xref: /linux/drivers/infiniband/hw/mlx5/qp.c (revision c1aac62f36c1e37ee81c9e09ee9ee733eef05dcb)
1 /*
2  * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  */
32 
33 #include <linux/module.h>
34 #include <rdma/ib_umem.h>
35 #include <rdma/ib_cache.h>
36 #include <rdma/ib_user_verbs.h>
37 #include "mlx5_ib.h"
38 
39 /* not supported currently */
40 static int wq_signature;
41 
42 enum {
43 	MLX5_IB_ACK_REQ_FREQ	= 8,
44 };
45 
46 enum {
47 	MLX5_IB_DEFAULT_SCHED_QUEUE	= 0x83,
48 	MLX5_IB_DEFAULT_QP0_SCHED_QUEUE	= 0x3f,
49 	MLX5_IB_LINK_TYPE_IB		= 0,
50 	MLX5_IB_LINK_TYPE_ETH		= 1
51 };
52 
53 enum {
54 	MLX5_IB_SQ_STRIDE	= 6,
55 };
56 
57 static const u32 mlx5_ib_opcode[] = {
58 	[IB_WR_SEND]				= MLX5_OPCODE_SEND,
59 	[IB_WR_LSO]				= MLX5_OPCODE_LSO,
60 	[IB_WR_SEND_WITH_IMM]			= MLX5_OPCODE_SEND_IMM,
61 	[IB_WR_RDMA_WRITE]			= MLX5_OPCODE_RDMA_WRITE,
62 	[IB_WR_RDMA_WRITE_WITH_IMM]		= MLX5_OPCODE_RDMA_WRITE_IMM,
63 	[IB_WR_RDMA_READ]			= MLX5_OPCODE_RDMA_READ,
64 	[IB_WR_ATOMIC_CMP_AND_SWP]		= MLX5_OPCODE_ATOMIC_CS,
65 	[IB_WR_ATOMIC_FETCH_AND_ADD]		= MLX5_OPCODE_ATOMIC_FA,
66 	[IB_WR_SEND_WITH_INV]			= MLX5_OPCODE_SEND_INVAL,
67 	[IB_WR_LOCAL_INV]			= MLX5_OPCODE_UMR,
68 	[IB_WR_REG_MR]				= MLX5_OPCODE_UMR,
69 	[IB_WR_MASKED_ATOMIC_CMP_AND_SWP]	= MLX5_OPCODE_ATOMIC_MASKED_CS,
70 	[IB_WR_MASKED_ATOMIC_FETCH_AND_ADD]	= MLX5_OPCODE_ATOMIC_MASKED_FA,
71 	[MLX5_IB_WR_UMR]			= MLX5_OPCODE_UMR,
72 };
73 
74 struct mlx5_wqe_eth_pad {
75 	u8 rsvd0[16];
76 };
77 
78 enum raw_qp_set_mask_map {
79 	MLX5_RAW_QP_MOD_SET_RQ_Q_CTR_ID		= 1UL << 0,
80 	MLX5_RAW_QP_RATE_LIMIT			= 1UL << 1,
81 };
82 
83 struct mlx5_modify_raw_qp_param {
84 	u16 operation;
85 
86 	u32 set_mask; /* raw_qp_set_mask_map */
87 	u32 rate_limit;
88 	u8 rq_q_ctr_id;
89 };
90 
91 static void get_cqs(enum ib_qp_type qp_type,
92 		    struct ib_cq *ib_send_cq, struct ib_cq *ib_recv_cq,
93 		    struct mlx5_ib_cq **send_cq, struct mlx5_ib_cq **recv_cq);
94 
95 static int is_qp0(enum ib_qp_type qp_type)
96 {
97 	return qp_type == IB_QPT_SMI;
98 }
99 
100 static int is_sqp(enum ib_qp_type qp_type)
101 {
102 	return is_qp0(qp_type) || is_qp1(qp_type);
103 }
104 
105 static void *get_wqe(struct mlx5_ib_qp *qp, int offset)
106 {
107 	return mlx5_buf_offset(&qp->buf, offset);
108 }
109 
110 static void *get_recv_wqe(struct mlx5_ib_qp *qp, int n)
111 {
112 	return get_wqe(qp, qp->rq.offset + (n << qp->rq.wqe_shift));
113 }
114 
115 void *mlx5_get_send_wqe(struct mlx5_ib_qp *qp, int n)
116 {
117 	return get_wqe(qp, qp->sq.offset + (n << MLX5_IB_SQ_STRIDE));
118 }
119 
120 /**
121  * mlx5_ib_read_user_wqe() - Copy a user-space WQE to kernel space.
122  *
123  * @qp: QP to copy from.
124  * @send: copy from the send queue when non-zero, use the receive queue
125  *	  otherwise.
126  * @wqe_index:  index to start copying from. For send work queues, the
127  *		wqe_index is in units of MLX5_SEND_WQE_BB.
128  *		For receive work queue, it is the number of work queue
129  *		element in the queue.
130  * @buffer: destination buffer.
131  * @length: maximum number of bytes to copy.
132  *
133  * Copies at least a single WQE, but may copy more data.
134  *
135  * Return: the number of bytes copied, or an error code.
136  */
137 int mlx5_ib_read_user_wqe(struct mlx5_ib_qp *qp, int send, int wqe_index,
138 			  void *buffer, u32 length,
139 			  struct mlx5_ib_qp_base *base)
140 {
141 	struct ib_device *ibdev = qp->ibqp.device;
142 	struct mlx5_ib_dev *dev = to_mdev(ibdev);
143 	struct mlx5_ib_wq *wq = send ? &qp->sq : &qp->rq;
144 	size_t offset;
145 	size_t wq_end;
146 	struct ib_umem *umem = base->ubuffer.umem;
147 	u32 first_copy_length;
148 	int wqe_length;
149 	int ret;
150 
151 	if (wq->wqe_cnt == 0) {
152 		mlx5_ib_dbg(dev, "mlx5_ib_read_user_wqe for a QP with wqe_cnt == 0. qp_type: 0x%x\n",
153 			    qp->ibqp.qp_type);
154 		return -EINVAL;
155 	}
156 
157 	offset = wq->offset + ((wqe_index % wq->wqe_cnt) << wq->wqe_shift);
158 	wq_end = wq->offset + (wq->wqe_cnt << wq->wqe_shift);
159 
160 	if (send && length < sizeof(struct mlx5_wqe_ctrl_seg))
161 		return -EINVAL;
162 
163 	if (offset > umem->length ||
164 	    (send && offset + sizeof(struct mlx5_wqe_ctrl_seg) > umem->length))
165 		return -EINVAL;
166 
167 	first_copy_length = min_t(u32, offset + length, wq_end) - offset;
168 	ret = ib_umem_copy_from(buffer, umem, offset, first_copy_length);
169 	if (ret)
170 		return ret;
171 
172 	if (send) {
173 		struct mlx5_wqe_ctrl_seg *ctrl = buffer;
174 		int ds = be32_to_cpu(ctrl->qpn_ds) & MLX5_WQE_CTRL_DS_MASK;
175 
176 		wqe_length = ds * MLX5_WQE_DS_UNITS;
177 	} else {
178 		wqe_length = 1 << wq->wqe_shift;
179 	}
180 
181 	if (wqe_length <= first_copy_length)
182 		return first_copy_length;
183 
184 	ret = ib_umem_copy_from(buffer + first_copy_length, umem, wq->offset,
185 				wqe_length - first_copy_length);
186 	if (ret)
187 		return ret;
188 
189 	return wqe_length;
190 }
191 
192 static void mlx5_ib_qp_event(struct mlx5_core_qp *qp, int type)
193 {
194 	struct ib_qp *ibqp = &to_mibqp(qp)->ibqp;
195 	struct ib_event event;
196 
197 	if (type == MLX5_EVENT_TYPE_PATH_MIG) {
198 		/* This event is only valid for trans_qps */
199 		to_mibqp(qp)->port = to_mibqp(qp)->trans_qp.alt_port;
200 	}
201 
202 	if (ibqp->event_handler) {
203 		event.device     = ibqp->device;
204 		event.element.qp = ibqp;
205 		switch (type) {
206 		case MLX5_EVENT_TYPE_PATH_MIG:
207 			event.event = IB_EVENT_PATH_MIG;
208 			break;
209 		case MLX5_EVENT_TYPE_COMM_EST:
210 			event.event = IB_EVENT_COMM_EST;
211 			break;
212 		case MLX5_EVENT_TYPE_SQ_DRAINED:
213 			event.event = IB_EVENT_SQ_DRAINED;
214 			break;
215 		case MLX5_EVENT_TYPE_SRQ_LAST_WQE:
216 			event.event = IB_EVENT_QP_LAST_WQE_REACHED;
217 			break;
218 		case MLX5_EVENT_TYPE_WQ_CATAS_ERROR:
219 			event.event = IB_EVENT_QP_FATAL;
220 			break;
221 		case MLX5_EVENT_TYPE_PATH_MIG_FAILED:
222 			event.event = IB_EVENT_PATH_MIG_ERR;
223 			break;
224 		case MLX5_EVENT_TYPE_WQ_INVAL_REQ_ERROR:
225 			event.event = IB_EVENT_QP_REQ_ERR;
226 			break;
227 		case MLX5_EVENT_TYPE_WQ_ACCESS_ERROR:
228 			event.event = IB_EVENT_QP_ACCESS_ERR;
229 			break;
230 		default:
231 			pr_warn("mlx5_ib: Unexpected event type %d on QP %06x\n", type, qp->qpn);
232 			return;
233 		}
234 
235 		ibqp->event_handler(&event, ibqp->qp_context);
236 	}
237 }
238 
239 static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
240 		       int has_rq, struct mlx5_ib_qp *qp, struct mlx5_ib_create_qp *ucmd)
241 {
242 	int wqe_size;
243 	int wq_size;
244 
245 	/* Sanity check RQ size before proceeding */
246 	if (cap->max_recv_wr > (1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz)))
247 		return -EINVAL;
248 
249 	if (!has_rq) {
250 		qp->rq.max_gs = 0;
251 		qp->rq.wqe_cnt = 0;
252 		qp->rq.wqe_shift = 0;
253 		cap->max_recv_wr = 0;
254 		cap->max_recv_sge = 0;
255 	} else {
256 		if (ucmd) {
257 			qp->rq.wqe_cnt = ucmd->rq_wqe_count;
258 			qp->rq.wqe_shift = ucmd->rq_wqe_shift;
259 			qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
260 			qp->rq.max_post = qp->rq.wqe_cnt;
261 		} else {
262 			wqe_size = qp->wq_sig ? sizeof(struct mlx5_wqe_signature_seg) : 0;
263 			wqe_size += cap->max_recv_sge * sizeof(struct mlx5_wqe_data_seg);
264 			wqe_size = roundup_pow_of_two(wqe_size);
265 			wq_size = roundup_pow_of_two(cap->max_recv_wr) * wqe_size;
266 			wq_size = max_t(int, wq_size, MLX5_SEND_WQE_BB);
267 			qp->rq.wqe_cnt = wq_size / wqe_size;
268 			if (wqe_size > MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq)) {
269 				mlx5_ib_dbg(dev, "wqe_size %d, max %d\n",
270 					    wqe_size,
271 					    MLX5_CAP_GEN(dev->mdev,
272 							 max_wqe_sz_rq));
273 				return -EINVAL;
274 			}
275 			qp->rq.wqe_shift = ilog2(wqe_size);
276 			qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
277 			qp->rq.max_post = qp->rq.wqe_cnt;
278 		}
279 	}
280 
281 	return 0;
282 }
283 
284 static int sq_overhead(struct ib_qp_init_attr *attr)
285 {
286 	int size = 0;
287 
288 	switch (attr->qp_type) {
289 	case IB_QPT_XRC_INI:
290 		size += sizeof(struct mlx5_wqe_xrc_seg);
291 		/* fall through */
292 	case IB_QPT_RC:
293 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
294 			max(sizeof(struct mlx5_wqe_atomic_seg) +
295 			    sizeof(struct mlx5_wqe_raddr_seg),
296 			    sizeof(struct mlx5_wqe_umr_ctrl_seg) +
297 			    sizeof(struct mlx5_mkey_seg));
298 		break;
299 
300 	case IB_QPT_XRC_TGT:
301 		return 0;
302 
303 	case IB_QPT_UC:
304 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
305 			max(sizeof(struct mlx5_wqe_raddr_seg),
306 			    sizeof(struct mlx5_wqe_umr_ctrl_seg) +
307 			    sizeof(struct mlx5_mkey_seg));
308 		break;
309 
310 	case IB_QPT_UD:
311 		if (attr->create_flags & IB_QP_CREATE_IPOIB_UD_LSO)
312 			size += sizeof(struct mlx5_wqe_eth_pad) +
313 				sizeof(struct mlx5_wqe_eth_seg);
314 		/* fall through */
315 	case IB_QPT_SMI:
316 	case MLX5_IB_QPT_HW_GSI:
317 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
318 			sizeof(struct mlx5_wqe_datagram_seg);
319 		break;
320 
321 	case MLX5_IB_QPT_REG_UMR:
322 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
323 			sizeof(struct mlx5_wqe_umr_ctrl_seg) +
324 			sizeof(struct mlx5_mkey_seg);
325 		break;
326 
327 	default:
328 		return -EINVAL;
329 	}
330 
331 	return size;
332 }
333 
334 static int calc_send_wqe(struct ib_qp_init_attr *attr)
335 {
336 	int inl_size = 0;
337 	int size;
338 
339 	size = sq_overhead(attr);
340 	if (size < 0)
341 		return size;
342 
343 	if (attr->cap.max_inline_data) {
344 		inl_size = size + sizeof(struct mlx5_wqe_inline_seg) +
345 			attr->cap.max_inline_data;
346 	}
347 
348 	size += attr->cap.max_send_sge * sizeof(struct mlx5_wqe_data_seg);
349 	if (attr->create_flags & IB_QP_CREATE_SIGNATURE_EN &&
350 	    ALIGN(max_t(int, inl_size, size), MLX5_SEND_WQE_BB) < MLX5_SIG_WQE_SIZE)
351 			return MLX5_SIG_WQE_SIZE;
352 	else
353 		return ALIGN(max_t(int, inl_size, size), MLX5_SEND_WQE_BB);
354 }
355 
356 static int get_send_sge(struct ib_qp_init_attr *attr, int wqe_size)
357 {
358 	int max_sge;
359 
360 	if (attr->qp_type == IB_QPT_RC)
361 		max_sge = (min_t(int, wqe_size, 512) -
362 			   sizeof(struct mlx5_wqe_ctrl_seg) -
363 			   sizeof(struct mlx5_wqe_raddr_seg)) /
364 			sizeof(struct mlx5_wqe_data_seg);
365 	else if (attr->qp_type == IB_QPT_XRC_INI)
366 		max_sge = (min_t(int, wqe_size, 512) -
367 			   sizeof(struct mlx5_wqe_ctrl_seg) -
368 			   sizeof(struct mlx5_wqe_xrc_seg) -
369 			   sizeof(struct mlx5_wqe_raddr_seg)) /
370 			sizeof(struct mlx5_wqe_data_seg);
371 	else
372 		max_sge = (wqe_size - sq_overhead(attr)) /
373 			sizeof(struct mlx5_wqe_data_seg);
374 
375 	return min_t(int, max_sge, wqe_size - sq_overhead(attr) /
376 		     sizeof(struct mlx5_wqe_data_seg));
377 }
378 
379 static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
380 			struct mlx5_ib_qp *qp)
381 {
382 	int wqe_size;
383 	int wq_size;
384 
385 	if (!attr->cap.max_send_wr)
386 		return 0;
387 
388 	wqe_size = calc_send_wqe(attr);
389 	mlx5_ib_dbg(dev, "wqe_size %d\n", wqe_size);
390 	if (wqe_size < 0)
391 		return wqe_size;
392 
393 	if (wqe_size > MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq)) {
394 		mlx5_ib_dbg(dev, "wqe_size(%d) > max_sq_desc_sz(%d)\n",
395 			    wqe_size, MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq));
396 		return -EINVAL;
397 	}
398 
399 	qp->max_inline_data = wqe_size - sq_overhead(attr) -
400 			      sizeof(struct mlx5_wqe_inline_seg);
401 	attr->cap.max_inline_data = qp->max_inline_data;
402 
403 	if (attr->create_flags & IB_QP_CREATE_SIGNATURE_EN)
404 		qp->signature_en = true;
405 
406 	wq_size = roundup_pow_of_two(attr->cap.max_send_wr * wqe_size);
407 	qp->sq.wqe_cnt = wq_size / MLX5_SEND_WQE_BB;
408 	if (qp->sq.wqe_cnt > (1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz))) {
409 		mlx5_ib_dbg(dev, "send queue size (%d * %d / %d -> %d) exceeds limits(%d)\n",
410 			    attr->cap.max_send_wr, wqe_size, MLX5_SEND_WQE_BB,
411 			    qp->sq.wqe_cnt,
412 			    1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz));
413 		return -ENOMEM;
414 	}
415 	qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
416 	qp->sq.max_gs = get_send_sge(attr, wqe_size);
417 	if (qp->sq.max_gs < attr->cap.max_send_sge)
418 		return -ENOMEM;
419 
420 	attr->cap.max_send_sge = qp->sq.max_gs;
421 	qp->sq.max_post = wq_size / wqe_size;
422 	attr->cap.max_send_wr = qp->sq.max_post;
423 
424 	return wq_size;
425 }
426 
427 static int set_user_buf_size(struct mlx5_ib_dev *dev,
428 			    struct mlx5_ib_qp *qp,
429 			    struct mlx5_ib_create_qp *ucmd,
430 			    struct mlx5_ib_qp_base *base,
431 			    struct ib_qp_init_attr *attr)
432 {
433 	int desc_sz = 1 << qp->sq.wqe_shift;
434 
435 	if (desc_sz > MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq)) {
436 		mlx5_ib_warn(dev, "desc_sz %d, max_sq_desc_sz %d\n",
437 			     desc_sz, MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq));
438 		return -EINVAL;
439 	}
440 
441 	if (ucmd->sq_wqe_count && ((1 << ilog2(ucmd->sq_wqe_count)) != ucmd->sq_wqe_count)) {
442 		mlx5_ib_warn(dev, "sq_wqe_count %d, sq_wqe_count %d\n",
443 			     ucmd->sq_wqe_count, ucmd->sq_wqe_count);
444 		return -EINVAL;
445 	}
446 
447 	qp->sq.wqe_cnt = ucmd->sq_wqe_count;
448 
449 	if (qp->sq.wqe_cnt > (1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz))) {
450 		mlx5_ib_warn(dev, "wqe_cnt %d, max_wqes %d\n",
451 			     qp->sq.wqe_cnt,
452 			     1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz));
453 		return -EINVAL;
454 	}
455 
456 	if (attr->qp_type == IB_QPT_RAW_PACKET) {
457 		base->ubuffer.buf_size = qp->rq.wqe_cnt << qp->rq.wqe_shift;
458 		qp->raw_packet_qp.sq.ubuffer.buf_size = qp->sq.wqe_cnt << 6;
459 	} else {
460 		base->ubuffer.buf_size = (qp->rq.wqe_cnt << qp->rq.wqe_shift) +
461 					 (qp->sq.wqe_cnt << 6);
462 	}
463 
464 	return 0;
465 }
466 
467 static int qp_has_rq(struct ib_qp_init_attr *attr)
468 {
469 	if (attr->qp_type == IB_QPT_XRC_INI ||
470 	    attr->qp_type == IB_QPT_XRC_TGT || attr->srq ||
471 	    attr->qp_type == MLX5_IB_QPT_REG_UMR ||
472 	    !attr->cap.max_recv_wr)
473 		return 0;
474 
475 	return 1;
476 }
477 
478 static int first_med_bfreg(void)
479 {
480 	return 1;
481 }
482 
483 enum {
484 	/* this is the first blue flame register in the array of bfregs assigned
485 	 * to a processes. Since we do not use it for blue flame but rather
486 	 * regular 64 bit doorbells, we do not need a lock for maintaiing
487 	 * "odd/even" order
488 	 */
489 	NUM_NON_BLUE_FLAME_BFREGS = 1,
490 };
491 
492 static int max_bfregs(struct mlx5_ib_dev *dev, struct mlx5_bfreg_info *bfregi)
493 {
494 	return get_num_uars(dev, bfregi) * MLX5_NON_FP_BFREGS_PER_UAR;
495 }
496 
497 static int num_med_bfreg(struct mlx5_ib_dev *dev,
498 			 struct mlx5_bfreg_info *bfregi)
499 {
500 	int n;
501 
502 	n = max_bfregs(dev, bfregi) - bfregi->num_low_latency_bfregs -
503 	    NUM_NON_BLUE_FLAME_BFREGS;
504 
505 	return n >= 0 ? n : 0;
506 }
507 
508 static int first_hi_bfreg(struct mlx5_ib_dev *dev,
509 			  struct mlx5_bfreg_info *bfregi)
510 {
511 	int med;
512 
513 	med = num_med_bfreg(dev, bfregi);
514 	return ++med;
515 }
516 
517 static int alloc_high_class_bfreg(struct mlx5_ib_dev *dev,
518 				  struct mlx5_bfreg_info *bfregi)
519 {
520 	int i;
521 
522 	for (i = first_hi_bfreg(dev, bfregi); i < max_bfregs(dev, bfregi); i++) {
523 		if (!bfregi->count[i]) {
524 			bfregi->count[i]++;
525 			return i;
526 		}
527 	}
528 
529 	return -ENOMEM;
530 }
531 
532 static int alloc_med_class_bfreg(struct mlx5_ib_dev *dev,
533 				 struct mlx5_bfreg_info *bfregi)
534 {
535 	int minidx = first_med_bfreg();
536 	int i;
537 
538 	for (i = first_med_bfreg(); i < first_hi_bfreg(dev, bfregi); i++) {
539 		if (bfregi->count[i] < bfregi->count[minidx])
540 			minidx = i;
541 		if (!bfregi->count[minidx])
542 			break;
543 	}
544 
545 	bfregi->count[minidx]++;
546 	return minidx;
547 }
548 
549 static int alloc_bfreg(struct mlx5_ib_dev *dev,
550 		       struct mlx5_bfreg_info *bfregi,
551 		       enum mlx5_ib_latency_class lat)
552 {
553 	int bfregn = -EINVAL;
554 
555 	mutex_lock(&bfregi->lock);
556 	switch (lat) {
557 	case MLX5_IB_LATENCY_CLASS_LOW:
558 		BUILD_BUG_ON(NUM_NON_BLUE_FLAME_BFREGS != 1);
559 		bfregn = 0;
560 		bfregi->count[bfregn]++;
561 		break;
562 
563 	case MLX5_IB_LATENCY_CLASS_MEDIUM:
564 		if (bfregi->ver < 2)
565 			bfregn = -ENOMEM;
566 		else
567 			bfregn = alloc_med_class_bfreg(dev, bfregi);
568 		break;
569 
570 	case MLX5_IB_LATENCY_CLASS_HIGH:
571 		if (bfregi->ver < 2)
572 			bfregn = -ENOMEM;
573 		else
574 			bfregn = alloc_high_class_bfreg(dev, bfregi);
575 		break;
576 	}
577 	mutex_unlock(&bfregi->lock);
578 
579 	return bfregn;
580 }
581 
582 static void free_bfreg(struct mlx5_ib_dev *dev, struct mlx5_bfreg_info *bfregi, int bfregn)
583 {
584 	mutex_lock(&bfregi->lock);
585 	bfregi->count[bfregn]--;
586 	mutex_unlock(&bfregi->lock);
587 }
588 
589 static enum mlx5_qp_state to_mlx5_state(enum ib_qp_state state)
590 {
591 	switch (state) {
592 	case IB_QPS_RESET:	return MLX5_QP_STATE_RST;
593 	case IB_QPS_INIT:	return MLX5_QP_STATE_INIT;
594 	case IB_QPS_RTR:	return MLX5_QP_STATE_RTR;
595 	case IB_QPS_RTS:	return MLX5_QP_STATE_RTS;
596 	case IB_QPS_SQD:	return MLX5_QP_STATE_SQD;
597 	case IB_QPS_SQE:	return MLX5_QP_STATE_SQER;
598 	case IB_QPS_ERR:	return MLX5_QP_STATE_ERR;
599 	default:		return -1;
600 	}
601 }
602 
603 static int to_mlx5_st(enum ib_qp_type type)
604 {
605 	switch (type) {
606 	case IB_QPT_RC:			return MLX5_QP_ST_RC;
607 	case IB_QPT_UC:			return MLX5_QP_ST_UC;
608 	case IB_QPT_UD:			return MLX5_QP_ST_UD;
609 	case MLX5_IB_QPT_REG_UMR:	return MLX5_QP_ST_REG_UMR;
610 	case IB_QPT_XRC_INI:
611 	case IB_QPT_XRC_TGT:		return MLX5_QP_ST_XRC;
612 	case IB_QPT_SMI:		return MLX5_QP_ST_QP0;
613 	case MLX5_IB_QPT_HW_GSI:	return MLX5_QP_ST_QP1;
614 	case IB_QPT_RAW_IPV6:		return MLX5_QP_ST_RAW_IPV6;
615 	case IB_QPT_RAW_PACKET:
616 	case IB_QPT_RAW_ETHERTYPE:	return MLX5_QP_ST_RAW_ETHERTYPE;
617 	case IB_QPT_MAX:
618 	default:		return -EINVAL;
619 	}
620 }
621 
622 static void mlx5_ib_lock_cqs(struct mlx5_ib_cq *send_cq,
623 			     struct mlx5_ib_cq *recv_cq);
624 static void mlx5_ib_unlock_cqs(struct mlx5_ib_cq *send_cq,
625 			       struct mlx5_ib_cq *recv_cq);
626 
627 static int bfregn_to_uar_index(struct mlx5_ib_dev *dev,
628 			       struct mlx5_bfreg_info *bfregi, int bfregn)
629 {
630 	int bfregs_per_sys_page;
631 	int index_of_sys_page;
632 	int offset;
633 
634 	bfregs_per_sys_page = get_uars_per_sys_page(dev, bfregi->lib_uar_4k) *
635 				MLX5_NON_FP_BFREGS_PER_UAR;
636 	index_of_sys_page = bfregn / bfregs_per_sys_page;
637 
638 	offset = bfregn % bfregs_per_sys_page / MLX5_NON_FP_BFREGS_PER_UAR;
639 
640 	return bfregi->sys_pages[index_of_sys_page] + offset;
641 }
642 
643 static int mlx5_ib_umem_get(struct mlx5_ib_dev *dev,
644 			    struct ib_pd *pd,
645 			    unsigned long addr, size_t size,
646 			    struct ib_umem **umem,
647 			    int *npages, int *page_shift, int *ncont,
648 			    u32 *offset)
649 {
650 	int err;
651 
652 	*umem = ib_umem_get(pd->uobject->context, addr, size, 0, 0);
653 	if (IS_ERR(*umem)) {
654 		mlx5_ib_dbg(dev, "umem_get failed\n");
655 		return PTR_ERR(*umem);
656 	}
657 
658 	mlx5_ib_cont_pages(*umem, addr, 0, npages, page_shift, ncont, NULL);
659 
660 	err = mlx5_ib_get_buf_offset(addr, *page_shift, offset);
661 	if (err) {
662 		mlx5_ib_warn(dev, "bad offset\n");
663 		goto err_umem;
664 	}
665 
666 	mlx5_ib_dbg(dev, "addr 0x%lx, size %zu, npages %d, page_shift %d, ncont %d, offset %d\n",
667 		    addr, size, *npages, *page_shift, *ncont, *offset);
668 
669 	return 0;
670 
671 err_umem:
672 	ib_umem_release(*umem);
673 	*umem = NULL;
674 
675 	return err;
676 }
677 
678 static void destroy_user_rq(struct ib_pd *pd, struct mlx5_ib_rwq *rwq)
679 {
680 	struct mlx5_ib_ucontext *context;
681 
682 	context = to_mucontext(pd->uobject->context);
683 	mlx5_ib_db_unmap_user(context, &rwq->db);
684 	if (rwq->umem)
685 		ib_umem_release(rwq->umem);
686 }
687 
688 static int create_user_rq(struct mlx5_ib_dev *dev, struct ib_pd *pd,
689 			  struct mlx5_ib_rwq *rwq,
690 			  struct mlx5_ib_create_wq *ucmd)
691 {
692 	struct mlx5_ib_ucontext *context;
693 	int page_shift = 0;
694 	int npages;
695 	u32 offset = 0;
696 	int ncont = 0;
697 	int err;
698 
699 	if (!ucmd->buf_addr)
700 		return -EINVAL;
701 
702 	context = to_mucontext(pd->uobject->context);
703 	rwq->umem = ib_umem_get(pd->uobject->context, ucmd->buf_addr,
704 			       rwq->buf_size, 0, 0);
705 	if (IS_ERR(rwq->umem)) {
706 		mlx5_ib_dbg(dev, "umem_get failed\n");
707 		err = PTR_ERR(rwq->umem);
708 		return err;
709 	}
710 
711 	mlx5_ib_cont_pages(rwq->umem, ucmd->buf_addr, 0, &npages, &page_shift,
712 			   &ncont, NULL);
713 	err = mlx5_ib_get_buf_offset(ucmd->buf_addr, page_shift,
714 				     &rwq->rq_page_offset);
715 	if (err) {
716 		mlx5_ib_warn(dev, "bad offset\n");
717 		goto err_umem;
718 	}
719 
720 	rwq->rq_num_pas = ncont;
721 	rwq->page_shift = page_shift;
722 	rwq->log_page_size =  page_shift - MLX5_ADAPTER_PAGE_SHIFT;
723 	rwq->wq_sig = !!(ucmd->flags & MLX5_WQ_FLAG_SIGNATURE);
724 
725 	mlx5_ib_dbg(dev, "addr 0x%llx, size %zd, npages %d, page_shift %d, ncont %d, offset %d\n",
726 		    (unsigned long long)ucmd->buf_addr, rwq->buf_size,
727 		    npages, page_shift, ncont, offset);
728 
729 	err = mlx5_ib_db_map_user(context, ucmd->db_addr, &rwq->db);
730 	if (err) {
731 		mlx5_ib_dbg(dev, "map failed\n");
732 		goto err_umem;
733 	}
734 
735 	rwq->create_type = MLX5_WQ_USER;
736 	return 0;
737 
738 err_umem:
739 	ib_umem_release(rwq->umem);
740 	return err;
741 }
742 
743 static int adjust_bfregn(struct mlx5_ib_dev *dev,
744 			 struct mlx5_bfreg_info *bfregi, int bfregn)
745 {
746 	return bfregn / MLX5_NON_FP_BFREGS_PER_UAR * MLX5_BFREGS_PER_UAR +
747 				bfregn % MLX5_NON_FP_BFREGS_PER_UAR;
748 }
749 
750 static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
751 			  struct mlx5_ib_qp *qp, struct ib_udata *udata,
752 			  struct ib_qp_init_attr *attr,
753 			  u32 **in,
754 			  struct mlx5_ib_create_qp_resp *resp, int *inlen,
755 			  struct mlx5_ib_qp_base *base)
756 {
757 	struct mlx5_ib_ucontext *context;
758 	struct mlx5_ib_create_qp ucmd;
759 	struct mlx5_ib_ubuffer *ubuffer = &base->ubuffer;
760 	int page_shift = 0;
761 	int uar_index;
762 	int npages;
763 	u32 offset = 0;
764 	int bfregn;
765 	int ncont = 0;
766 	__be64 *pas;
767 	void *qpc;
768 	int err;
769 
770 	err = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd));
771 	if (err) {
772 		mlx5_ib_dbg(dev, "copy failed\n");
773 		return err;
774 	}
775 
776 	context = to_mucontext(pd->uobject->context);
777 	/*
778 	 * TBD: should come from the verbs when we have the API
779 	 */
780 	if (qp->flags & MLX5_IB_QP_CROSS_CHANNEL)
781 		/* In CROSS_CHANNEL CQ and QP must use the same UAR */
782 		bfregn = MLX5_CROSS_CHANNEL_BFREG;
783 	else {
784 		bfregn = alloc_bfreg(dev, &context->bfregi, MLX5_IB_LATENCY_CLASS_HIGH);
785 		if (bfregn < 0) {
786 			mlx5_ib_dbg(dev, "failed to allocate low latency BFREG\n");
787 			mlx5_ib_dbg(dev, "reverting to medium latency\n");
788 			bfregn = alloc_bfreg(dev, &context->bfregi, MLX5_IB_LATENCY_CLASS_MEDIUM);
789 			if (bfregn < 0) {
790 				mlx5_ib_dbg(dev, "failed to allocate medium latency BFREG\n");
791 				mlx5_ib_dbg(dev, "reverting to high latency\n");
792 				bfregn = alloc_bfreg(dev, &context->bfregi, MLX5_IB_LATENCY_CLASS_LOW);
793 				if (bfregn < 0) {
794 					mlx5_ib_warn(dev, "bfreg allocation failed\n");
795 					return bfregn;
796 				}
797 			}
798 		}
799 	}
800 
801 	uar_index = bfregn_to_uar_index(dev, &context->bfregi, bfregn);
802 	mlx5_ib_dbg(dev, "bfregn 0x%x, uar_index 0x%x\n", bfregn, uar_index);
803 
804 	qp->rq.offset = 0;
805 	qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
806 	qp->sq.offset = qp->rq.wqe_cnt << qp->rq.wqe_shift;
807 
808 	err = set_user_buf_size(dev, qp, &ucmd, base, attr);
809 	if (err)
810 		goto err_bfreg;
811 
812 	if (ucmd.buf_addr && ubuffer->buf_size) {
813 		ubuffer->buf_addr = ucmd.buf_addr;
814 		err = mlx5_ib_umem_get(dev, pd, ubuffer->buf_addr,
815 				       ubuffer->buf_size,
816 				       &ubuffer->umem, &npages, &page_shift,
817 				       &ncont, &offset);
818 		if (err)
819 			goto err_bfreg;
820 	} else {
821 		ubuffer->umem = NULL;
822 	}
823 
824 	*inlen = MLX5_ST_SZ_BYTES(create_qp_in) +
825 		 MLX5_FLD_SZ_BYTES(create_qp_in, pas[0]) * ncont;
826 	*in = mlx5_vzalloc(*inlen);
827 	if (!*in) {
828 		err = -ENOMEM;
829 		goto err_umem;
830 	}
831 
832 	pas = (__be64 *)MLX5_ADDR_OF(create_qp_in, *in, pas);
833 	if (ubuffer->umem)
834 		mlx5_ib_populate_pas(dev, ubuffer->umem, page_shift, pas, 0);
835 
836 	qpc = MLX5_ADDR_OF(create_qp_in, *in, qpc);
837 
838 	MLX5_SET(qpc, qpc, log_page_size, page_shift - MLX5_ADAPTER_PAGE_SHIFT);
839 	MLX5_SET(qpc, qpc, page_offset, offset);
840 
841 	MLX5_SET(qpc, qpc, uar_page, uar_index);
842 	resp->bfreg_index = adjust_bfregn(dev, &context->bfregi, bfregn);
843 	qp->bfregn = bfregn;
844 
845 	err = mlx5_ib_db_map_user(context, ucmd.db_addr, &qp->db);
846 	if (err) {
847 		mlx5_ib_dbg(dev, "map failed\n");
848 		goto err_free;
849 	}
850 
851 	err = ib_copy_to_udata(udata, resp, sizeof(*resp));
852 	if (err) {
853 		mlx5_ib_dbg(dev, "copy failed\n");
854 		goto err_unmap;
855 	}
856 	qp->create_type = MLX5_QP_USER;
857 
858 	return 0;
859 
860 err_unmap:
861 	mlx5_ib_db_unmap_user(context, &qp->db);
862 
863 err_free:
864 	kvfree(*in);
865 
866 err_umem:
867 	if (ubuffer->umem)
868 		ib_umem_release(ubuffer->umem);
869 
870 err_bfreg:
871 	free_bfreg(dev, &context->bfregi, bfregn);
872 	return err;
873 }
874 
875 static void destroy_qp_user(struct mlx5_ib_dev *dev, struct ib_pd *pd,
876 			    struct mlx5_ib_qp *qp, struct mlx5_ib_qp_base *base)
877 {
878 	struct mlx5_ib_ucontext *context;
879 
880 	context = to_mucontext(pd->uobject->context);
881 	mlx5_ib_db_unmap_user(context, &qp->db);
882 	if (base->ubuffer.umem)
883 		ib_umem_release(base->ubuffer.umem);
884 	free_bfreg(dev, &context->bfregi, qp->bfregn);
885 }
886 
887 static int create_kernel_qp(struct mlx5_ib_dev *dev,
888 			    struct ib_qp_init_attr *init_attr,
889 			    struct mlx5_ib_qp *qp,
890 			    u32 **in, int *inlen,
891 			    struct mlx5_ib_qp_base *base)
892 {
893 	int uar_index;
894 	void *qpc;
895 	int err;
896 
897 	if (init_attr->create_flags & ~(IB_QP_CREATE_SIGNATURE_EN |
898 					IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK |
899 					IB_QP_CREATE_IPOIB_UD_LSO |
900 					mlx5_ib_create_qp_sqpn_qp1()))
901 		return -EINVAL;
902 
903 	if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
904 		qp->bf.bfreg = &dev->fp_bfreg;
905 	else
906 		qp->bf.bfreg = &dev->bfreg;
907 
908 	qp->bf.buf_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
909 	uar_index = qp->bf.bfreg->index;
910 
911 	err = calc_sq_size(dev, init_attr, qp);
912 	if (err < 0) {
913 		mlx5_ib_dbg(dev, "err %d\n", err);
914 		return err;
915 	}
916 
917 	qp->rq.offset = 0;
918 	qp->sq.offset = qp->rq.wqe_cnt << qp->rq.wqe_shift;
919 	base->ubuffer.buf_size = err + (qp->rq.wqe_cnt << qp->rq.wqe_shift);
920 
921 	err = mlx5_buf_alloc(dev->mdev, base->ubuffer.buf_size, &qp->buf);
922 	if (err) {
923 		mlx5_ib_dbg(dev, "err %d\n", err);
924 		return err;
925 	}
926 
927 	qp->sq.qend = mlx5_get_send_wqe(qp, qp->sq.wqe_cnt);
928 	*inlen = MLX5_ST_SZ_BYTES(create_qp_in) +
929 		 MLX5_FLD_SZ_BYTES(create_qp_in, pas[0]) * qp->buf.npages;
930 	*in = mlx5_vzalloc(*inlen);
931 	if (!*in) {
932 		err = -ENOMEM;
933 		goto err_buf;
934 	}
935 
936 	qpc = MLX5_ADDR_OF(create_qp_in, *in, qpc);
937 	MLX5_SET(qpc, qpc, uar_page, uar_index);
938 	MLX5_SET(qpc, qpc, log_page_size, qp->buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT);
939 
940 	/* Set "fast registration enabled" for all kernel QPs */
941 	MLX5_SET(qpc, qpc, fre, 1);
942 	MLX5_SET(qpc, qpc, rlky, 1);
943 
944 	if (init_attr->create_flags & mlx5_ib_create_qp_sqpn_qp1()) {
945 		MLX5_SET(qpc, qpc, deth_sqpn, 1);
946 		qp->flags |= MLX5_IB_QP_SQPN_QP1;
947 	}
948 
949 	mlx5_fill_page_array(&qp->buf,
950 			     (__be64 *)MLX5_ADDR_OF(create_qp_in, *in, pas));
951 
952 	err = mlx5_db_alloc(dev->mdev, &qp->db);
953 	if (err) {
954 		mlx5_ib_dbg(dev, "err %d\n", err);
955 		goto err_free;
956 	}
957 
958 	qp->sq.wrid = kmalloc(qp->sq.wqe_cnt * sizeof(*qp->sq.wrid), GFP_KERNEL);
959 	qp->sq.wr_data = kmalloc(qp->sq.wqe_cnt * sizeof(*qp->sq.wr_data), GFP_KERNEL);
960 	qp->rq.wrid = kmalloc(qp->rq.wqe_cnt * sizeof(*qp->rq.wrid), GFP_KERNEL);
961 	qp->sq.w_list = kmalloc(qp->sq.wqe_cnt * sizeof(*qp->sq.w_list), GFP_KERNEL);
962 	qp->sq.wqe_head = kmalloc(qp->sq.wqe_cnt * sizeof(*qp->sq.wqe_head), GFP_KERNEL);
963 
964 	if (!qp->sq.wrid || !qp->sq.wr_data || !qp->rq.wrid ||
965 	    !qp->sq.w_list || !qp->sq.wqe_head) {
966 		err = -ENOMEM;
967 		goto err_wrid;
968 	}
969 	qp->create_type = MLX5_QP_KERNEL;
970 
971 	return 0;
972 
973 err_wrid:
974 	kfree(qp->sq.wqe_head);
975 	kfree(qp->sq.w_list);
976 	kfree(qp->sq.wrid);
977 	kfree(qp->sq.wr_data);
978 	kfree(qp->rq.wrid);
979 	mlx5_db_free(dev->mdev, &qp->db);
980 
981 err_free:
982 	kvfree(*in);
983 
984 err_buf:
985 	mlx5_buf_free(dev->mdev, &qp->buf);
986 	return err;
987 }
988 
989 static void destroy_qp_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp)
990 {
991 	kfree(qp->sq.wqe_head);
992 	kfree(qp->sq.w_list);
993 	kfree(qp->sq.wrid);
994 	kfree(qp->sq.wr_data);
995 	kfree(qp->rq.wrid);
996 	mlx5_db_free(dev->mdev, &qp->db);
997 	mlx5_buf_free(dev->mdev, &qp->buf);
998 }
999 
1000 static u32 get_rx_type(struct mlx5_ib_qp *qp, struct ib_qp_init_attr *attr)
1001 {
1002 	if (attr->srq || (attr->qp_type == IB_QPT_XRC_TGT) ||
1003 	    (attr->qp_type == IB_QPT_XRC_INI))
1004 		return MLX5_SRQ_RQ;
1005 	else if (!qp->has_rq)
1006 		return MLX5_ZERO_LEN_RQ;
1007 	else
1008 		return MLX5_NON_ZERO_RQ;
1009 }
1010 
1011 static int is_connected(enum ib_qp_type qp_type)
1012 {
1013 	if (qp_type == IB_QPT_RC || qp_type == IB_QPT_UC)
1014 		return 1;
1015 
1016 	return 0;
1017 }
1018 
1019 static int create_raw_packet_qp_tis(struct mlx5_ib_dev *dev,
1020 				    struct mlx5_ib_sq *sq, u32 tdn)
1021 {
1022 	u32 in[MLX5_ST_SZ_DW(create_tis_in)] = {0};
1023 	void *tisc = MLX5_ADDR_OF(create_tis_in, in, ctx);
1024 
1025 	MLX5_SET(tisc, tisc, transport_domain, tdn);
1026 	return mlx5_core_create_tis(dev->mdev, in, sizeof(in), &sq->tisn);
1027 }
1028 
1029 static void destroy_raw_packet_qp_tis(struct mlx5_ib_dev *dev,
1030 				      struct mlx5_ib_sq *sq)
1031 {
1032 	mlx5_core_destroy_tis(dev->mdev, sq->tisn);
1033 }
1034 
1035 static int create_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
1036 				   struct mlx5_ib_sq *sq, void *qpin,
1037 				   struct ib_pd *pd)
1038 {
1039 	struct mlx5_ib_ubuffer *ubuffer = &sq->ubuffer;
1040 	__be64 *pas;
1041 	void *in;
1042 	void *sqc;
1043 	void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc);
1044 	void *wq;
1045 	int inlen;
1046 	int err;
1047 	int page_shift = 0;
1048 	int npages;
1049 	int ncont = 0;
1050 	u32 offset = 0;
1051 
1052 	err = mlx5_ib_umem_get(dev, pd, ubuffer->buf_addr, ubuffer->buf_size,
1053 			       &sq->ubuffer.umem, &npages, &page_shift,
1054 			       &ncont, &offset);
1055 	if (err)
1056 		return err;
1057 
1058 	inlen = MLX5_ST_SZ_BYTES(create_sq_in) + sizeof(u64) * ncont;
1059 	in = mlx5_vzalloc(inlen);
1060 	if (!in) {
1061 		err = -ENOMEM;
1062 		goto err_umem;
1063 	}
1064 
1065 	sqc = MLX5_ADDR_OF(create_sq_in, in, ctx);
1066 	MLX5_SET(sqc, sqc, flush_in_error_en, 1);
1067 	MLX5_SET(sqc, sqc, state, MLX5_SQC_STATE_RST);
1068 	MLX5_SET(sqc, sqc, user_index, MLX5_GET(qpc, qpc, user_index));
1069 	MLX5_SET(sqc, sqc, cqn, MLX5_GET(qpc, qpc, cqn_snd));
1070 	MLX5_SET(sqc, sqc, tis_lst_sz, 1);
1071 	MLX5_SET(sqc, sqc, tis_num_0, sq->tisn);
1072 
1073 	wq = MLX5_ADDR_OF(sqc, sqc, wq);
1074 	MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC);
1075 	MLX5_SET(wq, wq, pd, MLX5_GET(qpc, qpc, pd));
1076 	MLX5_SET(wq, wq, uar_page, MLX5_GET(qpc, qpc, uar_page));
1077 	MLX5_SET64(wq, wq, dbr_addr, MLX5_GET64(qpc, qpc, dbr_addr));
1078 	MLX5_SET(wq, wq, log_wq_stride, ilog2(MLX5_SEND_WQE_BB));
1079 	MLX5_SET(wq, wq, log_wq_sz, MLX5_GET(qpc, qpc, log_sq_size));
1080 	MLX5_SET(wq, wq, log_wq_pg_sz,  page_shift - MLX5_ADAPTER_PAGE_SHIFT);
1081 	MLX5_SET(wq, wq, page_offset, offset);
1082 
1083 	pas = (__be64 *)MLX5_ADDR_OF(wq, wq, pas);
1084 	mlx5_ib_populate_pas(dev, sq->ubuffer.umem, page_shift, pas, 0);
1085 
1086 	err = mlx5_core_create_sq_tracked(dev->mdev, in, inlen, &sq->base.mqp);
1087 
1088 	kvfree(in);
1089 
1090 	if (err)
1091 		goto err_umem;
1092 
1093 	return 0;
1094 
1095 err_umem:
1096 	ib_umem_release(sq->ubuffer.umem);
1097 	sq->ubuffer.umem = NULL;
1098 
1099 	return err;
1100 }
1101 
1102 static void destroy_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
1103 				     struct mlx5_ib_sq *sq)
1104 {
1105 	mlx5_core_destroy_sq_tracked(dev->mdev, &sq->base.mqp);
1106 	ib_umem_release(sq->ubuffer.umem);
1107 }
1108 
1109 static int get_rq_pas_size(void *qpc)
1110 {
1111 	u32 log_page_size = MLX5_GET(qpc, qpc, log_page_size) + 12;
1112 	u32 log_rq_stride = MLX5_GET(qpc, qpc, log_rq_stride);
1113 	u32 log_rq_size   = MLX5_GET(qpc, qpc, log_rq_size);
1114 	u32 page_offset   = MLX5_GET(qpc, qpc, page_offset);
1115 	u32 po_quanta	  = 1 << (log_page_size - 6);
1116 	u32 rq_sz	  = 1 << (log_rq_size + 4 + log_rq_stride);
1117 	u32 page_size	  = 1 << log_page_size;
1118 	u32 rq_sz_po      = rq_sz + (page_offset * po_quanta);
1119 	u32 rq_num_pas	  = (rq_sz_po + page_size - 1) / page_size;
1120 
1121 	return rq_num_pas * sizeof(u64);
1122 }
1123 
1124 static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
1125 				   struct mlx5_ib_rq *rq, void *qpin)
1126 {
1127 	struct mlx5_ib_qp *mqp = rq->base.container_mibqp;
1128 	__be64 *pas;
1129 	__be64 *qp_pas;
1130 	void *in;
1131 	void *rqc;
1132 	void *wq;
1133 	void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc);
1134 	int inlen;
1135 	int err;
1136 	u32 rq_pas_size = get_rq_pas_size(qpc);
1137 
1138 	inlen = MLX5_ST_SZ_BYTES(create_rq_in) + rq_pas_size;
1139 	in = mlx5_vzalloc(inlen);
1140 	if (!in)
1141 		return -ENOMEM;
1142 
1143 	rqc = MLX5_ADDR_OF(create_rq_in, in, ctx);
1144 	MLX5_SET(rqc, rqc, vsd, 1);
1145 	MLX5_SET(rqc, rqc, mem_rq_type, MLX5_RQC_MEM_RQ_TYPE_MEMORY_RQ_INLINE);
1146 	MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RST);
1147 	MLX5_SET(rqc, rqc, flush_in_error_en, 1);
1148 	MLX5_SET(rqc, rqc, user_index, MLX5_GET(qpc, qpc, user_index));
1149 	MLX5_SET(rqc, rqc, cqn, MLX5_GET(qpc, qpc, cqn_rcv));
1150 
1151 	if (mqp->flags & MLX5_IB_QP_CAP_SCATTER_FCS)
1152 		MLX5_SET(rqc, rqc, scatter_fcs, 1);
1153 
1154 	wq = MLX5_ADDR_OF(rqc, rqc, wq);
1155 	MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC);
1156 	MLX5_SET(wq, wq, end_padding_mode,
1157 		 MLX5_GET(qpc, qpc, end_padding_mode));
1158 	MLX5_SET(wq, wq, page_offset, MLX5_GET(qpc, qpc, page_offset));
1159 	MLX5_SET(wq, wq, pd, MLX5_GET(qpc, qpc, pd));
1160 	MLX5_SET64(wq, wq, dbr_addr, MLX5_GET64(qpc, qpc, dbr_addr));
1161 	MLX5_SET(wq, wq, log_wq_stride, MLX5_GET(qpc, qpc, log_rq_stride) + 4);
1162 	MLX5_SET(wq, wq, log_wq_pg_sz, MLX5_GET(qpc, qpc, log_page_size));
1163 	MLX5_SET(wq, wq, log_wq_sz, MLX5_GET(qpc, qpc, log_rq_size));
1164 
1165 	pas = (__be64 *)MLX5_ADDR_OF(wq, wq, pas);
1166 	qp_pas = (__be64 *)MLX5_ADDR_OF(create_qp_in, qpin, pas);
1167 	memcpy(pas, qp_pas, rq_pas_size);
1168 
1169 	err = mlx5_core_create_rq_tracked(dev->mdev, in, inlen, &rq->base.mqp);
1170 
1171 	kvfree(in);
1172 
1173 	return err;
1174 }
1175 
1176 static void destroy_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
1177 				     struct mlx5_ib_rq *rq)
1178 {
1179 	mlx5_core_destroy_rq_tracked(dev->mdev, &rq->base.mqp);
1180 }
1181 
1182 static int create_raw_packet_qp_tir(struct mlx5_ib_dev *dev,
1183 				    struct mlx5_ib_rq *rq, u32 tdn)
1184 {
1185 	u32 *in;
1186 	void *tirc;
1187 	int inlen;
1188 	int err;
1189 
1190 	inlen = MLX5_ST_SZ_BYTES(create_tir_in);
1191 	in = mlx5_vzalloc(inlen);
1192 	if (!in)
1193 		return -ENOMEM;
1194 
1195 	tirc = MLX5_ADDR_OF(create_tir_in, in, ctx);
1196 	MLX5_SET(tirc, tirc, disp_type, MLX5_TIRC_DISP_TYPE_DIRECT);
1197 	MLX5_SET(tirc, tirc, inline_rqn, rq->base.mqp.qpn);
1198 	MLX5_SET(tirc, tirc, transport_domain, tdn);
1199 
1200 	err = mlx5_core_create_tir(dev->mdev, in, inlen, &rq->tirn);
1201 
1202 	kvfree(in);
1203 
1204 	return err;
1205 }
1206 
1207 static void destroy_raw_packet_qp_tir(struct mlx5_ib_dev *dev,
1208 				      struct mlx5_ib_rq *rq)
1209 {
1210 	mlx5_core_destroy_tir(dev->mdev, rq->tirn);
1211 }
1212 
1213 static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
1214 				u32 *in,
1215 				struct ib_pd *pd)
1216 {
1217 	struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
1218 	struct mlx5_ib_sq *sq = &raw_packet_qp->sq;
1219 	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
1220 	struct ib_uobject *uobj = pd->uobject;
1221 	struct ib_ucontext *ucontext = uobj->context;
1222 	struct mlx5_ib_ucontext *mucontext = to_mucontext(ucontext);
1223 	int err;
1224 	u32 tdn = mucontext->tdn;
1225 
1226 	if (qp->sq.wqe_cnt) {
1227 		err = create_raw_packet_qp_tis(dev, sq, tdn);
1228 		if (err)
1229 			return err;
1230 
1231 		err = create_raw_packet_qp_sq(dev, sq, in, pd);
1232 		if (err)
1233 			goto err_destroy_tis;
1234 
1235 		sq->base.container_mibqp = qp;
1236 	}
1237 
1238 	if (qp->rq.wqe_cnt) {
1239 		rq->base.container_mibqp = qp;
1240 
1241 		err = create_raw_packet_qp_rq(dev, rq, in);
1242 		if (err)
1243 			goto err_destroy_sq;
1244 
1245 
1246 		err = create_raw_packet_qp_tir(dev, rq, tdn);
1247 		if (err)
1248 			goto err_destroy_rq;
1249 	}
1250 
1251 	qp->trans_qp.base.mqp.qpn = qp->sq.wqe_cnt ? sq->base.mqp.qpn :
1252 						     rq->base.mqp.qpn;
1253 
1254 	return 0;
1255 
1256 err_destroy_rq:
1257 	destroy_raw_packet_qp_rq(dev, rq);
1258 err_destroy_sq:
1259 	if (!qp->sq.wqe_cnt)
1260 		return err;
1261 	destroy_raw_packet_qp_sq(dev, sq);
1262 err_destroy_tis:
1263 	destroy_raw_packet_qp_tis(dev, sq);
1264 
1265 	return err;
1266 }
1267 
1268 static void destroy_raw_packet_qp(struct mlx5_ib_dev *dev,
1269 				  struct mlx5_ib_qp *qp)
1270 {
1271 	struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
1272 	struct mlx5_ib_sq *sq = &raw_packet_qp->sq;
1273 	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
1274 
1275 	if (qp->rq.wqe_cnt) {
1276 		destroy_raw_packet_qp_tir(dev, rq);
1277 		destroy_raw_packet_qp_rq(dev, rq);
1278 	}
1279 
1280 	if (qp->sq.wqe_cnt) {
1281 		destroy_raw_packet_qp_sq(dev, sq);
1282 		destroy_raw_packet_qp_tis(dev, sq);
1283 	}
1284 }
1285 
1286 static void raw_packet_qp_copy_info(struct mlx5_ib_qp *qp,
1287 				    struct mlx5_ib_raw_packet_qp *raw_packet_qp)
1288 {
1289 	struct mlx5_ib_sq *sq = &raw_packet_qp->sq;
1290 	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
1291 
1292 	sq->sq = &qp->sq;
1293 	rq->rq = &qp->rq;
1294 	sq->doorbell = &qp->db;
1295 	rq->doorbell = &qp->db;
1296 }
1297 
1298 static void destroy_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp)
1299 {
1300 	mlx5_core_destroy_tir(dev->mdev, qp->rss_qp.tirn);
1301 }
1302 
1303 static int create_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
1304 				 struct ib_pd *pd,
1305 				 struct ib_qp_init_attr *init_attr,
1306 				 struct ib_udata *udata)
1307 {
1308 	struct ib_uobject *uobj = pd->uobject;
1309 	struct ib_ucontext *ucontext = uobj->context;
1310 	struct mlx5_ib_ucontext *mucontext = to_mucontext(ucontext);
1311 	struct mlx5_ib_create_qp_resp resp = {};
1312 	int inlen;
1313 	int err;
1314 	u32 *in;
1315 	void *tirc;
1316 	void *hfso;
1317 	u32 selected_fields = 0;
1318 	size_t min_resp_len;
1319 	u32 tdn = mucontext->tdn;
1320 	struct mlx5_ib_create_qp_rss ucmd = {};
1321 	size_t required_cmd_sz;
1322 
1323 	if (init_attr->qp_type != IB_QPT_RAW_PACKET)
1324 		return -EOPNOTSUPP;
1325 
1326 	if (init_attr->create_flags || init_attr->send_cq)
1327 		return -EINVAL;
1328 
1329 	min_resp_len = offsetof(typeof(resp), bfreg_index) + sizeof(resp.bfreg_index);
1330 	if (udata->outlen < min_resp_len)
1331 		return -EINVAL;
1332 
1333 	required_cmd_sz = offsetof(typeof(ucmd), reserved1) + sizeof(ucmd.reserved1);
1334 	if (udata->inlen < required_cmd_sz) {
1335 		mlx5_ib_dbg(dev, "invalid inlen\n");
1336 		return -EINVAL;
1337 	}
1338 
1339 	if (udata->inlen > sizeof(ucmd) &&
1340 	    !ib_is_udata_cleared(udata, sizeof(ucmd),
1341 				 udata->inlen - sizeof(ucmd))) {
1342 		mlx5_ib_dbg(dev, "inlen is not supported\n");
1343 		return -EOPNOTSUPP;
1344 	}
1345 
1346 	if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen))) {
1347 		mlx5_ib_dbg(dev, "copy failed\n");
1348 		return -EFAULT;
1349 	}
1350 
1351 	if (ucmd.comp_mask) {
1352 		mlx5_ib_dbg(dev, "invalid comp mask\n");
1353 		return -EOPNOTSUPP;
1354 	}
1355 
1356 	if (memchr_inv(ucmd.reserved, 0, sizeof(ucmd.reserved)) || ucmd.reserved1) {
1357 		mlx5_ib_dbg(dev, "invalid reserved\n");
1358 		return -EOPNOTSUPP;
1359 	}
1360 
1361 	err = ib_copy_to_udata(udata, &resp, min_resp_len);
1362 	if (err) {
1363 		mlx5_ib_dbg(dev, "copy failed\n");
1364 		return -EINVAL;
1365 	}
1366 
1367 	inlen = MLX5_ST_SZ_BYTES(create_tir_in);
1368 	in = mlx5_vzalloc(inlen);
1369 	if (!in)
1370 		return -ENOMEM;
1371 
1372 	tirc = MLX5_ADDR_OF(create_tir_in, in, ctx);
1373 	MLX5_SET(tirc, tirc, disp_type,
1374 		 MLX5_TIRC_DISP_TYPE_INDIRECT);
1375 	MLX5_SET(tirc, tirc, indirect_table,
1376 		 init_attr->rwq_ind_tbl->ind_tbl_num);
1377 	MLX5_SET(tirc, tirc, transport_domain, tdn);
1378 
1379 	hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
1380 	switch (ucmd.rx_hash_function) {
1381 	case MLX5_RX_HASH_FUNC_TOEPLITZ:
1382 	{
1383 		void *rss_key = MLX5_ADDR_OF(tirc, tirc, rx_hash_toeplitz_key);
1384 		size_t len = MLX5_FLD_SZ_BYTES(tirc, rx_hash_toeplitz_key);
1385 
1386 		if (len != ucmd.rx_key_len) {
1387 			err = -EINVAL;
1388 			goto err;
1389 		}
1390 
1391 		MLX5_SET(tirc, tirc, rx_hash_fn, MLX5_RX_HASH_FN_TOEPLITZ);
1392 		MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
1393 		memcpy(rss_key, ucmd.rx_hash_key, len);
1394 		break;
1395 	}
1396 	default:
1397 		err = -EOPNOTSUPP;
1398 		goto err;
1399 	}
1400 
1401 	if (!ucmd.rx_hash_fields_mask) {
1402 		/* special case when this TIR serves as steering entry without hashing */
1403 		if (!init_attr->rwq_ind_tbl->log_ind_tbl_size)
1404 			goto create_tir;
1405 		err = -EINVAL;
1406 		goto err;
1407 	}
1408 
1409 	if (((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV4) ||
1410 	     (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV4)) &&
1411 	     ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV6) ||
1412 	     (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV6))) {
1413 		err = -EINVAL;
1414 		goto err;
1415 	}
1416 
1417 	/* If none of IPV4 & IPV6 SRC/DST was set - this bit field is ignored */
1418 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV4) ||
1419 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV4))
1420 		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
1421 			 MLX5_L3_PROT_TYPE_IPV4);
1422 	else if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV6) ||
1423 		 (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV6))
1424 		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
1425 			 MLX5_L3_PROT_TYPE_IPV6);
1426 
1427 	if (((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_TCP) ||
1428 	     (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_TCP)) &&
1429 	     ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_UDP) ||
1430 	     (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_UDP))) {
1431 		err = -EINVAL;
1432 		goto err;
1433 	}
1434 
1435 	/* If none of TCP & UDP SRC/DST was set - this bit field is ignored */
1436 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_TCP) ||
1437 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_TCP))
1438 		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
1439 			 MLX5_L4_PROT_TYPE_TCP);
1440 	else if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_UDP) ||
1441 		 (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_UDP))
1442 		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
1443 			 MLX5_L4_PROT_TYPE_UDP);
1444 
1445 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV4) ||
1446 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_IPV6))
1447 		selected_fields |= MLX5_HASH_FIELD_SEL_SRC_IP;
1448 
1449 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV4) ||
1450 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_IPV6))
1451 		selected_fields |= MLX5_HASH_FIELD_SEL_DST_IP;
1452 
1453 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_TCP) ||
1454 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_SRC_PORT_UDP))
1455 		selected_fields |= MLX5_HASH_FIELD_SEL_L4_SPORT;
1456 
1457 	if ((ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_TCP) ||
1458 	    (ucmd.rx_hash_fields_mask & MLX5_RX_HASH_DST_PORT_UDP))
1459 		selected_fields |= MLX5_HASH_FIELD_SEL_L4_DPORT;
1460 
1461 	MLX5_SET(rx_hash_field_select, hfso, selected_fields, selected_fields);
1462 
1463 create_tir:
1464 	err = mlx5_core_create_tir(dev->mdev, in, inlen, &qp->rss_qp.tirn);
1465 
1466 	if (err)
1467 		goto err;
1468 
1469 	kvfree(in);
1470 	/* qpn is reserved for that QP */
1471 	qp->trans_qp.base.mqp.qpn = 0;
1472 	qp->flags |= MLX5_IB_QP_RSS;
1473 	return 0;
1474 
1475 err:
1476 	kvfree(in);
1477 	return err;
1478 }
1479 
1480 static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
1481 			    struct ib_qp_init_attr *init_attr,
1482 			    struct ib_udata *udata, struct mlx5_ib_qp *qp)
1483 {
1484 	struct mlx5_ib_resources *devr = &dev->devr;
1485 	int inlen = MLX5_ST_SZ_BYTES(create_qp_in);
1486 	struct mlx5_core_dev *mdev = dev->mdev;
1487 	struct mlx5_ib_create_qp_resp resp;
1488 	struct mlx5_ib_cq *send_cq;
1489 	struct mlx5_ib_cq *recv_cq;
1490 	unsigned long flags;
1491 	u32 uidx = MLX5_IB_DEFAULT_UIDX;
1492 	struct mlx5_ib_create_qp ucmd;
1493 	struct mlx5_ib_qp_base *base;
1494 	void *qpc;
1495 	u32 *in;
1496 	int err;
1497 
1498 	base = init_attr->qp_type == IB_QPT_RAW_PACKET ?
1499 	       &qp->raw_packet_qp.rq.base :
1500 	       &qp->trans_qp.base;
1501 
1502 	mutex_init(&qp->mutex);
1503 	spin_lock_init(&qp->sq.lock);
1504 	spin_lock_init(&qp->rq.lock);
1505 
1506 	if (init_attr->rwq_ind_tbl) {
1507 		if (!udata)
1508 			return -ENOSYS;
1509 
1510 		err = create_rss_raw_qp_tir(dev, qp, pd, init_attr, udata);
1511 		return err;
1512 	}
1513 
1514 	if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK) {
1515 		if (!MLX5_CAP_GEN(mdev, block_lb_mc)) {
1516 			mlx5_ib_dbg(dev, "block multicast loopback isn't supported\n");
1517 			return -EINVAL;
1518 		} else {
1519 			qp->flags |= MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK;
1520 		}
1521 	}
1522 
1523 	if (init_attr->create_flags &
1524 			(IB_QP_CREATE_CROSS_CHANNEL |
1525 			 IB_QP_CREATE_MANAGED_SEND |
1526 			 IB_QP_CREATE_MANAGED_RECV)) {
1527 		if (!MLX5_CAP_GEN(mdev, cd)) {
1528 			mlx5_ib_dbg(dev, "cross-channel isn't supported\n");
1529 			return -EINVAL;
1530 		}
1531 		if (init_attr->create_flags & IB_QP_CREATE_CROSS_CHANNEL)
1532 			qp->flags |= MLX5_IB_QP_CROSS_CHANNEL;
1533 		if (init_attr->create_flags & IB_QP_CREATE_MANAGED_SEND)
1534 			qp->flags |= MLX5_IB_QP_MANAGED_SEND;
1535 		if (init_attr->create_flags & IB_QP_CREATE_MANAGED_RECV)
1536 			qp->flags |= MLX5_IB_QP_MANAGED_RECV;
1537 	}
1538 
1539 	if (init_attr->qp_type == IB_QPT_UD &&
1540 	    (init_attr->create_flags & IB_QP_CREATE_IPOIB_UD_LSO))
1541 		if (!MLX5_CAP_GEN(mdev, ipoib_basic_offloads)) {
1542 			mlx5_ib_dbg(dev, "ipoib UD lso qp isn't supported\n");
1543 			return -EOPNOTSUPP;
1544 		}
1545 
1546 	if (init_attr->create_flags & IB_QP_CREATE_SCATTER_FCS) {
1547 		if (init_attr->qp_type != IB_QPT_RAW_PACKET) {
1548 			mlx5_ib_dbg(dev, "Scatter FCS is supported only for Raw Packet QPs");
1549 			return -EOPNOTSUPP;
1550 		}
1551 		if (!MLX5_CAP_GEN(dev->mdev, eth_net_offloads) ||
1552 		    !MLX5_CAP_ETH(dev->mdev, scatter_fcs)) {
1553 			mlx5_ib_dbg(dev, "Scatter FCS isn't supported\n");
1554 			return -EOPNOTSUPP;
1555 		}
1556 		qp->flags |= MLX5_IB_QP_CAP_SCATTER_FCS;
1557 	}
1558 
1559 	if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
1560 		qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE;
1561 
1562 	if (pd && pd->uobject) {
1563 		if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) {
1564 			mlx5_ib_dbg(dev, "copy failed\n");
1565 			return -EFAULT;
1566 		}
1567 
1568 		err = get_qp_user_index(to_mucontext(pd->uobject->context),
1569 					&ucmd, udata->inlen, &uidx);
1570 		if (err)
1571 			return err;
1572 
1573 		qp->wq_sig = !!(ucmd.flags & MLX5_QP_FLAG_SIGNATURE);
1574 		qp->scat_cqe = !!(ucmd.flags & MLX5_QP_FLAG_SCATTER_CQE);
1575 	} else {
1576 		qp->wq_sig = !!wq_signature;
1577 	}
1578 
1579 	qp->has_rq = qp_has_rq(init_attr);
1580 	err = set_rq_size(dev, &init_attr->cap, qp->has_rq,
1581 			  qp, (pd && pd->uobject) ? &ucmd : NULL);
1582 	if (err) {
1583 		mlx5_ib_dbg(dev, "err %d\n", err);
1584 		return err;
1585 	}
1586 
1587 	if (pd) {
1588 		if (pd->uobject) {
1589 			__u32 max_wqes =
1590 				1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
1591 			mlx5_ib_dbg(dev, "requested sq_wqe_count (%d)\n", ucmd.sq_wqe_count);
1592 			if (ucmd.rq_wqe_shift != qp->rq.wqe_shift ||
1593 			    ucmd.rq_wqe_count != qp->rq.wqe_cnt) {
1594 				mlx5_ib_dbg(dev, "invalid rq params\n");
1595 				return -EINVAL;
1596 			}
1597 			if (ucmd.sq_wqe_count > max_wqes) {
1598 				mlx5_ib_dbg(dev, "requested sq_wqe_count (%d) > max allowed (%d)\n",
1599 					    ucmd.sq_wqe_count, max_wqes);
1600 				return -EINVAL;
1601 			}
1602 			if (init_attr->create_flags &
1603 			    mlx5_ib_create_qp_sqpn_qp1()) {
1604 				mlx5_ib_dbg(dev, "user-space is not allowed to create UD QPs spoofing as QP1\n");
1605 				return -EINVAL;
1606 			}
1607 			err = create_user_qp(dev, pd, qp, udata, init_attr, &in,
1608 					     &resp, &inlen, base);
1609 			if (err)
1610 				mlx5_ib_dbg(dev, "err %d\n", err);
1611 		} else {
1612 			err = create_kernel_qp(dev, init_attr, qp, &in, &inlen,
1613 					       base);
1614 			if (err)
1615 				mlx5_ib_dbg(dev, "err %d\n", err);
1616 		}
1617 
1618 		if (err)
1619 			return err;
1620 	} else {
1621 		in = mlx5_vzalloc(inlen);
1622 		if (!in)
1623 			return -ENOMEM;
1624 
1625 		qp->create_type = MLX5_QP_EMPTY;
1626 	}
1627 
1628 	if (is_sqp(init_attr->qp_type))
1629 		qp->port = init_attr->port_num;
1630 
1631 	qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
1632 
1633 	MLX5_SET(qpc, qpc, st, to_mlx5_st(init_attr->qp_type));
1634 	MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);
1635 
1636 	if (init_attr->qp_type != MLX5_IB_QPT_REG_UMR)
1637 		MLX5_SET(qpc, qpc, pd, to_mpd(pd ? pd : devr->p0)->pdn);
1638 	else
1639 		MLX5_SET(qpc, qpc, latency_sensitive, 1);
1640 
1641 
1642 	if (qp->wq_sig)
1643 		MLX5_SET(qpc, qpc, wq_signature, 1);
1644 
1645 	if (qp->flags & MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK)
1646 		MLX5_SET(qpc, qpc, block_lb_mc, 1);
1647 
1648 	if (qp->flags & MLX5_IB_QP_CROSS_CHANNEL)
1649 		MLX5_SET(qpc, qpc, cd_master, 1);
1650 	if (qp->flags & MLX5_IB_QP_MANAGED_SEND)
1651 		MLX5_SET(qpc, qpc, cd_slave_send, 1);
1652 	if (qp->flags & MLX5_IB_QP_MANAGED_RECV)
1653 		MLX5_SET(qpc, qpc, cd_slave_receive, 1);
1654 
1655 	if (qp->scat_cqe && is_connected(init_attr->qp_type)) {
1656 		int rcqe_sz;
1657 		int scqe_sz;
1658 
1659 		rcqe_sz = mlx5_ib_get_cqe_size(dev, init_attr->recv_cq);
1660 		scqe_sz = mlx5_ib_get_cqe_size(dev, init_attr->send_cq);
1661 
1662 		if (rcqe_sz == 128)
1663 			MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA64_CQE);
1664 		else
1665 			MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA32_CQE);
1666 
1667 		if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR) {
1668 			if (scqe_sz == 128)
1669 				MLX5_SET(qpc, qpc, cs_req, MLX5_REQ_SCAT_DATA64_CQE);
1670 			else
1671 				MLX5_SET(qpc, qpc, cs_req, MLX5_REQ_SCAT_DATA32_CQE);
1672 		}
1673 	}
1674 
1675 	if (qp->rq.wqe_cnt) {
1676 		MLX5_SET(qpc, qpc, log_rq_stride, qp->rq.wqe_shift - 4);
1677 		MLX5_SET(qpc, qpc, log_rq_size, ilog2(qp->rq.wqe_cnt));
1678 	}
1679 
1680 	MLX5_SET(qpc, qpc, rq_type, get_rx_type(qp, init_attr));
1681 
1682 	if (qp->sq.wqe_cnt)
1683 		MLX5_SET(qpc, qpc, log_sq_size, ilog2(qp->sq.wqe_cnt));
1684 	else
1685 		MLX5_SET(qpc, qpc, no_sq, 1);
1686 
1687 	/* Set default resources */
1688 	switch (init_attr->qp_type) {
1689 	case IB_QPT_XRC_TGT:
1690 		MLX5_SET(qpc, qpc, cqn_rcv, to_mcq(devr->c0)->mcq.cqn);
1691 		MLX5_SET(qpc, qpc, cqn_snd, to_mcq(devr->c0)->mcq.cqn);
1692 		MLX5_SET(qpc, qpc, srqn_rmpn_xrqn, to_msrq(devr->s0)->msrq.srqn);
1693 		MLX5_SET(qpc, qpc, xrcd, to_mxrcd(init_attr->xrcd)->xrcdn);
1694 		break;
1695 	case IB_QPT_XRC_INI:
1696 		MLX5_SET(qpc, qpc, cqn_rcv, to_mcq(devr->c0)->mcq.cqn);
1697 		MLX5_SET(qpc, qpc, xrcd, to_mxrcd(devr->x1)->xrcdn);
1698 		MLX5_SET(qpc, qpc, srqn_rmpn_xrqn, to_msrq(devr->s0)->msrq.srqn);
1699 		break;
1700 	default:
1701 		if (init_attr->srq) {
1702 			MLX5_SET(qpc, qpc, xrcd, to_mxrcd(devr->x0)->xrcdn);
1703 			MLX5_SET(qpc, qpc, srqn_rmpn_xrqn, to_msrq(init_attr->srq)->msrq.srqn);
1704 		} else {
1705 			MLX5_SET(qpc, qpc, xrcd, to_mxrcd(devr->x1)->xrcdn);
1706 			MLX5_SET(qpc, qpc, srqn_rmpn_xrqn, to_msrq(devr->s1)->msrq.srqn);
1707 		}
1708 	}
1709 
1710 	if (init_attr->send_cq)
1711 		MLX5_SET(qpc, qpc, cqn_snd, to_mcq(init_attr->send_cq)->mcq.cqn);
1712 
1713 	if (init_attr->recv_cq)
1714 		MLX5_SET(qpc, qpc, cqn_rcv, to_mcq(init_attr->recv_cq)->mcq.cqn);
1715 
1716 	MLX5_SET64(qpc, qpc, dbr_addr, qp->db.dma);
1717 
1718 	/* 0xffffff means we ask to work with cqe version 0 */
1719 	if (MLX5_CAP_GEN(mdev, cqe_version) == MLX5_CQE_VERSION_V1)
1720 		MLX5_SET(qpc, qpc, user_index, uidx);
1721 
1722 	/* we use IB_QP_CREATE_IPOIB_UD_LSO to indicates ipoib qp */
1723 	if (init_attr->qp_type == IB_QPT_UD &&
1724 	    (init_attr->create_flags & IB_QP_CREATE_IPOIB_UD_LSO)) {
1725 		MLX5_SET(qpc, qpc, ulp_stateless_offload_mode, 1);
1726 		qp->flags |= MLX5_IB_QP_LSO;
1727 	}
1728 
1729 	if (init_attr->qp_type == IB_QPT_RAW_PACKET) {
1730 		qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd.sq_buf_addr;
1731 		raw_packet_qp_copy_info(qp, &qp->raw_packet_qp);
1732 		err = create_raw_packet_qp(dev, qp, in, pd);
1733 	} else {
1734 		err = mlx5_core_create_qp(dev->mdev, &base->mqp, in, inlen);
1735 	}
1736 
1737 	if (err) {
1738 		mlx5_ib_dbg(dev, "create qp failed\n");
1739 		goto err_create;
1740 	}
1741 
1742 	kvfree(in);
1743 
1744 	base->container_mibqp = qp;
1745 	base->mqp.event = mlx5_ib_qp_event;
1746 
1747 	get_cqs(init_attr->qp_type, init_attr->send_cq, init_attr->recv_cq,
1748 		&send_cq, &recv_cq);
1749 	spin_lock_irqsave(&dev->reset_flow_resource_lock, flags);
1750 	mlx5_ib_lock_cqs(send_cq, recv_cq);
1751 	/* Maintain device to QPs access, needed for further handling via reset
1752 	 * flow
1753 	 */
1754 	list_add_tail(&qp->qps_list, &dev->qp_list);
1755 	/* Maintain CQ to QPs access, needed for further handling via reset flow
1756 	 */
1757 	if (send_cq)
1758 		list_add_tail(&qp->cq_send_list, &send_cq->list_send_qp);
1759 	if (recv_cq)
1760 		list_add_tail(&qp->cq_recv_list, &recv_cq->list_recv_qp);
1761 	mlx5_ib_unlock_cqs(send_cq, recv_cq);
1762 	spin_unlock_irqrestore(&dev->reset_flow_resource_lock, flags);
1763 
1764 	return 0;
1765 
1766 err_create:
1767 	if (qp->create_type == MLX5_QP_USER)
1768 		destroy_qp_user(dev, pd, qp, base);
1769 	else if (qp->create_type == MLX5_QP_KERNEL)
1770 		destroy_qp_kernel(dev, qp);
1771 
1772 	kvfree(in);
1773 	return err;
1774 }
1775 
1776 static void mlx5_ib_lock_cqs(struct mlx5_ib_cq *send_cq, struct mlx5_ib_cq *recv_cq)
1777 	__acquires(&send_cq->lock) __acquires(&recv_cq->lock)
1778 {
1779 	if (send_cq) {
1780 		if (recv_cq) {
1781 			if (send_cq->mcq.cqn < recv_cq->mcq.cqn)  {
1782 				spin_lock(&send_cq->lock);
1783 				spin_lock_nested(&recv_cq->lock,
1784 						 SINGLE_DEPTH_NESTING);
1785 			} else if (send_cq->mcq.cqn == recv_cq->mcq.cqn) {
1786 				spin_lock(&send_cq->lock);
1787 				__acquire(&recv_cq->lock);
1788 			} else {
1789 				spin_lock(&recv_cq->lock);
1790 				spin_lock_nested(&send_cq->lock,
1791 						 SINGLE_DEPTH_NESTING);
1792 			}
1793 		} else {
1794 			spin_lock(&send_cq->lock);
1795 			__acquire(&recv_cq->lock);
1796 		}
1797 	} else if (recv_cq) {
1798 		spin_lock(&recv_cq->lock);
1799 		__acquire(&send_cq->lock);
1800 	} else {
1801 		__acquire(&send_cq->lock);
1802 		__acquire(&recv_cq->lock);
1803 	}
1804 }
1805 
1806 static void mlx5_ib_unlock_cqs(struct mlx5_ib_cq *send_cq, struct mlx5_ib_cq *recv_cq)
1807 	__releases(&send_cq->lock) __releases(&recv_cq->lock)
1808 {
1809 	if (send_cq) {
1810 		if (recv_cq) {
1811 			if (send_cq->mcq.cqn < recv_cq->mcq.cqn)  {
1812 				spin_unlock(&recv_cq->lock);
1813 				spin_unlock(&send_cq->lock);
1814 			} else if (send_cq->mcq.cqn == recv_cq->mcq.cqn) {
1815 				__release(&recv_cq->lock);
1816 				spin_unlock(&send_cq->lock);
1817 			} else {
1818 				spin_unlock(&send_cq->lock);
1819 				spin_unlock(&recv_cq->lock);
1820 			}
1821 		} else {
1822 			__release(&recv_cq->lock);
1823 			spin_unlock(&send_cq->lock);
1824 		}
1825 	} else if (recv_cq) {
1826 		__release(&send_cq->lock);
1827 		spin_unlock(&recv_cq->lock);
1828 	} else {
1829 		__release(&recv_cq->lock);
1830 		__release(&send_cq->lock);
1831 	}
1832 }
1833 
1834 static struct mlx5_ib_pd *get_pd(struct mlx5_ib_qp *qp)
1835 {
1836 	return to_mpd(qp->ibqp.pd);
1837 }
1838 
1839 static void get_cqs(enum ib_qp_type qp_type,
1840 		    struct ib_cq *ib_send_cq, struct ib_cq *ib_recv_cq,
1841 		    struct mlx5_ib_cq **send_cq, struct mlx5_ib_cq **recv_cq)
1842 {
1843 	switch (qp_type) {
1844 	case IB_QPT_XRC_TGT:
1845 		*send_cq = NULL;
1846 		*recv_cq = NULL;
1847 		break;
1848 	case MLX5_IB_QPT_REG_UMR:
1849 	case IB_QPT_XRC_INI:
1850 		*send_cq = ib_send_cq ? to_mcq(ib_send_cq) : NULL;
1851 		*recv_cq = NULL;
1852 		break;
1853 
1854 	case IB_QPT_SMI:
1855 	case MLX5_IB_QPT_HW_GSI:
1856 	case IB_QPT_RC:
1857 	case IB_QPT_UC:
1858 	case IB_QPT_UD:
1859 	case IB_QPT_RAW_IPV6:
1860 	case IB_QPT_RAW_ETHERTYPE:
1861 	case IB_QPT_RAW_PACKET:
1862 		*send_cq = ib_send_cq ? to_mcq(ib_send_cq) : NULL;
1863 		*recv_cq = ib_recv_cq ? to_mcq(ib_recv_cq) : NULL;
1864 		break;
1865 
1866 	case IB_QPT_MAX:
1867 	default:
1868 		*send_cq = NULL;
1869 		*recv_cq = NULL;
1870 		break;
1871 	}
1872 }
1873 
1874 static int modify_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
1875 				const struct mlx5_modify_raw_qp_param *raw_qp_param,
1876 				u8 lag_tx_affinity);
1877 
1878 static void destroy_qp_common(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp)
1879 {
1880 	struct mlx5_ib_cq *send_cq, *recv_cq;
1881 	struct mlx5_ib_qp_base *base = &qp->trans_qp.base;
1882 	unsigned long flags;
1883 	int err;
1884 
1885 	if (qp->ibqp.rwq_ind_tbl) {
1886 		destroy_rss_raw_qp_tir(dev, qp);
1887 		return;
1888 	}
1889 
1890 	base = qp->ibqp.qp_type == IB_QPT_RAW_PACKET ?
1891 	       &qp->raw_packet_qp.rq.base :
1892 	       &qp->trans_qp.base;
1893 
1894 	if (qp->state != IB_QPS_RESET) {
1895 		if (qp->ibqp.qp_type != IB_QPT_RAW_PACKET) {
1896 			err = mlx5_core_qp_modify(dev->mdev,
1897 						  MLX5_CMD_OP_2RST_QP, 0,
1898 						  NULL, &base->mqp);
1899 		} else {
1900 			struct mlx5_modify_raw_qp_param raw_qp_param = {
1901 				.operation = MLX5_CMD_OP_2RST_QP
1902 			};
1903 
1904 			err = modify_raw_packet_qp(dev, qp, &raw_qp_param, 0);
1905 		}
1906 		if (err)
1907 			mlx5_ib_warn(dev, "mlx5_ib: modify QP 0x%06x to RESET failed\n",
1908 				     base->mqp.qpn);
1909 	}
1910 
1911 	get_cqs(qp->ibqp.qp_type, qp->ibqp.send_cq, qp->ibqp.recv_cq,
1912 		&send_cq, &recv_cq);
1913 
1914 	spin_lock_irqsave(&dev->reset_flow_resource_lock, flags);
1915 	mlx5_ib_lock_cqs(send_cq, recv_cq);
1916 	/* del from lists under both locks above to protect reset flow paths */
1917 	list_del(&qp->qps_list);
1918 	if (send_cq)
1919 		list_del(&qp->cq_send_list);
1920 
1921 	if (recv_cq)
1922 		list_del(&qp->cq_recv_list);
1923 
1924 	if (qp->create_type == MLX5_QP_KERNEL) {
1925 		__mlx5_ib_cq_clean(recv_cq, base->mqp.qpn,
1926 				   qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
1927 		if (send_cq != recv_cq)
1928 			__mlx5_ib_cq_clean(send_cq, base->mqp.qpn,
1929 					   NULL);
1930 	}
1931 	mlx5_ib_unlock_cqs(send_cq, recv_cq);
1932 	spin_unlock_irqrestore(&dev->reset_flow_resource_lock, flags);
1933 
1934 	if (qp->ibqp.qp_type == IB_QPT_RAW_PACKET) {
1935 		destroy_raw_packet_qp(dev, qp);
1936 	} else {
1937 		err = mlx5_core_destroy_qp(dev->mdev, &base->mqp);
1938 		if (err)
1939 			mlx5_ib_warn(dev, "failed to destroy QP 0x%x\n",
1940 				     base->mqp.qpn);
1941 	}
1942 
1943 	if (qp->create_type == MLX5_QP_KERNEL)
1944 		destroy_qp_kernel(dev, qp);
1945 	else if (qp->create_type == MLX5_QP_USER)
1946 		destroy_qp_user(dev, &get_pd(qp)->ibpd, qp, base);
1947 }
1948 
1949 static const char *ib_qp_type_str(enum ib_qp_type type)
1950 {
1951 	switch (type) {
1952 	case IB_QPT_SMI:
1953 		return "IB_QPT_SMI";
1954 	case IB_QPT_GSI:
1955 		return "IB_QPT_GSI";
1956 	case IB_QPT_RC:
1957 		return "IB_QPT_RC";
1958 	case IB_QPT_UC:
1959 		return "IB_QPT_UC";
1960 	case IB_QPT_UD:
1961 		return "IB_QPT_UD";
1962 	case IB_QPT_RAW_IPV6:
1963 		return "IB_QPT_RAW_IPV6";
1964 	case IB_QPT_RAW_ETHERTYPE:
1965 		return "IB_QPT_RAW_ETHERTYPE";
1966 	case IB_QPT_XRC_INI:
1967 		return "IB_QPT_XRC_INI";
1968 	case IB_QPT_XRC_TGT:
1969 		return "IB_QPT_XRC_TGT";
1970 	case IB_QPT_RAW_PACKET:
1971 		return "IB_QPT_RAW_PACKET";
1972 	case MLX5_IB_QPT_REG_UMR:
1973 		return "MLX5_IB_QPT_REG_UMR";
1974 	case IB_QPT_MAX:
1975 	default:
1976 		return "Invalid QP type";
1977 	}
1978 }
1979 
1980 struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd,
1981 				struct ib_qp_init_attr *init_attr,
1982 				struct ib_udata *udata)
1983 {
1984 	struct mlx5_ib_dev *dev;
1985 	struct mlx5_ib_qp *qp;
1986 	u16 xrcdn = 0;
1987 	int err;
1988 
1989 	if (pd) {
1990 		dev = to_mdev(pd->device);
1991 
1992 		if (init_attr->qp_type == IB_QPT_RAW_PACKET) {
1993 			if (!pd->uobject) {
1994 				mlx5_ib_dbg(dev, "Raw Packet QP is not supported for kernel consumers\n");
1995 				return ERR_PTR(-EINVAL);
1996 			} else if (!to_mucontext(pd->uobject->context)->cqe_version) {
1997 				mlx5_ib_dbg(dev, "Raw Packet QP is only supported for CQE version > 0\n");
1998 				return ERR_PTR(-EINVAL);
1999 			}
2000 		}
2001 	} else {
2002 		/* being cautious here */
2003 		if (init_attr->qp_type != IB_QPT_XRC_TGT &&
2004 		    init_attr->qp_type != MLX5_IB_QPT_REG_UMR) {
2005 			pr_warn("%s: no PD for transport %s\n", __func__,
2006 				ib_qp_type_str(init_attr->qp_type));
2007 			return ERR_PTR(-EINVAL);
2008 		}
2009 		dev = to_mdev(to_mxrcd(init_attr->xrcd)->ibxrcd.device);
2010 	}
2011 
2012 	switch (init_attr->qp_type) {
2013 	case IB_QPT_XRC_TGT:
2014 	case IB_QPT_XRC_INI:
2015 		if (!MLX5_CAP_GEN(dev->mdev, xrc)) {
2016 			mlx5_ib_dbg(dev, "XRC not supported\n");
2017 			return ERR_PTR(-ENOSYS);
2018 		}
2019 		init_attr->recv_cq = NULL;
2020 		if (init_attr->qp_type == IB_QPT_XRC_TGT) {
2021 			xrcdn = to_mxrcd(init_attr->xrcd)->xrcdn;
2022 			init_attr->send_cq = NULL;
2023 		}
2024 
2025 		/* fall through */
2026 	case IB_QPT_RAW_PACKET:
2027 	case IB_QPT_RC:
2028 	case IB_QPT_UC:
2029 	case IB_QPT_UD:
2030 	case IB_QPT_SMI:
2031 	case MLX5_IB_QPT_HW_GSI:
2032 	case MLX5_IB_QPT_REG_UMR:
2033 		qp = kzalloc(sizeof(*qp), GFP_KERNEL);
2034 		if (!qp)
2035 			return ERR_PTR(-ENOMEM);
2036 
2037 		err = create_qp_common(dev, pd, init_attr, udata, qp);
2038 		if (err) {
2039 			mlx5_ib_dbg(dev, "create_qp_common failed\n");
2040 			kfree(qp);
2041 			return ERR_PTR(err);
2042 		}
2043 
2044 		if (is_qp0(init_attr->qp_type))
2045 			qp->ibqp.qp_num = 0;
2046 		else if (is_qp1(init_attr->qp_type))
2047 			qp->ibqp.qp_num = 1;
2048 		else
2049 			qp->ibqp.qp_num = qp->trans_qp.base.mqp.qpn;
2050 
2051 		mlx5_ib_dbg(dev, "ib qpnum 0x%x, mlx qpn 0x%x, rcqn 0x%x, scqn 0x%x\n",
2052 			    qp->ibqp.qp_num, qp->trans_qp.base.mqp.qpn,
2053 			    init_attr->recv_cq ? to_mcq(init_attr->recv_cq)->mcq.cqn : -1,
2054 			    init_attr->send_cq ? to_mcq(init_attr->send_cq)->mcq.cqn : -1);
2055 
2056 		qp->trans_qp.xrcdn = xrcdn;
2057 
2058 		break;
2059 
2060 	case IB_QPT_GSI:
2061 		return mlx5_ib_gsi_create_qp(pd, init_attr);
2062 
2063 	case IB_QPT_RAW_IPV6:
2064 	case IB_QPT_RAW_ETHERTYPE:
2065 	case IB_QPT_MAX:
2066 	default:
2067 		mlx5_ib_dbg(dev, "unsupported qp type %d\n",
2068 			    init_attr->qp_type);
2069 		/* Don't support raw QPs */
2070 		return ERR_PTR(-EINVAL);
2071 	}
2072 
2073 	return &qp->ibqp;
2074 }
2075 
2076 int mlx5_ib_destroy_qp(struct ib_qp *qp)
2077 {
2078 	struct mlx5_ib_dev *dev = to_mdev(qp->device);
2079 	struct mlx5_ib_qp *mqp = to_mqp(qp);
2080 
2081 	if (unlikely(qp->qp_type == IB_QPT_GSI))
2082 		return mlx5_ib_gsi_destroy_qp(qp);
2083 
2084 	destroy_qp_common(dev, mqp);
2085 
2086 	kfree(mqp);
2087 
2088 	return 0;
2089 }
2090 
2091 static __be32 to_mlx5_access_flags(struct mlx5_ib_qp *qp, const struct ib_qp_attr *attr,
2092 				   int attr_mask)
2093 {
2094 	u32 hw_access_flags = 0;
2095 	u8 dest_rd_atomic;
2096 	u32 access_flags;
2097 
2098 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
2099 		dest_rd_atomic = attr->max_dest_rd_atomic;
2100 	else
2101 		dest_rd_atomic = qp->trans_qp.resp_depth;
2102 
2103 	if (attr_mask & IB_QP_ACCESS_FLAGS)
2104 		access_flags = attr->qp_access_flags;
2105 	else
2106 		access_flags = qp->trans_qp.atomic_rd_en;
2107 
2108 	if (!dest_rd_atomic)
2109 		access_flags &= IB_ACCESS_REMOTE_WRITE;
2110 
2111 	if (access_flags & IB_ACCESS_REMOTE_READ)
2112 		hw_access_flags |= MLX5_QP_BIT_RRE;
2113 	if (access_flags & IB_ACCESS_REMOTE_ATOMIC)
2114 		hw_access_flags |= (MLX5_QP_BIT_RAE | MLX5_ATOMIC_MODE_CX);
2115 	if (access_flags & IB_ACCESS_REMOTE_WRITE)
2116 		hw_access_flags |= MLX5_QP_BIT_RWE;
2117 
2118 	return cpu_to_be32(hw_access_flags);
2119 }
2120 
2121 enum {
2122 	MLX5_PATH_FLAG_FL	= 1 << 0,
2123 	MLX5_PATH_FLAG_FREE_AR	= 1 << 1,
2124 	MLX5_PATH_FLAG_COUNTER	= 1 << 2,
2125 };
2126 
2127 static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate)
2128 {
2129 	if (rate == IB_RATE_PORT_CURRENT) {
2130 		return 0;
2131 	} else if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_300_GBPS) {
2132 		return -EINVAL;
2133 	} else {
2134 		while (rate != IB_RATE_2_5_GBPS &&
2135 		       !(1 << (rate + MLX5_STAT_RATE_OFFSET) &
2136 			 MLX5_CAP_GEN(dev->mdev, stat_rate_support)))
2137 			--rate;
2138 	}
2139 
2140 	return rate + MLX5_STAT_RATE_OFFSET;
2141 }
2142 
2143 static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
2144 				      struct mlx5_ib_sq *sq, u8 sl)
2145 {
2146 	void *in;
2147 	void *tisc;
2148 	int inlen;
2149 	int err;
2150 
2151 	inlen = MLX5_ST_SZ_BYTES(modify_tis_in);
2152 	in = mlx5_vzalloc(inlen);
2153 	if (!in)
2154 		return -ENOMEM;
2155 
2156 	MLX5_SET(modify_tis_in, in, bitmask.prio, 1);
2157 
2158 	tisc = MLX5_ADDR_OF(modify_tis_in, in, ctx);
2159 	MLX5_SET(tisc, tisc, prio, ((sl & 0x7) << 1));
2160 
2161 	err = mlx5_core_modify_tis(dev, sq->tisn, in, inlen);
2162 
2163 	kvfree(in);
2164 
2165 	return err;
2166 }
2167 
2168 static int modify_raw_packet_tx_affinity(struct mlx5_core_dev *dev,
2169 					 struct mlx5_ib_sq *sq, u8 tx_affinity)
2170 {
2171 	void *in;
2172 	void *tisc;
2173 	int inlen;
2174 	int err;
2175 
2176 	inlen = MLX5_ST_SZ_BYTES(modify_tis_in);
2177 	in = mlx5_vzalloc(inlen);
2178 	if (!in)
2179 		return -ENOMEM;
2180 
2181 	MLX5_SET(modify_tis_in, in, bitmask.lag_tx_port_affinity, 1);
2182 
2183 	tisc = MLX5_ADDR_OF(modify_tis_in, in, ctx);
2184 	MLX5_SET(tisc, tisc, lag_tx_port_affinity, tx_affinity);
2185 
2186 	err = mlx5_core_modify_tis(dev, sq->tisn, in, inlen);
2187 
2188 	kvfree(in);
2189 
2190 	return err;
2191 }
2192 
2193 static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
2194 			 const struct ib_ah_attr *ah,
2195 			 struct mlx5_qp_path *path, u8 port, int attr_mask,
2196 			 u32 path_flags, const struct ib_qp_attr *attr,
2197 			 bool alt)
2198 {
2199 	enum rdma_link_layer ll = rdma_port_get_link_layer(&dev->ib_dev, port);
2200 	int err;
2201 
2202 	if (attr_mask & IB_QP_PKEY_INDEX)
2203 		path->pkey_index = cpu_to_be16(alt ? attr->alt_pkey_index :
2204 						     attr->pkey_index);
2205 
2206 	if (ah->ah_flags & IB_AH_GRH) {
2207 		if (ah->grh.sgid_index >=
2208 		    dev->mdev->port_caps[port - 1].gid_table_len) {
2209 			pr_err("sgid_index (%u) too large. max is %d\n",
2210 			       ah->grh.sgid_index,
2211 			       dev->mdev->port_caps[port - 1].gid_table_len);
2212 			return -EINVAL;
2213 		}
2214 	}
2215 
2216 	if (ll == IB_LINK_LAYER_ETHERNET) {
2217 		if (!(ah->ah_flags & IB_AH_GRH))
2218 			return -EINVAL;
2219 		memcpy(path->rmac, ah->dmac, sizeof(ah->dmac));
2220 		path->udp_sport = mlx5_get_roce_udp_sport(dev, port,
2221 							  ah->grh.sgid_index);
2222 		path->dci_cfi_prio_sl = (ah->sl & 0x7) << 4;
2223 	} else {
2224 		path->fl_free_ar = (path_flags & MLX5_PATH_FLAG_FL) ? 0x80 : 0;
2225 		path->fl_free_ar |=
2226 			(path_flags & MLX5_PATH_FLAG_FREE_AR) ? 0x40 : 0;
2227 		path->rlid = cpu_to_be16(ah->dlid);
2228 		path->grh_mlid = ah->src_path_bits & 0x7f;
2229 		if (ah->ah_flags & IB_AH_GRH)
2230 			path->grh_mlid	|= 1 << 7;
2231 		path->dci_cfi_prio_sl = ah->sl & 0xf;
2232 	}
2233 
2234 	if (ah->ah_flags & IB_AH_GRH) {
2235 		path->mgid_index = ah->grh.sgid_index;
2236 		path->hop_limit  = ah->grh.hop_limit;
2237 		path->tclass_flowlabel =
2238 			cpu_to_be32((ah->grh.traffic_class << 20) |
2239 				    (ah->grh.flow_label));
2240 		memcpy(path->rgid, ah->grh.dgid.raw, 16);
2241 	}
2242 
2243 	err = ib_rate_to_mlx5(dev, ah->static_rate);
2244 	if (err < 0)
2245 		return err;
2246 	path->static_rate = err;
2247 	path->port = port;
2248 
2249 	if (attr_mask & IB_QP_TIMEOUT)
2250 		path->ackto_lt = (alt ? attr->alt_timeout : attr->timeout) << 3;
2251 
2252 	if ((qp->ibqp.qp_type == IB_QPT_RAW_PACKET) && qp->sq.wqe_cnt)
2253 		return modify_raw_packet_eth_prio(dev->mdev,
2254 						  &qp->raw_packet_qp.sq,
2255 						  ah->sl & 0xf);
2256 
2257 	return 0;
2258 }
2259 
2260 static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_QP_ST_MAX] = {
2261 	[MLX5_QP_STATE_INIT] = {
2262 		[MLX5_QP_STATE_INIT] = {
2263 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_RRE		|
2264 					  MLX5_QP_OPTPAR_RAE		|
2265 					  MLX5_QP_OPTPAR_RWE		|
2266 					  MLX5_QP_OPTPAR_PKEY_INDEX	|
2267 					  MLX5_QP_OPTPAR_PRI_PORT,
2268 			[MLX5_QP_ST_UC] = MLX5_QP_OPTPAR_RWE		|
2269 					  MLX5_QP_OPTPAR_PKEY_INDEX	|
2270 					  MLX5_QP_OPTPAR_PRI_PORT,
2271 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
2272 					  MLX5_QP_OPTPAR_Q_KEY		|
2273 					  MLX5_QP_OPTPAR_PRI_PORT,
2274 		},
2275 		[MLX5_QP_STATE_RTR] = {
2276 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
2277 					  MLX5_QP_OPTPAR_RRE            |
2278 					  MLX5_QP_OPTPAR_RAE            |
2279 					  MLX5_QP_OPTPAR_RWE            |
2280 					  MLX5_QP_OPTPAR_PKEY_INDEX,
2281 			[MLX5_QP_ST_UC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
2282 					  MLX5_QP_OPTPAR_RWE            |
2283 					  MLX5_QP_OPTPAR_PKEY_INDEX,
2284 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX     |
2285 					  MLX5_QP_OPTPAR_Q_KEY,
2286 			[MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_PKEY_INDEX	|
2287 					   MLX5_QP_OPTPAR_Q_KEY,
2288 			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
2289 					  MLX5_QP_OPTPAR_RRE            |
2290 					  MLX5_QP_OPTPAR_RAE            |
2291 					  MLX5_QP_OPTPAR_RWE            |
2292 					  MLX5_QP_OPTPAR_PKEY_INDEX,
2293 		},
2294 	},
2295 	[MLX5_QP_STATE_RTR] = {
2296 		[MLX5_QP_STATE_RTS] = {
2297 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
2298 					  MLX5_QP_OPTPAR_RRE		|
2299 					  MLX5_QP_OPTPAR_RAE		|
2300 					  MLX5_QP_OPTPAR_RWE		|
2301 					  MLX5_QP_OPTPAR_PM_STATE	|
2302 					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
2303 			[MLX5_QP_ST_UC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
2304 					  MLX5_QP_OPTPAR_RWE		|
2305 					  MLX5_QP_OPTPAR_PM_STATE,
2306 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
2307 		},
2308 	},
2309 	[MLX5_QP_STATE_RTS] = {
2310 		[MLX5_QP_STATE_RTS] = {
2311 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_RRE		|
2312 					  MLX5_QP_OPTPAR_RAE		|
2313 					  MLX5_QP_OPTPAR_RWE		|
2314 					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
2315 					  MLX5_QP_OPTPAR_PM_STATE	|
2316 					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
2317 			[MLX5_QP_ST_UC] = MLX5_QP_OPTPAR_RWE		|
2318 					  MLX5_QP_OPTPAR_PM_STATE	|
2319 					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
2320 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
2321 					  MLX5_QP_OPTPAR_SRQN		|
2322 					  MLX5_QP_OPTPAR_CQN_RCV,
2323 		},
2324 	},
2325 	[MLX5_QP_STATE_SQER] = {
2326 		[MLX5_QP_STATE_RTS] = {
2327 			[MLX5_QP_ST_UD]	 = MLX5_QP_OPTPAR_Q_KEY,
2328 			[MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_Q_KEY,
2329 			[MLX5_QP_ST_UC]	 = MLX5_QP_OPTPAR_RWE,
2330 			[MLX5_QP_ST_RC]	 = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
2331 					   MLX5_QP_OPTPAR_RWE		|
2332 					   MLX5_QP_OPTPAR_RAE		|
2333 					   MLX5_QP_OPTPAR_RRE,
2334 		},
2335 	},
2336 };
2337 
2338 static int ib_nr_to_mlx5_nr(int ib_mask)
2339 {
2340 	switch (ib_mask) {
2341 	case IB_QP_STATE:
2342 		return 0;
2343 	case IB_QP_CUR_STATE:
2344 		return 0;
2345 	case IB_QP_EN_SQD_ASYNC_NOTIFY:
2346 		return 0;
2347 	case IB_QP_ACCESS_FLAGS:
2348 		return MLX5_QP_OPTPAR_RWE | MLX5_QP_OPTPAR_RRE |
2349 			MLX5_QP_OPTPAR_RAE;
2350 	case IB_QP_PKEY_INDEX:
2351 		return MLX5_QP_OPTPAR_PKEY_INDEX;
2352 	case IB_QP_PORT:
2353 		return MLX5_QP_OPTPAR_PRI_PORT;
2354 	case IB_QP_QKEY:
2355 		return MLX5_QP_OPTPAR_Q_KEY;
2356 	case IB_QP_AV:
2357 		return MLX5_QP_OPTPAR_PRIMARY_ADDR_PATH |
2358 			MLX5_QP_OPTPAR_PRI_PORT;
2359 	case IB_QP_PATH_MTU:
2360 		return 0;
2361 	case IB_QP_TIMEOUT:
2362 		return MLX5_QP_OPTPAR_ACK_TIMEOUT;
2363 	case IB_QP_RETRY_CNT:
2364 		return MLX5_QP_OPTPAR_RETRY_COUNT;
2365 	case IB_QP_RNR_RETRY:
2366 		return MLX5_QP_OPTPAR_RNR_RETRY;
2367 	case IB_QP_RQ_PSN:
2368 		return 0;
2369 	case IB_QP_MAX_QP_RD_ATOMIC:
2370 		return MLX5_QP_OPTPAR_SRA_MAX;
2371 	case IB_QP_ALT_PATH:
2372 		return MLX5_QP_OPTPAR_ALT_ADDR_PATH;
2373 	case IB_QP_MIN_RNR_TIMER:
2374 		return MLX5_QP_OPTPAR_RNR_TIMEOUT;
2375 	case IB_QP_SQ_PSN:
2376 		return 0;
2377 	case IB_QP_MAX_DEST_RD_ATOMIC:
2378 		return MLX5_QP_OPTPAR_RRA_MAX | MLX5_QP_OPTPAR_RWE |
2379 			MLX5_QP_OPTPAR_RRE | MLX5_QP_OPTPAR_RAE;
2380 	case IB_QP_PATH_MIG_STATE:
2381 		return MLX5_QP_OPTPAR_PM_STATE;
2382 	case IB_QP_CAP:
2383 		return 0;
2384 	case IB_QP_DEST_QPN:
2385 		return 0;
2386 	}
2387 	return 0;
2388 }
2389 
2390 static int ib_mask_to_mlx5_opt(int ib_mask)
2391 {
2392 	int result = 0;
2393 	int i;
2394 
2395 	for (i = 0; i < 8 * sizeof(int); i++) {
2396 		if ((1 << i) & ib_mask)
2397 			result |= ib_nr_to_mlx5_nr(1 << i);
2398 	}
2399 
2400 	return result;
2401 }
2402 
2403 static int modify_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
2404 				   struct mlx5_ib_rq *rq, int new_state,
2405 				   const struct mlx5_modify_raw_qp_param *raw_qp_param)
2406 {
2407 	void *in;
2408 	void *rqc;
2409 	int inlen;
2410 	int err;
2411 
2412 	inlen = MLX5_ST_SZ_BYTES(modify_rq_in);
2413 	in = mlx5_vzalloc(inlen);
2414 	if (!in)
2415 		return -ENOMEM;
2416 
2417 	MLX5_SET(modify_rq_in, in, rq_state, rq->state);
2418 
2419 	rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
2420 	MLX5_SET(rqc, rqc, state, new_state);
2421 
2422 	if (raw_qp_param->set_mask & MLX5_RAW_QP_MOD_SET_RQ_Q_CTR_ID) {
2423 		if (MLX5_CAP_GEN(dev->mdev, modify_rq_counter_set_id)) {
2424 			MLX5_SET64(modify_rq_in, in, modify_bitmask,
2425 				   MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_MODIFY_RQ_COUNTER_SET_ID);
2426 			MLX5_SET(rqc, rqc, counter_set_id, raw_qp_param->rq_q_ctr_id);
2427 		} else
2428 			pr_info_once("%s: RAW PACKET QP counters are not supported on current FW\n",
2429 				     dev->ib_dev.name);
2430 	}
2431 
2432 	err = mlx5_core_modify_rq(dev->mdev, rq->base.mqp.qpn, in, inlen);
2433 	if (err)
2434 		goto out;
2435 
2436 	rq->state = new_state;
2437 
2438 out:
2439 	kvfree(in);
2440 	return err;
2441 }
2442 
2443 static int modify_raw_packet_qp_sq(struct mlx5_core_dev *dev,
2444 				   struct mlx5_ib_sq *sq,
2445 				   int new_state,
2446 				   const struct mlx5_modify_raw_qp_param *raw_qp_param)
2447 {
2448 	struct mlx5_ib_qp *ibqp = sq->base.container_mibqp;
2449 	u32 old_rate = ibqp->rate_limit;
2450 	u32 new_rate = old_rate;
2451 	u16 rl_index = 0;
2452 	void *in;
2453 	void *sqc;
2454 	int inlen;
2455 	int err;
2456 
2457 	inlen = MLX5_ST_SZ_BYTES(modify_sq_in);
2458 	in = mlx5_vzalloc(inlen);
2459 	if (!in)
2460 		return -ENOMEM;
2461 
2462 	MLX5_SET(modify_sq_in, in, sq_state, sq->state);
2463 
2464 	sqc = MLX5_ADDR_OF(modify_sq_in, in, ctx);
2465 	MLX5_SET(sqc, sqc, state, new_state);
2466 
2467 	if (raw_qp_param->set_mask & MLX5_RAW_QP_RATE_LIMIT) {
2468 		if (new_state != MLX5_SQC_STATE_RDY)
2469 			pr_warn("%s: Rate limit can only be changed when SQ is moving to RDY\n",
2470 				__func__);
2471 		else
2472 			new_rate = raw_qp_param->rate_limit;
2473 	}
2474 
2475 	if (old_rate != new_rate) {
2476 		if (new_rate) {
2477 			err = mlx5_rl_add_rate(dev, new_rate, &rl_index);
2478 			if (err) {
2479 				pr_err("Failed configuring rate %u: %d\n",
2480 				       new_rate, err);
2481 				goto out;
2482 			}
2483 		}
2484 
2485 		MLX5_SET64(modify_sq_in, in, modify_bitmask, 1);
2486 		MLX5_SET(sqc, sqc, packet_pacing_rate_limit_index, rl_index);
2487 	}
2488 
2489 	err = mlx5_core_modify_sq(dev, sq->base.mqp.qpn, in, inlen);
2490 	if (err) {
2491 		/* Remove new rate from table if failed */
2492 		if (new_rate &&
2493 		    old_rate != new_rate)
2494 			mlx5_rl_remove_rate(dev, new_rate);
2495 		goto out;
2496 	}
2497 
2498 	/* Only remove the old rate after new rate was set */
2499 	if ((old_rate &&
2500 	    (old_rate != new_rate)) ||
2501 	    (new_state != MLX5_SQC_STATE_RDY))
2502 		mlx5_rl_remove_rate(dev, old_rate);
2503 
2504 	ibqp->rate_limit = new_rate;
2505 	sq->state = new_state;
2506 
2507 out:
2508 	kvfree(in);
2509 	return err;
2510 }
2511 
2512 static int modify_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
2513 				const struct mlx5_modify_raw_qp_param *raw_qp_param,
2514 				u8 tx_affinity)
2515 {
2516 	struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
2517 	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
2518 	struct mlx5_ib_sq *sq = &raw_packet_qp->sq;
2519 	int modify_rq = !!qp->rq.wqe_cnt;
2520 	int modify_sq = !!qp->sq.wqe_cnt;
2521 	int rq_state;
2522 	int sq_state;
2523 	int err;
2524 
2525 	switch (raw_qp_param->operation) {
2526 	case MLX5_CMD_OP_RST2INIT_QP:
2527 		rq_state = MLX5_RQC_STATE_RDY;
2528 		sq_state = MLX5_SQC_STATE_RDY;
2529 		break;
2530 	case MLX5_CMD_OP_2ERR_QP:
2531 		rq_state = MLX5_RQC_STATE_ERR;
2532 		sq_state = MLX5_SQC_STATE_ERR;
2533 		break;
2534 	case MLX5_CMD_OP_2RST_QP:
2535 		rq_state = MLX5_RQC_STATE_RST;
2536 		sq_state = MLX5_SQC_STATE_RST;
2537 		break;
2538 	case MLX5_CMD_OP_RTR2RTS_QP:
2539 	case MLX5_CMD_OP_RTS2RTS_QP:
2540 		if (raw_qp_param->set_mask ==
2541 		    MLX5_RAW_QP_RATE_LIMIT) {
2542 			modify_rq = 0;
2543 			sq_state = sq->state;
2544 		} else {
2545 			return raw_qp_param->set_mask ? -EINVAL : 0;
2546 		}
2547 		break;
2548 	case MLX5_CMD_OP_INIT2INIT_QP:
2549 	case MLX5_CMD_OP_INIT2RTR_QP:
2550 		if (raw_qp_param->set_mask)
2551 			return -EINVAL;
2552 		else
2553 			return 0;
2554 	default:
2555 		WARN_ON(1);
2556 		return -EINVAL;
2557 	}
2558 
2559 	if (modify_rq) {
2560 		err =  modify_raw_packet_qp_rq(dev, rq, rq_state, raw_qp_param);
2561 		if (err)
2562 			return err;
2563 	}
2564 
2565 	if (modify_sq) {
2566 		if (tx_affinity) {
2567 			err = modify_raw_packet_tx_affinity(dev->mdev, sq,
2568 							    tx_affinity);
2569 			if (err)
2570 				return err;
2571 		}
2572 
2573 		return modify_raw_packet_qp_sq(dev->mdev, sq, sq_state, raw_qp_param);
2574 	}
2575 
2576 	return 0;
2577 }
2578 
2579 static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
2580 			       const struct ib_qp_attr *attr, int attr_mask,
2581 			       enum ib_qp_state cur_state, enum ib_qp_state new_state)
2582 {
2583 	static const u16 optab[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE] = {
2584 		[MLX5_QP_STATE_RST] = {
2585 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2586 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2587 			[MLX5_QP_STATE_INIT]	= MLX5_CMD_OP_RST2INIT_QP,
2588 		},
2589 		[MLX5_QP_STATE_INIT]  = {
2590 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2591 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2592 			[MLX5_QP_STATE_INIT]	= MLX5_CMD_OP_INIT2INIT_QP,
2593 			[MLX5_QP_STATE_RTR]	= MLX5_CMD_OP_INIT2RTR_QP,
2594 		},
2595 		[MLX5_QP_STATE_RTR]   = {
2596 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2597 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2598 			[MLX5_QP_STATE_RTS]	= MLX5_CMD_OP_RTR2RTS_QP,
2599 		},
2600 		[MLX5_QP_STATE_RTS]   = {
2601 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2602 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2603 			[MLX5_QP_STATE_RTS]	= MLX5_CMD_OP_RTS2RTS_QP,
2604 		},
2605 		[MLX5_QP_STATE_SQD] = {
2606 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2607 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2608 		},
2609 		[MLX5_QP_STATE_SQER] = {
2610 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2611 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2612 			[MLX5_QP_STATE_RTS]	= MLX5_CMD_OP_SQERR2RTS_QP,
2613 		},
2614 		[MLX5_QP_STATE_ERR] = {
2615 			[MLX5_QP_STATE_RST]	= MLX5_CMD_OP_2RST_QP,
2616 			[MLX5_QP_STATE_ERR]	= MLX5_CMD_OP_2ERR_QP,
2617 		}
2618 	};
2619 
2620 	struct mlx5_ib_dev *dev = to_mdev(ibqp->device);
2621 	struct mlx5_ib_qp *qp = to_mqp(ibqp);
2622 	struct mlx5_ib_qp_base *base = &qp->trans_qp.base;
2623 	struct mlx5_ib_cq *send_cq, *recv_cq;
2624 	struct mlx5_qp_context *context;
2625 	struct mlx5_ib_pd *pd;
2626 	struct mlx5_ib_port *mibport = NULL;
2627 	enum mlx5_qp_state mlx5_cur, mlx5_new;
2628 	enum mlx5_qp_optpar optpar;
2629 	int mlx5_st;
2630 	int err;
2631 	u16 op;
2632 	u8 tx_affinity = 0;
2633 
2634 	context = kzalloc(sizeof(*context), GFP_KERNEL);
2635 	if (!context)
2636 		return -ENOMEM;
2637 
2638 	err = to_mlx5_st(ibqp->qp_type);
2639 	if (err < 0) {
2640 		mlx5_ib_dbg(dev, "unsupported qp type %d\n", ibqp->qp_type);
2641 		goto out;
2642 	}
2643 
2644 	context->flags = cpu_to_be32(err << 16);
2645 
2646 	if (!(attr_mask & IB_QP_PATH_MIG_STATE)) {
2647 		context->flags |= cpu_to_be32(MLX5_QP_PM_MIGRATED << 11);
2648 	} else {
2649 		switch (attr->path_mig_state) {
2650 		case IB_MIG_MIGRATED:
2651 			context->flags |= cpu_to_be32(MLX5_QP_PM_MIGRATED << 11);
2652 			break;
2653 		case IB_MIG_REARM:
2654 			context->flags |= cpu_to_be32(MLX5_QP_PM_REARM << 11);
2655 			break;
2656 		case IB_MIG_ARMED:
2657 			context->flags |= cpu_to_be32(MLX5_QP_PM_ARMED << 11);
2658 			break;
2659 		}
2660 	}
2661 
2662 	if ((cur_state == IB_QPS_RESET) && (new_state == IB_QPS_INIT)) {
2663 		if ((ibqp->qp_type == IB_QPT_RC) ||
2664 		    (ibqp->qp_type == IB_QPT_UD &&
2665 		     !(qp->flags & MLX5_IB_QP_SQPN_QP1)) ||
2666 		    (ibqp->qp_type == IB_QPT_UC) ||
2667 		    (ibqp->qp_type == IB_QPT_RAW_PACKET) ||
2668 		    (ibqp->qp_type == IB_QPT_XRC_INI) ||
2669 		    (ibqp->qp_type == IB_QPT_XRC_TGT)) {
2670 			if (mlx5_lag_is_active(dev->mdev)) {
2671 				tx_affinity = (unsigned int)atomic_add_return(1,
2672 						&dev->roce.next_port) %
2673 						MLX5_MAX_PORTS + 1;
2674 				context->flags |= cpu_to_be32(tx_affinity << 24);
2675 			}
2676 		}
2677 	}
2678 
2679 	if (is_sqp(ibqp->qp_type)) {
2680 		context->mtu_msgmax = (IB_MTU_256 << 5) | 8;
2681 	} else if (ibqp->qp_type == IB_QPT_UD ||
2682 		   ibqp->qp_type == MLX5_IB_QPT_REG_UMR) {
2683 		context->mtu_msgmax = (IB_MTU_4096 << 5) | 12;
2684 	} else if (attr_mask & IB_QP_PATH_MTU) {
2685 		if (attr->path_mtu < IB_MTU_256 ||
2686 		    attr->path_mtu > IB_MTU_4096) {
2687 			mlx5_ib_warn(dev, "invalid mtu %d\n", attr->path_mtu);
2688 			err = -EINVAL;
2689 			goto out;
2690 		}
2691 		context->mtu_msgmax = (attr->path_mtu << 5) |
2692 				      (u8)MLX5_CAP_GEN(dev->mdev, log_max_msg);
2693 	}
2694 
2695 	if (attr_mask & IB_QP_DEST_QPN)
2696 		context->log_pg_sz_remote_qpn = cpu_to_be32(attr->dest_qp_num);
2697 
2698 	if (attr_mask & IB_QP_PKEY_INDEX)
2699 		context->pri_path.pkey_index = cpu_to_be16(attr->pkey_index);
2700 
2701 	/* todo implement counter_index functionality */
2702 
2703 	if (is_sqp(ibqp->qp_type))
2704 		context->pri_path.port = qp->port;
2705 
2706 	if (attr_mask & IB_QP_PORT)
2707 		context->pri_path.port = attr->port_num;
2708 
2709 	if (attr_mask & IB_QP_AV) {
2710 		err = mlx5_set_path(dev, qp, &attr->ah_attr, &context->pri_path,
2711 				    attr_mask & IB_QP_PORT ? attr->port_num : qp->port,
2712 				    attr_mask, 0, attr, false);
2713 		if (err)
2714 			goto out;
2715 	}
2716 
2717 	if (attr_mask & IB_QP_TIMEOUT)
2718 		context->pri_path.ackto_lt |= attr->timeout << 3;
2719 
2720 	if (attr_mask & IB_QP_ALT_PATH) {
2721 		err = mlx5_set_path(dev, qp, &attr->alt_ah_attr,
2722 				    &context->alt_path,
2723 				    attr->alt_port_num,
2724 				    attr_mask | IB_QP_PKEY_INDEX | IB_QP_TIMEOUT,
2725 				    0, attr, true);
2726 		if (err)
2727 			goto out;
2728 	}
2729 
2730 	pd = get_pd(qp);
2731 	get_cqs(qp->ibqp.qp_type, qp->ibqp.send_cq, qp->ibqp.recv_cq,
2732 		&send_cq, &recv_cq);
2733 
2734 	context->flags_pd = cpu_to_be32(pd ? pd->pdn : to_mpd(dev->devr.p0)->pdn);
2735 	context->cqn_send = send_cq ? cpu_to_be32(send_cq->mcq.cqn) : 0;
2736 	context->cqn_recv = recv_cq ? cpu_to_be32(recv_cq->mcq.cqn) : 0;
2737 	context->params1  = cpu_to_be32(MLX5_IB_ACK_REQ_FREQ << 28);
2738 
2739 	if (attr_mask & IB_QP_RNR_RETRY)
2740 		context->params1 |= cpu_to_be32(attr->rnr_retry << 13);
2741 
2742 	if (attr_mask & IB_QP_RETRY_CNT)
2743 		context->params1 |= cpu_to_be32(attr->retry_cnt << 16);
2744 
2745 	if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC) {
2746 		if (attr->max_rd_atomic)
2747 			context->params1 |=
2748 				cpu_to_be32(fls(attr->max_rd_atomic - 1) << 21);
2749 	}
2750 
2751 	if (attr_mask & IB_QP_SQ_PSN)
2752 		context->next_send_psn = cpu_to_be32(attr->sq_psn);
2753 
2754 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC) {
2755 		if (attr->max_dest_rd_atomic)
2756 			context->params2 |=
2757 				cpu_to_be32(fls(attr->max_dest_rd_atomic - 1) << 21);
2758 	}
2759 
2760 	if (attr_mask & (IB_QP_ACCESS_FLAGS | IB_QP_MAX_DEST_RD_ATOMIC))
2761 		context->params2 |= to_mlx5_access_flags(qp, attr, attr_mask);
2762 
2763 	if (attr_mask & IB_QP_MIN_RNR_TIMER)
2764 		context->rnr_nextrecvpsn |= cpu_to_be32(attr->min_rnr_timer << 24);
2765 
2766 	if (attr_mask & IB_QP_RQ_PSN)
2767 		context->rnr_nextrecvpsn |= cpu_to_be32(attr->rq_psn);
2768 
2769 	if (attr_mask & IB_QP_QKEY)
2770 		context->qkey = cpu_to_be32(attr->qkey);
2771 
2772 	if (qp->rq.wqe_cnt && cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT)
2773 		context->db_rec_addr = cpu_to_be64(qp->db.dma);
2774 
2775 	if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
2776 		u8 port_num = (attr_mask & IB_QP_PORT ? attr->port_num :
2777 			       qp->port) - 1;
2778 		mibport = &dev->port[port_num];
2779 		context->qp_counter_set_usr_page |=
2780 			cpu_to_be32((u32)(mibport->q_cnt_id) << 24);
2781 	}
2782 
2783 	if (!ibqp->uobject && cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT)
2784 		context->sq_crq_size |= cpu_to_be16(1 << 4);
2785 
2786 	if (qp->flags & MLX5_IB_QP_SQPN_QP1)
2787 		context->deth_sqpn = cpu_to_be32(1);
2788 
2789 	mlx5_cur = to_mlx5_state(cur_state);
2790 	mlx5_new = to_mlx5_state(new_state);
2791 	mlx5_st = to_mlx5_st(ibqp->qp_type);
2792 	if (mlx5_st < 0)
2793 		goto out;
2794 
2795 	if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE ||
2796 	    !optab[mlx5_cur][mlx5_new])
2797 		goto out;
2798 
2799 	op = optab[mlx5_cur][mlx5_new];
2800 	optpar = ib_mask_to_mlx5_opt(attr_mask);
2801 	optpar &= opt_mask[mlx5_cur][mlx5_new][mlx5_st];
2802 
2803 	if (qp->ibqp.qp_type == IB_QPT_RAW_PACKET) {
2804 		struct mlx5_modify_raw_qp_param raw_qp_param = {};
2805 
2806 		raw_qp_param.operation = op;
2807 		if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
2808 			raw_qp_param.rq_q_ctr_id = mibport->q_cnt_id;
2809 			raw_qp_param.set_mask |= MLX5_RAW_QP_MOD_SET_RQ_Q_CTR_ID;
2810 		}
2811 
2812 		if (attr_mask & IB_QP_RATE_LIMIT) {
2813 			raw_qp_param.rate_limit = attr->rate_limit;
2814 			raw_qp_param.set_mask |= MLX5_RAW_QP_RATE_LIMIT;
2815 		}
2816 
2817 		err = modify_raw_packet_qp(dev, qp, &raw_qp_param, tx_affinity);
2818 	} else {
2819 		err = mlx5_core_qp_modify(dev->mdev, op, optpar, context,
2820 					  &base->mqp);
2821 	}
2822 
2823 	if (err)
2824 		goto out;
2825 
2826 	qp->state = new_state;
2827 
2828 	if (attr_mask & IB_QP_ACCESS_FLAGS)
2829 		qp->trans_qp.atomic_rd_en = attr->qp_access_flags;
2830 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
2831 		qp->trans_qp.resp_depth = attr->max_dest_rd_atomic;
2832 	if (attr_mask & IB_QP_PORT)
2833 		qp->port = attr->port_num;
2834 	if (attr_mask & IB_QP_ALT_PATH)
2835 		qp->trans_qp.alt_port = attr->alt_port_num;
2836 
2837 	/*
2838 	 * If we moved a kernel QP to RESET, clean up all old CQ
2839 	 * entries and reinitialize the QP.
2840 	 */
2841 	if (new_state == IB_QPS_RESET && !ibqp->uobject) {
2842 		mlx5_ib_cq_clean(recv_cq, base->mqp.qpn,
2843 				 ibqp->srq ? to_msrq(ibqp->srq) : NULL);
2844 		if (send_cq != recv_cq)
2845 			mlx5_ib_cq_clean(send_cq, base->mqp.qpn, NULL);
2846 
2847 		qp->rq.head = 0;
2848 		qp->rq.tail = 0;
2849 		qp->sq.head = 0;
2850 		qp->sq.tail = 0;
2851 		qp->sq.cur_post = 0;
2852 		qp->sq.last_poll = 0;
2853 		qp->db.db[MLX5_RCV_DBR] = 0;
2854 		qp->db.db[MLX5_SND_DBR] = 0;
2855 	}
2856 
2857 out:
2858 	kfree(context);
2859 	return err;
2860 }
2861 
2862 int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
2863 		      int attr_mask, struct ib_udata *udata)
2864 {
2865 	struct mlx5_ib_dev *dev = to_mdev(ibqp->device);
2866 	struct mlx5_ib_qp *qp = to_mqp(ibqp);
2867 	enum ib_qp_type qp_type;
2868 	enum ib_qp_state cur_state, new_state;
2869 	int err = -EINVAL;
2870 	int port;
2871 	enum rdma_link_layer ll = IB_LINK_LAYER_UNSPECIFIED;
2872 
2873 	if (ibqp->rwq_ind_tbl)
2874 		return -ENOSYS;
2875 
2876 	if (unlikely(ibqp->qp_type == IB_QPT_GSI))
2877 		return mlx5_ib_gsi_modify_qp(ibqp, attr, attr_mask);
2878 
2879 	qp_type = (unlikely(ibqp->qp_type == MLX5_IB_QPT_HW_GSI)) ?
2880 		IB_QPT_GSI : ibqp->qp_type;
2881 
2882 	mutex_lock(&qp->mutex);
2883 
2884 	cur_state = attr_mask & IB_QP_CUR_STATE ? attr->cur_qp_state : qp->state;
2885 	new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
2886 
2887 	if (!(cur_state == new_state && cur_state == IB_QPS_RESET)) {
2888 		port = attr_mask & IB_QP_PORT ? attr->port_num : qp->port;
2889 		ll = dev->ib_dev.get_link_layer(&dev->ib_dev, port);
2890 	}
2891 
2892 	if (qp_type != MLX5_IB_QPT_REG_UMR &&
2893 	    !ib_modify_qp_is_ok(cur_state, new_state, qp_type, attr_mask, ll)) {
2894 		mlx5_ib_dbg(dev, "invalid QP state transition from %d to %d, qp_type %d, attr_mask 0x%x\n",
2895 			    cur_state, new_state, ibqp->qp_type, attr_mask);
2896 		goto out;
2897 	}
2898 
2899 	if ((attr_mask & IB_QP_PORT) &&
2900 	    (attr->port_num == 0 ||
2901 	     attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports))) {
2902 		mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
2903 			    attr->port_num, dev->num_ports);
2904 		goto out;
2905 	}
2906 
2907 	if (attr_mask & IB_QP_PKEY_INDEX) {
2908 		port = attr_mask & IB_QP_PORT ? attr->port_num : qp->port;
2909 		if (attr->pkey_index >=
2910 		    dev->mdev->port_caps[port - 1].pkey_table_len) {
2911 			mlx5_ib_dbg(dev, "invalid pkey index %d\n",
2912 				    attr->pkey_index);
2913 			goto out;
2914 		}
2915 	}
2916 
2917 	if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
2918 	    attr->max_rd_atomic >
2919 	    (1 << MLX5_CAP_GEN(dev->mdev, log_max_ra_res_qp))) {
2920 		mlx5_ib_dbg(dev, "invalid max_rd_atomic value %d\n",
2921 			    attr->max_rd_atomic);
2922 		goto out;
2923 	}
2924 
2925 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
2926 	    attr->max_dest_rd_atomic >
2927 	    (1 << MLX5_CAP_GEN(dev->mdev, log_max_ra_req_qp))) {
2928 		mlx5_ib_dbg(dev, "invalid max_dest_rd_atomic value %d\n",
2929 			    attr->max_dest_rd_atomic);
2930 		goto out;
2931 	}
2932 
2933 	if (cur_state == new_state && cur_state == IB_QPS_RESET) {
2934 		err = 0;
2935 		goto out;
2936 	}
2937 
2938 	err = __mlx5_ib_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
2939 
2940 out:
2941 	mutex_unlock(&qp->mutex);
2942 	return err;
2943 }
2944 
2945 static int mlx5_wq_overflow(struct mlx5_ib_wq *wq, int nreq, struct ib_cq *ib_cq)
2946 {
2947 	struct mlx5_ib_cq *cq;
2948 	unsigned cur;
2949 
2950 	cur = wq->head - wq->tail;
2951 	if (likely(cur + nreq < wq->max_post))
2952 		return 0;
2953 
2954 	cq = to_mcq(ib_cq);
2955 	spin_lock(&cq->lock);
2956 	cur = wq->head - wq->tail;
2957 	spin_unlock(&cq->lock);
2958 
2959 	return cur + nreq >= wq->max_post;
2960 }
2961 
2962 static __always_inline void set_raddr_seg(struct mlx5_wqe_raddr_seg *rseg,
2963 					  u64 remote_addr, u32 rkey)
2964 {
2965 	rseg->raddr    = cpu_to_be64(remote_addr);
2966 	rseg->rkey     = cpu_to_be32(rkey);
2967 	rseg->reserved = 0;
2968 }
2969 
2970 static void *set_eth_seg(struct mlx5_wqe_eth_seg *eseg,
2971 			 struct ib_send_wr *wr, void *qend,
2972 			 struct mlx5_ib_qp *qp, int *size)
2973 {
2974 	void *seg = eseg;
2975 
2976 	memset(eseg, 0, sizeof(struct mlx5_wqe_eth_seg));
2977 
2978 	if (wr->send_flags & IB_SEND_IP_CSUM)
2979 		eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM |
2980 				 MLX5_ETH_WQE_L4_CSUM;
2981 
2982 	seg += sizeof(struct mlx5_wqe_eth_seg);
2983 	*size += sizeof(struct mlx5_wqe_eth_seg) / 16;
2984 
2985 	if (wr->opcode == IB_WR_LSO) {
2986 		struct ib_ud_wr *ud_wr = container_of(wr, struct ib_ud_wr, wr);
2987 		int size_of_inl_hdr_start = sizeof(eseg->inline_hdr.start);
2988 		u64 left, leftlen, copysz;
2989 		void *pdata = ud_wr->header;
2990 
2991 		left = ud_wr->hlen;
2992 		eseg->mss = cpu_to_be16(ud_wr->mss);
2993 		eseg->inline_hdr.sz = cpu_to_be16(left);
2994 
2995 		/*
2996 		 * check if there is space till the end of queue, if yes,
2997 		 * copy all in one shot, otherwise copy till the end of queue,
2998 		 * rollback and than the copy the left
2999 		 */
3000 		leftlen = qend - (void *)eseg->inline_hdr.start;
3001 		copysz = min_t(u64, leftlen, left);
3002 
3003 		memcpy(seg - size_of_inl_hdr_start, pdata, copysz);
3004 
3005 		if (likely(copysz > size_of_inl_hdr_start)) {
3006 			seg += ALIGN(copysz - size_of_inl_hdr_start, 16);
3007 			*size += ALIGN(copysz - size_of_inl_hdr_start, 16) / 16;
3008 		}
3009 
3010 		if (unlikely(copysz < left)) { /* the last wqe in the queue */
3011 			seg = mlx5_get_send_wqe(qp, 0);
3012 			left -= copysz;
3013 			pdata += copysz;
3014 			memcpy(seg, pdata, left);
3015 			seg += ALIGN(left, 16);
3016 			*size += ALIGN(left, 16) / 16;
3017 		}
3018 	}
3019 
3020 	return seg;
3021 }
3022 
3023 static void set_datagram_seg(struct mlx5_wqe_datagram_seg *dseg,
3024 			     struct ib_send_wr *wr)
3025 {
3026 	memcpy(&dseg->av, &to_mah(ud_wr(wr)->ah)->av, sizeof(struct mlx5_av));
3027 	dseg->av.dqp_dct = cpu_to_be32(ud_wr(wr)->remote_qpn | MLX5_EXTENDED_UD_AV);
3028 	dseg->av.key.qkey.qkey = cpu_to_be32(ud_wr(wr)->remote_qkey);
3029 }
3030 
3031 static void set_data_ptr_seg(struct mlx5_wqe_data_seg *dseg, struct ib_sge *sg)
3032 {
3033 	dseg->byte_count = cpu_to_be32(sg->length);
3034 	dseg->lkey       = cpu_to_be32(sg->lkey);
3035 	dseg->addr       = cpu_to_be64(sg->addr);
3036 }
3037 
3038 static u64 get_xlt_octo(u64 bytes)
3039 {
3040 	return ALIGN(bytes, MLX5_IB_UMR_XLT_ALIGNMENT) /
3041 	       MLX5_IB_UMR_OCTOWORD;
3042 }
3043 
3044 static __be64 frwr_mkey_mask(void)
3045 {
3046 	u64 result;
3047 
3048 	result = MLX5_MKEY_MASK_LEN		|
3049 		MLX5_MKEY_MASK_PAGE_SIZE	|
3050 		MLX5_MKEY_MASK_START_ADDR	|
3051 		MLX5_MKEY_MASK_EN_RINVAL	|
3052 		MLX5_MKEY_MASK_KEY		|
3053 		MLX5_MKEY_MASK_LR		|
3054 		MLX5_MKEY_MASK_LW		|
3055 		MLX5_MKEY_MASK_RR		|
3056 		MLX5_MKEY_MASK_RW		|
3057 		MLX5_MKEY_MASK_A		|
3058 		MLX5_MKEY_MASK_SMALL_FENCE	|
3059 		MLX5_MKEY_MASK_FREE;
3060 
3061 	return cpu_to_be64(result);
3062 }
3063 
3064 static __be64 sig_mkey_mask(void)
3065 {
3066 	u64 result;
3067 
3068 	result = MLX5_MKEY_MASK_LEN		|
3069 		MLX5_MKEY_MASK_PAGE_SIZE	|
3070 		MLX5_MKEY_MASK_START_ADDR	|
3071 		MLX5_MKEY_MASK_EN_SIGERR	|
3072 		MLX5_MKEY_MASK_EN_RINVAL	|
3073 		MLX5_MKEY_MASK_KEY		|
3074 		MLX5_MKEY_MASK_LR		|
3075 		MLX5_MKEY_MASK_LW		|
3076 		MLX5_MKEY_MASK_RR		|
3077 		MLX5_MKEY_MASK_RW		|
3078 		MLX5_MKEY_MASK_SMALL_FENCE	|
3079 		MLX5_MKEY_MASK_FREE		|
3080 		MLX5_MKEY_MASK_BSF_EN;
3081 
3082 	return cpu_to_be64(result);
3083 }
3084 
3085 static void set_reg_umr_seg(struct mlx5_wqe_umr_ctrl_seg *umr,
3086 			    struct mlx5_ib_mr *mr)
3087 {
3088 	int size = mr->ndescs * mr->desc_size;
3089 
3090 	memset(umr, 0, sizeof(*umr));
3091 
3092 	umr->flags = MLX5_UMR_CHECK_NOT_FREE;
3093 	umr->xlt_octowords = cpu_to_be16(get_xlt_octo(size));
3094 	umr->mkey_mask = frwr_mkey_mask();
3095 }
3096 
3097 static void set_linv_umr_seg(struct mlx5_wqe_umr_ctrl_seg *umr)
3098 {
3099 	memset(umr, 0, sizeof(*umr));
3100 	umr->mkey_mask = cpu_to_be64(MLX5_MKEY_MASK_FREE);
3101 	umr->flags = MLX5_UMR_INLINE;
3102 }
3103 
3104 static __be64 get_umr_enable_mr_mask(void)
3105 {
3106 	u64 result;
3107 
3108 	result = MLX5_MKEY_MASK_KEY |
3109 		 MLX5_MKEY_MASK_FREE;
3110 
3111 	return cpu_to_be64(result);
3112 }
3113 
3114 static __be64 get_umr_disable_mr_mask(void)
3115 {
3116 	u64 result;
3117 
3118 	result = MLX5_MKEY_MASK_FREE;
3119 
3120 	return cpu_to_be64(result);
3121 }
3122 
3123 static __be64 get_umr_update_translation_mask(void)
3124 {
3125 	u64 result;
3126 
3127 	result = MLX5_MKEY_MASK_LEN |
3128 		 MLX5_MKEY_MASK_PAGE_SIZE |
3129 		 MLX5_MKEY_MASK_START_ADDR;
3130 
3131 	return cpu_to_be64(result);
3132 }
3133 
3134 static __be64 get_umr_update_access_mask(int atomic)
3135 {
3136 	u64 result;
3137 
3138 	result = MLX5_MKEY_MASK_LR |
3139 		 MLX5_MKEY_MASK_LW |
3140 		 MLX5_MKEY_MASK_RR |
3141 		 MLX5_MKEY_MASK_RW;
3142 
3143 	if (atomic)
3144 		result |= MLX5_MKEY_MASK_A;
3145 
3146 	return cpu_to_be64(result);
3147 }
3148 
3149 static __be64 get_umr_update_pd_mask(void)
3150 {
3151 	u64 result;
3152 
3153 	result = MLX5_MKEY_MASK_PD;
3154 
3155 	return cpu_to_be64(result);
3156 }
3157 
3158 static void set_reg_umr_segment(struct mlx5_wqe_umr_ctrl_seg *umr,
3159 				struct ib_send_wr *wr, int atomic)
3160 {
3161 	struct mlx5_umr_wr *umrwr = umr_wr(wr);
3162 
3163 	memset(umr, 0, sizeof(*umr));
3164 
3165 	if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
3166 		umr->flags = MLX5_UMR_CHECK_FREE; /* fail if free */
3167 	else
3168 		umr->flags = MLX5_UMR_CHECK_NOT_FREE; /* fail if not free */
3169 
3170 	umr->xlt_octowords = cpu_to_be16(get_xlt_octo(umrwr->xlt_size));
3171 	if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_XLT) {
3172 		u64 offset = get_xlt_octo(umrwr->offset);
3173 
3174 		umr->xlt_offset = cpu_to_be16(offset & 0xffff);
3175 		umr->xlt_offset_47_16 = cpu_to_be32(offset >> 16);
3176 		umr->flags |= MLX5_UMR_TRANSLATION_OFFSET_EN;
3177 	}
3178 	if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_TRANSLATION)
3179 		umr->mkey_mask |= get_umr_update_translation_mask();
3180 	if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_PD_ACCESS) {
3181 		umr->mkey_mask |= get_umr_update_access_mask(atomic);
3182 		umr->mkey_mask |= get_umr_update_pd_mask();
3183 	}
3184 	if (wr->send_flags & MLX5_IB_SEND_UMR_ENABLE_MR)
3185 		umr->mkey_mask |= get_umr_enable_mr_mask();
3186 	if (wr->send_flags & MLX5_IB_SEND_UMR_DISABLE_MR)
3187 		umr->mkey_mask |= get_umr_disable_mr_mask();
3188 
3189 	if (!wr->num_sge)
3190 		umr->flags |= MLX5_UMR_INLINE;
3191 }
3192 
3193 static u8 get_umr_flags(int acc)
3194 {
3195 	return (acc & IB_ACCESS_REMOTE_ATOMIC ? MLX5_PERM_ATOMIC       : 0) |
3196 	       (acc & IB_ACCESS_REMOTE_WRITE  ? MLX5_PERM_REMOTE_WRITE : 0) |
3197 	       (acc & IB_ACCESS_REMOTE_READ   ? MLX5_PERM_REMOTE_READ  : 0) |
3198 	       (acc & IB_ACCESS_LOCAL_WRITE   ? MLX5_PERM_LOCAL_WRITE  : 0) |
3199 		MLX5_PERM_LOCAL_READ | MLX5_PERM_UMR_EN;
3200 }
3201 
3202 static void set_reg_mkey_seg(struct mlx5_mkey_seg *seg,
3203 			     struct mlx5_ib_mr *mr,
3204 			     u32 key, int access)
3205 {
3206 	int ndescs = ALIGN(mr->ndescs, 8) >> 1;
3207 
3208 	memset(seg, 0, sizeof(*seg));
3209 
3210 	if (mr->access_mode == MLX5_MKC_ACCESS_MODE_MTT)
3211 		seg->log2_page_size = ilog2(mr->ibmr.page_size);
3212 	else if (mr->access_mode == MLX5_MKC_ACCESS_MODE_KLMS)
3213 		/* KLMs take twice the size of MTTs */
3214 		ndescs *= 2;
3215 
3216 	seg->flags = get_umr_flags(access) | mr->access_mode;
3217 	seg->qpn_mkey7_0 = cpu_to_be32((key & 0xff) | 0xffffff00);
3218 	seg->flags_pd = cpu_to_be32(MLX5_MKEY_REMOTE_INVAL);
3219 	seg->start_addr = cpu_to_be64(mr->ibmr.iova);
3220 	seg->len = cpu_to_be64(mr->ibmr.length);
3221 	seg->xlt_oct_size = cpu_to_be32(ndescs);
3222 }
3223 
3224 static void set_linv_mkey_seg(struct mlx5_mkey_seg *seg)
3225 {
3226 	memset(seg, 0, sizeof(*seg));
3227 	seg->status = MLX5_MKEY_STATUS_FREE;
3228 }
3229 
3230 static void set_reg_mkey_segment(struct mlx5_mkey_seg *seg, struct ib_send_wr *wr)
3231 {
3232 	struct mlx5_umr_wr *umrwr = umr_wr(wr);
3233 
3234 	memset(seg, 0, sizeof(*seg));
3235 	if (wr->send_flags & MLX5_IB_SEND_UMR_DISABLE_MR)
3236 		seg->status = MLX5_MKEY_STATUS_FREE;
3237 
3238 	seg->flags = convert_access(umrwr->access_flags);
3239 	if (umrwr->pd)
3240 		seg->flags_pd = cpu_to_be32(to_mpd(umrwr->pd)->pdn);
3241 	if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_TRANSLATION &&
3242 	    !umrwr->length)
3243 		seg->flags_pd |= cpu_to_be32(MLX5_MKEY_LEN64);
3244 
3245 	seg->start_addr = cpu_to_be64(umrwr->virt_addr);
3246 	seg->len = cpu_to_be64(umrwr->length);
3247 	seg->log2_page_size = umrwr->page_shift;
3248 	seg->qpn_mkey7_0 = cpu_to_be32(0xffffff00 |
3249 				       mlx5_mkey_variant(umrwr->mkey));
3250 }
3251 
3252 static void set_reg_data_seg(struct mlx5_wqe_data_seg *dseg,
3253 			     struct mlx5_ib_mr *mr,
3254 			     struct mlx5_ib_pd *pd)
3255 {
3256 	int bcount = mr->desc_size * mr->ndescs;
3257 
3258 	dseg->addr = cpu_to_be64(mr->desc_map);
3259 	dseg->byte_count = cpu_to_be32(ALIGN(bcount, 64));
3260 	dseg->lkey = cpu_to_be32(pd->ibpd.local_dma_lkey);
3261 }
3262 
3263 static __be32 send_ieth(struct ib_send_wr *wr)
3264 {
3265 	switch (wr->opcode) {
3266 	case IB_WR_SEND_WITH_IMM:
3267 	case IB_WR_RDMA_WRITE_WITH_IMM:
3268 		return wr->ex.imm_data;
3269 
3270 	case IB_WR_SEND_WITH_INV:
3271 		return cpu_to_be32(wr->ex.invalidate_rkey);
3272 
3273 	default:
3274 		return 0;
3275 	}
3276 }
3277 
3278 static u8 calc_sig(void *wqe, int size)
3279 {
3280 	u8 *p = wqe;
3281 	u8 res = 0;
3282 	int i;
3283 
3284 	for (i = 0; i < size; i++)
3285 		res ^= p[i];
3286 
3287 	return ~res;
3288 }
3289 
3290 static u8 wq_sig(void *wqe)
3291 {
3292 	return calc_sig(wqe, (*((u8 *)wqe + 8) & 0x3f) << 4);
3293 }
3294 
3295 static int set_data_inl_seg(struct mlx5_ib_qp *qp, struct ib_send_wr *wr,
3296 			    void *wqe, int *sz)
3297 {
3298 	struct mlx5_wqe_inline_seg *seg;
3299 	void *qend = qp->sq.qend;
3300 	void *addr;
3301 	int inl = 0;
3302 	int copy;
3303 	int len;
3304 	int i;
3305 
3306 	seg = wqe;
3307 	wqe += sizeof(*seg);
3308 	for (i = 0; i < wr->num_sge; i++) {
3309 		addr = (void *)(unsigned long)(wr->sg_list[i].addr);
3310 		len  = wr->sg_list[i].length;
3311 		inl += len;
3312 
3313 		if (unlikely(inl > qp->max_inline_data))
3314 			return -ENOMEM;
3315 
3316 		if (unlikely(wqe + len > qend)) {
3317 			copy = qend - wqe;
3318 			memcpy(wqe, addr, copy);
3319 			addr += copy;
3320 			len -= copy;
3321 			wqe = mlx5_get_send_wqe(qp, 0);
3322 		}
3323 		memcpy(wqe, addr, len);
3324 		wqe += len;
3325 	}
3326 
3327 	seg->byte_count = cpu_to_be32(inl | MLX5_INLINE_SEG);
3328 
3329 	*sz = ALIGN(inl + sizeof(seg->byte_count), 16) / 16;
3330 
3331 	return 0;
3332 }
3333 
3334 static u16 prot_field_size(enum ib_signature_type type)
3335 {
3336 	switch (type) {
3337 	case IB_SIG_TYPE_T10_DIF:
3338 		return MLX5_DIF_SIZE;
3339 	default:
3340 		return 0;
3341 	}
3342 }
3343 
3344 static u8 bs_selector(int block_size)
3345 {
3346 	switch (block_size) {
3347 	case 512:	    return 0x1;
3348 	case 520:	    return 0x2;
3349 	case 4096:	    return 0x3;
3350 	case 4160:	    return 0x4;
3351 	case 1073741824:    return 0x5;
3352 	default:	    return 0;
3353 	}
3354 }
3355 
3356 static void mlx5_fill_inl_bsf(struct ib_sig_domain *domain,
3357 			      struct mlx5_bsf_inl *inl)
3358 {
3359 	/* Valid inline section and allow BSF refresh */
3360 	inl->vld_refresh = cpu_to_be16(MLX5_BSF_INL_VALID |
3361 				       MLX5_BSF_REFRESH_DIF);
3362 	inl->dif_apptag = cpu_to_be16(domain->sig.dif.app_tag);
3363 	inl->dif_reftag = cpu_to_be32(domain->sig.dif.ref_tag);
3364 	/* repeating block */
3365 	inl->rp_inv_seed = MLX5_BSF_REPEAT_BLOCK;
3366 	inl->sig_type = domain->sig.dif.bg_type == IB_T10DIF_CRC ?
3367 			MLX5_DIF_CRC : MLX5_DIF_IPCS;
3368 
3369 	if (domain->sig.dif.ref_remap)
3370 		inl->dif_inc_ref_guard_check |= MLX5_BSF_INC_REFTAG;
3371 
3372 	if (domain->sig.dif.app_escape) {
3373 		if (domain->sig.dif.ref_escape)
3374 			inl->dif_inc_ref_guard_check |= MLX5_BSF_APPREF_ESCAPE;
3375 		else
3376 			inl->dif_inc_ref_guard_check |= MLX5_BSF_APPTAG_ESCAPE;
3377 	}
3378 
3379 	inl->dif_app_bitmask_check =
3380 		cpu_to_be16(domain->sig.dif.apptag_check_mask);
3381 }
3382 
3383 static int mlx5_set_bsf(struct ib_mr *sig_mr,
3384 			struct ib_sig_attrs *sig_attrs,
3385 			struct mlx5_bsf *bsf, u32 data_size)
3386 {
3387 	struct mlx5_core_sig_ctx *msig = to_mmr(sig_mr)->sig;
3388 	struct mlx5_bsf_basic *basic = &bsf->basic;
3389 	struct ib_sig_domain *mem = &sig_attrs->mem;
3390 	struct ib_sig_domain *wire = &sig_attrs->wire;
3391 
3392 	memset(bsf, 0, sizeof(*bsf));
3393 
3394 	/* Basic + Extended + Inline */
3395 	basic->bsf_size_sbs = 1 << 7;
3396 	/* Input domain check byte mask */
3397 	basic->check_byte_mask = sig_attrs->check_mask;
3398 	basic->raw_data_size = cpu_to_be32(data_size);
3399 
3400 	/* Memory domain */
3401 	switch (sig_attrs->mem.sig_type) {
3402 	case IB_SIG_TYPE_NONE:
3403 		break;
3404 	case IB_SIG_TYPE_T10_DIF:
3405 		basic->mem.bs_selector = bs_selector(mem->sig.dif.pi_interval);
3406 		basic->m_bfs_psv = cpu_to_be32(msig->psv_memory.psv_idx);
3407 		mlx5_fill_inl_bsf(mem, &bsf->m_inl);
3408 		break;
3409 	default:
3410 		return -EINVAL;
3411 	}
3412 
3413 	/* Wire domain */
3414 	switch (sig_attrs->wire.sig_type) {
3415 	case IB_SIG_TYPE_NONE:
3416 		break;
3417 	case IB_SIG_TYPE_T10_DIF:
3418 		if (mem->sig.dif.pi_interval == wire->sig.dif.pi_interval &&
3419 		    mem->sig_type == wire->sig_type) {
3420 			/* Same block structure */
3421 			basic->bsf_size_sbs |= 1 << 4;
3422 			if (mem->sig.dif.bg_type == wire->sig.dif.bg_type)
3423 				basic->wire.copy_byte_mask |= MLX5_CPY_GRD_MASK;
3424 			if (mem->sig.dif.app_tag == wire->sig.dif.app_tag)
3425 				basic->wire.copy_byte_mask |= MLX5_CPY_APP_MASK;
3426 			if (mem->sig.dif.ref_tag == wire->sig.dif.ref_tag)
3427 				basic->wire.copy_byte_mask |= MLX5_CPY_REF_MASK;
3428 		} else
3429 			basic->wire.bs_selector = bs_selector(wire->sig.dif.pi_interval);
3430 
3431 		basic->w_bfs_psv = cpu_to_be32(msig->psv_wire.psv_idx);
3432 		mlx5_fill_inl_bsf(wire, &bsf->w_inl);
3433 		break;
3434 	default:
3435 		return -EINVAL;
3436 	}
3437 
3438 	return 0;
3439 }
3440 
3441 static int set_sig_data_segment(struct ib_sig_handover_wr *wr,
3442 				struct mlx5_ib_qp *qp, void **seg, int *size)
3443 {
3444 	struct ib_sig_attrs *sig_attrs = wr->sig_attrs;
3445 	struct ib_mr *sig_mr = wr->sig_mr;
3446 	struct mlx5_bsf *bsf;
3447 	u32 data_len = wr->wr.sg_list->length;
3448 	u32 data_key = wr->wr.sg_list->lkey;
3449 	u64 data_va = wr->wr.sg_list->addr;
3450 	int ret;
3451 	int wqe_size;
3452 
3453 	if (!wr->prot ||
3454 	    (data_key == wr->prot->lkey &&
3455 	     data_va == wr->prot->addr &&
3456 	     data_len == wr->prot->length)) {
3457 		/**
3458 		 * Source domain doesn't contain signature information
3459 		 * or data and protection are interleaved in memory.
3460 		 * So need construct:
3461 		 *                  ------------------
3462 		 *                 |     data_klm     |
3463 		 *                  ------------------
3464 		 *                 |       BSF        |
3465 		 *                  ------------------
3466 		 **/
3467 		struct mlx5_klm *data_klm = *seg;
3468 
3469 		data_klm->bcount = cpu_to_be32(data_len);
3470 		data_klm->key = cpu_to_be32(data_key);
3471 		data_klm->va = cpu_to_be64(data_va);
3472 		wqe_size = ALIGN(sizeof(*data_klm), 64);
3473 	} else {
3474 		/**
3475 		 * Source domain contains signature information
3476 		 * So need construct a strided block format:
3477 		 *               ---------------------------
3478 		 *              |     stride_block_ctrl     |
3479 		 *               ---------------------------
3480 		 *              |          data_klm         |
3481 		 *               ---------------------------
3482 		 *              |          prot_klm         |
3483 		 *               ---------------------------
3484 		 *              |             BSF           |
3485 		 *               ---------------------------
3486 		 **/
3487 		struct mlx5_stride_block_ctrl_seg *sblock_ctrl;
3488 		struct mlx5_stride_block_entry *data_sentry;
3489 		struct mlx5_stride_block_entry *prot_sentry;
3490 		u32 prot_key = wr->prot->lkey;
3491 		u64 prot_va = wr->prot->addr;
3492 		u16 block_size = sig_attrs->mem.sig.dif.pi_interval;
3493 		int prot_size;
3494 
3495 		sblock_ctrl = *seg;
3496 		data_sentry = (void *)sblock_ctrl + sizeof(*sblock_ctrl);
3497 		prot_sentry = (void *)data_sentry + sizeof(*data_sentry);
3498 
3499 		prot_size = prot_field_size(sig_attrs->mem.sig_type);
3500 		if (!prot_size) {
3501 			pr_err("Bad block size given: %u\n", block_size);
3502 			return -EINVAL;
3503 		}
3504 		sblock_ctrl->bcount_per_cycle = cpu_to_be32(block_size +
3505 							    prot_size);
3506 		sblock_ctrl->op = cpu_to_be32(MLX5_STRIDE_BLOCK_OP);
3507 		sblock_ctrl->repeat_count = cpu_to_be32(data_len / block_size);
3508 		sblock_ctrl->num_entries = cpu_to_be16(2);
3509 
3510 		data_sentry->bcount = cpu_to_be16(block_size);
3511 		data_sentry->key = cpu_to_be32(data_key);
3512 		data_sentry->va = cpu_to_be64(data_va);
3513 		data_sentry->stride = cpu_to_be16(block_size);
3514 
3515 		prot_sentry->bcount = cpu_to_be16(prot_size);
3516 		prot_sentry->key = cpu_to_be32(prot_key);
3517 		prot_sentry->va = cpu_to_be64(prot_va);
3518 		prot_sentry->stride = cpu_to_be16(prot_size);
3519 
3520 		wqe_size = ALIGN(sizeof(*sblock_ctrl) + sizeof(*data_sentry) +
3521 				 sizeof(*prot_sentry), 64);
3522 	}
3523 
3524 	*seg += wqe_size;
3525 	*size += wqe_size / 16;
3526 	if (unlikely((*seg == qp->sq.qend)))
3527 		*seg = mlx5_get_send_wqe(qp, 0);
3528 
3529 	bsf = *seg;
3530 	ret = mlx5_set_bsf(sig_mr, sig_attrs, bsf, data_len);
3531 	if (ret)
3532 		return -EINVAL;
3533 
3534 	*seg += sizeof(*bsf);
3535 	*size += sizeof(*bsf) / 16;
3536 	if (unlikely((*seg == qp->sq.qend)))
3537 		*seg = mlx5_get_send_wqe(qp, 0);
3538 
3539 	return 0;
3540 }
3541 
3542 static void set_sig_mkey_segment(struct mlx5_mkey_seg *seg,
3543 				 struct ib_sig_handover_wr *wr, u32 size,
3544 				 u32 length, u32 pdn)
3545 {
3546 	struct ib_mr *sig_mr = wr->sig_mr;
3547 	u32 sig_key = sig_mr->rkey;
3548 	u8 sigerr = to_mmr(sig_mr)->sig->sigerr_count & 1;
3549 
3550 	memset(seg, 0, sizeof(*seg));
3551 
3552 	seg->flags = get_umr_flags(wr->access_flags) |
3553 				   MLX5_MKC_ACCESS_MODE_KLMS;
3554 	seg->qpn_mkey7_0 = cpu_to_be32((sig_key & 0xff) | 0xffffff00);
3555 	seg->flags_pd = cpu_to_be32(MLX5_MKEY_REMOTE_INVAL | sigerr << 26 |
3556 				    MLX5_MKEY_BSF_EN | pdn);
3557 	seg->len = cpu_to_be64(length);
3558 	seg->xlt_oct_size = cpu_to_be32(get_xlt_octo(size));
3559 	seg->bsfs_octo_size = cpu_to_be32(MLX5_MKEY_BSF_OCTO_SIZE);
3560 }
3561 
3562 static void set_sig_umr_segment(struct mlx5_wqe_umr_ctrl_seg *umr,
3563 				u32 size)
3564 {
3565 	memset(umr, 0, sizeof(*umr));
3566 
3567 	umr->flags = MLX5_FLAGS_INLINE | MLX5_FLAGS_CHECK_FREE;
3568 	umr->xlt_octowords = cpu_to_be16(get_xlt_octo(size));
3569 	umr->bsf_octowords = cpu_to_be16(MLX5_MKEY_BSF_OCTO_SIZE);
3570 	umr->mkey_mask = sig_mkey_mask();
3571 }
3572 
3573 
3574 static int set_sig_umr_wr(struct ib_send_wr *send_wr, struct mlx5_ib_qp *qp,
3575 			  void **seg, int *size)
3576 {
3577 	struct ib_sig_handover_wr *wr = sig_handover_wr(send_wr);
3578 	struct mlx5_ib_mr *sig_mr = to_mmr(wr->sig_mr);
3579 	u32 pdn = get_pd(qp)->pdn;
3580 	u32 xlt_size;
3581 	int region_len, ret;
3582 
3583 	if (unlikely(wr->wr.num_sge != 1) ||
3584 	    unlikely(wr->access_flags & IB_ACCESS_REMOTE_ATOMIC) ||
3585 	    unlikely(!sig_mr->sig) || unlikely(!qp->signature_en) ||
3586 	    unlikely(!sig_mr->sig->sig_status_checked))
3587 		return -EINVAL;
3588 
3589 	/* length of the protected region, data + protection */
3590 	region_len = wr->wr.sg_list->length;
3591 	if (wr->prot &&
3592 	    (wr->prot->lkey != wr->wr.sg_list->lkey  ||
3593 	     wr->prot->addr != wr->wr.sg_list->addr  ||
3594 	     wr->prot->length != wr->wr.sg_list->length))
3595 		region_len += wr->prot->length;
3596 
3597 	/**
3598 	 * KLM octoword size - if protection was provided
3599 	 * then we use strided block format (3 octowords),
3600 	 * else we use single KLM (1 octoword)
3601 	 **/
3602 	xlt_size = wr->prot ? 0x30 : sizeof(struct mlx5_klm);
3603 
3604 	set_sig_umr_segment(*seg, xlt_size);
3605 	*seg += sizeof(struct mlx5_wqe_umr_ctrl_seg);
3606 	*size += sizeof(struct mlx5_wqe_umr_ctrl_seg) / 16;
3607 	if (unlikely((*seg == qp->sq.qend)))
3608 		*seg = mlx5_get_send_wqe(qp, 0);
3609 
3610 	set_sig_mkey_segment(*seg, wr, xlt_size, region_len, pdn);
3611 	*seg += sizeof(struct mlx5_mkey_seg);
3612 	*size += sizeof(struct mlx5_mkey_seg) / 16;
3613 	if (unlikely((*seg == qp->sq.qend)))
3614 		*seg = mlx5_get_send_wqe(qp, 0);
3615 
3616 	ret = set_sig_data_segment(wr, qp, seg, size);
3617 	if (ret)
3618 		return ret;
3619 
3620 	sig_mr->sig->sig_status_checked = false;
3621 	return 0;
3622 }
3623 
3624 static int set_psv_wr(struct ib_sig_domain *domain,
3625 		      u32 psv_idx, void **seg, int *size)
3626 {
3627 	struct mlx5_seg_set_psv *psv_seg = *seg;
3628 
3629 	memset(psv_seg, 0, sizeof(*psv_seg));
3630 	psv_seg->psv_num = cpu_to_be32(psv_idx);
3631 	switch (domain->sig_type) {
3632 	case IB_SIG_TYPE_NONE:
3633 		break;
3634 	case IB_SIG_TYPE_T10_DIF:
3635 		psv_seg->transient_sig = cpu_to_be32(domain->sig.dif.bg << 16 |
3636 						     domain->sig.dif.app_tag);
3637 		psv_seg->ref_tag = cpu_to_be32(domain->sig.dif.ref_tag);
3638 		break;
3639 	default:
3640 		pr_err("Bad signature type given.\n");
3641 		return 1;
3642 	}
3643 
3644 	*seg += sizeof(*psv_seg);
3645 	*size += sizeof(*psv_seg) / 16;
3646 
3647 	return 0;
3648 }
3649 
3650 static int set_reg_wr(struct mlx5_ib_qp *qp,
3651 		      struct ib_reg_wr *wr,
3652 		      void **seg, int *size)
3653 {
3654 	struct mlx5_ib_mr *mr = to_mmr(wr->mr);
3655 	struct mlx5_ib_pd *pd = to_mpd(qp->ibqp.pd);
3656 
3657 	if (unlikely(wr->wr.send_flags & IB_SEND_INLINE)) {
3658 		mlx5_ib_warn(to_mdev(qp->ibqp.device),
3659 			     "Invalid IB_SEND_INLINE send flag\n");
3660 		return -EINVAL;
3661 	}
3662 
3663 	set_reg_umr_seg(*seg, mr);
3664 	*seg += sizeof(struct mlx5_wqe_umr_ctrl_seg);
3665 	*size += sizeof(struct mlx5_wqe_umr_ctrl_seg) / 16;
3666 	if (unlikely((*seg == qp->sq.qend)))
3667 		*seg = mlx5_get_send_wqe(qp, 0);
3668 
3669 	set_reg_mkey_seg(*seg, mr, wr->key, wr->access);
3670 	*seg += sizeof(struct mlx5_mkey_seg);
3671 	*size += sizeof(struct mlx5_mkey_seg) / 16;
3672 	if (unlikely((*seg == qp->sq.qend)))
3673 		*seg = mlx5_get_send_wqe(qp, 0);
3674 
3675 	set_reg_data_seg(*seg, mr, pd);
3676 	*seg += sizeof(struct mlx5_wqe_data_seg);
3677 	*size += (sizeof(struct mlx5_wqe_data_seg) / 16);
3678 
3679 	return 0;
3680 }
3681 
3682 static void set_linv_wr(struct mlx5_ib_qp *qp, void **seg, int *size)
3683 {
3684 	set_linv_umr_seg(*seg);
3685 	*seg += sizeof(struct mlx5_wqe_umr_ctrl_seg);
3686 	*size += sizeof(struct mlx5_wqe_umr_ctrl_seg) / 16;
3687 	if (unlikely((*seg == qp->sq.qend)))
3688 		*seg = mlx5_get_send_wqe(qp, 0);
3689 	set_linv_mkey_seg(*seg);
3690 	*seg += sizeof(struct mlx5_mkey_seg);
3691 	*size += sizeof(struct mlx5_mkey_seg) / 16;
3692 	if (unlikely((*seg == qp->sq.qend)))
3693 		*seg = mlx5_get_send_wqe(qp, 0);
3694 }
3695 
3696 static void dump_wqe(struct mlx5_ib_qp *qp, int idx, int size_16)
3697 {
3698 	__be32 *p = NULL;
3699 	int tidx = idx;
3700 	int i, j;
3701 
3702 	pr_debug("dump wqe at %p\n", mlx5_get_send_wqe(qp, tidx));
3703 	for (i = 0, j = 0; i < size_16 * 4; i += 4, j += 4) {
3704 		if ((i & 0xf) == 0) {
3705 			void *buf = mlx5_get_send_wqe(qp, tidx);
3706 			tidx = (tidx + 1) & (qp->sq.wqe_cnt - 1);
3707 			p = buf;
3708 			j = 0;
3709 		}
3710 		pr_debug("%08x %08x %08x %08x\n", be32_to_cpu(p[j]),
3711 			 be32_to_cpu(p[j + 1]), be32_to_cpu(p[j + 2]),
3712 			 be32_to_cpu(p[j + 3]));
3713 	}
3714 }
3715 
3716 static u8 get_fence(u8 fence, struct ib_send_wr *wr)
3717 {
3718 	if (unlikely(wr->opcode == IB_WR_LOCAL_INV &&
3719 		     wr->send_flags & IB_SEND_FENCE))
3720 		return MLX5_FENCE_MODE_STRONG_ORDERING;
3721 
3722 	if (unlikely(fence)) {
3723 		if (wr->send_flags & IB_SEND_FENCE)
3724 			return MLX5_FENCE_MODE_SMALL_AND_FENCE;
3725 		else
3726 			return fence;
3727 	} else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
3728 		return MLX5_FENCE_MODE_FENCE;
3729 	}
3730 
3731 	return 0;
3732 }
3733 
3734 static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
3735 		     struct mlx5_wqe_ctrl_seg **ctrl,
3736 		     struct ib_send_wr *wr, unsigned *idx,
3737 		     int *size, int nreq)
3738 {
3739 	if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)))
3740 		return -ENOMEM;
3741 
3742 	*idx = qp->sq.cur_post & (qp->sq.wqe_cnt - 1);
3743 	*seg = mlx5_get_send_wqe(qp, *idx);
3744 	*ctrl = *seg;
3745 	*(uint32_t *)(*seg + 8) = 0;
3746 	(*ctrl)->imm = send_ieth(wr);
3747 	(*ctrl)->fm_ce_se = qp->sq_signal_bits |
3748 		(wr->send_flags & IB_SEND_SIGNALED ?
3749 		 MLX5_WQE_CTRL_CQ_UPDATE : 0) |
3750 		(wr->send_flags & IB_SEND_SOLICITED ?
3751 		 MLX5_WQE_CTRL_SOLICITED : 0);
3752 
3753 	*seg += sizeof(**ctrl);
3754 	*size = sizeof(**ctrl) / 16;
3755 
3756 	return 0;
3757 }
3758 
3759 static void finish_wqe(struct mlx5_ib_qp *qp,
3760 		       struct mlx5_wqe_ctrl_seg *ctrl,
3761 		       u8 size, unsigned idx, u64 wr_id,
3762 		       int nreq, u8 fence, u8 next_fence,
3763 		       u32 mlx5_opcode)
3764 {
3765 	u8 opmod = 0;
3766 
3767 	ctrl->opmod_idx_opcode = cpu_to_be32(((u32)(qp->sq.cur_post) << 8) |
3768 					     mlx5_opcode | ((u32)opmod << 24));
3769 	ctrl->qpn_ds = cpu_to_be32(size | (qp->trans_qp.base.mqp.qpn << 8));
3770 	ctrl->fm_ce_se |= fence;
3771 	qp->fm_cache = next_fence;
3772 	if (unlikely(qp->wq_sig))
3773 		ctrl->signature = wq_sig(ctrl);
3774 
3775 	qp->sq.wrid[idx] = wr_id;
3776 	qp->sq.w_list[idx].opcode = mlx5_opcode;
3777 	qp->sq.wqe_head[idx] = qp->sq.head + nreq;
3778 	qp->sq.cur_post += DIV_ROUND_UP(size * 16, MLX5_SEND_WQE_BB);
3779 	qp->sq.w_list[idx].next = qp->sq.cur_post;
3780 }
3781 
3782 
3783 int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
3784 		      struct ib_send_wr **bad_wr)
3785 {
3786 	struct mlx5_wqe_ctrl_seg *ctrl = NULL;  /* compiler warning */
3787 	struct mlx5_ib_dev *dev = to_mdev(ibqp->device);
3788 	struct mlx5_core_dev *mdev = dev->mdev;
3789 	struct mlx5_ib_qp *qp;
3790 	struct mlx5_ib_mr *mr;
3791 	struct mlx5_wqe_data_seg *dpseg;
3792 	struct mlx5_wqe_xrc_seg *xrc;
3793 	struct mlx5_bf *bf;
3794 	int uninitialized_var(size);
3795 	void *qend;
3796 	unsigned long flags;
3797 	unsigned idx;
3798 	int err = 0;
3799 	int inl = 0;
3800 	int num_sge;
3801 	void *seg;
3802 	int nreq;
3803 	int i;
3804 	u8 next_fence = 0;
3805 	u8 fence;
3806 
3807 	if (unlikely(ibqp->qp_type == IB_QPT_GSI))
3808 		return mlx5_ib_gsi_post_send(ibqp, wr, bad_wr);
3809 
3810 	qp = to_mqp(ibqp);
3811 	bf = &qp->bf;
3812 	qend = qp->sq.qend;
3813 
3814 	spin_lock_irqsave(&qp->sq.lock, flags);
3815 
3816 	if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
3817 		err = -EIO;
3818 		*bad_wr = wr;
3819 		nreq = 0;
3820 		goto out;
3821 	}
3822 
3823 	for (nreq = 0; wr; nreq++, wr = wr->next) {
3824 		if (unlikely(wr->opcode >= ARRAY_SIZE(mlx5_ib_opcode))) {
3825 			mlx5_ib_warn(dev, "\n");
3826 			err = -EINVAL;
3827 			*bad_wr = wr;
3828 			goto out;
3829 		}
3830 
3831 		fence = qp->fm_cache;
3832 		num_sge = wr->num_sge;
3833 		if (unlikely(num_sge > qp->sq.max_gs)) {
3834 			mlx5_ib_warn(dev, "\n");
3835 			err = -EINVAL;
3836 			*bad_wr = wr;
3837 			goto out;
3838 		}
3839 
3840 		err = begin_wqe(qp, &seg, &ctrl, wr, &idx, &size, nreq);
3841 		if (err) {
3842 			mlx5_ib_warn(dev, "\n");
3843 			err = -ENOMEM;
3844 			*bad_wr = wr;
3845 			goto out;
3846 		}
3847 
3848 		switch (ibqp->qp_type) {
3849 		case IB_QPT_XRC_INI:
3850 			xrc = seg;
3851 			seg += sizeof(*xrc);
3852 			size += sizeof(*xrc) / 16;
3853 			/* fall through */
3854 		case IB_QPT_RC:
3855 			switch (wr->opcode) {
3856 			case IB_WR_RDMA_READ:
3857 			case IB_WR_RDMA_WRITE:
3858 			case IB_WR_RDMA_WRITE_WITH_IMM:
3859 				set_raddr_seg(seg, rdma_wr(wr)->remote_addr,
3860 					      rdma_wr(wr)->rkey);
3861 				seg += sizeof(struct mlx5_wqe_raddr_seg);
3862 				size += sizeof(struct mlx5_wqe_raddr_seg) / 16;
3863 				break;
3864 
3865 			case IB_WR_ATOMIC_CMP_AND_SWP:
3866 			case IB_WR_ATOMIC_FETCH_AND_ADD:
3867 			case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
3868 				mlx5_ib_warn(dev, "Atomic operations are not supported yet\n");
3869 				err = -ENOSYS;
3870 				*bad_wr = wr;
3871 				goto out;
3872 
3873 			case IB_WR_LOCAL_INV:
3874 				next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
3875 				qp->sq.wr_data[idx] = IB_WR_LOCAL_INV;
3876 				ctrl->imm = cpu_to_be32(wr->ex.invalidate_rkey);
3877 				set_linv_wr(qp, &seg, &size);
3878 				num_sge = 0;
3879 				break;
3880 
3881 			case IB_WR_REG_MR:
3882 				next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
3883 				qp->sq.wr_data[idx] = IB_WR_REG_MR;
3884 				ctrl->imm = cpu_to_be32(reg_wr(wr)->key);
3885 				err = set_reg_wr(qp, reg_wr(wr), &seg, &size);
3886 				if (err) {
3887 					*bad_wr = wr;
3888 					goto out;
3889 				}
3890 				num_sge = 0;
3891 				break;
3892 
3893 			case IB_WR_REG_SIG_MR:
3894 				qp->sq.wr_data[idx] = IB_WR_REG_SIG_MR;
3895 				mr = to_mmr(sig_handover_wr(wr)->sig_mr);
3896 
3897 				ctrl->imm = cpu_to_be32(mr->ibmr.rkey);
3898 				err = set_sig_umr_wr(wr, qp, &seg, &size);
3899 				if (err) {
3900 					mlx5_ib_warn(dev, "\n");
3901 					*bad_wr = wr;
3902 					goto out;
3903 				}
3904 
3905 				finish_wqe(qp, ctrl, size, idx, wr->wr_id,
3906 					   nreq, get_fence(fence, wr),
3907 					   next_fence, MLX5_OPCODE_UMR);
3908 				/*
3909 				 * SET_PSV WQEs are not signaled and solicited
3910 				 * on error
3911 				 */
3912 				wr->send_flags &= ~IB_SEND_SIGNALED;
3913 				wr->send_flags |= IB_SEND_SOLICITED;
3914 				err = begin_wqe(qp, &seg, &ctrl, wr,
3915 						&idx, &size, nreq);
3916 				if (err) {
3917 					mlx5_ib_warn(dev, "\n");
3918 					err = -ENOMEM;
3919 					*bad_wr = wr;
3920 					goto out;
3921 				}
3922 
3923 				err = set_psv_wr(&sig_handover_wr(wr)->sig_attrs->mem,
3924 						 mr->sig->psv_memory.psv_idx, &seg,
3925 						 &size);
3926 				if (err) {
3927 					mlx5_ib_warn(dev, "\n");
3928 					*bad_wr = wr;
3929 					goto out;
3930 				}
3931 
3932 				finish_wqe(qp, ctrl, size, idx, wr->wr_id,
3933 					   nreq, get_fence(fence, wr),
3934 					   next_fence, MLX5_OPCODE_SET_PSV);
3935 				err = begin_wqe(qp, &seg, &ctrl, wr,
3936 						&idx, &size, nreq);
3937 				if (err) {
3938 					mlx5_ib_warn(dev, "\n");
3939 					err = -ENOMEM;
3940 					*bad_wr = wr;
3941 					goto out;
3942 				}
3943 
3944 				next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
3945 				err = set_psv_wr(&sig_handover_wr(wr)->sig_attrs->wire,
3946 						 mr->sig->psv_wire.psv_idx, &seg,
3947 						 &size);
3948 				if (err) {
3949 					mlx5_ib_warn(dev, "\n");
3950 					*bad_wr = wr;
3951 					goto out;
3952 				}
3953 
3954 				finish_wqe(qp, ctrl, size, idx, wr->wr_id,
3955 					   nreq, get_fence(fence, wr),
3956 					   next_fence, MLX5_OPCODE_SET_PSV);
3957 				num_sge = 0;
3958 				goto skip_psv;
3959 
3960 			default:
3961 				break;
3962 			}
3963 			break;
3964 
3965 		case IB_QPT_UC:
3966 			switch (wr->opcode) {
3967 			case IB_WR_RDMA_WRITE:
3968 			case IB_WR_RDMA_WRITE_WITH_IMM:
3969 				set_raddr_seg(seg, rdma_wr(wr)->remote_addr,
3970 					      rdma_wr(wr)->rkey);
3971 				seg  += sizeof(struct mlx5_wqe_raddr_seg);
3972 				size += sizeof(struct mlx5_wqe_raddr_seg) / 16;
3973 				break;
3974 
3975 			default:
3976 				break;
3977 			}
3978 			break;
3979 
3980 		case IB_QPT_SMI:
3981 		case MLX5_IB_QPT_HW_GSI:
3982 			set_datagram_seg(seg, wr);
3983 			seg += sizeof(struct mlx5_wqe_datagram_seg);
3984 			size += sizeof(struct mlx5_wqe_datagram_seg) / 16;
3985 			if (unlikely((seg == qend)))
3986 				seg = mlx5_get_send_wqe(qp, 0);
3987 			break;
3988 		case IB_QPT_UD:
3989 			set_datagram_seg(seg, wr);
3990 			seg += sizeof(struct mlx5_wqe_datagram_seg);
3991 			size += sizeof(struct mlx5_wqe_datagram_seg) / 16;
3992 
3993 			if (unlikely((seg == qend)))
3994 				seg = mlx5_get_send_wqe(qp, 0);
3995 
3996 			/* handle qp that supports ud offload */
3997 			if (qp->flags & IB_QP_CREATE_IPOIB_UD_LSO) {
3998 				struct mlx5_wqe_eth_pad *pad;
3999 
4000 				pad = seg;
4001 				memset(pad, 0, sizeof(struct mlx5_wqe_eth_pad));
4002 				seg += sizeof(struct mlx5_wqe_eth_pad);
4003 				size += sizeof(struct mlx5_wqe_eth_pad) / 16;
4004 
4005 				seg = set_eth_seg(seg, wr, qend, qp, &size);
4006 
4007 				if (unlikely((seg == qend)))
4008 					seg = mlx5_get_send_wqe(qp, 0);
4009 			}
4010 			break;
4011 		case MLX5_IB_QPT_REG_UMR:
4012 			if (wr->opcode != MLX5_IB_WR_UMR) {
4013 				err = -EINVAL;
4014 				mlx5_ib_warn(dev, "bad opcode\n");
4015 				goto out;
4016 			}
4017 			qp->sq.wr_data[idx] = MLX5_IB_WR_UMR;
4018 			ctrl->imm = cpu_to_be32(umr_wr(wr)->mkey);
4019 			set_reg_umr_segment(seg, wr, !!(MLX5_CAP_GEN(mdev, atomic)));
4020 			seg += sizeof(struct mlx5_wqe_umr_ctrl_seg);
4021 			size += sizeof(struct mlx5_wqe_umr_ctrl_seg) / 16;
4022 			if (unlikely((seg == qend)))
4023 				seg = mlx5_get_send_wqe(qp, 0);
4024 			set_reg_mkey_segment(seg, wr);
4025 			seg += sizeof(struct mlx5_mkey_seg);
4026 			size += sizeof(struct mlx5_mkey_seg) / 16;
4027 			if (unlikely((seg == qend)))
4028 				seg = mlx5_get_send_wqe(qp, 0);
4029 			break;
4030 
4031 		default:
4032 			break;
4033 		}
4034 
4035 		if (wr->send_flags & IB_SEND_INLINE && num_sge) {
4036 			int uninitialized_var(sz);
4037 
4038 			err = set_data_inl_seg(qp, wr, seg, &sz);
4039 			if (unlikely(err)) {
4040 				mlx5_ib_warn(dev, "\n");
4041 				*bad_wr = wr;
4042 				goto out;
4043 			}
4044 			inl = 1;
4045 			size += sz;
4046 		} else {
4047 			dpseg = seg;
4048 			for (i = 0; i < num_sge; i++) {
4049 				if (unlikely(dpseg == qend)) {
4050 					seg = mlx5_get_send_wqe(qp, 0);
4051 					dpseg = seg;
4052 				}
4053 				if (likely(wr->sg_list[i].length)) {
4054 					set_data_ptr_seg(dpseg, wr->sg_list + i);
4055 					size += sizeof(struct mlx5_wqe_data_seg) / 16;
4056 					dpseg++;
4057 				}
4058 			}
4059 		}
4060 
4061 		finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
4062 			   get_fence(fence, wr), next_fence,
4063 			   mlx5_ib_opcode[wr->opcode]);
4064 skip_psv:
4065 		if (0)
4066 			dump_wqe(qp, idx, size);
4067 	}
4068 
4069 out:
4070 	if (likely(nreq)) {
4071 		qp->sq.head += nreq;
4072 
4073 		/* Make sure that descriptors are written before
4074 		 * updating doorbell record and ringing the doorbell
4075 		 */
4076 		wmb();
4077 
4078 		qp->db.db[MLX5_SND_DBR] = cpu_to_be32(qp->sq.cur_post);
4079 
4080 		/* Make sure doorbell record is visible to the HCA before
4081 		 * we hit doorbell */
4082 		wmb();
4083 
4084 		/* currently we support only regular doorbells */
4085 		mlx5_write64((__be32 *)ctrl, bf->bfreg->map + bf->offset, NULL);
4086 		/* Make sure doorbells don't leak out of SQ spinlock
4087 		 * and reach the HCA out of order.
4088 		 */
4089 		mmiowb();
4090 		bf->offset ^= bf->buf_size;
4091 	}
4092 
4093 	spin_unlock_irqrestore(&qp->sq.lock, flags);
4094 
4095 	return err;
4096 }
4097 
4098 static void set_sig_seg(struct mlx5_rwqe_sig *sig, int size)
4099 {
4100 	sig->signature = calc_sig(sig, size);
4101 }
4102 
4103 int mlx5_ib_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
4104 		      struct ib_recv_wr **bad_wr)
4105 {
4106 	struct mlx5_ib_qp *qp = to_mqp(ibqp);
4107 	struct mlx5_wqe_data_seg *scat;
4108 	struct mlx5_rwqe_sig *sig;
4109 	struct mlx5_ib_dev *dev = to_mdev(ibqp->device);
4110 	struct mlx5_core_dev *mdev = dev->mdev;
4111 	unsigned long flags;
4112 	int err = 0;
4113 	int nreq;
4114 	int ind;
4115 	int i;
4116 
4117 	if (unlikely(ibqp->qp_type == IB_QPT_GSI))
4118 		return mlx5_ib_gsi_post_recv(ibqp, wr, bad_wr);
4119 
4120 	spin_lock_irqsave(&qp->rq.lock, flags);
4121 
4122 	if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
4123 		err = -EIO;
4124 		*bad_wr = wr;
4125 		nreq = 0;
4126 		goto out;
4127 	}
4128 
4129 	ind = qp->rq.head & (qp->rq.wqe_cnt - 1);
4130 
4131 	for (nreq = 0; wr; nreq++, wr = wr->next) {
4132 		if (mlx5_wq_overflow(&qp->rq, nreq, qp->ibqp.recv_cq)) {
4133 			err = -ENOMEM;
4134 			*bad_wr = wr;
4135 			goto out;
4136 		}
4137 
4138 		if (unlikely(wr->num_sge > qp->rq.max_gs)) {
4139 			err = -EINVAL;
4140 			*bad_wr = wr;
4141 			goto out;
4142 		}
4143 
4144 		scat = get_recv_wqe(qp, ind);
4145 		if (qp->wq_sig)
4146 			scat++;
4147 
4148 		for (i = 0; i < wr->num_sge; i++)
4149 			set_data_ptr_seg(scat + i, wr->sg_list + i);
4150 
4151 		if (i < qp->rq.max_gs) {
4152 			scat[i].byte_count = 0;
4153 			scat[i].lkey       = cpu_to_be32(MLX5_INVALID_LKEY);
4154 			scat[i].addr       = 0;
4155 		}
4156 
4157 		if (qp->wq_sig) {
4158 			sig = (struct mlx5_rwqe_sig *)scat;
4159 			set_sig_seg(sig, (qp->rq.max_gs + 1) << 2);
4160 		}
4161 
4162 		qp->rq.wrid[ind] = wr->wr_id;
4163 
4164 		ind = (ind + 1) & (qp->rq.wqe_cnt - 1);
4165 	}
4166 
4167 out:
4168 	if (likely(nreq)) {
4169 		qp->rq.head += nreq;
4170 
4171 		/* Make sure that descriptors are written before
4172 		 * doorbell record.
4173 		 */
4174 		wmb();
4175 
4176 		*qp->db.db = cpu_to_be32(qp->rq.head & 0xffff);
4177 	}
4178 
4179 	spin_unlock_irqrestore(&qp->rq.lock, flags);
4180 
4181 	return err;
4182 }
4183 
4184 static inline enum ib_qp_state to_ib_qp_state(enum mlx5_qp_state mlx5_state)
4185 {
4186 	switch (mlx5_state) {
4187 	case MLX5_QP_STATE_RST:      return IB_QPS_RESET;
4188 	case MLX5_QP_STATE_INIT:     return IB_QPS_INIT;
4189 	case MLX5_QP_STATE_RTR:      return IB_QPS_RTR;
4190 	case MLX5_QP_STATE_RTS:      return IB_QPS_RTS;
4191 	case MLX5_QP_STATE_SQ_DRAINING:
4192 	case MLX5_QP_STATE_SQD:      return IB_QPS_SQD;
4193 	case MLX5_QP_STATE_SQER:     return IB_QPS_SQE;
4194 	case MLX5_QP_STATE_ERR:      return IB_QPS_ERR;
4195 	default:		     return -1;
4196 	}
4197 }
4198 
4199 static inline enum ib_mig_state to_ib_mig_state(int mlx5_mig_state)
4200 {
4201 	switch (mlx5_mig_state) {
4202 	case MLX5_QP_PM_ARMED:		return IB_MIG_ARMED;
4203 	case MLX5_QP_PM_REARM:		return IB_MIG_REARM;
4204 	case MLX5_QP_PM_MIGRATED:	return IB_MIG_MIGRATED;
4205 	default: return -1;
4206 	}
4207 }
4208 
4209 static int to_ib_qp_access_flags(int mlx5_flags)
4210 {
4211 	int ib_flags = 0;
4212 
4213 	if (mlx5_flags & MLX5_QP_BIT_RRE)
4214 		ib_flags |= IB_ACCESS_REMOTE_READ;
4215 	if (mlx5_flags & MLX5_QP_BIT_RWE)
4216 		ib_flags |= IB_ACCESS_REMOTE_WRITE;
4217 	if (mlx5_flags & MLX5_QP_BIT_RAE)
4218 		ib_flags |= IB_ACCESS_REMOTE_ATOMIC;
4219 
4220 	return ib_flags;
4221 }
4222 
4223 static void to_ib_ah_attr(struct mlx5_ib_dev *ibdev, struct ib_ah_attr *ib_ah_attr,
4224 				struct mlx5_qp_path *path)
4225 {
4226 	struct mlx5_core_dev *dev = ibdev->mdev;
4227 
4228 	memset(ib_ah_attr, 0, sizeof(*ib_ah_attr));
4229 	ib_ah_attr->port_num	  = path->port;
4230 
4231 	if (ib_ah_attr->port_num == 0 ||
4232 	    ib_ah_attr->port_num > MLX5_CAP_GEN(dev, num_ports))
4233 		return;
4234 
4235 	ib_ah_attr->sl = path->dci_cfi_prio_sl & 0xf;
4236 
4237 	ib_ah_attr->dlid	  = be16_to_cpu(path->rlid);
4238 	ib_ah_attr->src_path_bits = path->grh_mlid & 0x7f;
4239 	ib_ah_attr->static_rate   = path->static_rate ? path->static_rate - 5 : 0;
4240 	ib_ah_attr->ah_flags      = (path->grh_mlid & (1 << 7)) ? IB_AH_GRH : 0;
4241 	if (ib_ah_attr->ah_flags) {
4242 		ib_ah_attr->grh.sgid_index = path->mgid_index;
4243 		ib_ah_attr->grh.hop_limit  = path->hop_limit;
4244 		ib_ah_attr->grh.traffic_class =
4245 			(be32_to_cpu(path->tclass_flowlabel) >> 20) & 0xff;
4246 		ib_ah_attr->grh.flow_label =
4247 			be32_to_cpu(path->tclass_flowlabel) & 0xfffff;
4248 		memcpy(ib_ah_attr->grh.dgid.raw,
4249 		       path->rgid, sizeof(ib_ah_attr->grh.dgid.raw));
4250 	}
4251 }
4252 
4253 static int query_raw_packet_qp_sq_state(struct mlx5_ib_dev *dev,
4254 					struct mlx5_ib_sq *sq,
4255 					u8 *sq_state)
4256 {
4257 	void *out;
4258 	void *sqc;
4259 	int inlen;
4260 	int err;
4261 
4262 	inlen = MLX5_ST_SZ_BYTES(query_sq_out);
4263 	out = mlx5_vzalloc(inlen);
4264 	if (!out)
4265 		return -ENOMEM;
4266 
4267 	err = mlx5_core_query_sq(dev->mdev, sq->base.mqp.qpn, out);
4268 	if (err)
4269 		goto out;
4270 
4271 	sqc = MLX5_ADDR_OF(query_sq_out, out, sq_context);
4272 	*sq_state = MLX5_GET(sqc, sqc, state);
4273 	sq->state = *sq_state;
4274 
4275 out:
4276 	kvfree(out);
4277 	return err;
4278 }
4279 
4280 static int query_raw_packet_qp_rq_state(struct mlx5_ib_dev *dev,
4281 					struct mlx5_ib_rq *rq,
4282 					u8 *rq_state)
4283 {
4284 	void *out;
4285 	void *rqc;
4286 	int inlen;
4287 	int err;
4288 
4289 	inlen = MLX5_ST_SZ_BYTES(query_rq_out);
4290 	out = mlx5_vzalloc(inlen);
4291 	if (!out)
4292 		return -ENOMEM;
4293 
4294 	err = mlx5_core_query_rq(dev->mdev, rq->base.mqp.qpn, out);
4295 	if (err)
4296 		goto out;
4297 
4298 	rqc = MLX5_ADDR_OF(query_rq_out, out, rq_context);
4299 	*rq_state = MLX5_GET(rqc, rqc, state);
4300 	rq->state = *rq_state;
4301 
4302 out:
4303 	kvfree(out);
4304 	return err;
4305 }
4306 
4307 static int sqrq_state_to_qp_state(u8 sq_state, u8 rq_state,
4308 				  struct mlx5_ib_qp *qp, u8 *qp_state)
4309 {
4310 	static const u8 sqrq_trans[MLX5_RQ_NUM_STATE][MLX5_SQ_NUM_STATE] = {
4311 		[MLX5_RQC_STATE_RST] = {
4312 			[MLX5_SQC_STATE_RST]	= IB_QPS_RESET,
4313 			[MLX5_SQC_STATE_RDY]	= MLX5_QP_STATE_BAD,
4314 			[MLX5_SQC_STATE_ERR]	= MLX5_QP_STATE_BAD,
4315 			[MLX5_SQ_STATE_NA]	= IB_QPS_RESET,
4316 		},
4317 		[MLX5_RQC_STATE_RDY] = {
4318 			[MLX5_SQC_STATE_RST]	= MLX5_QP_STATE_BAD,
4319 			[MLX5_SQC_STATE_RDY]	= MLX5_QP_STATE,
4320 			[MLX5_SQC_STATE_ERR]	= IB_QPS_SQE,
4321 			[MLX5_SQ_STATE_NA]	= MLX5_QP_STATE,
4322 		},
4323 		[MLX5_RQC_STATE_ERR] = {
4324 			[MLX5_SQC_STATE_RST]    = MLX5_QP_STATE_BAD,
4325 			[MLX5_SQC_STATE_RDY]	= MLX5_QP_STATE_BAD,
4326 			[MLX5_SQC_STATE_ERR]	= IB_QPS_ERR,
4327 			[MLX5_SQ_STATE_NA]	= IB_QPS_ERR,
4328 		},
4329 		[MLX5_RQ_STATE_NA] = {
4330 			[MLX5_SQC_STATE_RST]    = IB_QPS_RESET,
4331 			[MLX5_SQC_STATE_RDY]	= MLX5_QP_STATE,
4332 			[MLX5_SQC_STATE_ERR]	= MLX5_QP_STATE,
4333 			[MLX5_SQ_STATE_NA]	= MLX5_QP_STATE_BAD,
4334 		},
4335 	};
4336 
4337 	*qp_state = sqrq_trans[rq_state][sq_state];
4338 
4339 	if (*qp_state == MLX5_QP_STATE_BAD) {
4340 		WARN(1, "Buggy Raw Packet QP state, SQ 0x%x state: 0x%x, RQ 0x%x state: 0x%x",
4341 		     qp->raw_packet_qp.sq.base.mqp.qpn, sq_state,
4342 		     qp->raw_packet_qp.rq.base.mqp.qpn, rq_state);
4343 		return -EINVAL;
4344 	}
4345 
4346 	if (*qp_state == MLX5_QP_STATE)
4347 		*qp_state = qp->state;
4348 
4349 	return 0;
4350 }
4351 
4352 static int query_raw_packet_qp_state(struct mlx5_ib_dev *dev,
4353 				     struct mlx5_ib_qp *qp,
4354 				     u8 *raw_packet_qp_state)
4355 {
4356 	struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
4357 	struct mlx5_ib_sq *sq = &raw_packet_qp->sq;
4358 	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
4359 	int err;
4360 	u8 sq_state = MLX5_SQ_STATE_NA;
4361 	u8 rq_state = MLX5_RQ_STATE_NA;
4362 
4363 	if (qp->sq.wqe_cnt) {
4364 		err = query_raw_packet_qp_sq_state(dev, sq, &sq_state);
4365 		if (err)
4366 			return err;
4367 	}
4368 
4369 	if (qp->rq.wqe_cnt) {
4370 		err = query_raw_packet_qp_rq_state(dev, rq, &rq_state);
4371 		if (err)
4372 			return err;
4373 	}
4374 
4375 	return sqrq_state_to_qp_state(sq_state, rq_state, qp,
4376 				      raw_packet_qp_state);
4377 }
4378 
4379 static int query_qp_attr(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
4380 			 struct ib_qp_attr *qp_attr)
4381 {
4382 	int outlen = MLX5_ST_SZ_BYTES(query_qp_out);
4383 	struct mlx5_qp_context *context;
4384 	int mlx5_state;
4385 	u32 *outb;
4386 	int err = 0;
4387 
4388 	outb = kzalloc(outlen, GFP_KERNEL);
4389 	if (!outb)
4390 		return -ENOMEM;
4391 
4392 	err = mlx5_core_qp_query(dev->mdev, &qp->trans_qp.base.mqp, outb,
4393 				 outlen);
4394 	if (err)
4395 		goto out;
4396 
4397 	/* FIXME: use MLX5_GET rather than mlx5_qp_context manual struct */
4398 	context = (struct mlx5_qp_context *)MLX5_ADDR_OF(query_qp_out, outb, qpc);
4399 
4400 	mlx5_state = be32_to_cpu(context->flags) >> 28;
4401 
4402 	qp->state		     = to_ib_qp_state(mlx5_state);
4403 	qp_attr->path_mtu	     = context->mtu_msgmax >> 5;
4404 	qp_attr->path_mig_state	     =
4405 		to_ib_mig_state((be32_to_cpu(context->flags) >> 11) & 0x3);
4406 	qp_attr->qkey		     = be32_to_cpu(context->qkey);
4407 	qp_attr->rq_psn		     = be32_to_cpu(context->rnr_nextrecvpsn) & 0xffffff;
4408 	qp_attr->sq_psn		     = be32_to_cpu(context->next_send_psn) & 0xffffff;
4409 	qp_attr->dest_qp_num	     = be32_to_cpu(context->log_pg_sz_remote_qpn) & 0xffffff;
4410 	qp_attr->qp_access_flags     =
4411 		to_ib_qp_access_flags(be32_to_cpu(context->params2));
4412 
4413 	if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC) {
4414 		to_ib_ah_attr(dev, &qp_attr->ah_attr, &context->pri_path);
4415 		to_ib_ah_attr(dev, &qp_attr->alt_ah_attr, &context->alt_path);
4416 		qp_attr->alt_pkey_index =
4417 			be16_to_cpu(context->alt_path.pkey_index);
4418 		qp_attr->alt_port_num	= qp_attr->alt_ah_attr.port_num;
4419 	}
4420 
4421 	qp_attr->pkey_index = be16_to_cpu(context->pri_path.pkey_index);
4422 	qp_attr->port_num = context->pri_path.port;
4423 
4424 	/* qp_attr->en_sqd_async_notify is only applicable in modify qp */
4425 	qp_attr->sq_draining = mlx5_state == MLX5_QP_STATE_SQ_DRAINING;
4426 
4427 	qp_attr->max_rd_atomic = 1 << ((be32_to_cpu(context->params1) >> 21) & 0x7);
4428 
4429 	qp_attr->max_dest_rd_atomic =
4430 		1 << ((be32_to_cpu(context->params2) >> 21) & 0x7);
4431 	qp_attr->min_rnr_timer	    =
4432 		(be32_to_cpu(context->rnr_nextrecvpsn) >> 24) & 0x1f;
4433 	qp_attr->timeout	    = context->pri_path.ackto_lt >> 3;
4434 	qp_attr->retry_cnt	    = (be32_to_cpu(context->params1) >> 16) & 0x7;
4435 	qp_attr->rnr_retry	    = (be32_to_cpu(context->params1) >> 13) & 0x7;
4436 	qp_attr->alt_timeout	    = context->alt_path.ackto_lt >> 3;
4437 
4438 out:
4439 	kfree(outb);
4440 	return err;
4441 }
4442 
4443 int mlx5_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
4444 		     int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
4445 {
4446 	struct mlx5_ib_dev *dev = to_mdev(ibqp->device);
4447 	struct mlx5_ib_qp *qp = to_mqp(ibqp);
4448 	int err = 0;
4449 	u8 raw_packet_qp_state;
4450 
4451 	if (ibqp->rwq_ind_tbl)
4452 		return -ENOSYS;
4453 
4454 	if (unlikely(ibqp->qp_type == IB_QPT_GSI))
4455 		return mlx5_ib_gsi_query_qp(ibqp, qp_attr, qp_attr_mask,
4456 					    qp_init_attr);
4457 
4458 	mutex_lock(&qp->mutex);
4459 
4460 	if (qp->ibqp.qp_type == IB_QPT_RAW_PACKET) {
4461 		err = query_raw_packet_qp_state(dev, qp, &raw_packet_qp_state);
4462 		if (err)
4463 			goto out;
4464 		qp->state = raw_packet_qp_state;
4465 		qp_attr->port_num = 1;
4466 	} else {
4467 		err = query_qp_attr(dev, qp, qp_attr);
4468 		if (err)
4469 			goto out;
4470 	}
4471 
4472 	qp_attr->qp_state	     = qp->state;
4473 	qp_attr->cur_qp_state	     = qp_attr->qp_state;
4474 	qp_attr->cap.max_recv_wr     = qp->rq.wqe_cnt;
4475 	qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
4476 
4477 	if (!ibqp->uobject) {
4478 		qp_attr->cap.max_send_wr  = qp->sq.max_post;
4479 		qp_attr->cap.max_send_sge = qp->sq.max_gs;
4480 		qp_init_attr->qp_context = ibqp->qp_context;
4481 	} else {
4482 		qp_attr->cap.max_send_wr  = 0;
4483 		qp_attr->cap.max_send_sge = 0;
4484 	}
4485 
4486 	qp_init_attr->qp_type = ibqp->qp_type;
4487 	qp_init_attr->recv_cq = ibqp->recv_cq;
4488 	qp_init_attr->send_cq = ibqp->send_cq;
4489 	qp_init_attr->srq = ibqp->srq;
4490 	qp_attr->cap.max_inline_data = qp->max_inline_data;
4491 
4492 	qp_init_attr->cap	     = qp_attr->cap;
4493 
4494 	qp_init_attr->create_flags = 0;
4495 	if (qp->flags & MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK)
4496 		qp_init_attr->create_flags |= IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK;
4497 
4498 	if (qp->flags & MLX5_IB_QP_CROSS_CHANNEL)
4499 		qp_init_attr->create_flags |= IB_QP_CREATE_CROSS_CHANNEL;
4500 	if (qp->flags & MLX5_IB_QP_MANAGED_SEND)
4501 		qp_init_attr->create_flags |= IB_QP_CREATE_MANAGED_SEND;
4502 	if (qp->flags & MLX5_IB_QP_MANAGED_RECV)
4503 		qp_init_attr->create_flags |= IB_QP_CREATE_MANAGED_RECV;
4504 	if (qp->flags & MLX5_IB_QP_SQPN_QP1)
4505 		qp_init_attr->create_flags |= mlx5_ib_create_qp_sqpn_qp1();
4506 
4507 	qp_init_attr->sq_sig_type = qp->sq_signal_bits & MLX5_WQE_CTRL_CQ_UPDATE ?
4508 		IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
4509 
4510 out:
4511 	mutex_unlock(&qp->mutex);
4512 	return err;
4513 }
4514 
4515 struct ib_xrcd *mlx5_ib_alloc_xrcd(struct ib_device *ibdev,
4516 					  struct ib_ucontext *context,
4517 					  struct ib_udata *udata)
4518 {
4519 	struct mlx5_ib_dev *dev = to_mdev(ibdev);
4520 	struct mlx5_ib_xrcd *xrcd;
4521 	int err;
4522 
4523 	if (!MLX5_CAP_GEN(dev->mdev, xrc))
4524 		return ERR_PTR(-ENOSYS);
4525 
4526 	xrcd = kmalloc(sizeof(*xrcd), GFP_KERNEL);
4527 	if (!xrcd)
4528 		return ERR_PTR(-ENOMEM);
4529 
4530 	err = mlx5_core_xrcd_alloc(dev->mdev, &xrcd->xrcdn);
4531 	if (err) {
4532 		kfree(xrcd);
4533 		return ERR_PTR(-ENOMEM);
4534 	}
4535 
4536 	return &xrcd->ibxrcd;
4537 }
4538 
4539 int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd)
4540 {
4541 	struct mlx5_ib_dev *dev = to_mdev(xrcd->device);
4542 	u32 xrcdn = to_mxrcd(xrcd)->xrcdn;
4543 	int err;
4544 
4545 	err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
4546 	if (err) {
4547 		mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
4548 		return err;
4549 	}
4550 
4551 	kfree(xrcd);
4552 
4553 	return 0;
4554 }
4555 
4556 static void mlx5_ib_wq_event(struct mlx5_core_qp *core_qp, int type)
4557 {
4558 	struct mlx5_ib_rwq *rwq = to_mibrwq(core_qp);
4559 	struct mlx5_ib_dev *dev = to_mdev(rwq->ibwq.device);
4560 	struct ib_event event;
4561 
4562 	if (rwq->ibwq.event_handler) {
4563 		event.device     = rwq->ibwq.device;
4564 		event.element.wq = &rwq->ibwq;
4565 		switch (type) {
4566 		case MLX5_EVENT_TYPE_WQ_CATAS_ERROR:
4567 			event.event = IB_EVENT_WQ_FATAL;
4568 			break;
4569 		default:
4570 			mlx5_ib_warn(dev, "Unexpected event type %d on WQ %06x\n", type, core_qp->qpn);
4571 			return;
4572 		}
4573 
4574 		rwq->ibwq.event_handler(&event, rwq->ibwq.wq_context);
4575 	}
4576 }
4577 
4578 static int  create_rq(struct mlx5_ib_rwq *rwq, struct ib_pd *pd,
4579 		      struct ib_wq_init_attr *init_attr)
4580 {
4581 	struct mlx5_ib_dev *dev;
4582 	__be64 *rq_pas0;
4583 	void *in;
4584 	void *rqc;
4585 	void *wq;
4586 	int inlen;
4587 	int err;
4588 
4589 	dev = to_mdev(pd->device);
4590 
4591 	inlen = MLX5_ST_SZ_BYTES(create_rq_in) + sizeof(u64) * rwq->rq_num_pas;
4592 	in = mlx5_vzalloc(inlen);
4593 	if (!in)
4594 		return -ENOMEM;
4595 
4596 	rqc = MLX5_ADDR_OF(create_rq_in, in, ctx);
4597 	MLX5_SET(rqc,  rqc, mem_rq_type,
4598 		 MLX5_RQC_MEM_RQ_TYPE_MEMORY_RQ_INLINE);
4599 	MLX5_SET(rqc, rqc, user_index, rwq->user_index);
4600 	MLX5_SET(rqc,  rqc, cqn, to_mcq(init_attr->cq)->mcq.cqn);
4601 	MLX5_SET(rqc,  rqc, state, MLX5_RQC_STATE_RST);
4602 	MLX5_SET(rqc,  rqc, flush_in_error_en, 1);
4603 	wq = MLX5_ADDR_OF(rqc, rqc, wq);
4604 	MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC);
4605 	MLX5_SET(wq, wq, end_padding_mode, MLX5_WQ_END_PAD_MODE_ALIGN);
4606 	MLX5_SET(wq, wq, log_wq_stride, rwq->log_rq_stride);
4607 	MLX5_SET(wq, wq, log_wq_sz, rwq->log_rq_size);
4608 	MLX5_SET(wq, wq, pd, to_mpd(pd)->pdn);
4609 	MLX5_SET(wq, wq, page_offset, rwq->rq_page_offset);
4610 	MLX5_SET(wq, wq, log_wq_pg_sz, rwq->log_page_size);
4611 	MLX5_SET(wq, wq, wq_signature, rwq->wq_sig);
4612 	MLX5_SET64(wq, wq, dbr_addr, rwq->db.dma);
4613 	rq_pas0 = (__be64 *)MLX5_ADDR_OF(wq, wq, pas);
4614 	mlx5_ib_populate_pas(dev, rwq->umem, rwq->page_shift, rq_pas0, 0);
4615 	err = mlx5_core_create_rq_tracked(dev->mdev, in, inlen, &rwq->core_qp);
4616 	kvfree(in);
4617 	return err;
4618 }
4619 
4620 static int set_user_rq_size(struct mlx5_ib_dev *dev,
4621 			    struct ib_wq_init_attr *wq_init_attr,
4622 			    struct mlx5_ib_create_wq *ucmd,
4623 			    struct mlx5_ib_rwq *rwq)
4624 {
4625 	/* Sanity check RQ size before proceeding */
4626 	if (wq_init_attr->max_wr > (1 << MLX5_CAP_GEN(dev->mdev, log_max_wq_sz)))
4627 		return -EINVAL;
4628 
4629 	if (!ucmd->rq_wqe_count)
4630 		return -EINVAL;
4631 
4632 	rwq->wqe_count = ucmd->rq_wqe_count;
4633 	rwq->wqe_shift = ucmd->rq_wqe_shift;
4634 	rwq->buf_size = (rwq->wqe_count << rwq->wqe_shift);
4635 	rwq->log_rq_stride = rwq->wqe_shift;
4636 	rwq->log_rq_size = ilog2(rwq->wqe_count);
4637 	return 0;
4638 }
4639 
4640 static int prepare_user_rq(struct ib_pd *pd,
4641 			   struct ib_wq_init_attr *init_attr,
4642 			   struct ib_udata *udata,
4643 			   struct mlx5_ib_rwq *rwq)
4644 {
4645 	struct mlx5_ib_dev *dev = to_mdev(pd->device);
4646 	struct mlx5_ib_create_wq ucmd = {};
4647 	int err;
4648 	size_t required_cmd_sz;
4649 
4650 	required_cmd_sz = offsetof(typeof(ucmd), reserved) + sizeof(ucmd.reserved);
4651 	if (udata->inlen < required_cmd_sz) {
4652 		mlx5_ib_dbg(dev, "invalid inlen\n");
4653 		return -EINVAL;
4654 	}
4655 
4656 	if (udata->inlen > sizeof(ucmd) &&
4657 	    !ib_is_udata_cleared(udata, sizeof(ucmd),
4658 				 udata->inlen - sizeof(ucmd))) {
4659 		mlx5_ib_dbg(dev, "inlen is not supported\n");
4660 		return -EOPNOTSUPP;
4661 	}
4662 
4663 	if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen))) {
4664 		mlx5_ib_dbg(dev, "copy failed\n");
4665 		return -EFAULT;
4666 	}
4667 
4668 	if (ucmd.comp_mask) {
4669 		mlx5_ib_dbg(dev, "invalid comp mask\n");
4670 		return -EOPNOTSUPP;
4671 	}
4672 
4673 	if (ucmd.reserved) {
4674 		mlx5_ib_dbg(dev, "invalid reserved\n");
4675 		return -EOPNOTSUPP;
4676 	}
4677 
4678 	err = set_user_rq_size(dev, init_attr, &ucmd, rwq);
4679 	if (err) {
4680 		mlx5_ib_dbg(dev, "err %d\n", err);
4681 		return err;
4682 	}
4683 
4684 	err = create_user_rq(dev, pd, rwq, &ucmd);
4685 	if (err) {
4686 		mlx5_ib_dbg(dev, "err %d\n", err);
4687 		if (err)
4688 			return err;
4689 	}
4690 
4691 	rwq->user_index = ucmd.user_index;
4692 	return 0;
4693 }
4694 
4695 struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
4696 				struct ib_wq_init_attr *init_attr,
4697 				struct ib_udata *udata)
4698 {
4699 	struct mlx5_ib_dev *dev;
4700 	struct mlx5_ib_rwq *rwq;
4701 	struct mlx5_ib_create_wq_resp resp = {};
4702 	size_t min_resp_len;
4703 	int err;
4704 
4705 	if (!udata)
4706 		return ERR_PTR(-ENOSYS);
4707 
4708 	min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved);
4709 	if (udata->outlen && udata->outlen < min_resp_len)
4710 		return ERR_PTR(-EINVAL);
4711 
4712 	dev = to_mdev(pd->device);
4713 	switch (init_attr->wq_type) {
4714 	case IB_WQT_RQ:
4715 		rwq = kzalloc(sizeof(*rwq), GFP_KERNEL);
4716 		if (!rwq)
4717 			return ERR_PTR(-ENOMEM);
4718 		err = prepare_user_rq(pd, init_attr, udata, rwq);
4719 		if (err)
4720 			goto err;
4721 		err = create_rq(rwq, pd, init_attr);
4722 		if (err)
4723 			goto err_user_rq;
4724 		break;
4725 	default:
4726 		mlx5_ib_dbg(dev, "unsupported wq type %d\n",
4727 			    init_attr->wq_type);
4728 		return ERR_PTR(-EINVAL);
4729 	}
4730 
4731 	rwq->ibwq.wq_num = rwq->core_qp.qpn;
4732 	rwq->ibwq.state = IB_WQS_RESET;
4733 	if (udata->outlen) {
4734 		resp.response_length = offsetof(typeof(resp), response_length) +
4735 				sizeof(resp.response_length);
4736 		err = ib_copy_to_udata(udata, &resp, resp.response_length);
4737 		if (err)
4738 			goto err_copy;
4739 	}
4740 
4741 	rwq->core_qp.event = mlx5_ib_wq_event;
4742 	rwq->ibwq.event_handler = init_attr->event_handler;
4743 	return &rwq->ibwq;
4744 
4745 err_copy:
4746 	mlx5_core_destroy_rq_tracked(dev->mdev, &rwq->core_qp);
4747 err_user_rq:
4748 	destroy_user_rq(pd, rwq);
4749 err:
4750 	kfree(rwq);
4751 	return ERR_PTR(err);
4752 }
4753 
4754 int mlx5_ib_destroy_wq(struct ib_wq *wq)
4755 {
4756 	struct mlx5_ib_dev *dev = to_mdev(wq->device);
4757 	struct mlx5_ib_rwq *rwq = to_mrwq(wq);
4758 
4759 	mlx5_core_destroy_rq_tracked(dev->mdev, &rwq->core_qp);
4760 	destroy_user_rq(wq->pd, rwq);
4761 	kfree(rwq);
4762 
4763 	return 0;
4764 }
4765 
4766 struct ib_rwq_ind_table *mlx5_ib_create_rwq_ind_table(struct ib_device *device,
4767 						      struct ib_rwq_ind_table_init_attr *init_attr,
4768 						      struct ib_udata *udata)
4769 {
4770 	struct mlx5_ib_dev *dev = to_mdev(device);
4771 	struct mlx5_ib_rwq_ind_table *rwq_ind_tbl;
4772 	int sz = 1 << init_attr->log_ind_tbl_size;
4773 	struct mlx5_ib_create_rwq_ind_tbl_resp resp = {};
4774 	size_t min_resp_len;
4775 	int inlen;
4776 	int err;
4777 	int i;
4778 	u32 *in;
4779 	void *rqtc;
4780 
4781 	if (udata->inlen > 0 &&
4782 	    !ib_is_udata_cleared(udata, 0,
4783 				 udata->inlen))
4784 		return ERR_PTR(-EOPNOTSUPP);
4785 
4786 	if (init_attr->log_ind_tbl_size >
4787 	    MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) {
4788 		mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n",
4789 			    init_attr->log_ind_tbl_size,
4790 			    MLX5_CAP_GEN(dev->mdev, log_max_rqt_size));
4791 		return ERR_PTR(-EINVAL);
4792 	}
4793 
4794 	min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved);
4795 	if (udata->outlen && udata->outlen < min_resp_len)
4796 		return ERR_PTR(-EINVAL);
4797 
4798 	rwq_ind_tbl = kzalloc(sizeof(*rwq_ind_tbl), GFP_KERNEL);
4799 	if (!rwq_ind_tbl)
4800 		return ERR_PTR(-ENOMEM);
4801 
4802 	inlen = MLX5_ST_SZ_BYTES(create_rqt_in) + sizeof(u32) * sz;
4803 	in = mlx5_vzalloc(inlen);
4804 	if (!in) {
4805 		err = -ENOMEM;
4806 		goto err;
4807 	}
4808 
4809 	rqtc = MLX5_ADDR_OF(create_rqt_in, in, rqt_context);
4810 
4811 	MLX5_SET(rqtc, rqtc, rqt_actual_size, sz);
4812 	MLX5_SET(rqtc, rqtc, rqt_max_size, sz);
4813 
4814 	for (i = 0; i < sz; i++)
4815 		MLX5_SET(rqtc, rqtc, rq_num[i], init_attr->ind_tbl[i]->wq_num);
4816 
4817 	err = mlx5_core_create_rqt(dev->mdev, in, inlen, &rwq_ind_tbl->rqtn);
4818 	kvfree(in);
4819 
4820 	if (err)
4821 		goto err;
4822 
4823 	rwq_ind_tbl->ib_rwq_ind_tbl.ind_tbl_num = rwq_ind_tbl->rqtn;
4824 	if (udata->outlen) {
4825 		resp.response_length = offsetof(typeof(resp), response_length) +
4826 					sizeof(resp.response_length);
4827 		err = ib_copy_to_udata(udata, &resp, resp.response_length);
4828 		if (err)
4829 			goto err_copy;
4830 	}
4831 
4832 	return &rwq_ind_tbl->ib_rwq_ind_tbl;
4833 
4834 err_copy:
4835 	mlx5_core_destroy_rqt(dev->mdev, rwq_ind_tbl->rqtn);
4836 err:
4837 	kfree(rwq_ind_tbl);
4838 	return ERR_PTR(err);
4839 }
4840 
4841 int mlx5_ib_destroy_rwq_ind_table(struct ib_rwq_ind_table *ib_rwq_ind_tbl)
4842 {
4843 	struct mlx5_ib_rwq_ind_table *rwq_ind_tbl = to_mrwq_ind_table(ib_rwq_ind_tbl);
4844 	struct mlx5_ib_dev *dev = to_mdev(ib_rwq_ind_tbl->device);
4845 
4846 	mlx5_core_destroy_rqt(dev->mdev, rwq_ind_tbl->rqtn);
4847 
4848 	kfree(rwq_ind_tbl);
4849 	return 0;
4850 }
4851 
4852 int mlx5_ib_modify_wq(struct ib_wq *wq, struct ib_wq_attr *wq_attr,
4853 		      u32 wq_attr_mask, struct ib_udata *udata)
4854 {
4855 	struct mlx5_ib_dev *dev = to_mdev(wq->device);
4856 	struct mlx5_ib_rwq *rwq = to_mrwq(wq);
4857 	struct mlx5_ib_modify_wq ucmd = {};
4858 	size_t required_cmd_sz;
4859 	int curr_wq_state;
4860 	int wq_state;
4861 	int inlen;
4862 	int err;
4863 	void *rqc;
4864 	void *in;
4865 
4866 	required_cmd_sz = offsetof(typeof(ucmd), reserved) + sizeof(ucmd.reserved);
4867 	if (udata->inlen < required_cmd_sz)
4868 		return -EINVAL;
4869 
4870 	if (udata->inlen > sizeof(ucmd) &&
4871 	    !ib_is_udata_cleared(udata, sizeof(ucmd),
4872 				 udata->inlen - sizeof(ucmd)))
4873 		return -EOPNOTSUPP;
4874 
4875 	if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)))
4876 		return -EFAULT;
4877 
4878 	if (ucmd.comp_mask || ucmd.reserved)
4879 		return -EOPNOTSUPP;
4880 
4881 	inlen = MLX5_ST_SZ_BYTES(modify_rq_in);
4882 	in = mlx5_vzalloc(inlen);
4883 	if (!in)
4884 		return -ENOMEM;
4885 
4886 	rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
4887 
4888 	curr_wq_state = (wq_attr_mask & IB_WQ_CUR_STATE) ?
4889 		wq_attr->curr_wq_state : wq->state;
4890 	wq_state = (wq_attr_mask & IB_WQ_STATE) ?
4891 		wq_attr->wq_state : curr_wq_state;
4892 	if (curr_wq_state == IB_WQS_ERR)
4893 		curr_wq_state = MLX5_RQC_STATE_ERR;
4894 	if (wq_state == IB_WQS_ERR)
4895 		wq_state = MLX5_RQC_STATE_ERR;
4896 	MLX5_SET(modify_rq_in, in, rq_state, curr_wq_state);
4897 	MLX5_SET(rqc, rqc, state, wq_state);
4898 
4899 	err = mlx5_core_modify_rq(dev->mdev, rwq->core_qp.qpn, in, inlen);
4900 	kvfree(in);
4901 	if (!err)
4902 		rwq->ibwq.state = (wq_state == MLX5_RQC_STATE_ERR) ? IB_WQS_ERR : wq_state;
4903 
4904 	return err;
4905 }
4906