1 // SPDX-License-Identifier: GPL-2.0 or BSD-3-Clause
2 
3 /* Authors: Bernard Metzler <bmt@zurich.ibm.com> */
4 /* Copyright (c) 2008-2019, IBM Corporation */
5 
6 #include <linux/errno.h>
7 #include <linux/types.h>
8 #include <linux/uaccess.h>
9 #include <linux/vmalloc.h>
10 #include <linux/xarray.h>
11 
12 #include <rdma/iw_cm.h>
13 #include <rdma/ib_verbs.h>
14 #include <rdma/ib_user_verbs.h>
15 #include <rdma/uverbs_ioctl.h>
16 
17 #include "siw.h"
18 #include "siw_verbs.h"
19 #include "siw_mem.h"
20 
21 static int ib_qp_state_to_siw_qp_state[IB_QPS_ERR + 1] = {
22 	[IB_QPS_RESET] = SIW_QP_STATE_IDLE,
23 	[IB_QPS_INIT] = SIW_QP_STATE_IDLE,
24 	[IB_QPS_RTR] = SIW_QP_STATE_RTR,
25 	[IB_QPS_RTS] = SIW_QP_STATE_RTS,
26 	[IB_QPS_SQD] = SIW_QP_STATE_CLOSING,
27 	[IB_QPS_SQE] = SIW_QP_STATE_TERMINATE,
28 	[IB_QPS_ERR] = SIW_QP_STATE_ERROR
29 };
30 
31 static char ib_qp_state_to_string[IB_QPS_ERR + 1][sizeof("RESET")] = {
32 	[IB_QPS_RESET] = "RESET", [IB_QPS_INIT] = "INIT", [IB_QPS_RTR] = "RTR",
33 	[IB_QPS_RTS] = "RTS",     [IB_QPS_SQD] = "SQD",   [IB_QPS_SQE] = "SQE",
34 	[IB_QPS_ERR] = "ERR"
35 };
36 
37 void siw_mmap_free(struct rdma_user_mmap_entry *rdma_entry)
38 {
39 	struct siw_user_mmap_entry *entry = to_siw_mmap_entry(rdma_entry);
40 
41 	kfree(entry);
42 }
43 
44 int siw_mmap(struct ib_ucontext *ctx, struct vm_area_struct *vma)
45 {
46 	struct siw_ucontext *uctx = to_siw_ctx(ctx);
47 	size_t size = vma->vm_end - vma->vm_start;
48 	struct rdma_user_mmap_entry *rdma_entry;
49 	struct siw_user_mmap_entry *entry;
50 	int rv = -EINVAL;
51 
52 	/*
53 	 * Must be page aligned
54 	 */
55 	if (vma->vm_start & (PAGE_SIZE - 1)) {
56 		pr_warn("siw: mmap not page aligned\n");
57 		return -EINVAL;
58 	}
59 	rdma_entry = rdma_user_mmap_entry_get(&uctx->base_ucontext, vma);
60 	if (!rdma_entry) {
61 		siw_dbg(&uctx->sdev->base_dev, "mmap lookup failed: %lu, %#zx\n",
62 			vma->vm_pgoff, size);
63 		return -EINVAL;
64 	}
65 	entry = to_siw_mmap_entry(rdma_entry);
66 
67 	rv = remap_vmalloc_range(vma, entry->address, 0);
68 	if (rv) {
69 		pr_warn("remap_vmalloc_range failed: %lu, %zu\n", vma->vm_pgoff,
70 			size);
71 		goto out;
72 	}
73 out:
74 	rdma_user_mmap_entry_put(rdma_entry);
75 
76 	return rv;
77 }
78 
79 int siw_alloc_ucontext(struct ib_ucontext *base_ctx, struct ib_udata *udata)
80 {
81 	struct siw_device *sdev = to_siw_dev(base_ctx->device);
82 	struct siw_ucontext *ctx = to_siw_ctx(base_ctx);
83 	struct siw_uresp_alloc_ctx uresp = {};
84 	int rv;
85 
86 	if (atomic_inc_return(&sdev->num_ctx) > SIW_MAX_CONTEXT) {
87 		rv = -ENOMEM;
88 		goto err_out;
89 	}
90 	ctx->sdev = sdev;
91 
92 	uresp.dev_id = sdev->vendor_part_id;
93 
94 	if (udata->outlen < sizeof(uresp)) {
95 		rv = -EINVAL;
96 		goto err_out;
97 	}
98 	rv = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
99 	if (rv)
100 		goto err_out;
101 
102 	siw_dbg(base_ctx->device, "success. now %d context(s)\n",
103 		atomic_read(&sdev->num_ctx));
104 
105 	return 0;
106 
107 err_out:
108 	atomic_dec(&sdev->num_ctx);
109 	siw_dbg(base_ctx->device, "failure %d. now %d context(s)\n", rv,
110 		atomic_read(&sdev->num_ctx));
111 
112 	return rv;
113 }
114 
115 void siw_dealloc_ucontext(struct ib_ucontext *base_ctx)
116 {
117 	struct siw_ucontext *uctx = to_siw_ctx(base_ctx);
118 
119 	atomic_dec(&uctx->sdev->num_ctx);
120 }
121 
122 int siw_query_device(struct ib_device *base_dev, struct ib_device_attr *attr,
123 		     struct ib_udata *udata)
124 {
125 	struct siw_device *sdev = to_siw_dev(base_dev);
126 
127 	if (udata->inlen || udata->outlen)
128 		return -EINVAL;
129 
130 	memset(attr, 0, sizeof(*attr));
131 
132 	/* Revisit atomic caps if RFC 7306 gets supported */
133 	attr->atomic_cap = 0;
134 	attr->device_cap_flags =
135 		IB_DEVICE_MEM_MGT_EXTENSIONS | IB_DEVICE_ALLOW_USER_UNREG;
136 	attr->max_cq = sdev->attrs.max_cq;
137 	attr->max_cqe = sdev->attrs.max_cqe;
138 	attr->max_fast_reg_page_list_len = SIW_MAX_SGE_PBL;
139 	attr->max_mr = sdev->attrs.max_mr;
140 	attr->max_mw = sdev->attrs.max_mw;
141 	attr->max_mr_size = ~0ull;
142 	attr->max_pd = sdev->attrs.max_pd;
143 	attr->max_qp = sdev->attrs.max_qp;
144 	attr->max_qp_init_rd_atom = sdev->attrs.max_ird;
145 	attr->max_qp_rd_atom = sdev->attrs.max_ord;
146 	attr->max_qp_wr = sdev->attrs.max_qp_wr;
147 	attr->max_recv_sge = sdev->attrs.max_sge;
148 	attr->max_res_rd_atom = sdev->attrs.max_qp * sdev->attrs.max_ird;
149 	attr->max_send_sge = sdev->attrs.max_sge;
150 	attr->max_sge_rd = sdev->attrs.max_sge_rd;
151 	attr->max_srq = sdev->attrs.max_srq;
152 	attr->max_srq_sge = sdev->attrs.max_srq_sge;
153 	attr->max_srq_wr = sdev->attrs.max_srq_wr;
154 	attr->page_size_cap = PAGE_SIZE;
155 	attr->vendor_id = SIW_VENDOR_ID;
156 	attr->vendor_part_id = sdev->vendor_part_id;
157 
158 	memcpy(&attr->sys_image_guid, sdev->netdev->dev_addr, 6);
159 
160 	return 0;
161 }
162 
163 int siw_query_port(struct ib_device *base_dev, u8 port,
164 		   struct ib_port_attr *attr)
165 {
166 	struct siw_device *sdev = to_siw_dev(base_dev);
167 	int rv;
168 
169 	memset(attr, 0, sizeof(*attr));
170 
171 	rv = ib_get_eth_speed(base_dev, port, &attr->active_speed,
172 			 &attr->active_width);
173 	attr->gid_tbl_len = 1;
174 	attr->max_msg_sz = -1;
175 	attr->max_mtu = ib_mtu_int_to_enum(sdev->netdev->mtu);
176 	attr->active_mtu = ib_mtu_int_to_enum(sdev->netdev->mtu);
177 	attr->phys_state = sdev->state == IB_PORT_ACTIVE ?
178 		IB_PORT_PHYS_STATE_LINK_UP : IB_PORT_PHYS_STATE_DISABLED;
179 	attr->pkey_tbl_len = 1;
180 	attr->port_cap_flags = IB_PORT_CM_SUP | IB_PORT_DEVICE_MGMT_SUP;
181 	attr->state = sdev->state;
182 	/*
183 	 * All zero
184 	 *
185 	 * attr->lid = 0;
186 	 * attr->bad_pkey_cntr = 0;
187 	 * attr->qkey_viol_cntr = 0;
188 	 * attr->sm_lid = 0;
189 	 * attr->lmc = 0;
190 	 * attr->max_vl_num = 0;
191 	 * attr->sm_sl = 0;
192 	 * attr->subnet_timeout = 0;
193 	 * attr->init_type_repy = 0;
194 	 */
195 	return rv;
196 }
197 
198 int siw_get_port_immutable(struct ib_device *base_dev, u8 port,
199 			   struct ib_port_immutable *port_immutable)
200 {
201 	struct ib_port_attr attr;
202 	int rv = siw_query_port(base_dev, port, &attr);
203 
204 	if (rv)
205 		return rv;
206 
207 	port_immutable->pkey_tbl_len = attr.pkey_tbl_len;
208 	port_immutable->gid_tbl_len = attr.gid_tbl_len;
209 	port_immutable->core_cap_flags = RDMA_CORE_PORT_IWARP;
210 
211 	return 0;
212 }
213 
214 int siw_query_pkey(struct ib_device *base_dev, u8 port, u16 idx, u16 *pkey)
215 {
216 	/* Report the default pkey */
217 	*pkey = 0xffff;
218 	return 0;
219 }
220 
221 int siw_query_gid(struct ib_device *base_dev, u8 port, int idx,
222 		  union ib_gid *gid)
223 {
224 	struct siw_device *sdev = to_siw_dev(base_dev);
225 
226 	/* subnet_prefix == interface_id == 0; */
227 	memset(gid, 0, sizeof(*gid));
228 	memcpy(&gid->raw[0], sdev->netdev->dev_addr, 6);
229 
230 	return 0;
231 }
232 
233 int siw_alloc_pd(struct ib_pd *pd, struct ib_udata *udata)
234 {
235 	struct siw_device *sdev = to_siw_dev(pd->device);
236 
237 	if (atomic_inc_return(&sdev->num_pd) > SIW_MAX_PD) {
238 		atomic_dec(&sdev->num_pd);
239 		return -ENOMEM;
240 	}
241 	siw_dbg_pd(pd, "now %d PD's(s)\n", atomic_read(&sdev->num_pd));
242 
243 	return 0;
244 }
245 
246 void siw_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata)
247 {
248 	struct siw_device *sdev = to_siw_dev(pd->device);
249 
250 	siw_dbg_pd(pd, "free PD\n");
251 	atomic_dec(&sdev->num_pd);
252 }
253 
254 void siw_qp_get_ref(struct ib_qp *base_qp)
255 {
256 	siw_qp_get(to_siw_qp(base_qp));
257 }
258 
259 void siw_qp_put_ref(struct ib_qp *base_qp)
260 {
261 	siw_qp_put(to_siw_qp(base_qp));
262 }
263 
264 static struct rdma_user_mmap_entry *
265 siw_mmap_entry_insert(struct siw_ucontext *uctx,
266 		      void *address, size_t length,
267 		      u64 *offset)
268 {
269 	struct siw_user_mmap_entry *entry = kzalloc(sizeof(*entry), GFP_KERNEL);
270 	int rv;
271 
272 	*offset = SIW_INVAL_UOBJ_KEY;
273 	if (!entry)
274 		return NULL;
275 
276 	entry->address = address;
277 
278 	rv = rdma_user_mmap_entry_insert(&uctx->base_ucontext,
279 					 &entry->rdma_entry,
280 					 length);
281 	if (rv) {
282 		kfree(entry);
283 		return NULL;
284 	}
285 
286 	*offset = rdma_user_mmap_get_offset(&entry->rdma_entry);
287 
288 	return &entry->rdma_entry;
289 }
290 
291 /*
292  * siw_create_qp()
293  *
294  * Create QP of requested size on given device.
295  *
296  * @pd:		Protection Domain
297  * @attrs:	Initial QP attributes.
298  * @udata:	used to provide QP ID, SQ and RQ size back to user.
299  */
300 
301 struct ib_qp *siw_create_qp(struct ib_pd *pd,
302 			    struct ib_qp_init_attr *attrs,
303 			    struct ib_udata *udata)
304 {
305 	struct siw_qp *qp = NULL;
306 	struct ib_device *base_dev = pd->device;
307 	struct siw_device *sdev = to_siw_dev(base_dev);
308 	struct siw_ucontext *uctx =
309 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
310 					  base_ucontext);
311 	struct siw_cq *scq = NULL, *rcq = NULL;
312 	unsigned long flags;
313 	int num_sqe, num_rqe, rv = 0;
314 	size_t length;
315 
316 	siw_dbg(base_dev, "create new QP\n");
317 
318 	if (atomic_inc_return(&sdev->num_qp) > SIW_MAX_QP) {
319 		siw_dbg(base_dev, "too many QP's\n");
320 		rv = -ENOMEM;
321 		goto err_out;
322 	}
323 	if (attrs->qp_type != IB_QPT_RC) {
324 		siw_dbg(base_dev, "only RC QP's supported\n");
325 		rv = -EOPNOTSUPP;
326 		goto err_out;
327 	}
328 	if ((attrs->cap.max_send_wr > SIW_MAX_QP_WR) ||
329 	    (attrs->cap.max_recv_wr > SIW_MAX_QP_WR) ||
330 	    (attrs->cap.max_send_sge > SIW_MAX_SGE) ||
331 	    (attrs->cap.max_recv_sge > SIW_MAX_SGE)) {
332 		siw_dbg(base_dev, "QP size error\n");
333 		rv = -EINVAL;
334 		goto err_out;
335 	}
336 	if (attrs->cap.max_inline_data > SIW_MAX_INLINE) {
337 		siw_dbg(base_dev, "max inline send: %d > %d\n",
338 			attrs->cap.max_inline_data, (int)SIW_MAX_INLINE);
339 		rv = -EINVAL;
340 		goto err_out;
341 	}
342 	/*
343 	 * NOTE: we allow for zero element SQ and RQ WQE's SGL's
344 	 * but not for a QP unable to hold any WQE (SQ + RQ)
345 	 */
346 	if (attrs->cap.max_send_wr + attrs->cap.max_recv_wr == 0) {
347 		siw_dbg(base_dev, "QP must have send or receive queue\n");
348 		rv = -EINVAL;
349 		goto err_out;
350 	}
351 	scq = to_siw_cq(attrs->send_cq);
352 	rcq = to_siw_cq(attrs->recv_cq);
353 
354 	if (!scq || (!rcq && !attrs->srq)) {
355 		siw_dbg(base_dev, "send CQ or receive CQ invalid\n");
356 		rv = -EINVAL;
357 		goto err_out;
358 	}
359 	qp = kzalloc(sizeof(*qp), GFP_KERNEL);
360 	if (!qp) {
361 		rv = -ENOMEM;
362 		goto err_out;
363 	}
364 	init_rwsem(&qp->state_lock);
365 	spin_lock_init(&qp->sq_lock);
366 	spin_lock_init(&qp->rq_lock);
367 	spin_lock_init(&qp->orq_lock);
368 
369 	rv = siw_qp_add(sdev, qp);
370 	if (rv)
371 		goto err_out;
372 
373 	/* All queue indices are derived from modulo operations
374 	 * on a free running 'get' (consumer) and 'put' (producer)
375 	 * unsigned counter. Having queue sizes at power of two
376 	 * avoids handling counter wrap around.
377 	 */
378 	num_sqe = roundup_pow_of_two(attrs->cap.max_send_wr);
379 	num_rqe = roundup_pow_of_two(attrs->cap.max_recv_wr);
380 
381 	if (udata)
382 		qp->sendq = vmalloc_user(num_sqe * sizeof(struct siw_sqe));
383 	else
384 		qp->sendq = vzalloc(num_sqe * sizeof(struct siw_sqe));
385 
386 	if (qp->sendq == NULL) {
387 		siw_dbg(base_dev, "SQ size %d alloc failed\n", num_sqe);
388 		rv = -ENOMEM;
389 		goto err_out_xa;
390 	}
391 	if (attrs->sq_sig_type != IB_SIGNAL_REQ_WR) {
392 		if (attrs->sq_sig_type == IB_SIGNAL_ALL_WR)
393 			qp->attrs.flags |= SIW_SIGNAL_ALL_WR;
394 		else {
395 			rv = -EINVAL;
396 			goto err_out_xa;
397 		}
398 	}
399 	qp->pd = pd;
400 	qp->scq = scq;
401 	qp->rcq = rcq;
402 
403 	if (attrs->srq) {
404 		/*
405 		 * SRQ support.
406 		 * Verbs 6.3.7: ignore RQ size, if SRQ present
407 		 * Verbs 6.3.5: do not check PD of SRQ against PD of QP
408 		 */
409 		qp->srq = to_siw_srq(attrs->srq);
410 		qp->attrs.rq_size = 0;
411 		siw_dbg(base_dev, "QP [%u]: SRQ attached\n",
412 			qp->base_qp.qp_num);
413 	} else if (num_rqe) {
414 		if (udata)
415 			qp->recvq =
416 				vmalloc_user(num_rqe * sizeof(struct siw_rqe));
417 		else
418 			qp->recvq = vzalloc(num_rqe * sizeof(struct siw_rqe));
419 
420 		if (qp->recvq == NULL) {
421 			siw_dbg(base_dev, "RQ size %d alloc failed\n", num_rqe);
422 			rv = -ENOMEM;
423 			goto err_out_xa;
424 		}
425 		qp->attrs.rq_size = num_rqe;
426 	}
427 	qp->attrs.sq_size = num_sqe;
428 	qp->attrs.sq_max_sges = attrs->cap.max_send_sge;
429 	qp->attrs.rq_max_sges = attrs->cap.max_recv_sge;
430 
431 	/* Make those two tunables fixed for now. */
432 	qp->tx_ctx.gso_seg_limit = 1;
433 	qp->tx_ctx.zcopy_tx = zcopy_tx;
434 
435 	qp->attrs.state = SIW_QP_STATE_IDLE;
436 
437 	if (udata) {
438 		struct siw_uresp_create_qp uresp = {};
439 
440 		uresp.num_sqe = num_sqe;
441 		uresp.num_rqe = num_rqe;
442 		uresp.qp_id = qp_id(qp);
443 
444 		if (qp->sendq) {
445 			length = num_sqe * sizeof(struct siw_sqe);
446 			qp->sq_entry =
447 				siw_mmap_entry_insert(uctx, qp->sendq,
448 						      length, &uresp.sq_key);
449 			if (!qp->sq_entry) {
450 				rv = -ENOMEM;
451 				goto err_out_xa;
452 			}
453 		}
454 
455 		if (qp->recvq) {
456 			length = num_rqe * sizeof(struct siw_rqe);
457 			qp->rq_entry =
458 				siw_mmap_entry_insert(uctx, qp->recvq,
459 						      length, &uresp.rq_key);
460 			if (!qp->rq_entry) {
461 				uresp.sq_key = SIW_INVAL_UOBJ_KEY;
462 				rv = -ENOMEM;
463 				goto err_out_xa;
464 			}
465 		}
466 
467 		if (udata->outlen < sizeof(uresp)) {
468 			rv = -EINVAL;
469 			goto err_out_xa;
470 		}
471 		rv = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
472 		if (rv)
473 			goto err_out_xa;
474 	}
475 	qp->tx_cpu = siw_get_tx_cpu(sdev);
476 	if (qp->tx_cpu < 0) {
477 		rv = -EINVAL;
478 		goto err_out_xa;
479 	}
480 	INIT_LIST_HEAD(&qp->devq);
481 	spin_lock_irqsave(&sdev->lock, flags);
482 	list_add_tail(&qp->devq, &sdev->qp_list);
483 	spin_unlock_irqrestore(&sdev->lock, flags);
484 
485 	return &qp->base_qp;
486 
487 err_out_xa:
488 	xa_erase(&sdev->qp_xa, qp_id(qp));
489 err_out:
490 	if (qp) {
491 		if (uctx) {
492 			rdma_user_mmap_entry_remove(qp->sq_entry);
493 			rdma_user_mmap_entry_remove(qp->rq_entry);
494 		}
495 		vfree(qp->sendq);
496 		vfree(qp->recvq);
497 		kfree(qp);
498 	}
499 	atomic_dec(&sdev->num_qp);
500 
501 	return ERR_PTR(rv);
502 }
503 
504 /*
505  * Minimum siw_query_qp() verb interface.
506  *
507  * @qp_attr_mask is not used but all available information is provided
508  */
509 int siw_query_qp(struct ib_qp *base_qp, struct ib_qp_attr *qp_attr,
510 		 int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
511 {
512 	struct siw_qp *qp;
513 	struct siw_device *sdev;
514 
515 	if (base_qp && qp_attr && qp_init_attr) {
516 		qp = to_siw_qp(base_qp);
517 		sdev = to_siw_dev(base_qp->device);
518 	} else {
519 		return -EINVAL;
520 	}
521 	qp_attr->cap.max_inline_data = SIW_MAX_INLINE;
522 	qp_attr->cap.max_send_wr = qp->attrs.sq_size;
523 	qp_attr->cap.max_send_sge = qp->attrs.sq_max_sges;
524 	qp_attr->cap.max_recv_wr = qp->attrs.rq_size;
525 	qp_attr->cap.max_recv_sge = qp->attrs.rq_max_sges;
526 	qp_attr->path_mtu = ib_mtu_int_to_enum(sdev->netdev->mtu);
527 	qp_attr->max_rd_atomic = qp->attrs.irq_size;
528 	qp_attr->max_dest_rd_atomic = qp->attrs.orq_size;
529 
530 	qp_attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE |
531 				   IB_ACCESS_REMOTE_WRITE |
532 				   IB_ACCESS_REMOTE_READ;
533 
534 	qp_init_attr->qp_type = base_qp->qp_type;
535 	qp_init_attr->send_cq = base_qp->send_cq;
536 	qp_init_attr->recv_cq = base_qp->recv_cq;
537 	qp_init_attr->srq = base_qp->srq;
538 
539 	qp_init_attr->cap = qp_attr->cap;
540 
541 	return 0;
542 }
543 
544 int siw_verbs_modify_qp(struct ib_qp *base_qp, struct ib_qp_attr *attr,
545 			int attr_mask, struct ib_udata *udata)
546 {
547 	struct siw_qp_attrs new_attrs;
548 	enum siw_qp_attr_mask siw_attr_mask = 0;
549 	struct siw_qp *qp = to_siw_qp(base_qp);
550 	int rv = 0;
551 
552 	if (!attr_mask)
553 		return 0;
554 
555 	memset(&new_attrs, 0, sizeof(new_attrs));
556 
557 	if (attr_mask & IB_QP_ACCESS_FLAGS) {
558 		siw_attr_mask = SIW_QP_ATTR_ACCESS_FLAGS;
559 
560 		if (attr->qp_access_flags & IB_ACCESS_REMOTE_READ)
561 			new_attrs.flags |= SIW_RDMA_READ_ENABLED;
562 		if (attr->qp_access_flags & IB_ACCESS_REMOTE_WRITE)
563 			new_attrs.flags |= SIW_RDMA_WRITE_ENABLED;
564 		if (attr->qp_access_flags & IB_ACCESS_MW_BIND)
565 			new_attrs.flags |= SIW_RDMA_BIND_ENABLED;
566 	}
567 	if (attr_mask & IB_QP_STATE) {
568 		siw_dbg_qp(qp, "desired IB QP state: %s\n",
569 			   ib_qp_state_to_string[attr->qp_state]);
570 
571 		new_attrs.state = ib_qp_state_to_siw_qp_state[attr->qp_state];
572 
573 		if (new_attrs.state > SIW_QP_STATE_RTS)
574 			qp->tx_ctx.tx_suspend = 1;
575 
576 		siw_attr_mask |= SIW_QP_ATTR_STATE;
577 	}
578 	if (!siw_attr_mask)
579 		goto out;
580 
581 	down_write(&qp->state_lock);
582 
583 	rv = siw_qp_modify(qp, &new_attrs, siw_attr_mask);
584 
585 	up_write(&qp->state_lock);
586 out:
587 	return rv;
588 }
589 
590 int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
591 {
592 	struct siw_qp *qp = to_siw_qp(base_qp);
593 	struct siw_ucontext *uctx =
594 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
595 					  base_ucontext);
596 	struct siw_qp_attrs qp_attrs;
597 
598 	siw_dbg_qp(qp, "state %d\n", qp->attrs.state);
599 
600 	/*
601 	 * Mark QP as in process of destruction to prevent from
602 	 * any async callbacks to RDMA core
603 	 */
604 	qp->attrs.flags |= SIW_QP_IN_DESTROY;
605 	qp->rx_stream.rx_suspend = 1;
606 
607 	if (uctx) {
608 		rdma_user_mmap_entry_remove(qp->sq_entry);
609 		rdma_user_mmap_entry_remove(qp->rq_entry);
610 	}
611 
612 	down_write(&qp->state_lock);
613 
614 	qp_attrs.state = SIW_QP_STATE_ERROR;
615 	siw_qp_modify(qp, &qp_attrs, SIW_QP_ATTR_STATE);
616 
617 	if (qp->cep) {
618 		siw_cep_put(qp->cep);
619 		qp->cep = NULL;
620 	}
621 	up_write(&qp->state_lock);
622 
623 	kfree(qp->tx_ctx.mpa_crc_hd);
624 	kfree(qp->rx_stream.mpa_crc_hd);
625 
626 	qp->scq = qp->rcq = NULL;
627 
628 	siw_qp_put(qp);
629 
630 	return 0;
631 }
632 
633 /*
634  * siw_copy_inline_sgl()
635  *
636  * Prepare sgl of inlined data for sending. For userland callers
637  * function checks if given buffer addresses and len's are within
638  * process context bounds.
639  * Data from all provided sge's are copied together into the wqe,
640  * referenced by a single sge.
641  */
642 static int siw_copy_inline_sgl(const struct ib_send_wr *core_wr,
643 			       struct siw_sqe *sqe)
644 {
645 	struct ib_sge *core_sge = core_wr->sg_list;
646 	void *kbuf = &sqe->sge[1];
647 	int num_sge = core_wr->num_sge, bytes = 0;
648 
649 	sqe->sge[0].laddr = (uintptr_t)kbuf;
650 	sqe->sge[0].lkey = 0;
651 
652 	while (num_sge--) {
653 		if (!core_sge->length) {
654 			core_sge++;
655 			continue;
656 		}
657 		bytes += core_sge->length;
658 		if (bytes > SIW_MAX_INLINE) {
659 			bytes = -EINVAL;
660 			break;
661 		}
662 		memcpy(kbuf, (void *)(uintptr_t)core_sge->addr,
663 		       core_sge->length);
664 
665 		kbuf += core_sge->length;
666 		core_sge++;
667 	}
668 	sqe->sge[0].length = bytes > 0 ? bytes : 0;
669 	sqe->num_sge = bytes > 0 ? 1 : 0;
670 
671 	return bytes;
672 }
673 
674 /* Complete SQ WR's without processing */
675 static int siw_sq_flush_wr(struct siw_qp *qp, const struct ib_send_wr *wr,
676 			   const struct ib_send_wr **bad_wr)
677 {
678 	struct siw_sqe sqe = {};
679 	int rv = 0;
680 
681 	while (wr) {
682 		sqe.id = wr->wr_id;
683 		sqe.opcode = wr->opcode;
684 		rv = siw_sqe_complete(qp, &sqe, 0, SIW_WC_WR_FLUSH_ERR);
685 		if (rv) {
686 			if (bad_wr)
687 				*bad_wr = wr;
688 			break;
689 		}
690 		wr = wr->next;
691 	}
692 	return rv;
693 }
694 
695 /* Complete RQ WR's without processing */
696 static int siw_rq_flush_wr(struct siw_qp *qp, const struct ib_recv_wr *wr,
697 			   const struct ib_recv_wr **bad_wr)
698 {
699 	struct siw_rqe rqe = {};
700 	int rv = 0;
701 
702 	while (wr) {
703 		rqe.id = wr->wr_id;
704 		rv = siw_rqe_complete(qp, &rqe, 0, 0, SIW_WC_WR_FLUSH_ERR);
705 		if (rv) {
706 			if (bad_wr)
707 				*bad_wr = wr;
708 			break;
709 		}
710 		wr = wr->next;
711 	}
712 	return rv;
713 }
714 
715 /*
716  * siw_post_send()
717  *
718  * Post a list of S-WR's to a SQ.
719  *
720  * @base_qp:	Base QP contained in siw QP
721  * @wr:		Null terminated list of user WR's
722  * @bad_wr:	Points to failing WR in case of synchronous failure.
723  */
724 int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
725 		  const struct ib_send_wr **bad_wr)
726 {
727 	struct siw_qp *qp = to_siw_qp(base_qp);
728 	struct siw_wqe *wqe = tx_wqe(qp);
729 
730 	unsigned long flags;
731 	int rv = 0;
732 
733 	if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
734 		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
735 		*bad_wr = wr;
736 		return -EINVAL;
737 	}
738 
739 	/*
740 	 * Try to acquire QP state lock. Must be non-blocking
741 	 * to accommodate kernel clients needs.
742 	 */
743 	if (!down_read_trylock(&qp->state_lock)) {
744 		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
745 			/*
746 			 * ERROR state is final, so we can be sure
747 			 * this state will not change as long as the QP
748 			 * exists.
749 			 *
750 			 * This handles an ib_drain_sq() call with
751 			 * a concurrent request to set the QP state
752 			 * to ERROR.
753 			 */
754 			rv = siw_sq_flush_wr(qp, wr, bad_wr);
755 		} else {
756 			siw_dbg_qp(qp, "QP locked, state %d\n",
757 				   qp->attrs.state);
758 			*bad_wr = wr;
759 			rv = -ENOTCONN;
760 		}
761 		return rv;
762 	}
763 	if (unlikely(qp->attrs.state != SIW_QP_STATE_RTS)) {
764 		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
765 			/*
766 			 * Immediately flush this WR to CQ, if QP
767 			 * is in ERROR state. SQ is guaranteed to
768 			 * be empty, so WR complets in-order.
769 			 *
770 			 * Typically triggered by ib_drain_sq().
771 			 */
772 			rv = siw_sq_flush_wr(qp, wr, bad_wr);
773 		} else {
774 			siw_dbg_qp(qp, "QP out of state %d\n",
775 				   qp->attrs.state);
776 			*bad_wr = wr;
777 			rv = -ENOTCONN;
778 		}
779 		up_read(&qp->state_lock);
780 		return rv;
781 	}
782 	spin_lock_irqsave(&qp->sq_lock, flags);
783 
784 	while (wr) {
785 		u32 idx = qp->sq_put % qp->attrs.sq_size;
786 		struct siw_sqe *sqe = &qp->sendq[idx];
787 
788 		if (sqe->flags) {
789 			siw_dbg_qp(qp, "sq full\n");
790 			rv = -ENOMEM;
791 			break;
792 		}
793 		if (wr->num_sge > qp->attrs.sq_max_sges) {
794 			siw_dbg_qp(qp, "too many sge's: %d\n", wr->num_sge);
795 			rv = -EINVAL;
796 			break;
797 		}
798 		sqe->id = wr->wr_id;
799 
800 		if ((wr->send_flags & IB_SEND_SIGNALED) ||
801 		    (qp->attrs.flags & SIW_SIGNAL_ALL_WR))
802 			sqe->flags |= SIW_WQE_SIGNALLED;
803 
804 		if (wr->send_flags & IB_SEND_FENCE)
805 			sqe->flags |= SIW_WQE_READ_FENCE;
806 
807 		switch (wr->opcode) {
808 		case IB_WR_SEND:
809 		case IB_WR_SEND_WITH_INV:
810 			if (wr->send_flags & IB_SEND_SOLICITED)
811 				sqe->flags |= SIW_WQE_SOLICITED;
812 
813 			if (!(wr->send_flags & IB_SEND_INLINE)) {
814 				siw_copy_sgl(wr->sg_list, sqe->sge,
815 					     wr->num_sge);
816 				sqe->num_sge = wr->num_sge;
817 			} else {
818 				rv = siw_copy_inline_sgl(wr, sqe);
819 				if (rv <= 0) {
820 					rv = -EINVAL;
821 					break;
822 				}
823 				sqe->flags |= SIW_WQE_INLINE;
824 				sqe->num_sge = 1;
825 			}
826 			if (wr->opcode == IB_WR_SEND)
827 				sqe->opcode = SIW_OP_SEND;
828 			else {
829 				sqe->opcode = SIW_OP_SEND_REMOTE_INV;
830 				sqe->rkey = wr->ex.invalidate_rkey;
831 			}
832 			break;
833 
834 		case IB_WR_RDMA_READ_WITH_INV:
835 		case IB_WR_RDMA_READ:
836 			/*
837 			 * iWarp restricts RREAD sink to SGL containing
838 			 * 1 SGE only. we could relax to SGL with multiple
839 			 * elements referring the SAME ltag or even sending
840 			 * a private per-rreq tag referring to a checked
841 			 * local sgl with MULTIPLE ltag's.
842 			 */
843 			if (unlikely(wr->num_sge != 1)) {
844 				rv = -EINVAL;
845 				break;
846 			}
847 			siw_copy_sgl(wr->sg_list, &sqe->sge[0], 1);
848 			/*
849 			 * NOTE: zero length RREAD is allowed!
850 			 */
851 			sqe->raddr = rdma_wr(wr)->remote_addr;
852 			sqe->rkey = rdma_wr(wr)->rkey;
853 			sqe->num_sge = 1;
854 
855 			if (wr->opcode == IB_WR_RDMA_READ)
856 				sqe->opcode = SIW_OP_READ;
857 			else
858 				sqe->opcode = SIW_OP_READ_LOCAL_INV;
859 			break;
860 
861 		case IB_WR_RDMA_WRITE:
862 			if (!(wr->send_flags & IB_SEND_INLINE)) {
863 				siw_copy_sgl(wr->sg_list, &sqe->sge[0],
864 					     wr->num_sge);
865 				sqe->num_sge = wr->num_sge;
866 			} else {
867 				rv = siw_copy_inline_sgl(wr, sqe);
868 				if (unlikely(rv < 0)) {
869 					rv = -EINVAL;
870 					break;
871 				}
872 				sqe->flags |= SIW_WQE_INLINE;
873 				sqe->num_sge = 1;
874 			}
875 			sqe->raddr = rdma_wr(wr)->remote_addr;
876 			sqe->rkey = rdma_wr(wr)->rkey;
877 			sqe->opcode = SIW_OP_WRITE;
878 			break;
879 
880 		case IB_WR_REG_MR:
881 			sqe->base_mr = (uintptr_t)reg_wr(wr)->mr;
882 			sqe->rkey = reg_wr(wr)->key;
883 			sqe->access = reg_wr(wr)->access & IWARP_ACCESS_MASK;
884 			sqe->opcode = SIW_OP_REG_MR;
885 			break;
886 
887 		case IB_WR_LOCAL_INV:
888 			sqe->rkey = wr->ex.invalidate_rkey;
889 			sqe->opcode = SIW_OP_INVAL_STAG;
890 			break;
891 
892 		default:
893 			siw_dbg_qp(qp, "ib wr type %d unsupported\n",
894 				   wr->opcode);
895 			rv = -EINVAL;
896 			break;
897 		}
898 		siw_dbg_qp(qp, "opcode %d, flags 0x%x, wr_id 0x%pK\n",
899 			   sqe->opcode, sqe->flags,
900 			   (void *)(uintptr_t)sqe->id);
901 
902 		if (unlikely(rv < 0))
903 			break;
904 
905 		/* make SQE only valid after completely written */
906 		smp_wmb();
907 		sqe->flags |= SIW_WQE_VALID;
908 
909 		qp->sq_put++;
910 		wr = wr->next;
911 	}
912 
913 	/*
914 	 * Send directly if SQ processing is not in progress.
915 	 * Eventual immediate errors (rv < 0) do not affect the involved
916 	 * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
917 	 * processing, if new work is already pending. But rv must be passed
918 	 * to caller.
919 	 */
920 	if (wqe->wr_status != SIW_WR_IDLE) {
921 		spin_unlock_irqrestore(&qp->sq_lock, flags);
922 		goto skip_direct_sending;
923 	}
924 	rv = siw_activate_tx(qp);
925 	spin_unlock_irqrestore(&qp->sq_lock, flags);
926 
927 	if (rv <= 0)
928 		goto skip_direct_sending;
929 
930 	if (rdma_is_kernel_res(&qp->base_qp.res)) {
931 		rv = siw_sq_start(qp);
932 	} else {
933 		qp->tx_ctx.in_syscall = 1;
934 
935 		if (siw_qp_sq_process(qp) != 0 && !(qp->tx_ctx.tx_suspend))
936 			siw_qp_cm_drop(qp, 0);
937 
938 		qp->tx_ctx.in_syscall = 0;
939 	}
940 skip_direct_sending:
941 
942 	up_read(&qp->state_lock);
943 
944 	if (rv >= 0)
945 		return 0;
946 	/*
947 	 * Immediate error
948 	 */
949 	siw_dbg_qp(qp, "error %d\n", rv);
950 
951 	*bad_wr = wr;
952 	return rv;
953 }
954 
955 /*
956  * siw_post_receive()
957  *
958  * Post a list of R-WR's to a RQ.
959  *
960  * @base_qp:	Base QP contained in siw QP
961  * @wr:		Null terminated list of user WR's
962  * @bad_wr:	Points to failing WR in case of synchronous failure.
963  */
964 int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr,
965 		     const struct ib_recv_wr **bad_wr)
966 {
967 	struct siw_qp *qp = to_siw_qp(base_qp);
968 	unsigned long flags;
969 	int rv = 0;
970 
971 	if (qp->srq) {
972 		*bad_wr = wr;
973 		return -EOPNOTSUPP; /* what else from errno.h? */
974 	}
975 	if (!rdma_is_kernel_res(&qp->base_qp.res)) {
976 		siw_dbg_qp(qp, "no kernel post_recv for user mapped rq\n");
977 		*bad_wr = wr;
978 		return -EINVAL;
979 	}
980 
981 	/*
982 	 * Try to acquire QP state lock. Must be non-blocking
983 	 * to accommodate kernel clients needs.
984 	 */
985 	if (!down_read_trylock(&qp->state_lock)) {
986 		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
987 			/*
988 			 * ERROR state is final, so we can be sure
989 			 * this state will not change as long as the QP
990 			 * exists.
991 			 *
992 			 * This handles an ib_drain_rq() call with
993 			 * a concurrent request to set the QP state
994 			 * to ERROR.
995 			 */
996 			rv = siw_rq_flush_wr(qp, wr, bad_wr);
997 		} else {
998 			siw_dbg_qp(qp, "QP locked, state %d\n",
999 				   qp->attrs.state);
1000 			*bad_wr = wr;
1001 			rv = -ENOTCONN;
1002 		}
1003 		return rv;
1004 	}
1005 	if (qp->attrs.state > SIW_QP_STATE_RTS) {
1006 		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
1007 			/*
1008 			 * Immediately flush this WR to CQ, if QP
1009 			 * is in ERROR state. RQ is guaranteed to
1010 			 * be empty, so WR complets in-order.
1011 			 *
1012 			 * Typically triggered by ib_drain_rq().
1013 			 */
1014 			rv = siw_rq_flush_wr(qp, wr, bad_wr);
1015 		} else {
1016 			siw_dbg_qp(qp, "QP out of state %d\n",
1017 				   qp->attrs.state);
1018 			*bad_wr = wr;
1019 			rv = -ENOTCONN;
1020 		}
1021 		up_read(&qp->state_lock);
1022 		return rv;
1023 	}
1024 	/*
1025 	 * Serialize potentially multiple producers.
1026 	 * Not needed for single threaded consumer side.
1027 	 */
1028 	spin_lock_irqsave(&qp->rq_lock, flags);
1029 
1030 	while (wr) {
1031 		u32 idx = qp->rq_put % qp->attrs.rq_size;
1032 		struct siw_rqe *rqe = &qp->recvq[idx];
1033 
1034 		if (rqe->flags) {
1035 			siw_dbg_qp(qp, "RQ full\n");
1036 			rv = -ENOMEM;
1037 			break;
1038 		}
1039 		if (wr->num_sge > qp->attrs.rq_max_sges) {
1040 			siw_dbg_qp(qp, "too many sge's: %d\n", wr->num_sge);
1041 			rv = -EINVAL;
1042 			break;
1043 		}
1044 		rqe->id = wr->wr_id;
1045 		rqe->num_sge = wr->num_sge;
1046 		siw_copy_sgl(wr->sg_list, rqe->sge, wr->num_sge);
1047 
1048 		/* make sure RQE is completely written before valid */
1049 		smp_wmb();
1050 
1051 		rqe->flags = SIW_WQE_VALID;
1052 
1053 		qp->rq_put++;
1054 		wr = wr->next;
1055 	}
1056 	spin_unlock_irqrestore(&qp->rq_lock, flags);
1057 
1058 	up_read(&qp->state_lock);
1059 
1060 	if (rv < 0) {
1061 		siw_dbg_qp(qp, "error %d\n", rv);
1062 		*bad_wr = wr;
1063 	}
1064 	return rv > 0 ? 0 : rv;
1065 }
1066 
1067 void siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata)
1068 {
1069 	struct siw_cq *cq = to_siw_cq(base_cq);
1070 	struct siw_device *sdev = to_siw_dev(base_cq->device);
1071 	struct siw_ucontext *ctx =
1072 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
1073 					  base_ucontext);
1074 
1075 	siw_dbg_cq(cq, "free CQ resources\n");
1076 
1077 	siw_cq_flush(cq);
1078 
1079 	if (ctx)
1080 		rdma_user_mmap_entry_remove(cq->cq_entry);
1081 
1082 	atomic_dec(&sdev->num_cq);
1083 
1084 	vfree(cq->queue);
1085 }
1086 
1087 /*
1088  * siw_create_cq()
1089  *
1090  * Populate CQ of requested size
1091  *
1092  * @base_cq: CQ as allocated by RDMA midlayer
1093  * @attr: Initial CQ attributes
1094  * @udata: relates to user context
1095  */
1096 
1097 int siw_create_cq(struct ib_cq *base_cq, const struct ib_cq_init_attr *attr,
1098 		  struct ib_udata *udata)
1099 {
1100 	struct siw_device *sdev = to_siw_dev(base_cq->device);
1101 	struct siw_cq *cq = to_siw_cq(base_cq);
1102 	int rv, size = attr->cqe;
1103 
1104 	if (atomic_inc_return(&sdev->num_cq) > SIW_MAX_CQ) {
1105 		siw_dbg(base_cq->device, "too many CQ's\n");
1106 		rv = -ENOMEM;
1107 		goto err_out;
1108 	}
1109 	if (size < 1 || size > sdev->attrs.max_cqe) {
1110 		siw_dbg(base_cq->device, "CQ size error: %d\n", size);
1111 		rv = -EINVAL;
1112 		goto err_out;
1113 	}
1114 	size = roundup_pow_of_two(size);
1115 	cq->base_cq.cqe = size;
1116 	cq->num_cqe = size;
1117 
1118 	if (udata)
1119 		cq->queue = vmalloc_user(size * sizeof(struct siw_cqe) +
1120 					 sizeof(struct siw_cq_ctrl));
1121 	else
1122 		cq->queue = vzalloc(size * sizeof(struct siw_cqe) +
1123 				    sizeof(struct siw_cq_ctrl));
1124 
1125 	if (cq->queue == NULL) {
1126 		rv = -ENOMEM;
1127 		goto err_out;
1128 	}
1129 	get_random_bytes(&cq->id, 4);
1130 	siw_dbg(base_cq->device, "new CQ [%u]\n", cq->id);
1131 
1132 	spin_lock_init(&cq->lock);
1133 
1134 	cq->notify = (struct siw_cq_ctrl *)&cq->queue[size];
1135 
1136 	if (udata) {
1137 		struct siw_uresp_create_cq uresp = {};
1138 		struct siw_ucontext *ctx =
1139 			rdma_udata_to_drv_context(udata, struct siw_ucontext,
1140 						  base_ucontext);
1141 		size_t length = size * sizeof(struct siw_cqe) +
1142 			sizeof(struct siw_cq_ctrl);
1143 
1144 		cq->cq_entry =
1145 			siw_mmap_entry_insert(ctx, cq->queue,
1146 					      length, &uresp.cq_key);
1147 		if (!cq->cq_entry) {
1148 			rv = -ENOMEM;
1149 			goto err_out;
1150 		}
1151 
1152 		uresp.cq_id = cq->id;
1153 		uresp.num_cqe = size;
1154 
1155 		if (udata->outlen < sizeof(uresp)) {
1156 			rv = -EINVAL;
1157 			goto err_out;
1158 		}
1159 		rv = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
1160 		if (rv)
1161 			goto err_out;
1162 	}
1163 	return 0;
1164 
1165 err_out:
1166 	siw_dbg(base_cq->device, "CQ creation failed: %d", rv);
1167 
1168 	if (cq && cq->queue) {
1169 		struct siw_ucontext *ctx =
1170 			rdma_udata_to_drv_context(udata, struct siw_ucontext,
1171 						  base_ucontext);
1172 		if (ctx)
1173 			rdma_user_mmap_entry_remove(cq->cq_entry);
1174 		vfree(cq->queue);
1175 	}
1176 	atomic_dec(&sdev->num_cq);
1177 
1178 	return rv;
1179 }
1180 
1181 /*
1182  * siw_poll_cq()
1183  *
1184  * Reap CQ entries if available and copy work completion status into
1185  * array of WC's provided by caller. Returns number of reaped CQE's.
1186  *
1187  * @base_cq:	Base CQ contained in siw CQ.
1188  * @num_cqe:	Maximum number of CQE's to reap.
1189  * @wc:		Array of work completions to be filled by siw.
1190  */
1191 int siw_poll_cq(struct ib_cq *base_cq, int num_cqe, struct ib_wc *wc)
1192 {
1193 	struct siw_cq *cq = to_siw_cq(base_cq);
1194 	int i;
1195 
1196 	for (i = 0; i < num_cqe; i++) {
1197 		if (!siw_reap_cqe(cq, wc))
1198 			break;
1199 		wc++;
1200 	}
1201 	return i;
1202 }
1203 
1204 /*
1205  * siw_req_notify_cq()
1206  *
1207  * Request notification for new CQE's added to that CQ.
1208  * Defined flags:
1209  * o SIW_CQ_NOTIFY_SOLICITED lets siw trigger a notification
1210  *   event if a WQE with notification flag set enters the CQ
1211  * o SIW_CQ_NOTIFY_NEXT_COMP lets siw trigger a notification
1212  *   event if a WQE enters the CQ.
1213  * o IB_CQ_REPORT_MISSED_EVENTS: return value will provide the
1214  *   number of not reaped CQE's regardless of its notification
1215  *   type and current or new CQ notification settings.
1216  *
1217  * @base_cq:	Base CQ contained in siw CQ.
1218  * @flags:	Requested notification flags.
1219  */
1220 int siw_req_notify_cq(struct ib_cq *base_cq, enum ib_cq_notify_flags flags)
1221 {
1222 	struct siw_cq *cq = to_siw_cq(base_cq);
1223 
1224 	siw_dbg_cq(cq, "flags: 0x%02x\n", flags);
1225 
1226 	if ((flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED)
1227 		/*
1228 		 * Enable CQ event for next solicited completion.
1229 		 * and make it visible to all associated producers.
1230 		 */
1231 		smp_store_mb(cq->notify->flags, SIW_NOTIFY_SOLICITED);
1232 	else
1233 		/*
1234 		 * Enable CQ event for any signalled completion.
1235 		 * and make it visible to all associated producers.
1236 		 */
1237 		smp_store_mb(cq->notify->flags, SIW_NOTIFY_ALL);
1238 
1239 	if (flags & IB_CQ_REPORT_MISSED_EVENTS)
1240 		return cq->cq_put - cq->cq_get;
1241 
1242 	return 0;
1243 }
1244 
1245 /*
1246  * siw_dereg_mr()
1247  *
1248  * Release Memory Region.
1249  *
1250  * @base_mr: Base MR contained in siw MR.
1251  * @udata: points to user context, unused.
1252  */
1253 int siw_dereg_mr(struct ib_mr *base_mr, struct ib_udata *udata)
1254 {
1255 	struct siw_mr *mr = to_siw_mr(base_mr);
1256 	struct siw_device *sdev = to_siw_dev(base_mr->device);
1257 
1258 	siw_dbg_mem(mr->mem, "deregister MR\n");
1259 
1260 	atomic_dec(&sdev->num_mr);
1261 
1262 	siw_mr_drop_mem(mr);
1263 	kfree_rcu(mr, rcu);
1264 
1265 	return 0;
1266 }
1267 
1268 /*
1269  * siw_reg_user_mr()
1270  *
1271  * Register Memory Region.
1272  *
1273  * @pd:		Protection Domain
1274  * @start:	starting address of MR (virtual address)
1275  * @len:	len of MR
1276  * @rnic_va:	not used by siw
1277  * @rights:	MR access rights
1278  * @udata:	user buffer to communicate STag and Key.
1279  */
1280 struct ib_mr *siw_reg_user_mr(struct ib_pd *pd, u64 start, u64 len,
1281 			      u64 rnic_va, int rights, struct ib_udata *udata)
1282 {
1283 	struct siw_mr *mr = NULL;
1284 	struct siw_umem *umem = NULL;
1285 	struct siw_ureq_reg_mr ureq;
1286 	struct siw_device *sdev = to_siw_dev(pd->device);
1287 
1288 	unsigned long mem_limit = rlimit(RLIMIT_MEMLOCK);
1289 	int rv;
1290 
1291 	siw_dbg_pd(pd, "start: 0x%pK, va: 0x%pK, len: %llu\n",
1292 		   (void *)(uintptr_t)start, (void *)(uintptr_t)rnic_va,
1293 		   (unsigned long long)len);
1294 
1295 	if (atomic_inc_return(&sdev->num_mr) > SIW_MAX_MR) {
1296 		siw_dbg_pd(pd, "too many mr's\n");
1297 		rv = -ENOMEM;
1298 		goto err_out;
1299 	}
1300 	if (!len) {
1301 		rv = -EINVAL;
1302 		goto err_out;
1303 	}
1304 	if (mem_limit != RLIM_INFINITY) {
1305 		unsigned long num_pages =
1306 			(PAGE_ALIGN(len + (start & ~PAGE_MASK))) >> PAGE_SHIFT;
1307 		mem_limit >>= PAGE_SHIFT;
1308 
1309 		if (num_pages > mem_limit - current->mm->locked_vm) {
1310 			siw_dbg_pd(pd, "pages req %lu, max %lu, lock %lu\n",
1311 				   num_pages, mem_limit,
1312 				   current->mm->locked_vm);
1313 			rv = -ENOMEM;
1314 			goto err_out;
1315 		}
1316 	}
1317 	umem = siw_umem_get(start, len, ib_access_writable(rights));
1318 	if (IS_ERR(umem)) {
1319 		rv = PTR_ERR(umem);
1320 		siw_dbg_pd(pd, "getting user memory failed: %d\n", rv);
1321 		umem = NULL;
1322 		goto err_out;
1323 	}
1324 	mr = kzalloc(sizeof(*mr), GFP_KERNEL);
1325 	if (!mr) {
1326 		rv = -ENOMEM;
1327 		goto err_out;
1328 	}
1329 	rv = siw_mr_add_mem(mr, pd, umem, start, len, rights);
1330 	if (rv)
1331 		goto err_out;
1332 
1333 	if (udata) {
1334 		struct siw_uresp_reg_mr uresp = {};
1335 		struct siw_mem *mem = mr->mem;
1336 
1337 		if (udata->inlen < sizeof(ureq)) {
1338 			rv = -EINVAL;
1339 			goto err_out;
1340 		}
1341 		rv = ib_copy_from_udata(&ureq, udata, sizeof(ureq));
1342 		if (rv)
1343 			goto err_out;
1344 
1345 		mr->base_mr.lkey |= ureq.stag_key;
1346 		mr->base_mr.rkey |= ureq.stag_key;
1347 		mem->stag |= ureq.stag_key;
1348 		uresp.stag = mem->stag;
1349 
1350 		if (udata->outlen < sizeof(uresp)) {
1351 			rv = -EINVAL;
1352 			goto err_out;
1353 		}
1354 		rv = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
1355 		if (rv)
1356 			goto err_out;
1357 	}
1358 	mr->mem->stag_valid = 1;
1359 
1360 	return &mr->base_mr;
1361 
1362 err_out:
1363 	atomic_dec(&sdev->num_mr);
1364 	if (mr) {
1365 		if (mr->mem)
1366 			siw_mr_drop_mem(mr);
1367 		kfree_rcu(mr, rcu);
1368 	} else {
1369 		if (umem)
1370 			siw_umem_release(umem, false);
1371 	}
1372 	return ERR_PTR(rv);
1373 }
1374 
1375 struct ib_mr *siw_alloc_mr(struct ib_pd *pd, enum ib_mr_type mr_type,
1376 			   u32 max_sge, struct ib_udata *udata)
1377 {
1378 	struct siw_device *sdev = to_siw_dev(pd->device);
1379 	struct siw_mr *mr = NULL;
1380 	struct siw_pbl *pbl = NULL;
1381 	int rv;
1382 
1383 	if (atomic_inc_return(&sdev->num_mr) > SIW_MAX_MR) {
1384 		siw_dbg_pd(pd, "too many mr's\n");
1385 		rv = -ENOMEM;
1386 		goto err_out;
1387 	}
1388 	if (mr_type != IB_MR_TYPE_MEM_REG) {
1389 		siw_dbg_pd(pd, "mr type %d unsupported\n", mr_type);
1390 		rv = -EOPNOTSUPP;
1391 		goto err_out;
1392 	}
1393 	if (max_sge > SIW_MAX_SGE_PBL) {
1394 		siw_dbg_pd(pd, "too many sge's: %d\n", max_sge);
1395 		rv = -ENOMEM;
1396 		goto err_out;
1397 	}
1398 	pbl = siw_pbl_alloc(max_sge);
1399 	if (IS_ERR(pbl)) {
1400 		rv = PTR_ERR(pbl);
1401 		siw_dbg_pd(pd, "pbl allocation failed: %d\n", rv);
1402 		pbl = NULL;
1403 		goto err_out;
1404 	}
1405 	mr = kzalloc(sizeof(*mr), GFP_KERNEL);
1406 	if (!mr) {
1407 		rv = -ENOMEM;
1408 		goto err_out;
1409 	}
1410 	rv = siw_mr_add_mem(mr, pd, pbl, 0, max_sge * PAGE_SIZE, 0);
1411 	if (rv)
1412 		goto err_out;
1413 
1414 	mr->mem->is_pbl = 1;
1415 
1416 	siw_dbg_pd(pd, "[MEM %u]: success\n", mr->mem->stag);
1417 
1418 	return &mr->base_mr;
1419 
1420 err_out:
1421 	atomic_dec(&sdev->num_mr);
1422 
1423 	if (!mr) {
1424 		kfree(pbl);
1425 	} else {
1426 		if (mr->mem)
1427 			siw_mr_drop_mem(mr);
1428 		kfree_rcu(mr, rcu);
1429 	}
1430 	siw_dbg_pd(pd, "failed: %d\n", rv);
1431 
1432 	return ERR_PTR(rv);
1433 }
1434 
1435 /* Just used to count number of pages being mapped */
1436 static int siw_set_pbl_page(struct ib_mr *base_mr, u64 buf_addr)
1437 {
1438 	return 0;
1439 }
1440 
1441 int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle,
1442 		  unsigned int *sg_off)
1443 {
1444 	struct scatterlist *slp;
1445 	struct siw_mr *mr = to_siw_mr(base_mr);
1446 	struct siw_mem *mem = mr->mem;
1447 	struct siw_pbl *pbl = mem->pbl;
1448 	struct siw_pble *pble;
1449 	unsigned long pbl_size;
1450 	int i, rv;
1451 
1452 	if (!pbl) {
1453 		siw_dbg_mem(mem, "no PBL allocated\n");
1454 		return -EINVAL;
1455 	}
1456 	pble = pbl->pbe;
1457 
1458 	if (pbl->max_buf < num_sle) {
1459 		siw_dbg_mem(mem, "too many SGE's: %d > %d\n",
1460 			    mem->pbl->max_buf, num_sle);
1461 		return -ENOMEM;
1462 	}
1463 	for_each_sg(sl, slp, num_sle, i) {
1464 		if (sg_dma_len(slp) == 0) {
1465 			siw_dbg_mem(mem, "empty SGE\n");
1466 			return -EINVAL;
1467 		}
1468 		if (i == 0) {
1469 			pble->addr = sg_dma_address(slp);
1470 			pble->size = sg_dma_len(slp);
1471 			pble->pbl_off = 0;
1472 			pbl_size = pble->size;
1473 			pbl->num_buf = 1;
1474 		} else {
1475 			/* Merge PBL entries if adjacent */
1476 			if (pble->addr + pble->size == sg_dma_address(slp)) {
1477 				pble->size += sg_dma_len(slp);
1478 			} else {
1479 				pble++;
1480 				pbl->num_buf++;
1481 				pble->addr = sg_dma_address(slp);
1482 				pble->size = sg_dma_len(slp);
1483 				pble->pbl_off = pbl_size;
1484 			}
1485 			pbl_size += sg_dma_len(slp);
1486 		}
1487 		siw_dbg_mem(mem,
1488 			"sge[%d], size %u, addr 0x%p, total %lu\n",
1489 			i, pble->size, (void *)(uintptr_t)pble->addr,
1490 			pbl_size);
1491 	}
1492 	rv = ib_sg_to_pages(base_mr, sl, num_sle, sg_off, siw_set_pbl_page);
1493 	if (rv > 0) {
1494 		mem->len = base_mr->length;
1495 		mem->va = base_mr->iova;
1496 		siw_dbg_mem(mem,
1497 			"%llu bytes, start 0x%pK, %u SLE to %u entries\n",
1498 			mem->len, (void *)(uintptr_t)mem->va, num_sle,
1499 			pbl->num_buf);
1500 	}
1501 	return rv;
1502 }
1503 
1504 /*
1505  * siw_get_dma_mr()
1506  *
1507  * Create a (empty) DMA memory region, where no umem is attached.
1508  */
1509 struct ib_mr *siw_get_dma_mr(struct ib_pd *pd, int rights)
1510 {
1511 	struct siw_device *sdev = to_siw_dev(pd->device);
1512 	struct siw_mr *mr = NULL;
1513 	int rv;
1514 
1515 	if (atomic_inc_return(&sdev->num_mr) > SIW_MAX_MR) {
1516 		siw_dbg_pd(pd, "too many mr's\n");
1517 		rv = -ENOMEM;
1518 		goto err_out;
1519 	}
1520 	mr = kzalloc(sizeof(*mr), GFP_KERNEL);
1521 	if (!mr) {
1522 		rv = -ENOMEM;
1523 		goto err_out;
1524 	}
1525 	rv = siw_mr_add_mem(mr, pd, NULL, 0, ULONG_MAX, rights);
1526 	if (rv)
1527 		goto err_out;
1528 
1529 	mr->mem->stag_valid = 1;
1530 
1531 	siw_dbg_pd(pd, "[MEM %u]: success\n", mr->mem->stag);
1532 
1533 	return &mr->base_mr;
1534 
1535 err_out:
1536 	if (rv)
1537 		kfree(mr);
1538 
1539 	atomic_dec(&sdev->num_mr);
1540 
1541 	return ERR_PTR(rv);
1542 }
1543 
1544 /*
1545  * siw_create_srq()
1546  *
1547  * Create Shared Receive Queue of attributes @init_attrs
1548  * within protection domain given by @pd.
1549  *
1550  * @base_srq:	Base SRQ contained in siw SRQ.
1551  * @init_attrs:	SRQ init attributes.
1552  * @udata:	points to user context
1553  */
1554 int siw_create_srq(struct ib_srq *base_srq,
1555 		   struct ib_srq_init_attr *init_attrs, struct ib_udata *udata)
1556 {
1557 	struct siw_srq *srq = to_siw_srq(base_srq);
1558 	struct ib_srq_attr *attrs = &init_attrs->attr;
1559 	struct siw_device *sdev = to_siw_dev(base_srq->device);
1560 	struct siw_ucontext *ctx =
1561 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
1562 					  base_ucontext);
1563 	int rv;
1564 
1565 	if (atomic_inc_return(&sdev->num_srq) > SIW_MAX_SRQ) {
1566 		siw_dbg_pd(base_srq->pd, "too many SRQ's\n");
1567 		rv = -ENOMEM;
1568 		goto err_out;
1569 	}
1570 	if (attrs->max_wr == 0 || attrs->max_wr > SIW_MAX_SRQ_WR ||
1571 	    attrs->max_sge > SIW_MAX_SGE || attrs->srq_limit > attrs->max_wr) {
1572 		rv = -EINVAL;
1573 		goto err_out;
1574 	}
1575 	srq->max_sge = attrs->max_sge;
1576 	srq->num_rqe = roundup_pow_of_two(attrs->max_wr);
1577 	srq->limit = attrs->srq_limit;
1578 	if (srq->limit)
1579 		srq->armed = true;
1580 
1581 	srq->is_kernel_res = !udata;
1582 
1583 	if (udata)
1584 		srq->recvq =
1585 			vmalloc_user(srq->num_rqe * sizeof(struct siw_rqe));
1586 	else
1587 		srq->recvq = vzalloc(srq->num_rqe * sizeof(struct siw_rqe));
1588 
1589 	if (srq->recvq == NULL) {
1590 		rv = -ENOMEM;
1591 		goto err_out;
1592 	}
1593 	if (udata) {
1594 		struct siw_uresp_create_srq uresp = {};
1595 		size_t length = srq->num_rqe * sizeof(struct siw_rqe);
1596 
1597 		srq->srq_entry =
1598 			siw_mmap_entry_insert(ctx, srq->recvq,
1599 					      length, &uresp.srq_key);
1600 		if (!srq->srq_entry) {
1601 			rv = -ENOMEM;
1602 			goto err_out;
1603 		}
1604 
1605 		uresp.num_rqe = srq->num_rqe;
1606 
1607 		if (udata->outlen < sizeof(uresp)) {
1608 			rv = -EINVAL;
1609 			goto err_out;
1610 		}
1611 		rv = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
1612 		if (rv)
1613 			goto err_out;
1614 	}
1615 	spin_lock_init(&srq->lock);
1616 
1617 	siw_dbg_pd(base_srq->pd, "[SRQ]: success\n");
1618 
1619 	return 0;
1620 
1621 err_out:
1622 	if (srq->recvq) {
1623 		if (ctx)
1624 			rdma_user_mmap_entry_remove(srq->srq_entry);
1625 		vfree(srq->recvq);
1626 	}
1627 	atomic_dec(&sdev->num_srq);
1628 
1629 	return rv;
1630 }
1631 
1632 /*
1633  * siw_modify_srq()
1634  *
1635  * Modify SRQ. The caller may resize SRQ and/or set/reset notification
1636  * limit and (re)arm IB_EVENT_SRQ_LIMIT_REACHED notification.
1637  *
1638  * NOTE: it is unclear if RDMA core allows for changing the MAX_SGE
1639  * parameter. siw_modify_srq() does not check the attrs->max_sge param.
1640  */
1641 int siw_modify_srq(struct ib_srq *base_srq, struct ib_srq_attr *attrs,
1642 		   enum ib_srq_attr_mask attr_mask, struct ib_udata *udata)
1643 {
1644 	struct siw_srq *srq = to_siw_srq(base_srq);
1645 	unsigned long flags;
1646 	int rv = 0;
1647 
1648 	spin_lock_irqsave(&srq->lock, flags);
1649 
1650 	if (attr_mask & IB_SRQ_MAX_WR) {
1651 		/* resize request not yet supported */
1652 		rv = -EOPNOTSUPP;
1653 		goto out;
1654 	}
1655 	if (attr_mask & IB_SRQ_LIMIT) {
1656 		if (attrs->srq_limit) {
1657 			if (unlikely(attrs->srq_limit > srq->num_rqe)) {
1658 				rv = -EINVAL;
1659 				goto out;
1660 			}
1661 			srq->armed = true;
1662 		} else {
1663 			srq->armed = false;
1664 		}
1665 		srq->limit = attrs->srq_limit;
1666 	}
1667 out:
1668 	spin_unlock_irqrestore(&srq->lock, flags);
1669 
1670 	return rv;
1671 }
1672 
1673 /*
1674  * siw_query_srq()
1675  *
1676  * Query SRQ attributes.
1677  */
1678 int siw_query_srq(struct ib_srq *base_srq, struct ib_srq_attr *attrs)
1679 {
1680 	struct siw_srq *srq = to_siw_srq(base_srq);
1681 	unsigned long flags;
1682 
1683 	spin_lock_irqsave(&srq->lock, flags);
1684 
1685 	attrs->max_wr = srq->num_rqe;
1686 	attrs->max_sge = srq->max_sge;
1687 	attrs->srq_limit = srq->limit;
1688 
1689 	spin_unlock_irqrestore(&srq->lock, flags);
1690 
1691 	return 0;
1692 }
1693 
1694 /*
1695  * siw_destroy_srq()
1696  *
1697  * Destroy SRQ.
1698  * It is assumed that the SRQ is not referenced by any
1699  * QP anymore - the code trusts the RDMA core environment to keep track
1700  * of QP references.
1701  */
1702 void siw_destroy_srq(struct ib_srq *base_srq, struct ib_udata *udata)
1703 {
1704 	struct siw_srq *srq = to_siw_srq(base_srq);
1705 	struct siw_device *sdev = to_siw_dev(base_srq->device);
1706 	struct siw_ucontext *ctx =
1707 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
1708 					  base_ucontext);
1709 
1710 	if (ctx)
1711 		rdma_user_mmap_entry_remove(srq->srq_entry);
1712 	vfree(srq->recvq);
1713 	atomic_dec(&sdev->num_srq);
1714 }
1715 
1716 /*
1717  * siw_post_srq_recv()
1718  *
1719  * Post a list of receive queue elements to SRQ.
1720  * NOTE: The function does not check or lock a certain SRQ state
1721  *       during the post operation. The code simply trusts the
1722  *       RDMA core environment.
1723  *
1724  * @base_srq:	Base SRQ contained in siw SRQ
1725  * @wr:		List of R-WR's
1726  * @bad_wr:	Updated to failing WR if posting fails.
1727  */
1728 int siw_post_srq_recv(struct ib_srq *base_srq, const struct ib_recv_wr *wr,
1729 		      const struct ib_recv_wr **bad_wr)
1730 {
1731 	struct siw_srq *srq = to_siw_srq(base_srq);
1732 	unsigned long flags;
1733 	int rv = 0;
1734 
1735 	if (unlikely(!srq->is_kernel_res)) {
1736 		siw_dbg_pd(base_srq->pd,
1737 			   "[SRQ]: no kernel post_recv for mapped srq\n");
1738 		rv = -EINVAL;
1739 		goto out;
1740 	}
1741 	/*
1742 	 * Serialize potentially multiple producers.
1743 	 * Also needed to serialize potentially multiple
1744 	 * consumers.
1745 	 */
1746 	spin_lock_irqsave(&srq->lock, flags);
1747 
1748 	while (wr) {
1749 		u32 idx = srq->rq_put % srq->num_rqe;
1750 		struct siw_rqe *rqe = &srq->recvq[idx];
1751 
1752 		if (rqe->flags) {
1753 			siw_dbg_pd(base_srq->pd, "SRQ full\n");
1754 			rv = -ENOMEM;
1755 			break;
1756 		}
1757 		if (unlikely(wr->num_sge > srq->max_sge)) {
1758 			siw_dbg_pd(base_srq->pd,
1759 				   "[SRQ]: too many sge's: %d\n", wr->num_sge);
1760 			rv = -EINVAL;
1761 			break;
1762 		}
1763 		rqe->id = wr->wr_id;
1764 		rqe->num_sge = wr->num_sge;
1765 		siw_copy_sgl(wr->sg_list, rqe->sge, wr->num_sge);
1766 
1767 		/* Make sure S-RQE is completely written before valid */
1768 		smp_wmb();
1769 
1770 		rqe->flags = SIW_WQE_VALID;
1771 
1772 		srq->rq_put++;
1773 		wr = wr->next;
1774 	}
1775 	spin_unlock_irqrestore(&srq->lock, flags);
1776 out:
1777 	if (unlikely(rv < 0)) {
1778 		siw_dbg_pd(base_srq->pd, "[SRQ]: error %d\n", rv);
1779 		*bad_wr = wr;
1780 	}
1781 	return rv;
1782 }
1783 
1784 void siw_qp_event(struct siw_qp *qp, enum ib_event_type etype)
1785 {
1786 	struct ib_event event;
1787 	struct ib_qp *base_qp = &qp->base_qp;
1788 
1789 	/*
1790 	 * Do not report asynchronous errors on QP which gets
1791 	 * destroyed via verbs interface (siw_destroy_qp())
1792 	 */
1793 	if (qp->attrs.flags & SIW_QP_IN_DESTROY)
1794 		return;
1795 
1796 	event.event = etype;
1797 	event.device = base_qp->device;
1798 	event.element.qp = base_qp;
1799 
1800 	if (base_qp->event_handler) {
1801 		siw_dbg_qp(qp, "reporting event %d\n", etype);
1802 		base_qp->event_handler(&event, base_qp->qp_context);
1803 	}
1804 }
1805 
1806 void siw_cq_event(struct siw_cq *cq, enum ib_event_type etype)
1807 {
1808 	struct ib_event event;
1809 	struct ib_cq *base_cq = &cq->base_cq;
1810 
1811 	event.event = etype;
1812 	event.device = base_cq->device;
1813 	event.element.cq = base_cq;
1814 
1815 	if (base_cq->event_handler) {
1816 		siw_dbg_cq(cq, "reporting CQ event %d\n", etype);
1817 		base_cq->event_handler(&event, base_cq->cq_context);
1818 	}
1819 }
1820 
1821 void siw_srq_event(struct siw_srq *srq, enum ib_event_type etype)
1822 {
1823 	struct ib_event event;
1824 	struct ib_srq *base_srq = &srq->base_srq;
1825 
1826 	event.event = etype;
1827 	event.device = base_srq->device;
1828 	event.element.srq = base_srq;
1829 
1830 	if (base_srq->event_handler) {
1831 		siw_dbg_pd(srq->base_srq.pd,
1832 			   "reporting SRQ event %d\n", etype);
1833 		base_srq->event_handler(&event, base_srq->srq_context);
1834 	}
1835 }
1836 
1837 void siw_port_event(struct siw_device *sdev, u8 port, enum ib_event_type etype)
1838 {
1839 	struct ib_event event;
1840 
1841 	event.event = etype;
1842 	event.device = &sdev->base_dev;
1843 	event.element.port_num = port;
1844 
1845 	siw_dbg(&sdev->base_dev, "reporting port event %d\n", etype);
1846 
1847 	ib_dispatch_event(&event);
1848 }
1849