1 /*
2  * Copyright (c) 2005 Intel Inc. All rights reserved.
3  * Copyright (c) 2005-2006 Voltaire, Inc. All rights reserved.
4  *
5  * This software is available to you under a choice of one of two
6  * licenses.  You may choose to be licensed under the terms of the GNU
7  * General Public License (GPL) Version 2, available from the file
8  * COPYING in the main directory of this source tree, or the
9  * OpenIB.org BSD license below:
10  *
11  *     Redistribution and use in source and binary forms, with or
12  *     without modification, are permitted provided that the following
13  *     conditions are met:
14  *
15  *      - Redistributions of source code must retain the above
16  *        copyright notice, this list of conditions and the following
17  *        disclaimer.
18  *
19  *      - Redistributions in binary form must reproduce the above
20  *        copyright notice, this list of conditions and the following
21  *        disclaimer in the documentation and/or other materials
22  *        provided with the distribution.
23  *
24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
25  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
26  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
27  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
28  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
29  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
30  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
31  * SOFTWARE.
32  */
33 
34 #include <linux/slab.h>
35 
36 #include "mad_priv.h"
37 #include "mad_rmpp.h"
38 
39 enum rmpp_state {
40 	RMPP_STATE_ACTIVE,
41 	RMPP_STATE_TIMEOUT,
42 	RMPP_STATE_COMPLETE,
43 	RMPP_STATE_CANCELING
44 };
45 
46 struct mad_rmpp_recv {
47 	struct ib_mad_agent_private *agent;
48 	struct list_head list;
49 	struct delayed_work timeout_work;
50 	struct delayed_work cleanup_work;
51 	struct completion comp;
52 	enum rmpp_state state;
53 	spinlock_t lock;
54 	atomic_t refcount;
55 
56 	struct ib_ah *ah;
57 	struct ib_mad_recv_wc *rmpp_wc;
58 	struct ib_mad_recv_buf *cur_seg_buf;
59 	int last_ack;
60 	int seg_num;
61 	int newwin;
62 	int repwin;
63 
64 	__be64 tid;
65 	u32 src_qp;
66 	u16 slid;
67 	u8 mgmt_class;
68 	u8 class_version;
69 	u8 method;
70 };
71 
72 static inline void deref_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
73 {
74 	if (atomic_dec_and_test(&rmpp_recv->refcount))
75 		complete(&rmpp_recv->comp);
76 }
77 
78 static void destroy_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
79 {
80 	deref_rmpp_recv(rmpp_recv);
81 	wait_for_completion(&rmpp_recv->comp);
82 	ib_destroy_ah(rmpp_recv->ah);
83 	kfree(rmpp_recv);
84 }
85 
86 void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent)
87 {
88 	struct mad_rmpp_recv *rmpp_recv, *temp_rmpp_recv;
89 	unsigned long flags;
90 
91 	spin_lock_irqsave(&agent->lock, flags);
92 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
93 		if (rmpp_recv->state != RMPP_STATE_COMPLETE)
94 			ib_free_recv_mad(rmpp_recv->rmpp_wc);
95 		rmpp_recv->state = RMPP_STATE_CANCELING;
96 	}
97 	spin_unlock_irqrestore(&agent->lock, flags);
98 
99 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
100 		cancel_delayed_work(&rmpp_recv->timeout_work);
101 		cancel_delayed_work(&rmpp_recv->cleanup_work);
102 	}
103 
104 	flush_workqueue(agent->qp_info->port_priv->wq);
105 
106 	list_for_each_entry_safe(rmpp_recv, temp_rmpp_recv,
107 				 &agent->rmpp_list, list) {
108 		list_del(&rmpp_recv->list);
109 		destroy_rmpp_recv(rmpp_recv);
110 	}
111 }
112 
113 static void format_ack(struct ib_mad_send_buf *msg,
114 		       struct ib_rmpp_mad *data,
115 		       struct mad_rmpp_recv *rmpp_recv)
116 {
117 	struct ib_rmpp_mad *ack = msg->mad;
118 	unsigned long flags;
119 
120 	memcpy(ack, &data->mad_hdr, msg->hdr_len);
121 
122 	ack->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
123 	ack->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ACK;
124 	ib_set_rmpp_flags(&ack->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
125 
126 	spin_lock_irqsave(&rmpp_recv->lock, flags);
127 	rmpp_recv->last_ack = rmpp_recv->seg_num;
128 	ack->rmpp_hdr.seg_num = cpu_to_be32(rmpp_recv->seg_num);
129 	ack->rmpp_hdr.paylen_newwin = cpu_to_be32(rmpp_recv->newwin);
130 	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
131 }
132 
133 static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
134 		     struct ib_mad_recv_wc *recv_wc)
135 {
136 	struct ib_mad_send_buf *msg;
137 	int ret, hdr_len;
138 
139 	hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
140 	msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
141 				 recv_wc->wc->pkey_index, 1, hdr_len,
142 				 0, GFP_KERNEL,
143 				 IB_MGMT_BASE_VERSION);
144 	if (IS_ERR(msg))
145 		return;
146 
147 	format_ack(msg, (struct ib_rmpp_mad *) recv_wc->recv_buf.mad, rmpp_recv);
148 	msg->ah = rmpp_recv->ah;
149 	ret = ib_post_send_mad(msg, NULL);
150 	if (ret)
151 		ib_free_send_mad(msg);
152 }
153 
154 static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
155 						  struct ib_mad_recv_wc *recv_wc)
156 {
157 	struct ib_mad_send_buf *msg;
158 	struct ib_ah *ah;
159 	int hdr_len;
160 
161 	ah = ib_create_ah_from_wc(agent->qp->pd, recv_wc->wc,
162 				  recv_wc->recv_buf.grh, agent->port_num);
163 	if (IS_ERR(ah))
164 		return (void *) ah;
165 
166 	hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
167 	msg = ib_create_send_mad(agent, recv_wc->wc->src_qp,
168 				 recv_wc->wc->pkey_index, 1,
169 				 hdr_len, 0, GFP_KERNEL,
170 				 IB_MGMT_BASE_VERSION);
171 	if (IS_ERR(msg))
172 		ib_destroy_ah(ah);
173 	else {
174 		msg->ah = ah;
175 		msg->context[0] = ah;
176 	}
177 
178 	return msg;
179 }
180 
181 static void ack_ds_ack(struct ib_mad_agent_private *agent,
182 		       struct ib_mad_recv_wc *recv_wc)
183 {
184 	struct ib_mad_send_buf *msg;
185 	struct ib_rmpp_mad *rmpp_mad;
186 	int ret;
187 
188 	msg = alloc_response_msg(&agent->agent, recv_wc);
189 	if (IS_ERR(msg))
190 		return;
191 
192 	rmpp_mad = msg->mad;
193 	memcpy(rmpp_mad, recv_wc->recv_buf.mad, msg->hdr_len);
194 
195 	rmpp_mad->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
196 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
197 	rmpp_mad->rmpp_hdr.seg_num = 0;
198 	rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(1);
199 
200 	ret = ib_post_send_mad(msg, NULL);
201 	if (ret) {
202 		ib_destroy_ah(msg->ah);
203 		ib_free_send_mad(msg);
204 	}
205 }
206 
207 void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)
208 {
209 	if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)
210 		ib_destroy_ah(mad_send_wc->send_buf->ah);
211 	ib_free_send_mad(mad_send_wc->send_buf);
212 }
213 
214 static void nack_recv(struct ib_mad_agent_private *agent,
215 		      struct ib_mad_recv_wc *recv_wc, u8 rmpp_status)
216 {
217 	struct ib_mad_send_buf *msg;
218 	struct ib_rmpp_mad *rmpp_mad;
219 	int ret;
220 
221 	msg = alloc_response_msg(&agent->agent, recv_wc);
222 	if (IS_ERR(msg))
223 		return;
224 
225 	rmpp_mad = msg->mad;
226 	memcpy(rmpp_mad, recv_wc->recv_buf.mad, msg->hdr_len);
227 
228 	rmpp_mad->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
229 	rmpp_mad->rmpp_hdr.rmpp_version = IB_MGMT_RMPP_VERSION;
230 	rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ABORT;
231 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
232 	rmpp_mad->rmpp_hdr.rmpp_status = rmpp_status;
233 	rmpp_mad->rmpp_hdr.seg_num = 0;
234 	rmpp_mad->rmpp_hdr.paylen_newwin = 0;
235 
236 	ret = ib_post_send_mad(msg, NULL);
237 	if (ret) {
238 		ib_destroy_ah(msg->ah);
239 		ib_free_send_mad(msg);
240 	}
241 }
242 
243 static void recv_timeout_handler(struct work_struct *work)
244 {
245 	struct mad_rmpp_recv *rmpp_recv =
246 		container_of(work, struct mad_rmpp_recv, timeout_work.work);
247 	struct ib_mad_recv_wc *rmpp_wc;
248 	unsigned long flags;
249 
250 	spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
251 	if (rmpp_recv->state != RMPP_STATE_ACTIVE) {
252 		spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
253 		return;
254 	}
255 	rmpp_recv->state = RMPP_STATE_TIMEOUT;
256 	list_del(&rmpp_recv->list);
257 	spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
258 
259 	rmpp_wc = rmpp_recv->rmpp_wc;
260 	nack_recv(rmpp_recv->agent, rmpp_wc, IB_MGMT_RMPP_STATUS_T2L);
261 	destroy_rmpp_recv(rmpp_recv);
262 	ib_free_recv_mad(rmpp_wc);
263 }
264 
265 static void recv_cleanup_handler(struct work_struct *work)
266 {
267 	struct mad_rmpp_recv *rmpp_recv =
268 		container_of(work, struct mad_rmpp_recv, cleanup_work.work);
269 	unsigned long flags;
270 
271 	spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
272 	if (rmpp_recv->state == RMPP_STATE_CANCELING) {
273 		spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
274 		return;
275 	}
276 	list_del(&rmpp_recv->list);
277 	spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
278 	destroy_rmpp_recv(rmpp_recv);
279 }
280 
281 static struct mad_rmpp_recv *
282 create_rmpp_recv(struct ib_mad_agent_private *agent,
283 		 struct ib_mad_recv_wc *mad_recv_wc)
284 {
285 	struct mad_rmpp_recv *rmpp_recv;
286 	struct ib_mad_hdr *mad_hdr;
287 
288 	rmpp_recv = kmalloc(sizeof *rmpp_recv, GFP_KERNEL);
289 	if (!rmpp_recv)
290 		return NULL;
291 
292 	rmpp_recv->ah = ib_create_ah_from_wc(agent->agent.qp->pd,
293 					     mad_recv_wc->wc,
294 					     mad_recv_wc->recv_buf.grh,
295 					     agent->agent.port_num);
296 	if (IS_ERR(rmpp_recv->ah))
297 		goto error;
298 
299 	rmpp_recv->agent = agent;
300 	init_completion(&rmpp_recv->comp);
301 	INIT_DELAYED_WORK(&rmpp_recv->timeout_work, recv_timeout_handler);
302 	INIT_DELAYED_WORK(&rmpp_recv->cleanup_work, recv_cleanup_handler);
303 	spin_lock_init(&rmpp_recv->lock);
304 	rmpp_recv->state = RMPP_STATE_ACTIVE;
305 	atomic_set(&rmpp_recv->refcount, 1);
306 
307 	rmpp_recv->rmpp_wc = mad_recv_wc;
308 	rmpp_recv->cur_seg_buf = &mad_recv_wc->recv_buf;
309 	rmpp_recv->newwin = 1;
310 	rmpp_recv->seg_num = 1;
311 	rmpp_recv->last_ack = 0;
312 	rmpp_recv->repwin = 1;
313 
314 	mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
315 	rmpp_recv->tid = mad_hdr->tid;
316 	rmpp_recv->src_qp = mad_recv_wc->wc->src_qp;
317 	rmpp_recv->slid = mad_recv_wc->wc->slid;
318 	rmpp_recv->mgmt_class = mad_hdr->mgmt_class;
319 	rmpp_recv->class_version = mad_hdr->class_version;
320 	rmpp_recv->method  = mad_hdr->method;
321 	return rmpp_recv;
322 
323 error:	kfree(rmpp_recv);
324 	return NULL;
325 }
326 
327 static struct mad_rmpp_recv *
328 find_rmpp_recv(struct ib_mad_agent_private *agent,
329 	       struct ib_mad_recv_wc *mad_recv_wc)
330 {
331 	struct mad_rmpp_recv *rmpp_recv;
332 	struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
333 
334 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
335 		if (rmpp_recv->tid == mad_hdr->tid &&
336 		    rmpp_recv->src_qp == mad_recv_wc->wc->src_qp &&
337 		    rmpp_recv->slid == mad_recv_wc->wc->slid &&
338 		    rmpp_recv->mgmt_class == mad_hdr->mgmt_class &&
339 		    rmpp_recv->class_version == mad_hdr->class_version &&
340 		    rmpp_recv->method == mad_hdr->method)
341 			return rmpp_recv;
342 	}
343 	return NULL;
344 }
345 
346 static struct mad_rmpp_recv *
347 acquire_rmpp_recv(struct ib_mad_agent_private *agent,
348 		  struct ib_mad_recv_wc *mad_recv_wc)
349 {
350 	struct mad_rmpp_recv *rmpp_recv;
351 	unsigned long flags;
352 
353 	spin_lock_irqsave(&agent->lock, flags);
354 	rmpp_recv = find_rmpp_recv(agent, mad_recv_wc);
355 	if (rmpp_recv)
356 		atomic_inc(&rmpp_recv->refcount);
357 	spin_unlock_irqrestore(&agent->lock, flags);
358 	return rmpp_recv;
359 }
360 
361 static struct mad_rmpp_recv *
362 insert_rmpp_recv(struct ib_mad_agent_private *agent,
363 		 struct mad_rmpp_recv *rmpp_recv)
364 {
365 	struct mad_rmpp_recv *cur_rmpp_recv;
366 
367 	cur_rmpp_recv = find_rmpp_recv(agent, rmpp_recv->rmpp_wc);
368 	if (!cur_rmpp_recv)
369 		list_add_tail(&rmpp_recv->list, &agent->rmpp_list);
370 
371 	return cur_rmpp_recv;
372 }
373 
374 static inline int get_last_flag(struct ib_mad_recv_buf *seg)
375 {
376 	struct ib_rmpp_mad *rmpp_mad;
377 
378 	rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
379 	return ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & IB_MGMT_RMPP_FLAG_LAST;
380 }
381 
382 static inline int get_seg_num(struct ib_mad_recv_buf *seg)
383 {
384 	struct ib_rmpp_mad *rmpp_mad;
385 
386 	rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
387 	return be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
388 }
389 
390 static inline struct ib_mad_recv_buf * get_next_seg(struct list_head *rmpp_list,
391 						    struct ib_mad_recv_buf *seg)
392 {
393 	if (seg->list.next == rmpp_list)
394 		return NULL;
395 
396 	return container_of(seg->list.next, struct ib_mad_recv_buf, list);
397 }
398 
399 static inline int window_size(struct ib_mad_agent_private *agent)
400 {
401 	return max(agent->qp_info->recv_queue.max_active >> 3, 1);
402 }
403 
404 static struct ib_mad_recv_buf * find_seg_location(struct list_head *rmpp_list,
405 						  int seg_num)
406 {
407 	struct ib_mad_recv_buf *seg_buf;
408 	int cur_seg_num;
409 
410 	list_for_each_entry_reverse(seg_buf, rmpp_list, list) {
411 		cur_seg_num = get_seg_num(seg_buf);
412 		if (seg_num > cur_seg_num)
413 			return seg_buf;
414 		if (seg_num == cur_seg_num)
415 			break;
416 	}
417 	return NULL;
418 }
419 
420 static void update_seg_num(struct mad_rmpp_recv *rmpp_recv,
421 			   struct ib_mad_recv_buf *new_buf)
422 {
423 	struct list_head *rmpp_list = &rmpp_recv->rmpp_wc->rmpp_list;
424 
425 	while (new_buf && (get_seg_num(new_buf) == rmpp_recv->seg_num + 1)) {
426 		rmpp_recv->cur_seg_buf = new_buf;
427 		rmpp_recv->seg_num++;
428 		new_buf = get_next_seg(rmpp_list, new_buf);
429 	}
430 }
431 
432 static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
433 {
434 	struct ib_rmpp_mad *rmpp_mad;
435 	int hdr_size, data_size, pad;
436 
437 	rmpp_mad = (struct ib_rmpp_mad *)rmpp_recv->cur_seg_buf->mad;
438 
439 	hdr_size = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class);
440 	data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
441 	pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
442 	if (pad > IB_MGMT_RMPP_DATA || pad < 0)
443 		pad = 0;
444 
445 	return hdr_size + rmpp_recv->seg_num * data_size - pad;
446 }
447 
448 static struct ib_mad_recv_wc * complete_rmpp(struct mad_rmpp_recv *rmpp_recv)
449 {
450 	struct ib_mad_recv_wc *rmpp_wc;
451 
452 	ack_recv(rmpp_recv, rmpp_recv->rmpp_wc);
453 	if (rmpp_recv->seg_num > 1)
454 		cancel_delayed_work(&rmpp_recv->timeout_work);
455 
456 	rmpp_wc = rmpp_recv->rmpp_wc;
457 	rmpp_wc->mad_len = get_mad_len(rmpp_recv);
458 	/* 10 seconds until we can find the packet lifetime */
459 	queue_delayed_work(rmpp_recv->agent->qp_info->port_priv->wq,
460 			   &rmpp_recv->cleanup_work, msecs_to_jiffies(10000));
461 	return rmpp_wc;
462 }
463 
464 static struct ib_mad_recv_wc *
465 continue_rmpp(struct ib_mad_agent_private *agent,
466 	      struct ib_mad_recv_wc *mad_recv_wc)
467 {
468 	struct mad_rmpp_recv *rmpp_recv;
469 	struct ib_mad_recv_buf *prev_buf;
470 	struct ib_mad_recv_wc *done_wc;
471 	int seg_num;
472 	unsigned long flags;
473 
474 	rmpp_recv = acquire_rmpp_recv(agent, mad_recv_wc);
475 	if (!rmpp_recv)
476 		goto drop1;
477 
478 	seg_num = get_seg_num(&mad_recv_wc->recv_buf);
479 
480 	spin_lock_irqsave(&rmpp_recv->lock, flags);
481 	if ((rmpp_recv->state == RMPP_STATE_TIMEOUT) ||
482 	    (seg_num > rmpp_recv->newwin))
483 		goto drop3;
484 
485 	if ((seg_num <= rmpp_recv->last_ack) ||
486 	    (rmpp_recv->state == RMPP_STATE_COMPLETE)) {
487 		spin_unlock_irqrestore(&rmpp_recv->lock, flags);
488 		ack_recv(rmpp_recv, mad_recv_wc);
489 		goto drop2;
490 	}
491 
492 	prev_buf = find_seg_location(&rmpp_recv->rmpp_wc->rmpp_list, seg_num);
493 	if (!prev_buf)
494 		goto drop3;
495 
496 	done_wc = NULL;
497 	list_add(&mad_recv_wc->recv_buf.list, &prev_buf->list);
498 	if (rmpp_recv->cur_seg_buf == prev_buf) {
499 		update_seg_num(rmpp_recv, &mad_recv_wc->recv_buf);
500 		if (get_last_flag(rmpp_recv->cur_seg_buf)) {
501 			rmpp_recv->state = RMPP_STATE_COMPLETE;
502 			spin_unlock_irqrestore(&rmpp_recv->lock, flags);
503 			done_wc = complete_rmpp(rmpp_recv);
504 			goto out;
505 		} else if (rmpp_recv->seg_num == rmpp_recv->newwin) {
506 			rmpp_recv->newwin += window_size(agent);
507 			spin_unlock_irqrestore(&rmpp_recv->lock, flags);
508 			ack_recv(rmpp_recv, mad_recv_wc);
509 			goto out;
510 		}
511 	}
512 	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
513 out:
514 	deref_rmpp_recv(rmpp_recv);
515 	return done_wc;
516 
517 drop3:	spin_unlock_irqrestore(&rmpp_recv->lock, flags);
518 drop2:	deref_rmpp_recv(rmpp_recv);
519 drop1:	ib_free_recv_mad(mad_recv_wc);
520 	return NULL;
521 }
522 
523 static struct ib_mad_recv_wc *
524 start_rmpp(struct ib_mad_agent_private *agent,
525 	   struct ib_mad_recv_wc *mad_recv_wc)
526 {
527 	struct mad_rmpp_recv *rmpp_recv;
528 	unsigned long flags;
529 
530 	rmpp_recv = create_rmpp_recv(agent, mad_recv_wc);
531 	if (!rmpp_recv) {
532 		ib_free_recv_mad(mad_recv_wc);
533 		return NULL;
534 	}
535 
536 	spin_lock_irqsave(&agent->lock, flags);
537 	if (insert_rmpp_recv(agent, rmpp_recv)) {
538 		spin_unlock_irqrestore(&agent->lock, flags);
539 		/* duplicate first MAD */
540 		destroy_rmpp_recv(rmpp_recv);
541 		return continue_rmpp(agent, mad_recv_wc);
542 	}
543 	atomic_inc(&rmpp_recv->refcount);
544 
545 	if (get_last_flag(&mad_recv_wc->recv_buf)) {
546 		rmpp_recv->state = RMPP_STATE_COMPLETE;
547 		spin_unlock_irqrestore(&agent->lock, flags);
548 		complete_rmpp(rmpp_recv);
549 	} else {
550 		spin_unlock_irqrestore(&agent->lock, flags);
551 		/* 40 seconds until we can find the packet lifetimes */
552 		queue_delayed_work(agent->qp_info->port_priv->wq,
553 				   &rmpp_recv->timeout_work,
554 				   msecs_to_jiffies(40000));
555 		rmpp_recv->newwin += window_size(agent);
556 		ack_recv(rmpp_recv, mad_recv_wc);
557 		mad_recv_wc = NULL;
558 	}
559 	deref_rmpp_recv(rmpp_recv);
560 	return mad_recv_wc;
561 }
562 
563 static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
564 {
565 	struct ib_rmpp_mad *rmpp_mad;
566 	int timeout;
567 	u32 paylen = 0;
568 
569 	rmpp_mad = mad_send_wr->send_buf.mad;
570 	ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
571 	rmpp_mad->rmpp_hdr.seg_num = cpu_to_be32(++mad_send_wr->seg_num);
572 
573 	if (mad_send_wr->seg_num == 1) {
574 		rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
575 		paylen = mad_send_wr->send_buf.seg_count * IB_MGMT_RMPP_DATA -
576 			 mad_send_wr->pad;
577 	}
578 
579 	if (mad_send_wr->seg_num == mad_send_wr->send_buf.seg_count) {
580 		rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
581 		paylen = IB_MGMT_RMPP_DATA - mad_send_wr->pad;
582 	}
583 	rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
584 
585 	/* 2 seconds for an ACK until we can find the packet lifetime */
586 	timeout = mad_send_wr->send_buf.timeout_ms;
587 	if (!timeout || timeout > 2000)
588 		mad_send_wr->timeout = msecs_to_jiffies(2000);
589 
590 	return ib_send_mad(mad_send_wr);
591 }
592 
593 static void abort_send(struct ib_mad_agent_private *agent,
594 		       struct ib_mad_recv_wc *mad_recv_wc, u8 rmpp_status)
595 {
596 	struct ib_mad_send_wr_private *mad_send_wr;
597 	struct ib_mad_send_wc wc;
598 	unsigned long flags;
599 
600 	spin_lock_irqsave(&agent->lock, flags);
601 	mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
602 	if (!mad_send_wr)
603 		goto out;	/* Unmatched send */
604 
605 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) ||
606 	    (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
607 		goto out;	/* Send is already done */
608 
609 	ib_mark_mad_done(mad_send_wr);
610 	spin_unlock_irqrestore(&agent->lock, flags);
611 
612 	wc.status = IB_WC_REM_ABORT_ERR;
613 	wc.vendor_err = rmpp_status;
614 	wc.send_buf = &mad_send_wr->send_buf;
615 	ib_mad_complete_send_wr(mad_send_wr, &wc);
616 	return;
617 out:
618 	spin_unlock_irqrestore(&agent->lock, flags);
619 }
620 
621 static inline void adjust_last_ack(struct ib_mad_send_wr_private *wr,
622 				   int seg_num)
623 {
624 	struct list_head *list;
625 
626 	wr->last_ack = seg_num;
627 	list = &wr->last_ack_seg->list;
628 	list_for_each_entry(wr->last_ack_seg, list, list)
629 		if (wr->last_ack_seg->num == seg_num)
630 			break;
631 }
632 
633 static void process_ds_ack(struct ib_mad_agent_private *agent,
634 			   struct ib_mad_recv_wc *mad_recv_wc, int newwin)
635 {
636 	struct mad_rmpp_recv *rmpp_recv;
637 
638 	rmpp_recv = find_rmpp_recv(agent, mad_recv_wc);
639 	if (rmpp_recv && rmpp_recv->state == RMPP_STATE_COMPLETE)
640 		rmpp_recv->repwin = newwin;
641 }
642 
643 static void process_rmpp_ack(struct ib_mad_agent_private *agent,
644 			     struct ib_mad_recv_wc *mad_recv_wc)
645 {
646 	struct ib_mad_send_wr_private *mad_send_wr;
647 	struct ib_rmpp_mad *rmpp_mad;
648 	unsigned long flags;
649 	int seg_num, newwin, ret;
650 
651 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
652 	if (rmpp_mad->rmpp_hdr.rmpp_status) {
653 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
654 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
655 		return;
656 	}
657 
658 	seg_num = be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
659 	newwin = be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
660 	if (newwin < seg_num) {
661 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
662 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
663 		return;
664 	}
665 
666 	spin_lock_irqsave(&agent->lock, flags);
667 	mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
668 	if (!mad_send_wr) {
669 		if (!seg_num)
670 			process_ds_ack(agent, mad_recv_wc, newwin);
671 		goto out;	/* Unmatched or DS RMPP ACK */
672 	}
673 
674 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) &&
675 	    (mad_send_wr->timeout)) {
676 		spin_unlock_irqrestore(&agent->lock, flags);
677 		ack_ds_ack(agent, mad_recv_wc);
678 		return;		/* Repeated ACK for DS RMPP transaction */
679 	}
680 
681 	if ((mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) ||
682 	    (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
683 		goto out;	/* Send is already done */
684 
685 	if (seg_num > mad_send_wr->send_buf.seg_count ||
686 	    seg_num > mad_send_wr->newwin) {
687 		spin_unlock_irqrestore(&agent->lock, flags);
688 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
689 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
690 		return;
691 	}
692 
693 	if (newwin < mad_send_wr->newwin || seg_num < mad_send_wr->last_ack)
694 		goto out;	/* Old ACK */
695 
696 	if (seg_num > mad_send_wr->last_ack) {
697 		adjust_last_ack(mad_send_wr, seg_num);
698 		mad_send_wr->retries_left = mad_send_wr->max_retries;
699 	}
700 	mad_send_wr->newwin = newwin;
701 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) {
702 		/* If no response is expected, the ACK completes the send */
703 		if (!mad_send_wr->send_buf.timeout_ms) {
704 			struct ib_mad_send_wc wc;
705 
706 			ib_mark_mad_done(mad_send_wr);
707 			spin_unlock_irqrestore(&agent->lock, flags);
708 
709 			wc.status = IB_WC_SUCCESS;
710 			wc.vendor_err = 0;
711 			wc.send_buf = &mad_send_wr->send_buf;
712 			ib_mad_complete_send_wr(mad_send_wr, &wc);
713 			return;
714 		}
715 		if (mad_send_wr->refcount == 1)
716 			ib_reset_mad_timeout(mad_send_wr,
717 					     mad_send_wr->send_buf.timeout_ms);
718 		spin_unlock_irqrestore(&agent->lock, flags);
719 		ack_ds_ack(agent, mad_recv_wc);
720 		return;
721 	} else if (mad_send_wr->refcount == 1 &&
722 		   mad_send_wr->seg_num < mad_send_wr->newwin &&
723 		   mad_send_wr->seg_num < mad_send_wr->send_buf.seg_count) {
724 		/* Send failure will just result in a timeout/retry */
725 		ret = send_next_seg(mad_send_wr);
726 		if (ret)
727 			goto out;
728 
729 		mad_send_wr->refcount++;
730 		list_move_tail(&mad_send_wr->agent_list,
731 			      &mad_send_wr->mad_agent_priv->send_list);
732 	}
733 out:
734 	spin_unlock_irqrestore(&agent->lock, flags);
735 }
736 
737 static struct ib_mad_recv_wc *
738 process_rmpp_data(struct ib_mad_agent_private *agent,
739 		  struct ib_mad_recv_wc *mad_recv_wc)
740 {
741 	struct ib_rmpp_hdr *rmpp_hdr;
742 	u8 rmpp_status;
743 
744 	rmpp_hdr = &((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr;
745 
746 	if (rmpp_hdr->rmpp_status) {
747 		rmpp_status = IB_MGMT_RMPP_STATUS_BAD_STATUS;
748 		goto bad;
749 	}
750 
751 	if (rmpp_hdr->seg_num == cpu_to_be32(1)) {
752 		if (!(ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST)) {
753 			rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
754 			goto bad;
755 		}
756 		return start_rmpp(agent, mad_recv_wc);
757 	} else {
758 		if (ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST) {
759 			rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
760 			goto bad;
761 		}
762 		return continue_rmpp(agent, mad_recv_wc);
763 	}
764 bad:
765 	nack_recv(agent, mad_recv_wc, rmpp_status);
766 	ib_free_recv_mad(mad_recv_wc);
767 	return NULL;
768 }
769 
770 static void process_rmpp_stop(struct ib_mad_agent_private *agent,
771 			      struct ib_mad_recv_wc *mad_recv_wc)
772 {
773 	struct ib_rmpp_mad *rmpp_mad;
774 
775 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
776 
777 	if (rmpp_mad->rmpp_hdr.rmpp_status != IB_MGMT_RMPP_STATUS_RESX) {
778 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
779 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
780 	} else
781 		abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
782 }
783 
784 static void process_rmpp_abort(struct ib_mad_agent_private *agent,
785 			       struct ib_mad_recv_wc *mad_recv_wc)
786 {
787 	struct ib_rmpp_mad *rmpp_mad;
788 
789 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
790 
791 	if (rmpp_mad->rmpp_hdr.rmpp_status < IB_MGMT_RMPP_STATUS_ABORT_MIN ||
792 	    rmpp_mad->rmpp_hdr.rmpp_status > IB_MGMT_RMPP_STATUS_ABORT_MAX) {
793 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
794 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
795 	} else
796 		abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
797 }
798 
799 struct ib_mad_recv_wc *
800 ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
801 			struct ib_mad_recv_wc *mad_recv_wc)
802 {
803 	struct ib_rmpp_mad *rmpp_mad;
804 
805 	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
806 	if (!(rmpp_mad->rmpp_hdr.rmpp_rtime_flags & IB_MGMT_RMPP_FLAG_ACTIVE))
807 		return mad_recv_wc;
808 
809 	if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION) {
810 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
811 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
812 		goto out;
813 	}
814 
815 	switch (rmpp_mad->rmpp_hdr.rmpp_type) {
816 	case IB_MGMT_RMPP_TYPE_DATA:
817 		return process_rmpp_data(agent, mad_recv_wc);
818 	case IB_MGMT_RMPP_TYPE_ACK:
819 		process_rmpp_ack(agent, mad_recv_wc);
820 		break;
821 	case IB_MGMT_RMPP_TYPE_STOP:
822 		process_rmpp_stop(agent, mad_recv_wc);
823 		break;
824 	case IB_MGMT_RMPP_TYPE_ABORT:
825 		process_rmpp_abort(agent, mad_recv_wc);
826 		break;
827 	default:
828 		abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
829 		nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
830 		break;
831 	}
832 out:
833 	ib_free_recv_mad(mad_recv_wc);
834 	return NULL;
835 }
836 
837 static int init_newwin(struct ib_mad_send_wr_private *mad_send_wr)
838 {
839 	struct ib_mad_agent_private *agent = mad_send_wr->mad_agent_priv;
840 	struct ib_mad_hdr *mad_hdr = mad_send_wr->send_buf.mad;
841 	struct mad_rmpp_recv *rmpp_recv;
842 	struct ib_ah_attr ah_attr;
843 	unsigned long flags;
844 	int newwin = 1;
845 
846 	if (!(mad_hdr->method & IB_MGMT_METHOD_RESP))
847 		goto out;
848 
849 	spin_lock_irqsave(&agent->lock, flags);
850 	list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
851 		if (rmpp_recv->tid != mad_hdr->tid ||
852 		    rmpp_recv->mgmt_class != mad_hdr->mgmt_class ||
853 		    rmpp_recv->class_version != mad_hdr->class_version ||
854 		    (rmpp_recv->method & IB_MGMT_METHOD_RESP))
855 			continue;
856 
857 		if (ib_query_ah(mad_send_wr->send_buf.ah, &ah_attr))
858 			continue;
859 
860 		if (rmpp_recv->slid == ah_attr.dlid) {
861 			newwin = rmpp_recv->repwin;
862 			break;
863 		}
864 	}
865 	spin_unlock_irqrestore(&agent->lock, flags);
866 out:
867 	return newwin;
868 }
869 
870 int ib_send_rmpp_mad(struct ib_mad_send_wr_private *mad_send_wr)
871 {
872 	struct ib_rmpp_mad *rmpp_mad;
873 	int ret;
874 
875 	rmpp_mad = mad_send_wr->send_buf.mad;
876 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
877 	      IB_MGMT_RMPP_FLAG_ACTIVE))
878 		return IB_RMPP_RESULT_UNHANDLED;
879 
880 	if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA) {
881 		mad_send_wr->seg_num = 1;
882 		return IB_RMPP_RESULT_INTERNAL;
883 	}
884 
885 	mad_send_wr->newwin = init_newwin(mad_send_wr);
886 
887 	/* We need to wait for the final ACK even if there isn't a response */
888 	mad_send_wr->refcount += (mad_send_wr->timeout == 0);
889 	ret = send_next_seg(mad_send_wr);
890 	if (!ret)
891 		return IB_RMPP_RESULT_CONSUMED;
892 	return ret;
893 }
894 
895 int ib_process_rmpp_send_wc(struct ib_mad_send_wr_private *mad_send_wr,
896 			    struct ib_mad_send_wc *mad_send_wc)
897 {
898 	struct ib_rmpp_mad *rmpp_mad;
899 	int ret;
900 
901 	rmpp_mad = mad_send_wr->send_buf.mad;
902 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
903 	      IB_MGMT_RMPP_FLAG_ACTIVE))
904 		return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
905 
906 	if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA)
907 		return IB_RMPP_RESULT_INTERNAL;	 /* ACK, STOP, or ABORT */
908 
909 	if (mad_send_wc->status != IB_WC_SUCCESS ||
910 	    mad_send_wr->status != IB_WC_SUCCESS)
911 		return IB_RMPP_RESULT_PROCESSED; /* Canceled or send error */
912 
913 	if (!mad_send_wr->timeout)
914 		return IB_RMPP_RESULT_PROCESSED; /* Response received */
915 
916 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count) {
917 		mad_send_wr->timeout =
918 			msecs_to_jiffies(mad_send_wr->send_buf.timeout_ms);
919 		return IB_RMPP_RESULT_PROCESSED; /* Send done */
920 	}
921 
922 	if (mad_send_wr->seg_num == mad_send_wr->newwin ||
923 	    mad_send_wr->seg_num == mad_send_wr->send_buf.seg_count)
924 		return IB_RMPP_RESULT_PROCESSED; /* Wait for ACK */
925 
926 	ret = send_next_seg(mad_send_wr);
927 	if (ret) {
928 		mad_send_wc->status = IB_WC_GENERAL_ERR;
929 		return IB_RMPP_RESULT_PROCESSED;
930 	}
931 	return IB_RMPP_RESULT_CONSUMED;
932 }
933 
934 int ib_retry_rmpp(struct ib_mad_send_wr_private *mad_send_wr)
935 {
936 	struct ib_rmpp_mad *rmpp_mad;
937 	int ret;
938 
939 	rmpp_mad = mad_send_wr->send_buf.mad;
940 	if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
941 	      IB_MGMT_RMPP_FLAG_ACTIVE))
942 		return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
943 
944 	if (mad_send_wr->last_ack == mad_send_wr->send_buf.seg_count)
945 		return IB_RMPP_RESULT_PROCESSED;
946 
947 	mad_send_wr->seg_num = mad_send_wr->last_ack;
948 	mad_send_wr->cur_seg = mad_send_wr->last_ack_seg;
949 
950 	ret = send_next_seg(mad_send_wr);
951 	if (ret)
952 		return IB_RMPP_RESULT_PROCESSED;
953 
954 	return IB_RMPP_RESULT_CONSUMED;
955 }
956