(&device->dev,
 253                                            "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
 254                                            mad_reg_req->mgmt_class);
 255                                 goto error1;
 256                         }
 257                 } else if (mad_reg_req->mgmt_class == 0) {
 258                         /*
 259                          * Class 0 is reserved in IBA and is used for
 260                          * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
 261                          */
 262                         dev_notice(&device->dev,
 263                                    "ib_register_mad_agent: Invalid Mgmt Class 0\n");
 264                         goto error1;
 265                 } else if (is_vendor_class(mad_reg_req->mgmt_class)) {
 266                         /*
 267                          * If class is in "new" vendor range,
 268                          * ensure supplied OUI is not zero
 269                          */
 270                         if (!is_vendor_oui(mad_reg_req->oui)) {
 271                                 dev_notice(&device->dev,
 272                                            "ib_register_mad_agent: No OUI specified for class 0x%x\n",
 273                                            mad_reg_req->mgmt_class);
 274                                 goto error1;
 275                         }
 276                 }
 277                 /* Make sure class supplied is consistent with RMPP */
 278                 if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
 279                         if (rmpp_version) {
 280                                 dev_notice(&device->dev,
 281                                            "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
 282                                            mad_reg_req->mgmt_class);
 283                                 goto error1;
 284                         }
 285                 }
 286
 287                 /* Make sure class supplied is consistent with QP type */
 288                 if (qp_type == IB_QPT_SMI) {
 289                         if ((mad_reg_req->mgmt_class !=
 290                                         IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
 291                             (mad_reg_req->mgmt_class !=
 292                                         IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
 293                                 dev_notice(&device->dev,
 294                                            "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
 295                                            mad_reg_req->mgmt_class);
 296                                 goto error1;
 297                         }
 298                 } else {
 299                         if ((mad_reg_req->mgmt_class ==
 300                                         IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
 301                             (mad_reg_req->mgmt_class ==
 302                                         IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
 303                                 dev_notice(&device->dev,
 304                                            "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
 305                                            mad_reg_req->mgmt_class);
 306                                 goto error1;
 307                         }
 308                 }
 309         } else {
 310                 /* No registration request supplied */
 311                 if (!send_handler)
 312                         goto error1;
 313                 if (registration_flags & IB_MAD_USER_RMPP)
 314                         goto error1;
 315         }
 316
 317         /* Validate device and port */
 318         port_priv = ib_get_mad_port(device, port_num);
 319         if (!port_priv) {
 320                 dev_notice(&device->dev, "ib_register_mad_agent: Invalid port\n");
 321                 ret = ERR_PTR(-ENODEV);
 322                 goto error1;
 323         }
 324
 325         /* Verify the QP requested is supported.  For example, Ethernet devices
 326          * will not have QP0 */
 327         if (!port_priv->qp_info[qpn].qp) {
 328                 dev_notice(&device->dev,
 329                            "ib_register_mad_agent: QP %d not supported\n", qpn);
 330                 ret = ERR_PTR(-EPROTONOSUPPORT);
 331                 goto error1;
 332         }
 333
 334         /* Allocate structures */
 335         mad_agent_priv = kzalloc(sizeof *mad_agent_priv, GFP_KERNEL);
 336         if (!mad_agent_priv) {
 337                 ret = ERR_PTR(-ENOMEM);
 338                 goto error1;
 339         }
 340
 341         mad_agent_priv->agent.mr = ib_get_dma_mr(port_priv->qp_info[qpn].qp->pd,
 342                                                  IB_ACCESS_LOCAL_WRITE);
 343         if (IS_ERR(mad_agent_priv->agent.mr)) {
 344                 ret = ERR_PTR(-ENOMEM);
 345                 goto error2;
 346         }
 347
 348         if (mad_reg_req) {
 349                 reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
 350                 if (!reg_req) {
 351                         ret = ERR_PTR(-ENOMEM);
 352                         goto error3;
 353                 }
 354         }
 355
 356         /* Now, fill in the various structures */
 357         mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
 358         mad_agent_priv->reg_req = reg_req;
 359         mad_agent_priv->agent.rmpp_version = rmpp_version;
 360         mad_agent_priv->agent.device = device;
 361         mad_agent_priv->agent.recv_handler = recv_handler;
 362         mad_agent_priv->agent.send_handler = send_handler;
 363         mad_agent_priv->agent.context = context;
 364         mad_agent_priv->agent.qp = port_priv->qp_info[qpn].qp;
 365         mad_agent_priv->agent.port_num = port_num;
 366         mad_agent_priv->agent.flags = registration_flags;
 367         spin_lock_init(&mad_agent_priv->lock);
 368         INIT_LIST_HEAD(&mad_agent_priv->send_list);
 369         INIT_LIST_HEAD(&mad_agent_priv->wait_list);
 370         INIT_LIST_HEAD(&mad_agent_priv->done_list);
 371         INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
 372         INIT_DELAYED_WORK(&mad_agent_priv->timed_work, timeout_sends);
 373         INIT_LIST_HEAD(&mad_agent_priv->local_list);
 374         INIT_WORK(&mad_agent_priv->local_work, local_completions);
 375         atomic_set(&mad_agent_priv->refcount, 1);
 376         init_completion(&mad_agent_priv->comp);
 377
 378         spin_lock_irqsave(&port_priv->reg_lock, flags);
 379         mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
 380
 381         /*
 382          * Make sure MAD registration (if supplied)
 383          * is non overlapping with any existing ones
 384          */
 385         if (mad_reg_req) {
 386                 mgmt_class = convert_mgmt_class(mad_reg_req->mgmt_class);
 387                 if (!is_vendor_class(mgmt_class)) {
 388                         class = port_priv->version[mad_reg_req->
 389                                                    mgmt_class_version].class;
 390                         if (class) {
 391                                 method = class->method_table[mgmt_class];
 392                                 if (method) {
 393                                         if (method_in_use(&method,
 394                                                            mad_reg_req))
 395                                                 goto error4;
 396                                 }
 397                         }
 398                         ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
 399                                                   mgmt_class);
 400                 } else {
 401                         /* "New" vendor class range */
 402                         vendor = port_priv->version[mad_reg_req->
 403                                                     mgmt_class_version].vendor;
 404                         if (vendor) {
 405                                 vclass = vendor_class_index(mgmt_class);
 406                                 vendor_class = vendor->vendor_class[vclass];
 407                                 if (vendor_class) {
 408                                         if (is_vendor_method_in_use(
 409                                                         vendor_class,
 410                                                         mad_reg_req))
 411                                                 goto error4;
 412                                 }
 413                         }
 414                         ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
 415                 }
 416                 if (ret2) {
 417                         ret = ERR_PTR(ret2);
 418                         goto error4;
 419                 }
 420         }
 421
 422         /* Add mad agent into port's agent list */
 423         list_add_tail(&mad_agent_priv->agent_list, &port_priv->agent_list);
 424         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 425
 426         return &mad_agent_priv->agent;
 427
 428 error4:
 429         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 430         kfree(reg_req);
 431 error3:
 432         ib_dereg_mr(mad_agent_priv->agent.mr);
 433 error2:
 434         kfree(mad_agent_priv);
 435 error1:
 436         return ret;
 437 }
 438 EXPORT_SYMBOL(ib_register_mad_agent);
 439
 440 static inline int is_snooping_sends(int mad_snoop_flags)
 441 {
 442         return (mad_snoop_flags &
 443                 (/*IB_MAD_SNOOP_POSTED_SENDS |
 444                  IB_MAD_SNOOP_RMPP_SENDS |*/
 445                  IB_MAD_SNOOP_SEND_COMPLETIONS /*|
 446                  IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS*/));
 447 }
 448
 449 static inline int is_snooping_recvs(int mad_snoop_flags)
 450 {
 451         return (mad_snoop_flags &
 452                 (IB_MAD_SNOOP_RECVS /*|
 453                  IB_MAD_SNOOP_RMPP_RECVS*/));
 454 }
 455
 456 static int register_snoop_agent(struct ib_mad_qp_info *qp_info,
 457                                 struct ib_mad_snoop_private *mad_snoop_priv)
 458 {
 459         struct ib_mad_snoop_private **new_snoop_table;
 460         unsigned long flags;
 461         int i;
 462
 463         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 464         /* Check for empty slot in array. */
 465         for (i = 0; i < qp_info->snoop_table_size; i++)
 466                 if (!qp_info->snoop_table[i])
 467                         break;
 468
 469         if (i == qp_info->snoop_table_size) {
 470                 /* Grow table. */
 471                 new_snoop_table = krealloc(qp_info->snoop_table,
 472                                            sizeof mad_snoop_priv *
 473                                            (qp_info->snoop_table_size + 1),
 474                                            GFP_ATOMIC);
 475                 if (!new_snoop_table) {
 476                         i = -ENOMEM;
 477                         goto out;
 478                 }
 479
 480                 qp_info->snoop_table = new_snoop_table;
 481                 qp_info->snoop_table_size++;
 482         }
 483         qp_info->snoop_table[i] = mad_snoop_priv;
 484         atomic_inc(&qp_info->snoop_count);
 485 out:
 486         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 487         return i;
 488 }
 489
 490 struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
 491                                            u8 port_num,
 492                                            enum ib_qp_type qp_type,
 493                                            int mad_snoop_flags,
 494                                            ib_mad_snoop_handler snoop_handler,
 495                                            ib_mad_recv_handler recv_handler,
 496                                            void *context)
 497 {
 498         struct ib_mad_port_private *port_priv;
 499         struct ib_mad_agent *ret;
 500         struct ib_mad_snoop_private *mad_snoop_priv;
 501         int qpn;
 502
 503         /* Validate parameters */
 504         if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) ||
 505             (is_snooping_recvs(mad_snoop_flags) && !recv_handler)) {
 506                 ret = ERR_PTR(-EINVAL);
 507                 goto error1;
 508         }
 509         qpn = get_spl_qp_index(qp_type);
 510         if (qpn == -1) {
 511                 ret = ERR_PTR(-EINVAL);
 512                 goto error1;
 513         }
 514         port_priv = ib_get_mad_port(device, port_num);
 515         if (!port_priv) {
 516                 ret = ERR_PTR(-ENODEV);
 517                 goto error1;
 518         }
 519         /* Allocate structures */
 520         mad_snoop_priv = kzalloc(sizeof *mad_snoop_priv, GFP_KERNEL);
 521         if (!mad_snoop_priv) {
 522                 ret = ERR_PTR(-ENOMEM);
 523                 goto error1;
 524         }
 525
 526         /* Now, fill in the various structures */
 527         mad_snoop_priv->qp_info = &port_priv->qp_info[qpn];
 528         mad_snoop_priv->agent.device = device;
 529         mad_snoop_priv->agent.recv_handler = recv_handler;
 530         mad_snoop_priv->agent.snoop_handler = snoop_handler;
 531         mad_snoop_priv->agent.context = context;
 532         mad_snoop_priv->agent.qp = port_priv->qp_info[qpn].qp;
 533         mad_snoop_priv->agent.port_num = port_num;
 534         mad_snoop_priv->mad_snoop_flags = mad_snoop_flags;
 535         init_completion(&mad_snoop_priv->comp);
 536         mad_snoop_priv->snoop_index = register_snoop_agent(
 537                                                 &port_priv->qp_info[qpn],
 538                                                 mad_snoop_priv);
 539         if (mad_snoop_priv->snoop_index < 0) {
 540                 ret = ERR_PTR(mad_snoop_priv->snoop_index);
 541                 goto error2;
 542         }
 543
 544         atomic_set(&mad_snoop_priv->refcount, 1);
 545         return &mad_snoop_priv->agent;
 546
 547 error2:
 548         kfree(mad_snoop_priv);
 549 error1:
 550         return ret;
 551 }
 552 EXPORT_SYMBOL(ib_register_mad_snoop);
 553
 554 static inline void deref_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
 555 {
 556         if (atomic_dec_and_test(&mad_agent_priv->refcount))
 557                 complete(&mad_agent_priv->comp);
 558 }
 559
 560 static inline void deref_snoop_agent(struct ib_mad_snoop_private *mad_snoop_priv)
 561 {
 562         if (atomic_dec_and_test(&mad_snoop_priv->refcount))
 563                 complete(&mad_snoop_priv->comp);
 564 }
 565
 566 static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
 567 {
 568         struct ib_mad_port_private *port_priv;
 569         unsigned long flags;
 570
 571         /* Note that we could still be handling received MADs */
 572
 573         /*
 574          * Canceling all sends results in dropping received response
 575          * MADs, preventing us from queuing additional work
 576          */
 577         cancel_mads(mad_agent_priv);
 578         port_priv = mad_agent_priv->qp_info->port_priv;
 579         cancel_delayed_work(&mad_agent_priv->timed_work);
 580
 581         spin_lock_irqsave(&port_priv->reg_lock, flags);
 582         remove_mad_reg_req(mad_agent_priv);
 583         list_del(&mad_agent_priv->agent_list);
 584         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 585
 586         flush_workqueue(port_priv->wq);
 587         ib_cancel_rmpp_recvs(mad_agent_priv);
 588
 589         deref_mad_agent(mad_agent_priv);
 590         wait_for_completion(&mad_agent_priv->comp);
 591
 592         kfree(mad_agent_priv->reg_req);
 593         ib_dereg_mr(mad_agent_priv->agent.mr);
 594         kfree(mad_agent_priv);
 595 }
 596
 597 static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv)
 598 {
 599         struct ib_mad_qp_info *qp_info;
 600         unsigned long flags;
 601
 602         qp_info = mad_snoop_priv->qp_info;
 603         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 604         qp_info->snoop_table[mad_snoop_priv->snoop_index] = NULL;
 605         atomic_dec(&qp_info->snoop_count);
 606         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 607
 608         deref_snoop_agent(mad_snoop_priv);
 609         wait_for_completion(&mad_snoop_priv->comp);
 610
 611         kfree(mad_snoop_priv);
 612 }
 613
 614 /*
 615  * ib_unregister_mad_agent - Unregisters a client from using MAD services
 616  */
 617 int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
 618 {
 619         struct ib_mad_agent_private *mad_agent_priv;
 620         struct ib_mad_snoop_private *mad_snoop_priv;
 621
 622         /* If the TID is zero, the agent can only snoop. */
 623         if (mad_agent->hi_tid) {
 624                 mad_agent_priv = container_of(mad_agent,
 625                                               struct ib_mad_agent_private,
 626                                               agent);
 627                 unregister_mad_agent(mad_agent_priv);
 628         } else {
 629                 mad_snoop_priv = container_of(mad_agent,
 630                                               struct ib_mad_snoop_private,
 631                                               agent);
 632                 unregister_mad_snoop(mad_snoop_priv);
 633         }
 634         return 0;
 635 }
 636 EXPORT_SYMBOL(ib_unregister_mad_agent);
 637
 638 static void dequeue_mad(struct ib_mad_list_head *mad_list)
 639 {
 640         struct ib_mad_queue *mad_queue;
 641         unsigned long flags;
 642
 643         BUG_ON(!mad_list->mad_queue);
 644         mad_queue = mad_list->mad_queue;
 645         spin_lock_irqsave(&mad_queue->lock, flags);
 646         list_del(&mad_list->list);
 647         mad_queue->count--;
 648         spin_unlock_irqrestore(&mad_queue->lock, flags);
 649 }
 650
 651 static void snoop_send(struct ib_mad_qp_info *qp_info,
 652                        struct ib_mad_send_buf *send_buf,
 653                        struct ib_mad_send_wc *mad_send_wc,
 654                        int mad_snoop_flags)
 655 {
 656         struct ib_mad_snoop_private *mad_snoop_priv;
 657         unsigned long flags;
 658         int i;
 659
 660         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 661         for (i = 0; i < qp_info->snoop_table_size; i++) {
 662                 mad_snoop_priv = qp_info->snoop_table[i];
 663                 if (!mad_snoop_priv ||
 664                     !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
 665                         continue;
 666
 667                 atomic_inc(&mad_snoop_priv->refcount);
 668                 spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 669                 mad_snoop_priv->agent.snoop_handler(&mad_snoop_priv->agent,
 670                                                     send_buf, mad_send_wc);
 671                 deref_snoop_agent(mad_snoop_priv);
 672                 spin_lock_irqsave(&qp_info->snoop_lock, flags);
 673         }
 674         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 675 }
 676
 677 static void snoop_recv(struct ib_mad_qp_info *qp_info,
 678                        struct ib_mad_recv_wc *mad_recv_wc,
 679                        int mad_snoop_flags)
 680 {
 681         struct ib_mad_snoop_private *mad_snoop_priv;
 682         unsigned long flags;
 683         int i;
 684
 685         spin_lock_irqsave(&qp_info->snoop_lock, flags);
 686         for (i = 0; i < qp_info->snoop_table_size; i++) {
 687                 mad_snoop_priv = qp_info->snoop_table[i];
 688                 if (!mad_snoop_priv ||
 689                     !(mad_snoop_priv->mad_snoop_flags & mad_snoop_flags))
 690                         continue;
 691
 692                 atomic_inc(&mad_snoop_priv->refcount);
 693                 spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 694                 mad_snoop_priv->agent.recv_handler(&mad_snoop_priv->agent,
 695                                                    mad_recv_wc);
 696                 deref_snoop_agent(mad_snoop_priv);
 697                 spin_lock_irqsave(&qp_info->snoop_lock, flags);
 698         }
 699         spin_unlock_irqrestore(&qp_info->snoop_lock, flags);
 700 }
 701
 702 static void build_smp_wc(struct ib_qp *qp,
 703                          u64 wr_id, u16 slid, u16 pkey_index, u8 port_num,
 704                          struct ib_wc *wc)
 705 {
 706         memset(wc, 0, sizeof *wc);
 707         wc->wr_id = wr_id;
 708         wc->status = IB_WC_SUCCESS;
 709         wc->opcode = IB_WC_RECV;
 710         wc->pkey_index = pkey_index;
 711         wc->byte_len = sizeof(struct ib_mad) + sizeof(struct ib_grh);
 712         wc->src_qp = IB_QP0;
 713         wc->qp = qp;
 714         wc->slid = slid;
 715         wc->sl = 0;
 716         wc->dlid_path_bits = 0;
 717         wc->port_num = port_num;
 718 }
 719
 720 /*
 721  * Return 0 if SMP is to be sent
 722  * Return 1 if SMP was consumed locally (whether or not solicited)
 723  * Return < 0 if error
 724  */
 725 static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
 726                                   struct ib_mad_send_wr_private *mad_send_wr)
 727 {
 728         int ret = 0;
 729         struct ib_smp *smp = mad_send_wr->send_buf.mad;
 730         unsigned long flags;
 731         struct ib_mad_local_private *local;
 732         struct ib_mad_private *mad_priv;
 733         struct ib_mad_port_private *port_priv;
 734         struct ib_mad_agent_private *recv_mad_agent = NULL;
 735         struct ib_device *device = mad_agent_priv->agent.device;
 736         u8 port_num;
 737         struct ib_wc mad_wc;
 738         struct ib_send_wr *send_wr = &mad_send_wr->send_wr;
 739
 740         if (device->node_type == RDMA_NODE_IB_SWITCH &&
 741             smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
 742                 port_num = send_wr->wr.ud.port_num;
 743         else
 744                 port_num = mad_agent_priv->agent.port_num;
 745
 746         /*
 747          * Directed route handling starts if the initial LID routed part of
 748          * a request or the ending LID routed part of a response is empty.
 749          * If we are at the start of the LID routed part, don't update the
 750          * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
 751          */
 752         if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
 753              IB_LID_PERMISSIVE &&
 754              smi_handle_dr_smp_send(smp, device->node_type, port_num) ==
 755              IB_SMI_DISCARD) {
 756                 ret = -EINVAL;
 757                 dev_err(&device->dev, "Invalid directed route\n");
 758                 goto out;
 759         }
 760
 761         /* Check to post send on QP or process locally */
 762         if (smi_check_local_smp(smp, device) == IB_SMI_DISCARD &&
 763             smi_check_local_returning_smp(smp, device) == IB_SMI_DISCARD)
 764                 goto out;
 765
 766         local = kmalloc(sizeof *local, GFP_ATOMIC);
 767         if (!local) {
 768                 ret = -ENOMEM;
 769                 dev_err(&device->dev, "No memory for ib_mad_local_private\n");
 770                 goto out;
 771         }
 772         local->mad_priv = NULL;
 773         local->recv_mad_agent = NULL;
 774         mad_priv = kmem_cache_alloc(ib_mad_cache, GFP_ATOMIC);
 775         if (!mad_priv) {
 776                 ret = -ENOMEM;
 777                 dev_err(&device->dev, "No memory for local response MAD\n");
 778                 kfree(local);
 779                 goto out;
 780         }
 781
 782         build_smp_wc(mad_agent_priv->agent.qp,
 783                      send_wr->wr_id, be16_to_cpu(smp->dr_slid),
 784                      send_wr->wr.ud.pkey_index,
 785                      send_wr->wr.ud.port_num, &mad_wc);
 786
 787         /* No GRH for DR SMP */
 788         ret = device->process_mad(device, 0, port_num, &mad_wc, NULL,
 789                                   (struct ib_mad *)smp,
 790                                   (struct ib_mad *)&mad_priv->mad);
 791         switch (ret)
 792         {
 793         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
 794                 if (ib_response_mad(&mad_priv->mad.mad.mad_hdr) &&
 795                     mad_agent_priv->agent.recv_handler) {
 796                         local->mad_priv = mad_priv;
 797                         local->recv_mad_agent = mad_agent_priv;
 798                         /*
 799                          * Reference MAD agent until receive
 800                          * side of local completion handled
 801                          */
 802                         atomic_inc(&mad_agent_priv->refcount);
 803                 } else
 804                         kmem_cache_free(ib_mad_cache, mad_priv);
 805                 break;
 806         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
 807                 kmem_cache_free(ib_mad_cache, mad_priv);
 808                 break;
 809         case IB_MAD_RESULT_SUCCESS:
 810                 /* Treat like an incoming receive MAD */
 811                 port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
 812                                             mad_agent_priv->agent.port_num);
 813                 if (port_priv) {
 814                         memcpy(&mad_priv->mad.mad, smp, sizeof(struct ib_mad));
 815                         recv_mad_agent = find_mad_agent(port_priv,
 816                                                         &mad_priv->mad.mad.mad_hdr);
 817                 }
 818                 if (!port_priv || !recv_mad_agent) {
 819                         /*
 820                          * No receiving agent so drop packet and
 821                          * generate send completion.
 822                          */
 823                         kmem_cache_free(ib_mad_cache, mad_priv);
 824                         break;
 825                 }
 826                 local->mad_priv = mad_priv;
 827                 local->recv_mad_agent = recv_mad_agent;
 828                 break;
 829         default:
 830                 kmem_cache_free(ib_mad_cache, mad_priv);
 831                 kfree(local);
 832                 ret = -EINVAL;
 833                 goto out;
 834         }
 835
 836         local->mad_send_wr = mad_send_wr;
 837         /* Reference MAD agent until send side of local completion handled */
 838         atomic_inc(&mad_agent_priv->refcount);
 839         /* Queue local completion to local list */
 840         spin_lock_irqsave(&mad_agent_priv->lock, flags);
 841         list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
 842         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 843         queue_work(mad_agent_priv->qp_info->port_priv->wq,
 844                    &mad_agent_priv->local_work);
 845         ret = 1;
 846 out:
 847         return ret;
 848 }
 849
 850 static int get_pad_size(int hdr_len, int data_len)
 851 {
 852         int seg_size, pad;
 853
 854         seg_size = sizeof(struct ib_mad) - hdr_len;
 855         if (data_len && seg_size) {
 856                 pad = seg_size - data_len % seg_size;
 857                 return pad == seg_size ? 0 : pad;
 858         } else
 859                 return seg_size;
 860 }
 861
 862 static void free_send_rmpp_list(struct ib_mad_send_wr_private *mad_send_wr)
 863 {
 864         struct ib_rmpp_segment *s, *t;
 865
 866         list_for_each_entry_safe(s, t, &mad_send_wr->rmpp_list, list) {
 867                 list_del(&s->list);
 868                 kfree(s);
 869         }
 870 }
 871
 872 static int alloc_send_rmpp_list(struct ib_mad_send_wr_private *send_wr,
 873                                 gfp_t gfp_mask)
 874 {
 875         struct ib_mad_send_buf *send_buf = &send_wr->send_buf;
 876         struct ib_rmpp_mad *rmpp_mad = send_buf->mad;
 877         struct ib_rmpp_segment *seg = NULL;
 878         int left, seg_size, pad;
 879
 880         send_buf->seg_size = sizeof (struct ib_mad) - send_buf->hdr_len;
 881         seg_size = send_buf->seg_size;
 882         pad = send_wr->pad;
 883
 884         /* Allocate data segments. */
 885         for (left = send_buf->data_len + pad; left > 0; left -= seg_size) {
 886                 seg = kmalloc(sizeof (*seg) + seg_size, gfp_mask);
 887                 if (!seg) {
 888                         dev_err(&send_buf->mad_agent->device->dev,
 889                                 "alloc_send_rmpp_segs: RMPP mem alloc failed for len %zd, gfp %#x\n",
 890                                 sizeof (*seg) + seg_size, gfp_mask);
 891                         free_send_rmpp_list(send_wr);
 892                         return -ENOMEM;
 893                 }
 894                 seg->num = ++send_buf->seg_count;
 895                 list_add_tail(&seg->list, &send_wr->rmpp_list);
 896         }
 897
 898         /* Zero any padding */
 899         if (pad)
 900                 memset(seg->data + seg_size - pad, 0, pad);
 901
 902         rmpp_mad->rmpp_hdr.rmpp_version = send_wr->mad_agent_priv->
 903                                           agent.rmpp_version;
 904         rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
 905         ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
 906
 907         send_wr->cur_seg = container_of(send_wr->rmpp_list.next,
 908                                         struct ib_rmpp_segment, list);
 909         send_wr->last_ack_seg = send_wr->cur_seg;
 910         return 0;
 911 }
 912
 913 int ib_mad_kernel_rmpp_agent(const struct ib_mad_agent *agent)
 914 {
 915         return agent->rmpp_version && !(agent->flags & IB_MAD_USER_RMPP);
 916 }
 917 EXPORT_SYMBOL(ib_mad_kernel_rmpp_agent);
 918
 919 struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
 920                                             u32 remote_qpn, u16 pkey_index,
 921                                             int rmpp_active,
 922                                             int hdr_len, int data_len,
 923                                             gfp_t gfp_mask,
 924                                             u8 base_version)
 925 {
 926         struct ib_mad_agent_private *mad_agent_priv;
 927         struct ib_mad_send_wr_private *mad_send_wr;
 928         int pad, message_size, ret, size;
 929         void *buf;
 930
 931         mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
 932                                       agent);
 933         pad = get_pad_size(hdr_len, data_len);
 934         message_size = hdr_len + data_len + pad;
 935
 936         if (ib_mad_kernel_rmpp_agent(mad_agent)) {
 937                 if (!rmpp_active && message_size > sizeof(struct ib_mad))
 938                         return ERR_PTR(-EINVAL);
 939         } else
 940                 if (rmpp_active || message_size > sizeof(struct ib_mad))
 941                         return ERR_PTR(-EINVAL);
 942
 943         size = rmpp_active ? hdr_len : sizeof(struct ib_mad);
 944         buf = kzalloc(sizeof *mad_send_wr + size, gfp_mask);
 945         if (!buf)
 946                 return ERR_PTR(-ENOMEM);
 947
 948         mad_send_wr = buf + size;
 949         INIT_LIST_HEAD(&mad_send_wr->rmpp_list);
 950         mad_send_wr->send_buf.mad = buf;
 951         mad_send_wr->send_buf.hdr_len = hdr_len;
 952         mad_send_wr->send_buf.data_len = data_len;
 953         mad_send_wr->pad = pad;
 954
 955         mad_send_wr->mad_agent_priv = mad_agent_priv;
 956         mad_send_wr->sg_list[0].length = hdr_len;
 957         mad_send_wr->sg_list[0].lkey = mad_agent->mr->lkey;
 958         mad_send_wr->sg_list[1].length = sizeof(struct ib_mad) - hdr_len;
 959         mad_send_wr->sg_list[1].lkey = mad_agent->mr->lkey;
 960
 961         mad_send_wr->send_wr.wr_id = (unsigned long) mad_send_wr;
 962         mad_send_wr->send_wr.sg_list = mad_send_wr->sg_list;
 963         mad_send_wr->send_wr.num_sge = 2;
 964         mad_send_wr->send_wr.opcode = IB_WR_SEND;
 965         mad_send_wr->send_wr.send_flags = IB_SEND_SIGNALED;
 966         mad_send_wr->send_wr.wr.ud.remote_qpn = remote_qpn;
 967         mad_send_wr->send_wr.wr.ud.remote_qkey = IB_QP_SET_QKEY;
 968         mad_send_wr->send_wr.wr.ud.pkey_index = pkey_index;
 969
 970         if (rmpp_active) {
 971                 ret = alloc_send_rmpp_list(mad_send_wr, gfp_mask);
 972                 if (ret) {
 973                         kfree(buf);
 974                         return ERR_PTR(ret);
 975                 }
 976         }
 977
 978         mad_send_wr->send_buf.mad_agent = mad_agent;
 979         atomic_inc(&mad_agent_priv->refcount);
 980         return &mad_send_wr->send_buf;
 981 }
 982 EXPORT_SYMBOL(ib_create_send_mad);
 983
 984 int ib_get_mad_data_offset(u8 mgmt_class)
 985 {
 986         if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
 987                 return IB_MGMT_SA_HDR;
 988         else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
 989                  (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
 990                  (mgmt_class == IB_MGMT_CLASS_BIS))
 991                 return IB_MGMT_DEVICE_HDR;
 992         else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
 993                  (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
 994                 return IB_MGMT_VENDOR_HDR;
 995         else
 996                 return IB_MGMT_MAD_HDR;
 997 }
 998 EXPORT_SYMBOL(ib_get_mad_data_offset);
 999
1000 int ib_is_mad_class_rmpp(u8 mgmt_class)
1001 {
1002         if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
1003             (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
1004             (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
1005             (mgmt_class == IB_MGMT_CLASS_BIS) ||
1006             ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
1007              (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
1008                 return 1;
1009         return 0;
1010 }
1011 EXPORT_SYMBOL(ib_is_mad_class_rmpp);
1012
1013 void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
1014 {
1015         struct ib_mad_send_wr_private *mad_send_wr;
1016         struct list_head *list;
1017
1018         mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1019                                    send_buf);
1020         list = &mad_send_wr->cur_seg->list;
1021
1022         if (mad_send_wr->cur_seg->num < seg_num) {
1023                 list_for_each_entry(mad_send_wr->cur_seg, list, list)
1024                         if (mad_send_wr->cur_seg->num == seg_num)
1025                                 break;
1026         } else if (mad_send_wr->cur_seg->num > seg_num) {
1027                 list_for_each_entry_reverse(mad_send_wr->cur_seg, list, list)
1028                         if (mad_send_wr->cur_seg->num == seg_num)
1029                                 break;
1030         }
1031         return mad_send_wr->cur_seg->data;
1032 }
1033 EXPORT_SYMBOL(ib_get_rmpp_segment);
1034
1035 static inline void *ib_get_payload(struct ib_mad_send_wr_private *mad_send_wr)
1036 {
1037         if (mad_send_wr->send_buf.seg_count)
1038                 return ib_get_rmpp_segment(&mad_send_wr->send_buf,
1039                                            mad_send_wr->seg_num);
1040         else
1041                 return mad_send_wr->send_buf.mad +
1042                        mad_send_wr->send_buf.hdr_len;
1043 }
1044
1045 void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
1046 {
1047         struct ib_mad_agent_private *mad_agent_priv;
1048         struct ib_mad_send_wr_private *mad_send_wr;
1049
1050         mad_agent_priv = container_of(send_buf->mad_agent,
1051                                       struct ib_mad_agent_private, agent);
1052         mad_send_wr = container_of(send_buf, struct ib_mad_send_wr_private,
1053                                    send_buf);
1054
1055         free_send_rmpp_list(mad_send_wr);
1056         kfree(send_buf->mad);
1057         deref_mad_agent(mad_agent_priv);
1058 }
1059 EXPORT_SYMBOL(ib_free_send_mad);
1060
1061 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
1062 {
1063         struct ib_mad_qp_info *qp_info;
1064         struct list_head *list;
1065         struct ib_send_wr *bad_send_wr;
1066         struct ib_mad_agent *mad_agent;
1067         struct ib_sge *sge;
1068         unsigned long flags;
1069         int ret;
1070
1071         /* Set WR ID to find mad_send_wr upon completion */
1072         qp_info = mad_send_wr->mad_agent_priv->qp_info;
1073         mad_send_wr->send_wr.wr_id = (unsigned long)&mad_send_wr->mad_list;
1074         mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
1075
1076         mad_agent = mad_send_wr->send_buf.mad_agent;
1077         sge = mad_send_wr->sg_list;
1078         sge[0].addr = ib_dma_map_single(mad_agent->device,
1079                                         mad_send_wr->send_buf.mad,
1080                                         sge[0].length,
1081                                         DMA_TO_DEVICE);
1082         if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[0].addr)))
1083                 return -ENOMEM;
1084
1085         mad_send_wr->header_mapping = sge[0].addr;
1086
1087         sge[1].addr = ib_dma_map_single(mad_agent->device,
1088                                         ib_get_payload(mad_send_wr),
1089                                         sge[1].length,
1090                                         DMA_TO_DEVICE);
1091         if (unlikely(ib_dma_mapping_error(mad_agent->device, sge[1].addr))) {
1092                 ib_dma_unmap_single(mad_agent->device,
1093                                     mad_send_wr->header_mapping,
1094                                     sge[0].length, DMA_TO_DEVICE);
1095                 return -ENOMEM;
1096         }
1097         mad_send_wr->payload_mapping = sge[1].addr;
1098
1099         spin_lock_irqsave(&qp_info->send_queue.lock, flags);
1100         if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
1101                 ret = ib_post_send(mad_agent->qp, &mad_send_wr->send_wr,
1102                                    &bad_send_wr);
1103                 list = &qp_info->send_queue.list;
1104         } else {
1105                 ret = 0;
1106                 list = &qp_info->overflow_list;
1107         }
1108
1109         if (!ret) {
1110                 qp_info->send_queue.count++;
1111                 list_add_tail(&mad_send_wr->mad_list.list, list);
1112         }
1113         spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
1114         if (ret) {
1115                 ib_dma_unmap_single(mad_agent->device,
1116                                     mad_send_wr->header_mapping,
1117                                     sge[0].length, DMA_TO_DEVICE);
1118                 ib_dma_unmap_single(mad_agent->device,
1119                                     mad_send_wr->payload_mapping,
1120                                     sge[1].length, DMA_TO_DEVICE);
1121         }
1122         return ret;
1123 }
1124
1125 /*
1126  * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
1127  *  with the registered client
1128  */
1129 int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
1130                      struct ib_mad_send_buf **bad_send_buf)
1131 {
1132         struct ib_mad_agent_private *mad_agent_priv;
1133         struct ib_mad_send_buf *next_send_buf;
1134         struct ib_mad_send_wr_private *mad_send_wr;
1135         unsigned long flags;
1136         int ret = -EINVAL;
1137
1138         /* Walk list of send WRs and post each on send list */
1139         for (; send_buf; send_buf = next_send_buf) {
1140
1141                 mad_send_wr = container_of(send_buf,
1142                                            struct ib_mad_send_wr_private,
1143                                            send_buf);
1144                 mad_agent_priv = mad_send_wr->mad_agent_priv;
1145
1146                 if (!send_buf->mad_agent->send_handler ||
1147                     (send_buf->timeout_ms &&
1148                      !send_buf->mad_agent->recv_handler)) {
1149                         ret = -EINVAL;
1150                         goto error;
1151                 }
1152
1153                 if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
1154                         if (mad_agent_priv->agent.rmpp_version) {
1155                                 ret = -EINVAL;
1156                                 goto error;
1157                         }
1158                 }
1159
1160                 /*
1161                  * Save pointer to next work request to post in case the
1162                  * current one completes, and the user modifies the work
1163                  * request associated with the completion
1164                  */
1165                 next_send_buf = send_buf->next;
1166                 mad_send_wr->send_wr.wr.ud.ah = send_buf->ah;
1167
1168                 if (((struct ib_mad_hdr *) send_buf->mad)->mgmt_class ==
1169                     IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
1170                         ret = handle_outgoing_dr_smp(mad_agent_priv,
1171                                                      mad_send_wr);
1172                         if (ret < 0)            /* error */
1173                                 goto error;
1174                         else if (ret == 1)      /* locally consumed */
1175                                 continue;
1176                 }
1177
1178                 mad_send_wr->tid = ((struct ib_mad_hdr *) send_buf->mad)->tid;
1179                 /* Timeout will be updated after send completes */
1180                 mad_send_wr->timeout = msecs_to_jiffies(send_buf->timeout_ms);
1181                 mad_send_wr->max_retries = send_buf->retries;
1182                 mad_send_wr->retries_left = send_buf->retries;
1183                 send_buf->retries = 0;
1184                 /* Reference for work request to QP + response */
1185                 mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
1186                 mad_send_wr->status = IB_WC_SUCCESS;
1187
1188                 /* Reference MAD agent until send completes */
1189                 atomic_inc(&mad_agent_priv->refcount);
1190                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
1191                 list_add_tail(&mad_send_wr->agent_list,
1192                               &mad_agent_priv->send_list);
1193                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1194
1195                 if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1196                         ret = ib_send_rmpp_mad(mad_send_wr);
1197                         if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
1198                                 ret = ib_send_mad(mad_send_wr);
1199                 } else
1200                         ret = ib_send_mad(mad_send_wr);
1201                 if (ret < 0) {
1202                         /* Fail send request */
1203                         spin_lock_irqsave(&mad_agent_priv->lock, flags);
1204                         list_del(&mad_send_wr->agent_list);
1205                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1206                         atomic_dec(&mad_agent_priv->refcount);
1207                         goto error;
1208                 }
1209         }
1210         return 0;
1211 error:
1212         if (bad_send_buf)
1213                 *bad_send_buf = send_buf;
1214         return ret;
1215 }
1216 EXPORT_SYMBOL(ib_post_send_mad);
1217
1218 /*
1219  * ib_free_recv_mad - Returns data buffers used to receive
1220  *  a MAD to the access layer
1221  */
1222 void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
1223 {
1224         struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
1225         struct ib_mad_private_header *mad_priv_hdr;
1226         struct ib_mad_private *priv;
1227         struct list_head free_list;
1228
1229         INIT_LIST_HEAD(&free_list);
1230         list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
1231
1232         list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
1233                                         &free_list, list) {
1234                 mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
1235                                            recv_buf);
1236                 mad_priv_hdr = container_of(mad_recv_wc,
1237                                             struct ib_mad_private_header,
1238                                             recv_wc);
1239                 priv = container_of(mad_priv_hdr, struct ib_mad_private,
1240                                     header);
1241                 kmem_cache_free(ib_mad_cache, priv);
1242         }
1243 }
1244 EXPORT_SYMBOL(ib_free_recv_mad);
1245
1246 struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
1247                                         u8 rmpp_version,
1248                                         ib_mad_send_handler send_handler,
1249                                         ib_mad_recv_handler recv_handler,
1250                                         void *context)
1251 {
1252         return ERR_PTR(-EINVAL);        /* XXX: for now */
1253 }
1254 EXPORT_SYMBOL(ib_redirect_mad_qp);
1255
1256 int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
1257                       struct ib_wc *wc)
1258 {
1259         dev_err(&mad_agent->device->dev,
1260                 "ib_process_mad_wc() not implemented yet\n");
1261         return 0;
1262 }
1263 EXPORT_SYMBOL(ib_process_mad_wc);
1264
1265 static int method_in_use(struct ib_mad_mgmt_method_table **method,
1266                          struct ib_mad_reg_req *mad_reg_req)
1267 {
1268         int i;
1269
1270         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS) {
1271                 if ((*method)->agent[i]) {
1272                         pr_err("Method %d already in use\n", i);
1273                         return -EINVAL;
1274                 }
1275         }
1276         return 0;
1277 }
1278
1279 static int allocate_method_table(struct ib_mad_mgmt_method_table **method)
1280 {
1281         /* Allocate management method table */
1282         *method = kzalloc(sizeof **method, GFP_ATOMIC);
1283         if (!*method) {
1284                 pr_err("No memory for ib_mad_mgmt_method_table\n");
1285                 return -ENOMEM;
1286         }
1287
1288         return 0;
1289 }
1290
1291 /*
1292  * Check to see if there are any methods still in use
1293  */
1294 static int check_method_table(struct ib_mad_mgmt_method_table *method)
1295 {
1296         int i;
1297
1298         for (i = 0; i < IB_MGMT_MAX_METHODS; i++)
1299                 if (method->agent[i])
1300                         return 1;
1301         return 0;
1302 }
1303
1304 /*
1305  * Check to see if there are any method tables for this class still in use
1306  */
1307 static int check_class_table(struct ib_mad_mgmt_class_table *class)
1308 {
1309         int i;
1310
1311         for (i = 0; i < MAX_MGMT_CLASS; i++)
1312                 if (class->method_table[i])
1313                         return 1;
1314         return 0;
1315 }
1316
1317 static int check_vendor_class(struct ib_mad_mgmt_vendor_class *vendor_class)
1318 {
1319         int i;
1320
1321         for (i = 0; i < MAX_MGMT_OUI; i++)
1322                 if (vendor_class->method_table[i])
1323                         return 1;
1324         return 0;
1325 }
1326
1327 static int find_vendor_oui(struct ib_mad_mgmt_vendor_class *vendor_class,
1328                            const char *oui)
1329 {
1330         int i;
1331
1332         for (i = 0; i < MAX_MGMT_OUI; i++)
1333                 /* Is there matching OUI for this vendor class ? */
1334                 if (!memcmp(vendor_class->oui[i], oui, 3))
1335                         return i;
1336
1337         return -1;
1338 }
1339
1340 static int check_vendor_table(struct ib_mad_mgmt_vendor_class_table *vendor)
1341 {
1342         int i;
1343
1344         for (i = 0; i < MAX_MGMT_VENDOR_RANGE2; i++)
1345                 if (vendor->vendor_class[i])
1346                         return 1;
1347
1348         return 0;
1349 }
1350
1351 static void remove_methods_mad_agent(struct ib_mad_mgmt_method_table *method,
1352                                      struct ib_mad_agent_private *agent)
1353 {
1354         int i;
1355
1356         /* Remove any methods for this mad agent */
1357         for (i = 0; i < IB_MGMT_MAX_METHODS; i++) {
1358                 if (method->agent[i] == agent) {
1359                         method->agent[i] = NULL;
1360                 }
1361         }
1362 }
1363
1364 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1365                               struct ib_mad_agent_private *agent_priv,
1366                               u8 mgmt_class)
1367 {
1368         struct ib_mad_port_private *port_priv;
1369         struct ib_mad_mgmt_class_table **class;
1370         struct ib_mad_mgmt_method_table **method;
1371         int i, ret;
1372
1373         port_priv = agent_priv->qp_info->port_priv;
1374         class = &port_priv->version[mad_reg_req->mgmt_class_version].class;
1375         if (!*class) {
1376                 /* Allocate management class table for "new" class version */
1377                 *class = kzalloc(sizeof **class, GFP_ATOMIC);
1378                 if (!*class) {
1379                         dev_err(&agent_priv->agent.device->dev,
1380                                 "No memory for ib_mad_mgmt_class_table\n");
1381                         ret = -ENOMEM;
1382                         goto error1;
1383                 }
1384
1385                 /* Allocate method table for this management class */
1386                 method = &(*class)->method_table[mgmt_class];
1387                 if ((ret = allocate_method_table(method)))
1388                         goto error2;
1389         } else {
1390                 method = &(*class)->method_table[mgmt_class];
1391                 if (!*method) {
1392                         /* Allocate method table for this management class */
1393                         if ((ret = allocate_method_table(method)))
1394                                 goto error1;
1395                 }
1396         }
1397
1398         /* Now, make sure methods are not already in use */
1399         if (method_in_use(method, mad_reg_req))
1400                 goto error3;
1401
1402         /* Finally, add in methods being registered */
1403         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1404                 (*method)->agent[i] = agent_priv;
1405
1406         return 0;
1407
1408 error3:
1409         /* Remove any methods for this mad agent */
1410         remove_methods_mad_agent(*method, agent_priv);
1411         /* Now, check to see if there are any methods in use */
1412         if (!check_method_table(*method)) {
1413                 /* If not, release management method table */
1414                 kfree(*method);
1415                 *method = NULL;
1416         }
1417         ret = -EINVAL;
1418         goto error1;
1419 error2:
1420         kfree(*class);
1421         *class = NULL;
1422 error1:
1423         return ret;
1424 }
1425
1426 static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
1427                            struct ib_mad_agent_private *agent_priv)
1428 {
1429         struct ib_mad_port_private *port_priv;
1430         struct ib_mad_mgmt_vendor_class_table **vendor_table;
1431         struct ib_mad_mgmt_vendor_class_table *vendor = NULL;
1432         struct ib_mad_mgmt_vendor_class *vendor_class = NULL;
1433         struct ib_mad_mgmt_method_table **method;
1434         int i, ret = -ENOMEM;
1435         u8 vclass;
1436
1437         /* "New" vendor (with OUI) class */
1438         vclass = vendor_class_index(mad_reg_req->mgmt_class);
1439         port_priv = agent_priv->qp_info->port_priv;
1440         vendor_table = &port_priv->version[
1441                                 mad_reg_req->mgmt_class_version].vendor;
1442         if (!*vendor_table) {
1443                 /* Allocate mgmt vendor class table for "new" class version */
1444                 vendor = kzalloc(sizeof *vendor, GFP_ATOMIC);
1445                 if (!vendor) {
1446                         dev_err(&agent_priv->agent.device->dev,
1447                                 "No memory for ib_mad_mgmt_vendor_class_table\n");
1448                         goto error1;
1449                 }
1450
1451                 *vendor_table = vendor;
1452         }
1453         if (!(*vendor_table)->vendor_class[vclass]) {
1454                 /* Allocate table for this management vendor class */
1455                 vendor_class = kzalloc(sizeof *vendor_class, GFP_ATOMIC);
1456                 if (!vendor_class) {
1457                         dev_err(&agent_priv->agent.device->dev,
1458                                 "No memory for ib_mad_mgmt_vendor_class\n");
1459                         goto error2;
1460                 }
1461
1462                 (*vendor_table)->vendor_class[vclass] = vendor_class;
1463         }
1464         for (i = 0; i < MAX_MGMT_OUI; i++) {
1465                 /* Is there matching OUI for this vendor class ? */
1466                 if (!memcmp((*vendor_table)->vendor_class[vclass]->oui[i],
1467                             mad_reg_req->oui, 3)) {
1468                         method = &(*vendor_table)->vendor_class[
1469                                                 vclass]->method_table[i];
1470                         BUG_ON(!*method);
1471                         goto check_in_use;
1472                 }
1473         }
1474         for (i = 0; i < MAX_MGMT_OUI; i++) {
1475                 /* OUI slot available ? */
1476                 if (!is_vendor_oui((*vendor_table)->vendor_class[
1477                                 vclass]->oui[i])) {
1478                         method = &(*vendor_table)->vendor_class[
1479                                 vclass]->method_table[i];
1480                         BUG_ON(*method);
1481                         /* Allocate method table for this OUI */
1482                         if ((ret = allocate_method_table(method)))
1483                                 goto error3;
1484                         memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
1485                                mad_reg_req->oui, 3);
1486                         goto check_in_use;
1487                 }
1488         }
1489         dev_err(&agent_priv->agent.device->dev, "All OUI slots in use\n");
1490         goto error3;
1491
1492 check_in_use:
1493         /* Now, make sure methods are not already in use */
1494         if (method_in_use(method, mad_reg_req))
1495                 goto error4;
1496
1497         /* Finally, add in methods being registered */
1498         for_each_set_bit(i, mad_reg_req->method_mask, IB_MGMT_MAX_METHODS)
1499                 (*method)->agent[i] = agent_priv;
1500
1501         return 0;
1502
1503 error4:
1504         /* Remove any methods for this mad agent */
1505         remove_methods_mad_agent(*method, agent_priv);
1506         /* Now, check to see if there are any methods in use */
1507         if (!check_method_table(*method)) {
1508                 /* If not, release management method table */
1509                 kfree(*method);
1510                 *method = NULL;
1511         }
1512         ret = -EINVAL;
1513 error3:
1514         if (vendor_class) {
1515                 (*vendor_table)->vendor_class[vclass] = NULL;
1516                 kfree(vendor_class);
1517         }
1518 error2:
1519         if (vendor) {
1520                 *vendor_table = NULL;
1521                 kfree(vendor);
1522         }
1523 error1:
1524         return ret;
1525 }
1526
1527 static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
1528 {
1529         struct ib_mad_port_private *port_priv;
1530         struct ib_mad_mgmt_class_table *class;
1531         struct ib_mad_mgmt_method_table *method;
1532         struct ib_mad_mgmt_vendor_class_table *vendor;
1533         struct ib_mad_mgmt_vendor_class *vendor_class;
1534         int index;
1535         u8 mgmt_class;
1536
1537         /*
1538          * Was MAD registration request supplied
1539          * with original registration ?
1540          */
1541         if (!agent_priv->reg_req) {
1542                 goto out;
1543         }
1544
1545         port_priv = agent_priv->qp_info->port_priv;
1546         mgmt_class = convert_mgmt_class(agent_priv->reg_req->mgmt_class);
1547         class = port_priv->version[
1548                         agent_priv->reg_req->mgmt_class_version].class;
1549         if (!class)
1550                 goto vendor_check;
1551
1552         method = class->method_table[mgmt_class];
1553         if (method) {
1554                 /* Remove any methods for this mad agent */
1555                 remove_methods_mad_agent(method, agent_priv);
1556                 /* Now, check to see if there are any methods still in use */
1557                 if (!check_method_table(method)) {
1558                         /* If not, release management method table */
1559                          kfree(method);
1560                          class->method_table[mgmt_class] = NULL;
1561                          /* Any management classes left ? */
1562                         if (!check_class_table(class)) {
1563                                 /* If not, release management class table */
1564                                 kfree(class);
1565                                 port_priv->version[
1566                                         agent_priv->reg_req->
1567                                         mgmt_class_version].class = NULL;
1568                         }
1569                 }
1570         }
1571
1572 vendor_check:
1573         if (!is_vendor_class(mgmt_class))
1574                 goto out;
1575
1576         /* normalize mgmt_class to vendor range 2 */
1577         mgmt_class = vendor_class_index(agent_priv->reg_req->mgmt_class);
1578         vendor = port_priv->version[
1579                         agent_priv->reg_req->mgmt_class_version].vendor;
1580
1581         if (!vendor)
1582                 goto out;
1583
1584         vendor_class = vendor->vendor_class[mgmt_class];
1585         if (vendor_class) {
1586                 index = find_vendor_oui(vendor_class, agent_priv->reg_req->oui);
1587                 if (index < 0)
1588                         goto out;
1589                 method = vendor_class->method_table[index];
1590                 if (method) {
1591                         /* Remove any methods for this mad agent */
1592                         remove_methods_mad_agent(method, agent_priv);
1593                         /*
1594                          * Now, check to see if there are
1595                          * any methods still in use
1596                          */
1597                         if (!check_method_table(method)) {
1598                                 /* If not, release management method table */
1599                                 kfree(method);
1600                                 vendor_class->method_table[index] = NULL;
1601                                 memset(vendor_class->oui[index], 0, 3);
1602                                 /* Any OUIs left ? */
1603                                 if (!check_vendor_class(vendor_class)) {
1604                                         /* If not, release vendor class table */
1605                                         kfree(vendor_class);
1606                                         vendor->vendor_class[mgmt_class] = NULL;
1607                                         /* Any other vendor classes left ? */
1608                                         if (!check_vendor_table(vendor)) {
1609                                                 kfree(vendor);
1610                                                 port_priv->version[
1611                                                         agent_priv->reg_req->
1612                                                         mgmt_class_version].
1613                                                         vendor = NULL;
1614                                         }
1615                                 }
1616                         }
1617                 }
1618         }
1619
1620 out:
1621         return;
1622 }
1623
1624 static struct ib_mad_agent_private *
1625 find_mad_agent(struct ib_mad_port_private *port_priv,
1626                const struct ib_mad_hdr *mad_hdr)
1627 {
1628         struct ib_mad_agent_private *mad_agent = NULL;
1629         unsigned long flags;
1630
1631         spin_lock_irqsave(&port_priv->reg_lock, flags);
1632         if (ib_response_mad(mad_hdr)) {
1633                 u32 hi_tid;
1634                 struct ib_mad_agent_private *entry;
1635
1636                 /*
1637                  * Routing is based on high 32 bits of transaction ID
1638                  * of MAD.
1639                  */
1640                 hi_tid = be64_to_cpu(mad_hdr->tid) >> 32;
1641                 list_for_each_entry(entry, &port_priv->agent_list, agent_list) {
1642                         if (entry->agent.hi_tid == hi_tid) {
1643                                 mad_agent = entry;
1644                                 break;
1645                         }
1646                 }
1647         } else {
1648                 struct ib_mad_mgmt_class_table *class;
1649                 struct ib_mad_mgmt_method_table *method;
1650                 struct ib_mad_mgmt_vendor_class_table *vendor;
1651                 struct ib_mad_mgmt_vendor_class *vendor_class;
1652                 const struct ib_vendor_mad *vendor_mad;
1653                 int index;
1654
1655                 /*
1656                  * Routing is based on version, class, and method
1657                  * For "newer" vendor MADs, also based on OUI
1658                  */
1659                 if (mad_hdr->class_version >= MAX_MGMT_VERSION)
1660                         goto out;
1661                 if (!is_vendor_class(mad_hdr->mgmt_class)) {
1662                         class = port_priv->version[
1663                                         mad_hdr->class_version].class;
1664                         if (!class)
1665                                 goto out;
1666                         if (convert_mgmt_class(mad_hdr->mgmt_class) >=
1667                             IB_MGMT_MAX_METHODS)
1668                                 goto out;
1669                         method = class->method_table[convert_mgmt_class(
1670                                                         mad_hdr->mgmt_class)];
1671                         if (method)
1672                                 mad_agent = method->agent[mad_hdr->method &
1673                                                           ~IB_MGMT_METHOD_RESP];
1674                 } else {
1675                         vendor = port_priv->version[
1676                                         mad_hdr->class_version].vendor;
1677                         if (!vendor)
1678                                 goto out;
1679                         vendor_class = vendor->vendor_class[vendor_class_index(
1680                                                 mad_hdr->mgmt_class)];
1681                         if (!vendor_class)
1682                                 goto out;
1683                         /* Find matching OUI */
1684                         vendor_mad = (const struct ib_vendor_mad *)mad_hdr;
1685                         index = find_vendor_oui(vendor_class, vendor_mad->oui);
1686                         if (index == -1)
1687                                 goto out;
1688                         method = vendor_class->method_table[index];
1689                         if (method) {
1690                                 mad_agent = method->agent[mad_hdr->method &
1691                                                           ~IB_MGMT_METHOD_RESP];
1692                         }
1693                 }
1694         }
1695
1696         if (mad_agent) {
1697                 if (mad_agent->agent.recv_handler)
1698                         atomic_inc(&mad_agent->refcount);
1699                 else {
1700                         dev_notice(&port_priv->device->dev,
1701                                    "No receive handler for client %p on port %d\n",
1702                                    &mad_agent->agent, port_priv->port_num);
1703                         mad_agent = NULL;
1704                 }
1705         }
1706 out:
1707         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
1708
1709         return mad_agent;
1710 }
1711
1712 static int validate_mad(const struct ib_mad_hdr *mad_hdr, u32 qp_num)
1713 {
1714         int valid = 0;
1715
1716         /* Make sure MAD base version is understood */
1717         if (mad_hdr->base_version != IB_MGMT_BASE_VERSION) {
1718                 pr_err("MAD received with unsupported base version %d\n",
1719                         mad_hdr->base_version);
1720                 goto out;
1721         }
1722
1723         /* Filter SMI packets sent to other than QP0 */
1724         if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
1725             (mad_hdr->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
1726                 if (qp_num == 0)
1727                         valid = 1;
1728         } else {
1729                 /* Filter GSI packets sent to QP0 */
1730                 if (qp_num != 0)
1731                         valid = 1;
1732         }
1733
1734 out:
1735         return valid;
1736 }
1737
1738 static int is_rmpp_data_mad(const struct ib_mad_agent_private *mad_agent_priv,
1739                             const struct ib_mad_hdr *mad_hdr)
1740 {
1741         struct ib_rmpp_mad *rmpp_mad;
1742
1743         rmpp_mad = (struct ib_rmpp_mad *)mad_hdr;
1744         return !mad_agent_priv->agent.rmpp_version ||
1745                 !ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent) ||
1746                 !(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
1747                                     IB_MGMT_RMPP_FLAG_ACTIVE) ||
1748                 (rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
1749 }
1750
1751 static inline int rcv_has_same_class(const struct ib_mad_send_wr_private *wr,
1752                                      const struct ib_mad_recv_wc *rwc)
1753 {
1754         return ((struct ib_mad_hdr *)(wr->send_buf.mad))->mgmt_class ==
1755                 rwc->recv_buf.mad->mad_hdr.mgmt_class;
1756 }
1757
1758 static inline int rcv_has_same_gid(const struct ib_mad_agent_private *mad_agent_priv,
1759                                    const struct ib_mad_send_wr_private *wr,
1760                                    const struct ib_mad_recv_wc *rwc )
1761 {
1762         struct ib_ah_attr attr;
1763         u8 send_resp, rcv_resp;
1764         union ib_gid sgid;
1765         struct ib_device *device = mad_agent_priv->agent.device;
1766         u8 port_num = mad_agent_priv->agent.port_num;
1767         u8 lmc;
1768
1769         send_resp = ib_response_mad((struct ib_mad_hdr *)wr->send_buf.mad);
1770         rcv_resp = ib_response_mad(&rwc->recv_buf.mad->mad_hdr);
1771
1772         if (send_resp == rcv_resp)
1773                 /* both requests, or both responses. GIDs different */
1774                 return 0;
1775
1776         if (ib_query_ah(wr->send_buf.ah, &attr))
1777                 /* Assume not equal, to avoid false positives. */
1778                 return 0;
1779
1780         if (!!(attr.ah_flags & IB_AH_GRH) !=
1781             !!(rwc->wc->wc_flags & IB_WC_GRH))
1782                 /* one has GID, other does not.  Assume different */
1783                 return 0;
1784
1785         if (!send_resp && rcv_resp) {
1786                 /* is request/response. */
1787                 if (!(attr.ah_flags & IB_AH_GRH)) {
1788                         if (ib_get_cached_lmc(device, port_num, &lmc))
1789                                 return 0;
1790                         return (!lmc || !((attr.src_path_bits ^
1791                                            rwc->wc->dlid_path_bits) &
1792                                           ((1 << lmc) - 1)));
1793                 } else {
1794                         if (ib_get_cached_gid(device, port_num,
1795                                               attr.grh.sgid_index, &sgid))
1796                                 return 0;
1797                         return !memcmp(sgid.raw, rwc->recv_buf.grh->dgid.raw,
1798                                        16);
1799                 }
1800         }
1801
1802         if (!(attr.ah_flags & IB_AH_GRH))
1803                 return attr.dlid == rwc->wc->slid;
1804         else
1805                 return !memcmp(attr.grh.dgid.raw, rwc->recv_buf.grh->sgid.raw,
1806                                16);
1807 }
1808
1809 static inline int is_direct(u8 class)
1810 {
1811         return (class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE);
1812 }
1813
1814 struct ib_mad_send_wr_private*
1815 ib_find_send_mad(const struct ib_mad_agent_private *mad_agent_priv,
1816                  const struct ib_mad_recv_wc *wc)
1817 {
1818         struct ib_mad_send_wr_private *wr;
1819         const struct ib_mad_hdr *mad_hdr;
1820
1821         mad_hdr = &wc->recv_buf.mad->mad_hdr;
1822
1823         list_for_each_entry(wr, &mad_agent_priv->wait_list, agent_list) {
1824                 if ((wr->tid == mad_hdr->tid) &&
1825                     rcv_has_same_class(wr, wc) &&
1826                     /*
1827                      * Don't check GID for direct routed MADs.
1828                      * These might have permissive LIDs.
1829                      */
1830                     (is_direct(mad_hdr->mgmt_class) ||
1831                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
1832                         return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1833         }
1834
1835         /*
1836          * It's possible to receive the response before we've
1837          * been notified that the send has completed
1838          */
1839         list_for_each_entry(wr, &mad_agent_priv->send_list, agent_list) {
1840                 if (is_rmpp_data_mad(mad_agent_priv, wr->send_buf.mad) &&
1841                     wr->tid == mad_hdr->tid &&
1842                     wr->timeout &&
1843                     rcv_has_same_class(wr, wc) &&
1844                     /*
1845                      * Don't check GID for direct routed MADs.
1846                      * These might have permissive LIDs.
1847                      */
1848                     (is_direct(mad_hdr->mgmt_class) ||
1849                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
1850                         /* Verify request has not been canceled */
1851                         return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
1852         }
1853         return NULL;
1854 }
1855
1856 void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
1857 {
1858         mad_send_wr->timeout = 0;
1859         if (mad_send_wr->refcount == 1)
1860                 list_move_tail(&mad_send_wr->agent_list,
1861                               &mad_send_wr->mad_agent_priv->done_list);
1862 }
1863
1864 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
1865                                  struct ib_mad_recv_wc *mad_recv_wc)
1866 {
1867         struct ib_mad_send_wr_private *mad_send_wr;
1868         struct ib_mad_send_wc mad_send_wc;
1869         unsigned long flags;
1870
1871         INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
1872         list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
1873         if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
1874                 mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
1875                                                       mad_recv_wc);
1876                 if (!mad_recv_wc) {
1877                         deref_mad_agent(mad_agent_priv);
1878                         return;
1879                 }
1880         }
1881
1882         /* Complete corresponding request */
1883         if (ib_response_mad(&mad_recv_wc->recv_buf.mad->mad_hdr)) {
1884                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
1885                 mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
1886                 if (!mad_send_wr) {
1887                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1888                         if (!ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)
1889                            && ib_is_mad_class_rmpp(mad_recv_wc->recv_buf.mad->mad_hdr.mgmt_class)
1890                            && (ib_get_rmpp_flags(&((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr)
1891                                         & IB_MGMT_RMPP_FLAG_ACTIVE)) {
1892                                 /* user rmpp is in effect
1893                                  * and this is an active RMPP MAD
1894                                  */
1895                                 mad_recv_wc->wc->wr_id = 0;
1896                                 mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1897                                                                    mad_recv_wc);
1898                                 atomic_dec(&mad_agent_priv->refcount);
1899                         } else {
1900                                 /* not user rmpp, revert to normal behavior and
1901                                  * drop the mad */
1902                                 ib_free_recv_mad(mad_recv_wc);
1903                                 deref_mad_agent(mad_agent_priv);
1904                                 return;
1905                         }
1906                 } else {
1907                         ib_mark_mad_done(mad_send_wr);
1908                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
1909
1910                         /* Defined behavior is to complete response before request */
1911                         mad_recv_wc->wc->wr_id = (unsigned long) &mad_send_wr->send_buf;
1912                         mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1913                                                            mad_recv_wc);
1914                         atomic_dec(&mad_agent_priv->refcount);
1915
1916                         mad_send_wc.status = IB_WC_SUCCESS;
1917                         mad_send_wc.vendor_err = 0;
1918                         mad_send_wc.send_buf = &mad_send_wr->send_buf;
1919                         ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
1920                 }
1921         } else {
1922                 mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
1923                                                    mad_recv_wc);
1924                 deref_mad_agent(mad_agent_priv);
1925         }
1926 }
1927
1928 static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv,
1929                                      const struct ib_mad_qp_info *qp_info,
1930                                      const struct ib_wc *wc,
1931                                      int port_num,
1932                                      struct ib_mad_private *recv,
1933                                      struct ib_mad_private *response)
1934 {
1935         enum smi_forward_action retsmi;
1936
1937         if (smi_handle_dr_smp_recv(&recv->mad.smp,
1938                                    port_priv->device->node_type,
1939                                    port_num,
1940                                    port_priv->device->phys_port_cnt) ==
1941                                    IB_SMI_DISCARD)
1942                 return IB_SMI_DISCARD;
1943
1944         retsmi = smi_check_forward_dr_smp(&recv->mad.smp);
1945         if (retsmi == IB_SMI_LOCAL)
1946                 return IB_SMI_HANDLE;
1947
1948         if (retsmi == IB_SMI_SEND) { /* don't forward */
1949                 if (smi_handle_dr_smp_send(&recv->mad.smp,
1950                                            port_priv->device->node_type,
1951                                            port_num) == IB_SMI_DISCARD)
1952                         return IB_SMI_DISCARD;
1953
1954                 if (smi_check_local_smp(&recv->mad.smp, port_priv->device) == IB_SMI_DISCARD)
1955                         return IB_SMI_DISCARD;
1956         } else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
1957                 /* forward case for switches */
1958                 memcpy(response, recv, sizeof(*response));
1959                 response->header.recv_wc.wc = &response->header.wc;
1960                 response->header.recv_wc.recv_buf.mad = &response->mad.mad;
1961                 response->header.recv_wc.recv_buf.grh = &response->grh;
1962
1963                 agent_send_response(&response->mad.mad,
1964                                     &response->grh, wc,
1965                                     port_priv->device,
1966                                     smi_get_fwd_port(&recv->mad.smp),
1967                                     qp_info->qp->qp_num);
1968
1969                 return IB_SMI_DISCARD;
1970         }
1971         return IB_SMI_HANDLE;
1972 }
1973
1974 static bool generate_unmatched_resp(struct ib_mad_private *recv,
1975                                     struct ib_mad_private *response)
1976 {
1977         if (recv->mad.mad.mad_hdr.method == IB_MGMT_METHOD_GET ||
1978             recv->mad.mad.mad_hdr.method == IB_MGMT_METHOD_SET) {
1979                 memcpy(response, recv, sizeof *response);
1980                 response->header.recv_wc.wc = &response->header.wc;
1981                 response->header.recv_wc.recv_buf.mad = &response->mad.mad;
1982                 response->header.recv_wc.recv_buf.grh = &response->grh;
1983                 response->mad.mad.mad_hdr.method = IB_MGMT_METHOD_GET_RESP;
1984                 response->mad.mad.mad_hdr.status =
1985                         cpu_to_be16(IB_MGMT_MAD_STATUS_UNSUPPORTED_METHOD_ATTRIB);
1986                 if (recv->mad.mad.mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
1987                         response->mad.mad.mad_hdr.status |= IB_SMP_DIRECTION;
1988
1989                 return true;
1990         } else {
1991                 return false;
1992         }
1993 }
1994 static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
1995                                      struct ib_wc *wc)
1996 {
1997         struct ib_mad_qp_info *qp_info;
1998         struct ib_mad_private_header *mad_priv_hdr;
1999         struct ib_mad_private *recv, *response = NULL;
2000         struct ib_mad_list_head *mad_list;
2001         struct ib_mad_agent_private *mad_agent;
2002         int port_num;
2003         int ret = IB_MAD_RESULT_SUCCESS;
2004
2005         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2006         qp_info = mad_list->mad_queue->qp_info;
2007         dequeue_mad(mad_list);
2008
2009         mad_priv_hdr = container_of(mad_list, struct ib_mad_private_header,
2010                                     mad_list);
2011         recv = container_of(mad_priv_hdr, struct ib_mad_private, header);
2012         ib_dma_unmap_single(port_priv->device,
2013                             recv->header.mapping,
2014                             sizeof(struct ib_mad_private) -
2015                               sizeof(struct ib_mad_private_header),
2016                             DMA_FROM_DEVICE);
2017
2018         /* Setup MAD receive work completion from "normal" work completion */
2019         recv->header.wc = *wc;
2020         recv->header.recv_wc.wc = &recv->header.wc;
2021         recv->header.recv_wc.mad_len = sizeof(struct ib_mad);
2022         recv->header.recv_wc.recv_buf.mad = &recv->mad.mad;
2023         recv->header.recv_wc.recv_buf.grh = &recv->grh;
2024
2025         if (atomic_read(&qp_info->snoop_count))
2026                 snoop_recv(qp_info, &recv->header.recv_wc, IB_MAD_SNOOP_RECVS);
2027
2028         /* Validate MAD */
2029         if (!validate_mad(&recv->mad.mad.mad_hdr, qp_info->qp->qp_num))
2030                 goto out;
2031
2032         response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
2033         if (!response) {
2034                 dev_err(&port_priv->device->dev,
2035                         "ib_mad_recv_done_handler no memory for response buffer\n");
2036                 goto out;
2037         }
2038
2039         if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
2040                 port_num = wc->port_num;
2041         else
2042                 port_num = port_priv->port_num;
2043
2044         if (recv->mad.mad.mad_hdr.mgmt_class ==
2045             IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
2046                 if (handle_ib_smi(port_priv, qp_info, wc, port_num, recv,
2047                                   response)
2048                     == IB_SMI_DISCARD)
2049                         goto out;
2050         }
2051
2052         /* Give driver "right of first refusal" on incoming MAD */
2053         if (port_priv->device->process_mad) {
2054                 ret = port_priv->device->process_mad(port_priv->device, 0,
2055                                                      port_priv->port_num,
2056                                                      wc, &recv->grh,
2057                                                      &recv->mad.mad,
2058                                                      &response->mad.mad);
2059                 if (ret & IB_MAD_RESULT_SUCCESS) {
2060                         if (ret & IB_MAD_RESULT_CONSUMED)
2061                                 goto out;
2062                         if (ret & IB_MAD_RESULT_REPLY) {
2063                                 agent_send_response(&response->mad.mad,
2064                                                     &recv->grh, wc,
2065                                                     port_priv->device,
2066                                                     port_num,
2067                                                     qp_info->qp->qp_num);
2068                                 goto out;
2069                         }
2070                 }
2071         }
2072
2073         mad_agent = find_mad_agent(port_priv, &recv->mad.mad.mad_hdr);
2074         if (mad_agent) {
2075                 ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
2076                 /*
2077                  * recv is freed up in error cases in ib_mad_complete_recv
2078                  * or via recv_handler in ib_mad_complete_recv()
2079                  */
2080                 recv = NULL;
2081         } else if ((ret & IB_MAD_RESULT_SUCCESS) &&
2082                    generate_unmatched_resp(recv, response)) {
2083                 agent_send_response(&response->mad.mad, &recv->grh, wc,
2084                                     port_priv->device, port_num, qp_info->qp->qp_num);
2085         }
2086
2087 out:
2088         /* Post another receive request for this QP */
2089         if (response) {
2090                 ib_mad_post_receive_mads(qp_info, response);
2091                 if (recv)
2092                         kmem_cache_free(ib_mad_cache, recv);
2093         } else
2094                 ib_mad_post_receive_mads(qp_info, recv);
2095 }
2096
2097 static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
2098 {
2099         struct ib_mad_send_wr_private *mad_send_wr;
2100         unsigned long delay;
2101
2102         if (list_empty(&mad_agent_priv->wait_list)) {
2103                 cancel_delayed_work(&mad_agent_priv->timed_work);
2104         } else {
2105                 mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2106                                          struct ib_mad_send_wr_private,
2107                                          agent_list);
2108
2109                 if (time_after(mad_agent_priv->timeout,
2110                                mad_send_wr->timeout)) {
2111                         mad_agent_priv->timeout = mad_send_wr->timeout;
2112                         delay = mad_send_wr->timeout - jiffies;
2113                         if ((long)delay <= 0)
2114                                 delay = 1;
2115                         mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2116                                          &mad_agent_priv->timed_work, delay);
2117                 }
2118         }
2119 }
2120
2121 static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
2122 {
2123         struct ib_mad_agent_private *mad_agent_priv;
2124         struct ib_mad_send_wr_private *temp_mad_send_wr;
2125         struct list_head *list_item;
2126         unsigned long delay;
2127
2128         mad_agent_priv = mad_send_wr->mad_agent_priv;
2129         list_del(&mad_send_wr->agent_list);
2130
2131         delay = mad_send_wr->timeout;
2132         mad_send_wr->timeout += jiffies;
2133
2134         if (delay) {
2135                 list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
2136                         temp_mad_send_wr = list_entry(list_item,
2137                                                 struct ib_mad_send_wr_private,
2138                                                 agent_list);
2139                         if (time_after(mad_send_wr->timeout,
2140                                        temp_mad_send_wr->timeout))
2141                                 break;
2142                 }
2143         }
2144         else
2145                 list_item = &mad_agent_priv->wait_list;
2146         list_add(&mad_send_wr->agent_list, list_item);
2147
2148         /* Reschedule a work item if we have a shorter timeout */
2149         if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list)
2150                 mod_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
2151                                  &mad_agent_priv->timed_work, delay);
2152 }
2153
2154 void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
2155                           int timeout_ms)
2156 {
2157         mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2158         wait_for_response(mad_send_wr);
2159 }
2160
2161 /*
2162  * Process a send work completion
2163  */
2164 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
2165                              struct ib_mad_send_wc *mad_send_wc)
2166 {
2167         struct ib_mad_agent_private     *mad_agent_priv;
2168         unsigned long                   flags;
2169         int                             ret;
2170
2171         mad_agent_priv = mad_send_wr->mad_agent_priv;
2172         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2173         if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
2174                 ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
2175                 if (ret == IB_RMPP_RESULT_CONSUMED)
2176                         goto done;
2177         } else
2178                 ret = IB_RMPP_RESULT_UNHANDLED;
2179
2180         if (mad_send_wc->status != IB_WC_SUCCESS &&
2181             mad_send_wr->status == IB_WC_SUCCESS) {
2182                 mad_send_wr->status = mad_send_wc->status;
2183                 mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2184         }
2185
2186         if (--mad_send_wr->refcount > 0) {
2187                 if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
2188                     mad_send_wr->status == IB_WC_SUCCESS) {
2189                         wait_for_response(mad_send_wr);
2190                 }
2191                 goto done;
2192         }
2193
2194         /* Remove send from MAD agent and notify client of completion */
2195         list_del(&mad_send_wr->agent_list);
2196         adjust_timeout(mad_agent_priv);
2197         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2198
2199         if (mad_send_wr->status != IB_WC_SUCCESS )
2200                 mad_send_wc->status = mad_send_wr->status;
2201         if (ret == IB_RMPP_RESULT_INTERNAL)
2202                 ib_rmpp_send_handler(mad_send_wc);
2203         else
2204                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2205                                                    mad_send_wc);
2206
2207         /* Release reference on agent taken when sending */
2208         deref_mad_agent(mad_agent_priv);
2209         return;
2210 done:
2211         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2212 }
2213
2214 static void ib_mad_send_done_handler(struct ib_mad_port_private *port_priv,
2215                                      struct ib_wc *wc)
2216 {
2217         struct ib_mad_send_wr_private   *mad_send_wr, *queued_send_wr;
2218         struct ib_mad_list_head         *mad_list;
2219         struct ib_mad_qp_info           *qp_info;
2220         struct ib_mad_queue             *send_queue;
2221         struct ib_send_wr               *bad_send_wr;
2222         struct ib_mad_send_wc           mad_send_wc;
2223         unsigned long flags;
2224         int ret;
2225
2226         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2227         mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2228                                    mad_list);
2229         send_queue = mad_list->mad_queue;
2230         qp_info = send_queue->qp_info;
2231
2232 retry:
2233         ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2234                             mad_send_wr->header_mapping,
2235                             mad_send_wr->sg_list[0].length, DMA_TO_DEVICE);
2236         ib_dma_unmap_single(mad_send_wr->send_buf.mad_agent->device,
2237                             mad_send_wr->payload_mapping,
2238                             mad_send_wr->sg_list[1].length, DMA_TO_DEVICE);
2239         queued_send_wr = NULL;
2240         spin_lock_irqsave(&send_queue->lock, flags);
2241         list_del(&mad_list->list);
2242
2243         /* Move queued send to the send queue */
2244         if (send_queue->count-- > send_queue->max_active) {
2245                 mad_list = container_of(qp_info->overflow_list.next,
2246                                         struct ib_mad_list_head, list);
2247                 queued_send_wr = container_of(mad_list,
2248                                         struct ib_mad_send_wr_private,
2249                                         mad_list);
2250                 list_move_tail(&mad_list->list, &send_queue->list);
2251         }
2252         spin_unlock_irqrestore(&send_queue->lock, flags);
2253
2254         mad_send_wc.send_buf = &mad_send_wr->send_buf;
2255         mad_send_wc.status = wc->status;
2256         mad_send_wc.vendor_err = wc->vendor_err;
2257         if (atomic_read(&qp_info->snoop_count))
2258                 snoop_send(qp_info, &mad_send_wr->send_buf, &mad_send_wc,
2259                            IB_MAD_SNOOP_SEND_COMPLETIONS);
2260         ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
2261
2262         if (queued_send_wr) {
2263                 ret = ib_post_send(qp_info->qp, &queued_send_wr->send_wr,
2264                                    &bad_send_wr);
2265                 if (ret) {
2266                         dev_err(&port_priv->device->dev,
2267                                 "ib_post_send failed: %d\n", ret);
2268                         mad_send_wr = queued_send_wr;
2269                         wc->status = IB_WC_LOC_QP_OP_ERR;
2270                         goto retry;
2271                 }
2272         }
2273 }
2274
2275 static void mark_sends_for_retry(struct ib_mad_qp_info *qp_info)
2276 {
2277         struct ib_mad_send_wr_private *mad_send_wr;
2278         struct ib_mad_list_head *mad_list;
2279         unsigned long flags;
2280
2281         spin_lock_irqsave(&qp_info->send_queue.lock, flags);
2282         list_for_each_entry(mad_list, &qp_info->send_queue.list, list) {
2283                 mad_send_wr = container_of(mad_list,
2284                                            struct ib_mad_send_wr_private,
2285                                            mad_list);
2286                 mad_send_wr->retry = 1;
2287         }
2288         spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
2289 }
2290
2291 static void mad_error_handler(struct ib_mad_port_private *port_priv,
2292                               struct ib_wc *wc)
2293 {
2294         struct ib_mad_list_head *mad_list;
2295         struct ib_mad_qp_info *qp_info;
2296         struct ib_mad_send_wr_private *mad_send_wr;
2297         int ret;
2298
2299         /* Determine if failure was a send or receive */
2300         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
2301         qp_info = mad_list->mad_queue->qp_info;
2302         if (mad_list->mad_queue == &qp_info->recv_queue)
2303                 /*
2304                  * Receive errors indicate that the QP has entered the error
2305                  * state - error handling/shutdown code will cleanup
2306                  */
2307                 return;
2308
2309         /*
2310          * Send errors will transition the QP to SQE - move
2311          * QP to RTS and repost flushed work requests
2312          */
2313         mad_send_wr = container_of(mad_list, struct ib_mad_send_wr_private,
2314                                    mad_list);
2315         if (wc->status == IB_WC_WR_FLUSH_ERR) {
2316                 if (mad_send_wr->retry) {
2317                         /* Repost send */
2318                         struct ib_send_wr *bad_send_wr;
2319
2320                         mad_send_wr->retry = 0;
2321                         ret = ib_post_send(qp_info->qp, &mad_send_wr->send_wr,
2322                                         &bad_send_wr);
2323                         if (ret)
2324                                 ib_mad_send_done_handler(port_priv, wc);
2325                 } else
2326                         ib_mad_send_done_handler(port_priv, wc);
2327         } else {
2328                 struct ib_qp_attr *attr;
2329
2330                 /* Transition QP to RTS and fail offending send */
2331                 attr = kmalloc(sizeof *attr, GFP_KERNEL);
2332                 if (attr) {
2333                         attr->qp_state = IB_QPS_RTS;
2334                         attr->cur_qp_state = IB_QPS_SQE;
2335                         ret = ib_modify_qp(qp_info->qp, attr,
2336                                            IB_QP_STATE | IB_QP_CUR_STATE);
2337                         kfree(attr);
2338                         if (ret)
2339                                 dev_err(&port_priv->device->dev,
2340                                         "mad_error_handler - ib_modify_qp to RTS : %d\n",
2341                                         ret);
2342                         else
2343                                 mark_sends_for_retry(qp_info);
2344                 }
2345                 ib_mad_send_done_handler(port_priv, wc);
2346         }
2347 }
2348
2349 /*
2350  * IB MAD completion callback
2351  */
2352 static void ib_mad_completion_handler(struct work_struct *work)
2353 {
2354         struct ib_mad_port_private *port_priv;
2355         struct ib_wc wc;
2356
2357         port_priv = container_of(work, struct ib_mad_port_private, work);
2358         ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
2359
2360         while (ib_poll_cq(port_priv->cq, 1, &wc) == 1) {
2361                 if (wc.status == IB_WC_SUCCESS) {
2362                         switch (wc.opcode) {
2363                         case IB_WC_SEND:
2364                                 ib_mad_send_done_handler(port_priv, &wc);
2365                                 break;
2366                         case IB_WC_RECV:
2367                                 ib_mad_recv_done_handler(port_priv, &wc);
2368                                 break;
2369                         default:
2370                                 BUG_ON(1);
2371                                 break;
2372                         }
2373                 } else
2374                         mad_error_handler(port_priv, &wc);
2375         }
2376 }
2377
2378 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
2379 {
2380         unsigned long flags;
2381         struct ib_mad_send_wr_private *mad_send_wr, *temp_mad_send_wr;
2382         struct ib_mad_send_wc mad_send_wc;
2383         struct list_head cancel_list;
2384
2385         INIT_LIST_HEAD(&cancel_list);
2386
2387         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2388         list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2389                                  &mad_agent_priv->send_list, agent_list) {
2390                 if (mad_send_wr->status == IB_WC_SUCCESS) {
2391                         mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2392                         mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2393                 }
2394         }
2395
2396         /* Empty wait list to prevent receives from finding a request */
2397         list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
2398         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2399
2400         /* Report all cancelled requests */
2401         mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
2402         mad_send_wc.vendor_err = 0;
2403
2404         list_for_each_entry_safe(mad_send_wr, temp_mad_send_wr,
2405                                  &cancel_list, agent_list) {
2406                 mad_send_wc.send_buf = &mad_send_wr->send_buf;
2407                 list_del(&mad_send_wr->agent_list);
2408                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2409                                                    &mad_send_wc);
2410                 atomic_dec(&mad_agent_priv->refcount);
2411         }
2412 }
2413
2414 static struct ib_mad_send_wr_private*
2415 find_send_wr(struct ib_mad_agent_private *mad_agent_priv,
2416              struct ib_mad_send_buf *send_buf)
2417 {
2418         struct ib_mad_send_wr_private *mad_send_wr;
2419
2420         list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
2421                             agent_list) {
2422                 if (&mad_send_wr->send_buf == send_buf)
2423                         return mad_send_wr;
2424         }
2425
2426         list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
2427                             agent_list) {
2428                 if (is_rmpp_data_mad(mad_agent_priv,
2429                                      mad_send_wr->send_buf.mad) &&
2430                     &mad_send_wr->send_buf == send_buf)
2431                         return mad_send_wr;
2432         }
2433         return NULL;
2434 }
2435
2436 int ib_modify_mad(struct ib_mad_agent *mad_agent,
2437                   struct ib_mad_send_buf *send_buf, u32 timeout_ms)
2438 {
2439         struct ib_mad_agent_private *mad_agent_priv;
2440         struct ib_mad_send_wr_private *mad_send_wr;
2441         unsigned long flags;
2442         int active;
2443
2444         mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
2445                                       agent);
2446         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2447         mad_send_wr = find_send_wr(mad_agent_priv, send_buf);
2448         if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
2449                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2450                 return -EINVAL;
2451         }
2452
2453         active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
2454         if (!timeout_ms) {
2455                 mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
2456                 mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
2457         }
2458
2459         mad_send_wr->send_buf.timeout_ms = timeout_ms;
2460         if (active)
2461                 mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
2462         else
2463                 ib_reset_mad_timeout(mad_send_wr, timeout_ms);
2464
2465         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2466         return 0;
2467 }
2468 EXPORT_SYMBOL(ib_modify_mad);
2469
2470 void ib_cancel_mad(struct ib_mad_agent *mad_agent,
2471                    struct ib_mad_send_buf *send_buf)
2472 {
2473         ib_modify_mad(mad_agent, send_buf, 0);
2474 }
2475 EXPORT_SYMBOL(ib_cancel_mad);
2476
2477 static void local_completions(struct work_struct *work)
2478 {
2479         struct ib_mad_agent_private *mad_agent_priv;
2480         struct ib_mad_local_private *local;
2481         struct ib_mad_agent_private *recv_mad_agent;
2482         unsigned long flags;
2483         int free_mad;
2484         struct ib_wc wc;
2485         struct ib_mad_send_wc mad_send_wc;
2486
2487         mad_agent_priv =
2488                 container_of(work, struct ib_mad_agent_private, local_work);
2489
2490         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2491         while (!list_empty(&mad_agent_priv->local_list)) {
2492                 local = list_entry(mad_agent_priv->local_list.next,
2493                                    struct ib_mad_local_private,
2494                                    completion_list);
2495                 list_del(&local->completion_list);
2496                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2497                 free_mad = 0;
2498                 if (local->mad_priv) {
2499                         recv_mad_agent = local->recv_mad_agent;
2500                         if (!recv_mad_agent) {
2501                                 dev_err(&mad_agent_priv->agent.device->dev,
2502                                         "No receive MAD agent for local completion\n");
2503                                 free_mad = 1;
2504                                 goto local_send_completion;
2505                         }
2506
2507                         /*
2508                          * Defined behavior is to complete response
2509                          * before request
2510                          */
2511                         build_smp_wc(recv_mad_agent->agent.qp,
2512                                      (unsigned long) local->mad_send_wr,
2513                                      be16_to_cpu(IB_LID_PERMISSIVE),
2514                                      0, recv_mad_agent->agent.port_num, &wc);
2515
2516                         local->mad_priv->header.recv_wc.wc = &wc;
2517                         local->mad_priv->header.recv_wc.mad_len =
2518                                                 sizeof(struct ib_mad);
2519                         INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
2520                         list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
2521                                  &local->mad_priv->header.recv_wc.rmpp_list);
2522                         local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
2523                         local->mad_priv->header.recv_wc.recv_buf.mad =
2524                                                 &local->mad_priv->mad.mad;
2525                         if (atomic_read(&recv_mad_agent->qp_info->snoop_count))
2526                                 snoop_recv(recv_mad_agent->qp_info,
2527                                           &local->mad_priv->header.recv_wc,
2528                                            IB_MAD_SNOOP_RECVS);
2529                         recv_mad_agent->agent.recv_handler(
2530                                                 &recv_mad_agent->agent,
2531                                                 &local->mad_priv->header.recv_wc);
2532                         spin_lock_irqsave(&recv_mad_agent->lock, flags);
2533                         atomic_dec(&recv_mad_agent->refcount);
2534                         spin_unlock_irqrestore(&recv_mad_agent->lock, flags);
2535                 }
2536
2537 local_send_completion:
2538                 /* Complete send */
2539                 mad_send_wc.status = IB_WC_SUCCESS;
2540                 mad_send_wc.vendor_err = 0;
2541                 mad_send_wc.send_buf = &local->mad_send_wr->send_buf;
2542                 if (atomic_read(&mad_agent_priv->qp_info->snoop_count))
2543                         snoop_send(mad_agent_priv->qp_info,
2544                                    &local->mad_send_wr->send_buf,
2545                                    &mad_send_wc, IB_MAD_SNOOP_SEND_COMPLETIONS);
2546                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2547                                                    &mad_send_wc);
2548
2549                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
2550                 atomic_dec(&mad_agent_priv->refcount);
2551                 if (free_mad)
2552                         kmem_cache_free(ib_mad_cache, local->mad_priv);
2553                 kfree(local);
2554         }
2555         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2556 }
2557
2558 static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
2559 {
2560         int ret;
2561
2562         if (!mad_send_wr->retries_left)
2563                 return -ETIMEDOUT;
2564
2565         mad_send_wr->retries_left--;
2566         mad_send_wr->send_buf.retries++;
2567
2568         mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
2569
2570         if (ib_mad_kernel_rmpp_agent(&mad_send_wr->mad_agent_priv->agent)) {
2571                 ret = ib_retry_rmpp(mad_send_wr);
2572                 switch (ret) {
2573                 case IB_RMPP_RESULT_UNHANDLED:
2574                         ret = ib_send_mad(mad_send_wr);
2575                         break;
2576                 case IB_RMPP_RESULT_CONSUMED:
2577                         ret = 0;
2578                         break;
2579                 default:
2580                         ret = -ECOMM;
2581                         break;
2582                 }
2583         } else
2584                 ret = ib_send_mad(mad_send_wr);
2585
2586         if (!ret) {
2587                 mad_send_wr->refcount++;
2588                 list_add_tail(&mad_send_wr->agent_list,
2589                               &mad_send_wr->mad_agent_priv->send_list);
2590         }
2591         return ret;
2592 }
2593
2594 static void timeout_sends(struct work_struct *work)
2595 {
2596         struct ib_mad_agent_private *mad_agent_priv;
2597         struct ib_mad_send_wr_private *mad_send_wr;
2598         struct ib_mad_send_wc mad_send_wc;
2599         unsigned long flags, delay;
2600
2601         mad_agent_priv = container_of(work, struct ib_mad_agent_private,
2602                                       timed_work.work);
2603         mad_send_wc.vendor_err = 0;
2604
2605         spin_lock_irqsave(&mad_agent_priv->lock, flags);
2606         while (!list_empty(&mad_agent_priv->wait_list)) {
2607                 mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
2608                                          struct ib_mad_send_wr_private,
2609                                          agent_list);
2610
2611                 if (time_after(mad_send_wr->timeout, jiffies)) {
2612                         delay = mad_send_wr->timeout - jiffies;
2613                         if ((long)delay <= 0)
2614                                 delay = 1;
2615                         queue_delayed_work(mad_agent_priv->qp_info->
2616                                            port_priv->wq,
2617                                            &mad_agent_priv->timed_work, delay);
2618                         break;
2619                 }
2620
2621                 list_del(&mad_send_wr->agent_list);
2622                 if (mad_send_wr->status == IB_WC_SUCCESS &&
2623                     !retry_send(mad_send_wr))
2624                         continue;
2625
2626                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2627
2628                 if (mad_send_wr->status == IB_WC_SUCCESS)
2629                         mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
2630                 else
2631                         mad_send_wc.status = mad_send_wr->status;
2632                 mad_send_wc.send_buf = &mad_send_wr->send_buf;
2633                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
2634                                                    &mad_send_wc);
2635
2636                 atomic_dec(&mad_agent_priv->refcount);
2637                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
2638         }
2639         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
2640 }
2641
2642 static void ib_mad_thread_completion_handler(struct ib_cq *cq, void *arg)
2643 {
2644         struct ib_mad_port_private *port_priv = cq->cq_context;
2645         unsigned long flags;
2646
2647         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
2648         if (!list_empty(&port_priv->port_list))
2649                 queue_work(port_priv->wq, &port_priv->work);
2650         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
2651 }
2652
2653 /*
2654  * Allocate receive MADs and post receive WRs for them
2655  */
2656 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
2657                                     struct ib_mad_private *mad)
2658 {
2659         unsigned long flags;
2660         int post, ret;
2661         struct ib_mad_private *mad_priv;
2662         struct ib_sge sg_list;
2663         struct ib_recv_wr recv_wr, *bad_recv_wr;
2664         struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
2665
2666         /* Initialize common scatter list fields */
2667         sg_list.length = sizeof *mad_priv - sizeof mad_priv->header;
2668         sg_list.lkey = (*qp_info->port_priv->mr).lkey;
2669
2670         /* Initialize common receive WR fields */
2671         recv_wr.next = NULL;
2672         recv_wr.sg_list = &sg_list;
2673         recv_wr.num_sge = 1;
2674
2675         do {
2676                 /* Allocate and map receive buffer */
2677                 if (mad) {
2678                         mad_priv = mad;
2679                         mad = NULL;
2680                 } else {
2681                         mad_priv = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
2682                         if (!mad_priv) {
2683                                 dev_err(&qp_info->port_priv->device->dev,
2684                                         "No memory for receive buffer\n");
2685                                 ret = -ENOMEM;
2686                                 break;
2687                         }
2688                 }
2689                 sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
2690                                                  &mad_priv->grh,
2691                                                  sizeof *mad_priv -
2692                                                    sizeof mad_priv->header,
2693                                                  DMA_FROM_DEVICE);
2694                 if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
2695                                                   sg_list.addr))) {
2696                         ret = -ENOMEM;
2697                         break;
2698                 }
2699                 mad_priv->header.mapping = sg_list.addr;
2700                 recv_wr.wr_id = (unsigned long)&mad_priv->header.mad_list;
2701                 mad_priv->header.mad_list.mad_queue = recv_queue;
2702
2703                 /* Post receive WR */
2704                 spin_lock_irqsave(&recv_queue->lock, flags);
2705                 post = (++recv_queue->count < recv_queue->max_active);
2706                 list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
2707                 spin_unlock_irqrestore(&recv_queue->lock, flags);
2708                 ret = ib_post_recv(qp_info->qp, &recv_wr, &bad_recv_wr);
2709                 if (ret) {
2710                         spin_lock_irqsave(&recv_queue->lock, flags);
2711                         list_del(&mad_priv->header.mad_list.list);
2712                         recv_queue->count--;
2713                         spin_unlock_irqrestore(&recv_queue->lock, flags);
2714                         ib_dma_unmap_single(qp_info->port_priv->device,
2715                                             mad_priv->header.mapping,
2716                                             sizeof *mad_priv -
2717                                               sizeof mad_priv->header,
2718                                             DMA_FROM_DEVICE);
2719                         kmem_cache_free(ib_mad_cache, mad_priv);
2720                         dev_err(&qp_info->port_priv->device->dev,
2721                                 "ib_post_recv failed: %d\n", ret);
2722                         break;
2723                 }
2724         } while (post);
2725
2726         return ret;
2727 }
2728
2729 /*
2730  * Return all the posted receive MADs
2731  */
2732 static void cleanup_recv_queue(struct ib_mad_qp_info *qp_info)
2733 {
2734         struct ib_mad_private_header *mad_priv_hdr;
2735         struct ib_mad_private *recv;
2736         struct ib_mad_list_head *mad_list;
2737
2738         if (!qp_info->qp)
2739                 return;
2740
2741         while (!list_empty(&qp_info->recv_queue.list)) {
2742
2743                 mad_list = list_entry(qp_info->recv_queue.list.next,
2744                                       struct ib_mad_list_head, list);
2745                 mad_priv_hdr = container_of(mad_list,
2746                                             struct ib_mad_private_header,
2747                                             mad_list);
2748                 recv = container_of(mad_priv_hdr, struct ib_mad_private,
2749                                     header);
2750
2751                 /* Remove from posted receive MAD list */
2752                 list_del(&mad_list->list);
2753
2754                 ib_dma_unmap_single(qp_info->port_priv->device,
2755                                     recv->header.mapping,
2756                                     sizeof(struct ib_mad_private) -
2757                                       sizeof(struct ib_mad_private_header),
2758                                     DMA_FROM_DEVICE);
2759                 kmem_cache_free(ib_mad_cache, recv);
2760         }
2761
2762         qp_info->recv_queue.count = 0;
2763 }
2764
2765 /*
2766  * Start the port
2767  */
2768 static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
2769 {
2770         int ret, i;
2771         struct ib_qp_attr *attr;
2772         struct ib_qp *qp;
2773         u16 pkey_index;
2774
2775         attr = kmalloc(sizeof *attr, GFP_KERNEL);
2776         if (!attr) {
2777                 dev_err(&port_priv->device->dev,
2778                         "Couldn't kmalloc ib_qp_attr\n");
2779                 return -ENOMEM;
2780         }
2781
2782         ret = ib_find_pkey(port_priv->device, port_priv->port_num,
2783                            IB_DEFAULT_PKEY_FULL, &pkey_index);
2784         if (ret)
2785                 pkey_index = 0;
2786
2787         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2788                 qp = port_priv->qp_info[i].qp;
2789                 if (!qp)
2790                         continue;
2791
2792                 /*
2793                  * PKey index for QP1 is irrelevant but
2794                  * one is needed for the Reset to Init transition
2795                  */
2796                 attr->qp_state = IB_QPS_INIT;
2797                 attr->pkey_index = pkey_index;
2798                 attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
2799                 ret = ib_modify_qp(qp, attr, IB_QP_STATE |
2800                                              IB_QP_PKEY_INDEX | IB_QP_QKEY);
2801                 if (ret) {
2802                         dev_err(&port_priv->device->dev,
2803                                 "Couldn't change QP%d state to INIT: %d\n",
2804                                 i, ret);
2805                         goto out;
2806                 }
2807
2808                 attr->qp_state = IB_QPS_RTR;
2809                 ret = ib_modify_qp(qp, attr, IB_QP_STATE);
2810                 if (ret) {
2811                         dev_err(&port_priv->device->dev,
2812                                 "Couldn't change QP%d state to RTR: %d\n",
2813                                 i, ret);
2814                         goto out;
2815                 }
2816
2817                 attr->qp_state = IB_QPS_RTS;
2818                 attr->sq_psn = IB_MAD_SEND_Q_PSN;
2819                 ret = ib_modify_qp(qp, attr, IB_QP_STATE | IB_QP_SQ_PSN);
2820                 if (ret) {
2821                         dev_err(&port_priv->device->dev,
2822                                 "Couldn't change QP%d state to RTS: %d\n",
2823                                 i, ret);
2824                         goto out;
2825                 }
2826         }
2827
2828         ret = ib_req_notify_cq(port_priv->cq, IB_CQ_NEXT_COMP);
2829         if (ret) {
2830                 dev_err(&port_priv->device->dev,
2831                         "Failed to request completion notification: %d\n",
2832                         ret);
2833                 goto out;
2834         }
2835
2836         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
2837                 if (!port_priv->qp_info[i].qp)
2838                         continue;
2839
2840                 ret = ib_mad_post_receive_mads(&port_priv->qp_info[i], NULL);
2841                 if (ret) {
2842                         dev_err(&port_priv->device->dev,
2843                                 "Couldn't post receive WRs\n");
2844                         goto out;
2845                 }
2846         }
2847 out:
2848         kfree(attr);
2849         return ret;
2850 }
2851
2852 static void qp_event_handler(struct ib_event *event, void *qp_context)
2853 {
2854         struct ib_mad_qp_info   *qp_info = qp_context;
2855
2856         /* It's worse than that! He's dead, Jim! */
2857         dev_err(&qp_info->port_priv->device->dev,
2858                 "Fatal error (%d) on MAD QP (%d)\n",
2859                 event->event, qp_info->qp->qp_num);
2860 }
2861
2862 static void init_mad_queue(struct ib_mad_qp_info *qp_info,
2863                            struct ib_mad_queue *mad_queue)
2864 {
2865         mad_queue->qp_info = qp_info;
2866         mad_queue->count = 0;
2867         spin_lock_init(&mad_queue->lock);
2868         INIT_LIST_HEAD(&mad_queue->list);
2869 }
2870
2871 static void init_mad_qp(struct ib_mad_port_private *port_priv,
2872                         struct ib_mad_qp_info *qp_info)
2873 {
2874         qp_info->port_priv = port_priv;
2875         init_mad_queue(qp_info, &qp_info->send_queue);
2876         init_mad_queue(qp_info, &qp_info->recv_queue);
2877         INIT_LIST_HEAD(&qp_info->overflow_list);
2878         spin_lock_init(&qp_info->snoop_lock);
2879         qp_info->snoop_table = NULL;
2880         qp_info->snoop_table_size = 0;
2881         atomic_set(&qp_info->snoop_count, 0);
2882 }
2883
2884 static int create_mad_qp(struct ib_mad_qp_info *qp_info,
2885                          enum ib_qp_type qp_type)
2886 {
2887         struct ib_qp_init_attr  qp_init_attr;
2888         int ret;
2889
2890         memset(&qp_init_attr, 0, sizeof qp_init_attr);
2891         qp_init_attr.send_cq = qp_info->port_priv->cq;
2892         qp_init_attr.recv_cq = qp_info->port_priv->cq;
2893         qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
2894         qp_init_attr.cap.max_send_wr = mad_sendq_size;
2895         qp_init_attr.cap.max_recv_wr = mad_recvq_size;
2896         qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
2897         qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
2898         qp_init_attr.qp_type = qp_type;
2899         qp_init_attr.port_num = qp_info->port_priv->port_num;
2900         qp_init_attr.qp_context = qp_info;
2901         qp_init_attr.event_handler = qp_event_handler;
2902         qp_info->qp = ib_create_qp(qp_info->port_priv->pd, &qp_init_attr);
2903         if (IS_ERR(qp_info->qp)) {
2904                 dev_err(&qp_info->port_priv->device->dev,
2905                         "Couldn't create ib_mad QP%d\n",
2906                         get_spl_qp_index(qp_type));
2907                 ret = PTR_ERR(qp_info->qp);
2908                 goto error;
2909         }
2910         /* Use minimum queue sizes unless the CQ is resized */
2911         qp_info->send_queue.max_active = mad_sendq_size;
2912         qp_info->recv_queue.max_active = mad_recvq_size;
2913         return 0;
2914
2915 error:
2916         return ret;
2917 }
2918
2919 static void destroy_mad_qp(struct ib_mad_qp_info *qp_info)
2920 {
2921         if (!qp_info->qp)
2922                 return;
2923
2924         ib_destroy_qp(qp_info->qp);
2925         kfree(qp_info->snoop_table);
2926 }
2927
2928 /*
2929  * Open the port
2930  * Create the QP, PD, MR, and CQ if needed
2931  */
2932 static int ib_mad_port_open(struct ib_device *device,
2933                             int port_num)
2934 {
2935         int ret, cq_size;
2936         struct ib_mad_port_private *port_priv;
2937         unsigned long flags;
2938         char name[sizeof "ib_mad123"];
2939         int has_smi;
2940         struct ib_cq_init_attr cq_attr = {};
2941
2942         /* Create new device info */
2943         port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
2944         if (!port_priv) {
2945                 dev_err(&device->dev, "No memory for ib_mad_port_private\n");
2946                 return -ENOMEM;
2947         }
2948
2949         port_priv->device = device;
2950         port_priv->port_num = port_num;
2951         spin_lock_init(&port_priv->reg_lock);
2952         INIT_LIST_HEAD(&port_priv->agent_list);
2953         init_mad_qp(port_priv, &port_priv->qp_info[0]);
2954         init_mad_qp(port_priv, &port_priv->qp_info[1]);
2955
2956         cq_size = mad_sendq_size + mad_recvq_size;
2957         has_smi = rdma_cap_ib_smi(device, port_num);
2958         if (has_smi)
2959                 cq_size *= 2;
2960
2961         cq_attr.cqe = cq_size;
2962         port_priv->cq = ib_create_cq(port_priv->device,
2963                                      ib_mad_thread_completion_handler,
2964                                      NULL, port_priv, &cq_attr);
2965         if (IS_ERR(port_priv->cq)) {
2966                 dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
2967                 ret = PTR_ERR(port_priv->cq);
2968                 goto error3;
2969         }
2970
2971         port_priv->pd = ib_alloc_pd(device);
2972         if (IS_ERR(port_priv->pd)) {
2973                 dev_err(&device->dev, "Couldn't create ib_mad PD\n");
2974                 ret = PTR_ERR(port_priv->pd);
2975                 goto error4;
2976         }
2977
2978         port_priv->mr = ib_get_dma_mr(port_priv->pd, IB_ACCESS_LOCAL_WRITE);
2979         if (IS_ERR(port_priv->mr)) {
2980                 dev_err(&device->dev, "Couldn't get ib_mad DMA MR\n");
2981                 ret = PTR_ERR(port_priv->mr);
2982                 goto error5;
2983         }
2984
2985         if (has_smi) {
2986                 ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
2987                 if (ret)
2988                         goto error6;
2989         }
2990         ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
2991         if (ret)
2992                 goto error7;
2993
2994         snprintf(name, sizeof name, "ib_mad%d", port_num);
2995         port_priv->wq = create_singlethread_workqueue(name);
2996         if (!port_priv->wq) {
2997                 ret = -ENOMEM;
2998                 goto error8;
2999         }
3000         INIT_WORK(&port_priv->work, ib_mad_completion_handler);
3001
3002         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3003         list_add_tail(&port_priv->port_list, &ib_mad_port_list);
3004         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3005
3006         ret = ib_mad_port_start(port_priv);
3007         if (ret) {
3008                 dev_err(&device->dev, "Couldn't start port\n");
3009                 goto error9;
3010         }
3011
3012         return 0;
3013
3014 error9:
3015         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3016         list_del_init(&port_priv->port_list);
3017         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3018
3019         destroy_workqueue(port_priv->wq);
3020 error8:
3021         destroy_mad_qp(&port_priv->qp_info[1]);
3022 error7:
3023         destroy_mad_qp(&port_priv->qp_info[0]);
3024 error6:
3025         ib_dereg_mr(port_priv->mr);
3026 error5:
3027         ib_dealloc_pd(port_priv->pd);
3028 error4:
3029         ib_destroy_cq(port_priv->cq);
3030         cleanup_recv_queue(&port_priv->qp_info[1]);
3031         cleanup_recv_queue(&port_priv->qp_info[0]);
3032 error3:
3033         kfree(port_priv);
3034
3035         return ret;
3036 }
3037
3038 /*
3039  * Close the port
3040  * If there are no classes using the port, free the port
3041  * resources (CQ, MR, PD, QP) and remove the port's info structure
3042  */
3043 static int ib_mad_port_close(struct ib_device *device, int port_num)
3044 {
3045         struct ib_mad_port_private *port_priv;
3046         unsigned long flags;
3047
3048         spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3049         port_priv = __ib_get_mad_port(device, port_num);
3050         if (port_priv == NULL) {
3051                 spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3052                 dev_err(&device->dev, "Port %d not found\n", port_num);
3053                 return -ENODEV;
3054         }
3055         list_del_init(&port_priv->port_list);
3056         spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3057
3058         destroy_workqueue(port_priv->wq);
3059         destroy_mad_qp(&port_priv->qp_info[1]);
3060         destroy_mad_qp(&port_priv->qp_info[0]);
3061         ib_dereg_mr(port_priv->mr);
3062         ib_dealloc_pd(port_priv->pd);
3063         ib_destroy_cq(port_priv->cq);
3064         cleanup_recv_queue(&port_priv->qp_info[1]);
3065         cleanup_recv_queue(&port_priv->qp_info[0]);
3066         /* XXX: Handle deallocation of MAD registration tables */
3067
3068         kfree(port_priv);
3069
3070         return 0;
3071 }
3072
3073 static void ib_mad_init_device(struct ib_device *device)
3074 {
3075         int start, end, i;
3076
3077         if (device->node_type == RDMA_NODE_IB_SWITCH) {
3078                 start = 0;
3079                 end   = 0;
3080         } else {
3081                 start = 1;
3082                 end   = device->phys_port_cnt;
3083         }
3084
3085         for (i = start; i <= end; i++) {
3086                 if (!rdma_cap_ib_mad(device, i))
3087                         continue;
3088
3089                 if (ib_mad_port_open(device, i)) {
3090                         dev_err(&device->dev, "Couldn't open port %d\n", i);
3091                         goto error;
3092                 }
3093                 if (ib_agent_port_open(device, i)) {
3094                         dev_err(&device->dev,
3095                                 "Couldn't open port %d for agents\n", i);
3096                         goto error_agent;
3097                 }
3098         }
3099         return;
3100
3101 error_agent:
3102         if (ib_mad_port_close(device, i))
3103                 dev_err(&device->dev, "Couldn't close port %d\n", i);
3104
3105 error:
3106         while (--i >= start) {
3107                 if (!rdma_cap_ib_mad(device, i))
3108                         continue;
3109
3110                 if (ib_agent_port_close(device, i))
3111                         dev_err(&device->dev,
3112                                 "Couldn't close port %d for agents\n", i);
3113                 if (ib_mad_port_close(device, i))
3114                         dev_err(&device->dev, "Couldn't close port %d\n", i);
3115         }
3116 }
3117
3118 static void ib_mad_remove_device(struct ib_device *device)
3119 {
3120         int start, end, i;
3121
3122         if (device->node_type == RDMA_NODE_IB_SWITCH) {
3123                 start = 0;
3124                 end   = 0;
3125         } else {
3126                 start = 1;
3127                 end   = device->phys_port_cnt;
3128         }
3129
3130         for (i = start; i <= end; i++) {
3131                 if (!rdma_cap_ib_mad(device, i))
3132                         continue;
3133
3134                 if (ib_agent_port_close(device, i))
3135                         dev_err(&device->dev,
3136                                 "Couldn't close port %d for agents\n", i);
3137                 if (ib_mad_port_close(device, i))
3138                         dev_err(&device->dev, "Couldn't close port %d\n", i);
3139         }
3140 }
3141
3142 static struct ib_client mad_client = {
3143         .name   = "mad",
3144         .add = ib_mad_init_device,
3145         .remove = ib_mad_remove_device
3146 };
3147
3148 static int __init ib_mad_init_module(void)
3149 {
3150         int ret;
3151
3152         mad_recvq_size = min(mad_recvq_size, IB_MAD_QP_MAX_SIZE);
3153         mad_recvq_size = max(mad_recvq_size, IB_MAD_QP_MIN_SIZE);
3154
3155         mad_sendq_size = min(mad_sendq_size, IB_MAD_QP_MAX_SIZE);
3156         mad_sendq_size = max(mad_sendq_size, IB_MAD_QP_MIN_SIZE);
3157
3158         ib_mad_cache = kmem_cache_create("ib_mad",
3159                                          sizeof(struct ib_mad_private),
3160                                          0,
3161                                          SLAB_HWCACHE_ALIGN,
3162                                          NULL);
3163         if (!ib_mad_cache) {
3164                 pr_err("Couldn't create ib_mad cache\n");
3165                 ret = -ENOMEM;
3166                 goto error1;
3167         }
3168
3169         INIT_LIST_HEAD(&ib_mad_port_list);
3170
3171         if (ib_register_client(&mad_client)) {
3172                 pr_err("Couldn't register ib_mad client\n");
3173                 ret = -EINVAL;
3174                 goto error2;
3175         }
3176
3177         return 0;
3178
3179 error2:
3180         kmem_cache_destroy(ib_mad_cache);
3181 error1:
3182         return ret;
3183 }
3184
3185 static void __exit ib_mad_cleanup_module(void)
3186 {
3187         ib_unregister_client(&mad_client);
3188         kmem_cache_destroy(ib_mad_cache);
3189 }
3190
3191 module_init(ib_mad_init_module);
3192 module_exit(ib_mad_cleanup_module);