1// SPDX-License-Identifier: GPL-2.0 or BSD-3-Clause
2
3/* Authors: Bernard Metzler <bmt@zurich.ibm.com> */
4/* Copyright (c) 2008-2019, IBM Corporation */
5
6#include <linux/errno.h>
7#include <linux/types.h>
8#include <linux/net.h>
9#include <linux/scatterlist.h>
10#include <linux/highmem.h>
11#include <net/tcp.h>
12
13#include <rdma/iw_cm.h>
14#include <rdma/ib_verbs.h>
15#include <rdma/ib_user_verbs.h>
16
17#include "siw.h"
18#include "siw_verbs.h"
19#include "siw_mem.h"
20
21#define MAX_HDR_INLINE					\
22	(((uint32_t)(sizeof(struct siw_rreq_pkt) -	\
23		     sizeof(struct iwarp_send))) & 0xF8)
24
25static struct page *siw_get_pblpage(struct siw_mem *mem, u64 addr, int *idx)
26{
27	struct siw_pbl *pbl = mem->pbl;
28	u64 offset = addr - mem->va;
29	dma_addr_t paddr = siw_pbl_get_buffer(pbl, offset, NULL, idx);
30
31	if (paddr)
32		return ib_virt_dma_to_page(paddr);
33
34	return NULL;
35}
36
37/*
38 * Copy short payload at provided destination payload address
39 */
40static int siw_try_1seg(struct siw_iwarp_tx *c_tx, void *paddr)
41{
42	struct siw_wqe *wqe = &c_tx->wqe_active;
43	struct siw_sge *sge = &wqe->sqe.sge[0];
44	u32 bytes = sge->length;
45
46	if (bytes > MAX_HDR_INLINE || wqe->sqe.num_sge != 1)
47		return MAX_HDR_INLINE + 1;
48
49	if (!bytes)
50		return 0;
51
52	if (tx_flags(wqe) & SIW_WQE_INLINE) {
53		memcpy(paddr, &wqe->sqe.sge[1], bytes);
54	} else {
55		struct siw_mem *mem = wqe->mem[0];
56
57		if (!mem->mem_obj) {
58			/* Kernel client using kva */
59			memcpy(paddr, ib_virt_dma_to_ptr(sge->laddr), bytes);
60		} else if (c_tx->in_syscall) {
61			if (copy_from_user(paddr, u64_to_user_ptr(sge->laddr),
62					   bytes))
63				return -EFAULT;
64		} else {
65			unsigned int off = sge->laddr & ~PAGE_MASK;
66			struct page *p;
67			char *buffer;
68			int pbl_idx = 0;
69
70			if (!mem->is_pbl)
71				p = siw_get_upage(mem->umem, sge->laddr);
72			else
73				p = siw_get_pblpage(mem, sge->laddr, &pbl_idx);
74
75			if (unlikely(!p))
76				return -EFAULT;
77
78			buffer = kmap_local_page(p);
79
80			if (likely(PAGE_SIZE - off >= bytes)) {
81				memcpy(paddr, buffer + off, bytes);
82			} else {
83				unsigned long part = bytes - (PAGE_SIZE - off);
84
85				memcpy(paddr, buffer + off, part);
86				kunmap_local(buffer);
87
88				if (!mem->is_pbl)
89					p = siw_get_upage(mem->umem,
90							  sge->laddr + part);
91				else
92					p = siw_get_pblpage(mem,
93							    sge->laddr + part,
94							    &pbl_idx);
95				if (unlikely(!p))
96					return -EFAULT;
97
98				buffer = kmap_local_page(p);
99				memcpy(paddr + part, buffer, bytes - part);
100			}
101			kunmap_local(buffer);
102		}
103	}
104	return (int)bytes;
105}
106
107#define PKT_FRAGMENTED 1
108#define PKT_COMPLETE 0
109
110/*
111 * siw_qp_prepare_tx()
112 *
113 * Prepare tx state for sending out one fpdu. Builds complete pkt
114 * if no user data or only immediate data are present.
115 *
116 * returns PKT_COMPLETE if complete pkt built, PKT_FRAGMENTED otherwise.
117 */
118static int siw_qp_prepare_tx(struct siw_iwarp_tx *c_tx)
119{
120	struct siw_wqe *wqe = &c_tx->wqe_active;
121	char *crc = NULL;
122	int data = 0;
123
124	switch (tx_type(wqe)) {
125	case SIW_OP_READ:
126	case SIW_OP_READ_LOCAL_INV:
127		memcpy(&c_tx->pkt.ctrl,
128		       &iwarp_pktinfo[RDMAP_RDMA_READ_REQ].ctrl,
129		       sizeof(struct iwarp_ctrl));
130
131		c_tx->pkt.rreq.rsvd = 0;
132		c_tx->pkt.rreq.ddp_qn = htonl(RDMAP_UNTAGGED_QN_RDMA_READ);
133		c_tx->pkt.rreq.ddp_msn =
134			htonl(++c_tx->ddp_msn[RDMAP_UNTAGGED_QN_RDMA_READ]);
135		c_tx->pkt.rreq.ddp_mo = 0;
136		c_tx->pkt.rreq.sink_stag = htonl(wqe->sqe.sge[0].lkey);
137		c_tx->pkt.rreq.sink_to =
138			cpu_to_be64(wqe->sqe.sge[0].laddr);
139		c_tx->pkt.rreq.source_stag = htonl(wqe->sqe.rkey);
140		c_tx->pkt.rreq.source_to = cpu_to_be64(wqe->sqe.raddr);
141		c_tx->pkt.rreq.read_size = htonl(wqe->sqe.sge[0].length);
142
143		c_tx->ctrl_len = sizeof(struct iwarp_rdma_rreq);
144		crc = (char *)&c_tx->pkt.rreq_pkt.crc;
145		break;
146
147	case SIW_OP_SEND:
148		if (tx_flags(wqe) & SIW_WQE_SOLICITED)
149			memcpy(&c_tx->pkt.ctrl,
150			       &iwarp_pktinfo[RDMAP_SEND_SE].ctrl,
151			       sizeof(struct iwarp_ctrl));
152		else
153			memcpy(&c_tx->pkt.ctrl, &iwarp_pktinfo[RDMAP_SEND].ctrl,
154			       sizeof(struct iwarp_ctrl));
155
156		c_tx->pkt.send.ddp_qn = RDMAP_UNTAGGED_QN_SEND;
157		c_tx->pkt.send.ddp_msn =
158			htonl(++c_tx->ddp_msn[RDMAP_UNTAGGED_QN_SEND]);
159		c_tx->pkt.send.ddp_mo = 0;
160
161		c_tx->pkt.send_inv.inval_stag = 0;
162
163		c_tx->ctrl_len = sizeof(struct iwarp_send);
164
165		crc = (char *)&c_tx->pkt.send_pkt.crc;
166		data = siw_try_1seg(c_tx, crc);
167		break;
168
169	case SIW_OP_SEND_REMOTE_INV:
170		if (tx_flags(wqe) & SIW_WQE_SOLICITED)
171			memcpy(&c_tx->pkt.ctrl,
172			       &iwarp_pktinfo[RDMAP_SEND_SE_INVAL].ctrl,
173			       sizeof(struct iwarp_ctrl));
174		else
175			memcpy(&c_tx->pkt.ctrl,
176			       &iwarp_pktinfo[RDMAP_SEND_INVAL].ctrl,
177			       sizeof(struct iwarp_ctrl));
178
179		c_tx->pkt.send.ddp_qn = RDMAP_UNTAGGED_QN_SEND;
180		c_tx->pkt.send.ddp_msn =
181			htonl(++c_tx->ddp_msn[RDMAP_UNTAGGED_QN_SEND]);
182		c_tx->pkt.send.ddp_mo = 0;
183
184		c_tx->pkt.send_inv.inval_stag = cpu_to_be32(wqe->sqe.rkey);
185
186		c_tx->ctrl_len = sizeof(struct iwarp_send_inv);
187
188		crc = (char *)&c_tx->pkt.send_pkt.crc;
189		data = siw_try_1seg(c_tx, crc);
190		break;
191
192	case SIW_OP_WRITE:
193		memcpy(&c_tx->pkt.ctrl, &iwarp_pktinfo[RDMAP_RDMA_WRITE].ctrl,
194		       sizeof(struct iwarp_ctrl));
195
196		c_tx->pkt.rwrite.sink_stag = htonl(wqe->sqe.rkey);
197		c_tx->pkt.rwrite.sink_to = cpu_to_be64(wqe->sqe.raddr);
198		c_tx->ctrl_len = sizeof(struct iwarp_rdma_write);
199
200		crc = (char *)&c_tx->pkt.write_pkt.crc;
201		data = siw_try_1seg(c_tx, crc);
202		break;
203
204	case SIW_OP_READ_RESPONSE:
205		memcpy(&c_tx->pkt.ctrl,
206		       &iwarp_pktinfo[RDMAP_RDMA_READ_RESP].ctrl,
207		       sizeof(struct iwarp_ctrl));
208
209		/* NBO */
210		c_tx->pkt.rresp.sink_stag = cpu_to_be32(wqe->sqe.rkey);
211		c_tx->pkt.rresp.sink_to = cpu_to_be64(wqe->sqe.raddr);
212
213		c_tx->ctrl_len = sizeof(struct iwarp_rdma_rresp);
214
215		crc = (char *)&c_tx->pkt.write_pkt.crc;
216		data = siw_try_1seg(c_tx, crc);
217		break;
218
219	default:
220		siw_dbg_qp(tx_qp(c_tx), "stale wqe type %d\n", tx_type(wqe));
221		return -EOPNOTSUPP;
222	}
223	if (unlikely(data < 0))
224		return data;
225
226	c_tx->ctrl_sent = 0;
227
228	if (data <= MAX_HDR_INLINE) {
229		if (data) {
230			wqe->processed = data;
231
232			c_tx->pkt.ctrl.mpa_len =
233				htons(c_tx->ctrl_len + data - MPA_HDR_SIZE);
234
235			/* Add pad, if needed */
236			data += -(int)data & 0x3;
237			/* advance CRC location after payload */
238			crc += data;
239			c_tx->ctrl_len += data;
240
241			if (!(c_tx->pkt.ctrl.ddp_rdmap_ctrl & DDP_FLAG_TAGGED))
242				c_tx->pkt.c_untagged.ddp_mo = 0;
243			else
244				c_tx->pkt.c_tagged.ddp_to =
245					cpu_to_be64(wqe->sqe.raddr);
246		}
247
248		*(u32 *)crc = 0;
249		/*
250		 * Do complete CRC if enabled and short packet
251		 */
252		if (c_tx->mpa_crc_hd) {
253			crypto_shash_init(c_tx->mpa_crc_hd);
254			if (crypto_shash_update(c_tx->mpa_crc_hd,
255						(u8 *)&c_tx->pkt,
256						c_tx->ctrl_len))
257				return -EINVAL;
258			crypto_shash_final(c_tx->mpa_crc_hd, (u8 *)crc);
259		}
260		c_tx->ctrl_len += MPA_CRC_SIZE;
261
262		return PKT_COMPLETE;
263	}
264	c_tx->ctrl_len += MPA_CRC_SIZE;
265	c_tx->sge_idx = 0;
266	c_tx->sge_off = 0;
267	c_tx->pbl_idx = 0;
268
269	/*
270	 * Allow direct sending out of user buffer if WR is non signalled
271	 * and payload is over threshold.
272	 * Per RDMA verbs, the application should not change the send buffer
273	 * until the work completed. In iWarp, work completion is only
274	 * local delivery to TCP. TCP may reuse the buffer for
275	 * retransmission. Changing unsent data also breaks the CRC,
276	 * if applied.
277	 */
278	if (c_tx->zcopy_tx && wqe->bytes >= SENDPAGE_THRESH &&
279	    !(tx_flags(wqe) & SIW_WQE_SIGNALLED))
280		c_tx->use_sendpage = 1;
281	else
282		c_tx->use_sendpage = 0;
283
284	return PKT_FRAGMENTED;
285}
286
287/*
288 * Send out one complete control type FPDU, or header of FPDU carrying
289 * data. Used for fixed sized packets like Read.Requests or zero length
290 * SENDs, WRITEs, READ.Responses, or header only.
291 */
292static int siw_tx_ctrl(struct siw_iwarp_tx *c_tx, struct socket *s,
293			      int flags)
294{
295	struct msghdr msg = { .msg_flags = flags };
296	struct kvec iov = { .iov_base =
297				    (char *)&c_tx->pkt.ctrl + c_tx->ctrl_sent,
298			    .iov_len = c_tx->ctrl_len - c_tx->ctrl_sent };
299
300	int rv = kernel_sendmsg(s, &msg, &iov, 1,
301				c_tx->ctrl_len - c_tx->ctrl_sent);
302
303	if (rv >= 0) {
304		c_tx->ctrl_sent += rv;
305
306		if (c_tx->ctrl_sent == c_tx->ctrl_len)
307			rv = 0;
308		else
309			rv = -EAGAIN;
310	}
311	return rv;
312}
313
314/*
315 * 0copy TCP transmit interface: Use MSG_SPLICE_PAGES.
316 *
317 * Using sendpage to push page by page appears to be less efficient
318 * than using sendmsg, even if data are copied.
319 *
320 * A general performance limitation might be the extra four bytes
321 * trailer checksum segment to be pushed after user data.
322 */
323static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,
324			     size_t size)
325{
326	struct bio_vec bvec;
327	struct msghdr msg = {
328		.msg_flags = (MSG_MORE | MSG_DONTWAIT | MSG_SPLICE_PAGES),
329	};
330	struct sock *sk = s->sk;
331	int i = 0, rv = 0, sent = 0;
332
333	while (size) {
334		size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);
335
336		if (size + offset <= PAGE_SIZE)
337			msg.msg_flags &= ~MSG_MORE;
338
339		tcp_rate_check_app_limited(sk);
340		bvec_set_page(&bvec, page[i], bytes, offset);
341		iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
342
343try_page_again:
344		lock_sock(sk);
345		rv = tcp_sendmsg_locked(sk, &msg, size);
346		release_sock(sk);
347
348		if (rv > 0) {
349			size -= rv;
350			sent += rv;
351			if (rv != bytes) {
352				offset += rv;
353				bytes -= rv;
354				goto try_page_again;
355			}
356			offset = 0;
357		} else {
358			if (rv == -EAGAIN || rv == 0)
359				break;
360			return rv;
361		}
362		i++;
363	}
364	return sent;
365}
366
367/*
368 * siw_0copy_tx()
369 *
370 * Pushes list of pages to TCP socket. If pages from multiple
371 * SGE's, all referenced pages of each SGE are pushed in one
372 * shot.
373 */
374static int siw_0copy_tx(struct socket *s, struct page **page,
375			struct siw_sge *sge, unsigned int offset,
376			unsigned int size)
377{
378	int i = 0, sent = 0, rv;
379	int sge_bytes = min(sge->length - offset, size);
380
381	offset = (sge->laddr + offset) & ~PAGE_MASK;
382
383	while (sent != size) {
384		rv = siw_tcp_sendpages(s, &page[i], offset, sge_bytes);
385		if (rv >= 0) {
386			sent += rv;
387			if (size == sent || sge_bytes > rv)
388				break;
389
390			i += PAGE_ALIGN(sge_bytes + offset) >> PAGE_SHIFT;
391			sge++;
392			sge_bytes = min(sge->length, size - sent);
393			offset = sge->laddr & ~PAGE_MASK;
394		} else {
395			sent = rv;
396			break;
397		}
398	}
399	return sent;
400}
401
402#define MAX_TRAILER (MPA_CRC_SIZE + 4)
403
404static void siw_unmap_pages(struct kvec *iov, unsigned long kmap_mask, int len)
405{
406	int i;
407
408	/*
409	 * Work backwards through the array to honor the kmap_local_page()
410	 * ordering requirements.
411	 */
412	for (i = (len-1); i >= 0; i--) {
413		if (kmap_mask & BIT(i)) {
414			unsigned long addr = (unsigned long)iov[i].iov_base;
415
416			kunmap_local((void *)(addr & PAGE_MASK));
417		}
418	}
419}
420
421/*
422 * siw_tx_hdt() tries to push a complete packet to TCP where all
423 * packet fragments are referenced by the elements of one iovec.
424 * For the data portion, each involved page must be referenced by
425 * one extra element. All sge's data can be non-aligned to page
426 * boundaries. Two more elements are referencing iWARP header
427 * and trailer:
428 * MAX_ARRAY = 64KB/PAGE_SIZE + 1 + (2 * (SIW_MAX_SGE - 1) + HDR + TRL
429 */
430#define MAX_ARRAY ((0xffff / PAGE_SIZE) + 1 + (2 * (SIW_MAX_SGE - 1) + 2))
431
432/*
433 * Write out iov referencing hdr, data and trailer of current FPDU.
434 * Update transmit state dependent on write return status
435 */
436static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
437{
438	struct siw_wqe *wqe = &c_tx->wqe_active;
439	struct siw_sge *sge = &wqe->sqe.sge[c_tx->sge_idx];
440	struct kvec iov[MAX_ARRAY];
441	struct page *page_array[MAX_ARRAY];
442	struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR };
443
444	int seg = 0, do_crc = c_tx->do_crc, is_kva = 0, rv;
445	unsigned int data_len = c_tx->bytes_unsent, hdr_len = 0, trl_len = 0,
446		     sge_off = c_tx->sge_off, sge_idx = c_tx->sge_idx,
447		     pbl_idx = c_tx->pbl_idx;
448	unsigned long kmap_mask = 0L;
449
450	if (c_tx->state == SIW_SEND_HDR) {
451		if (c_tx->use_sendpage) {
452			rv = siw_tx_ctrl(c_tx, s, MSG_DONTWAIT | MSG_MORE);
453			if (rv)
454				goto done;
455
456			c_tx->state = SIW_SEND_DATA;
457		} else {
458			iov[0].iov_base =
459				(char *)&c_tx->pkt.ctrl + c_tx->ctrl_sent;
460			iov[0].iov_len = hdr_len =
461				c_tx->ctrl_len - c_tx->ctrl_sent;
462			seg = 1;
463		}
464	}
465
466	wqe->processed += data_len;
467
468	while (data_len) { /* walk the list of SGE's */
469		unsigned int sge_len = min(sge->length - sge_off, data_len);
470		unsigned int fp_off = (sge->laddr + sge_off) & ~PAGE_MASK;
471		struct siw_mem *mem;
472
473		if (!(tx_flags(wqe) & SIW_WQE_INLINE)) {
474			mem = wqe->mem[sge_idx];
475			is_kva = mem->mem_obj == NULL ? 1 : 0;
476		} else {
477			is_kva = 1;
478		}
479		if (is_kva && !c_tx->use_sendpage) {
480			/*
481			 * tx from kernel virtual address: either inline data
482			 * or memory region with assigned kernel buffer
483			 */
484			iov[seg].iov_base =
485				ib_virt_dma_to_ptr(sge->laddr + sge_off);
486			iov[seg].iov_len = sge_len;
487
488			if (do_crc)
489				crypto_shash_update(c_tx->mpa_crc_hd,
490						    iov[seg].iov_base,
491						    sge_len);
492			sge_off += sge_len;
493			data_len -= sge_len;
494			seg++;
495			goto sge_done;
496		}
497
498		while (sge_len) {
499			size_t plen = min((int)PAGE_SIZE - fp_off, sge_len);
500			void *kaddr;
501
502			if (!is_kva) {
503				struct page *p;
504
505				if (mem->is_pbl)
506					p = siw_get_pblpage(
507						mem, sge->laddr + sge_off,
508						&pbl_idx);
509				else
510					p = siw_get_upage(mem->umem,
511							  sge->laddr + sge_off);
512				if (unlikely(!p)) {
513					siw_unmap_pages(iov, kmap_mask, seg);
514					wqe->processed -= c_tx->bytes_unsent;
515					rv = -EFAULT;
516					goto done_crc;
517				}
518				page_array[seg] = p;
519
520				if (!c_tx->use_sendpage) {
521					void *kaddr = kmap_local_page(p);
522
523					/* Remember for later kunmap() */
524					kmap_mask |= BIT(seg);
525					iov[seg].iov_base = kaddr + fp_off;
526					iov[seg].iov_len = plen;
527
528					if (do_crc)
529						crypto_shash_update(
530							c_tx->mpa_crc_hd,
531							iov[seg].iov_base,
532							plen);
533				} else if (do_crc) {
534					kaddr = kmap_local_page(p);
535					crypto_shash_update(c_tx->mpa_crc_hd,
536							    kaddr + fp_off,
537							    plen);
538					kunmap_local(kaddr);
539				}
540			} else {
541				/*
542				 * Cast to an uintptr_t to preserve all 64 bits
543				 * in sge->laddr.
544				 */
545				u64 va = sge->laddr + sge_off;
546
547				page_array[seg] = ib_virt_dma_to_page(va);
548				if (do_crc)
549					crypto_shash_update(
550						c_tx->mpa_crc_hd,
551						ib_virt_dma_to_ptr(va),
552						plen);
553			}
554
555			sge_len -= plen;
556			sge_off += plen;
557			data_len -= plen;
558			fp_off = 0;
559
560			if (++seg >= (int)MAX_ARRAY) {
561				siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
562				siw_unmap_pages(iov, kmap_mask, seg-1);
563				wqe->processed -= c_tx->bytes_unsent;
564				rv = -EMSGSIZE;
565				goto done_crc;
566			}
567		}
568sge_done:
569		/* Update SGE variables at end of SGE */
570		if (sge_off == sge->length &&
571		    (data_len != 0 || wqe->processed < wqe->bytes)) {
572			sge_idx++;
573			sge++;
574			sge_off = 0;
575		}
576	}
577	/* trailer */
578	if (likely(c_tx->state != SIW_SEND_TRAILER)) {
579		iov[seg].iov_base = &c_tx->trailer.pad[4 - c_tx->pad];
580		iov[seg].iov_len = trl_len = MAX_TRAILER - (4 - c_tx->pad);
581	} else {
582		iov[seg].iov_base = &c_tx->trailer.pad[c_tx->ctrl_sent];
583		iov[seg].iov_len = trl_len = MAX_TRAILER - c_tx->ctrl_sent;
584	}
585
586	if (c_tx->pad) {
587		*(u32 *)c_tx->trailer.pad = 0;
588		if (do_crc)
589			crypto_shash_update(c_tx->mpa_crc_hd,
590				(u8 *)&c_tx->trailer.crc - c_tx->pad,
591				c_tx->pad);
592	}
593	if (!c_tx->mpa_crc_hd)
594		c_tx->trailer.crc = 0;
595	else if (do_crc)
596		crypto_shash_final(c_tx->mpa_crc_hd, (u8 *)&c_tx->trailer.crc);
597
598	data_len = c_tx->bytes_unsent;
599
600	if (c_tx->use_sendpage) {
601		rv = siw_0copy_tx(s, page_array, &wqe->sqe.sge[c_tx->sge_idx],
602				  c_tx->sge_off, data_len);
603		if (rv == data_len) {
604			rv = kernel_sendmsg(s, &msg, &iov[seg], 1, trl_len);
605			if (rv > 0)
606				rv += data_len;
607			else
608				rv = data_len;
609		}
610	} else {
611		rv = kernel_sendmsg(s, &msg, iov, seg + 1,
612				    hdr_len + data_len + trl_len);
613		siw_unmap_pages(iov, kmap_mask, seg);
614	}
615	if (rv < (int)hdr_len) {
616		/* Not even complete hdr pushed or negative rv */
617		wqe->processed -= data_len;
618		if (rv >= 0) {
619			c_tx->ctrl_sent += rv;
620			rv = -EAGAIN;
621		}
622		goto done_crc;
623	}
624	rv -= hdr_len;
625
626	if (rv >= (int)data_len) {
627		/* all user data pushed to TCP or no data to push */
628		if (data_len > 0 && wqe->processed < wqe->bytes) {
629			/* Save the current state for next tx */
630			c_tx->sge_idx = sge_idx;
631			c_tx->sge_off = sge_off;
632			c_tx->pbl_idx = pbl_idx;
633		}
634		rv -= data_len;
635
636		if (rv == trl_len) /* all pushed */
637			rv = 0;
638		else {
639			c_tx->state = SIW_SEND_TRAILER;
640			c_tx->ctrl_len = MAX_TRAILER;
641			c_tx->ctrl_sent = rv + 4 - c_tx->pad;
642			c_tx->bytes_unsent = 0;
643			rv = -EAGAIN;
644		}
645
646	} else if (data_len > 0) {
647		/* Maybe some user data pushed to TCP */
648		c_tx->state = SIW_SEND_DATA;
649		wqe->processed -= data_len - rv;
650
651		if (rv) {
652			/*
653			 * Some bytes out. Recompute tx state based
654			 * on old state and bytes pushed
655			 */
656			unsigned int sge_unsent;
657
658			c_tx->bytes_unsent -= rv;
659			sge = &wqe->sqe.sge[c_tx->sge_idx];
660			sge_unsent = sge->length - c_tx->sge_off;
661
662			while (sge_unsent <= rv) {
663				rv -= sge_unsent;
664				c_tx->sge_idx++;
665				c_tx->sge_off = 0;
666				sge++;
667				sge_unsent = sge->length;
668			}
669			c_tx->sge_off += rv;
670		}
671		rv = -EAGAIN;
672	}
673done_crc:
674	c_tx->do_crc = 0;
675done:
676	return rv;
677}
678
679static void siw_update_tcpseg(struct siw_iwarp_tx *c_tx,
680				     struct socket *s)
681{
682	struct tcp_sock *tp = tcp_sk(s->sk);
683
684	if (tp->gso_segs) {
685		if (c_tx->gso_seg_limit == 0)
686			c_tx->tcp_seglen = tp->mss_cache * tp->gso_segs;
687		else
688			c_tx->tcp_seglen =
689				tp->mss_cache *
690				min_t(u16, c_tx->gso_seg_limit, tp->gso_segs);
691	} else {
692		c_tx->tcp_seglen = tp->mss_cache;
693	}
694	/* Loopback may give odd numbers */
695	c_tx->tcp_seglen &= 0xfffffff8;
696}
697
698/*
699 * siw_prepare_fpdu()
700 *
701 * Prepares transmit context to send out one FPDU if FPDU will contain
702 * user data and user data are not immediate data.
703 * Computes maximum FPDU length to fill up TCP MSS if possible.
704 *
705 * @qp:		QP from which to transmit
706 * @wqe:	Current WQE causing transmission
707 *
708 * TODO: Take into account real available sendspace on socket
709 *       to avoid header misalignment due to send pausing within
710 *       fpdu transmission
711 */
712static void siw_prepare_fpdu(struct siw_qp *qp, struct siw_wqe *wqe)
713{
714	struct siw_iwarp_tx *c_tx = &qp->tx_ctx;
715	int data_len;
716
717	c_tx->ctrl_len =
718		iwarp_pktinfo[__rdmap_get_opcode(&c_tx->pkt.ctrl)].hdr_len;
719	c_tx->ctrl_sent = 0;
720
721	/*
722	 * Update target buffer offset if any
723	 */
724	if (!(c_tx->pkt.ctrl.ddp_rdmap_ctrl & DDP_FLAG_TAGGED))
725		/* Untagged message */
726		c_tx->pkt.c_untagged.ddp_mo = cpu_to_be32(wqe->processed);
727	else /* Tagged message */
728		c_tx->pkt.c_tagged.ddp_to =
729			cpu_to_be64(wqe->sqe.raddr + wqe->processed);
730
731	data_len = wqe->bytes - wqe->processed;
732	if (data_len + c_tx->ctrl_len + MPA_CRC_SIZE > c_tx->tcp_seglen) {
733		/* Trim DDP payload to fit into current TCP segment */
734		data_len = c_tx->tcp_seglen - (c_tx->ctrl_len + MPA_CRC_SIZE);
735		c_tx->pkt.ctrl.ddp_rdmap_ctrl &= ~DDP_FLAG_LAST;
736		c_tx->pad = 0;
737	} else {
738		c_tx->pkt.ctrl.ddp_rdmap_ctrl |= DDP_FLAG_LAST;
739		c_tx->pad = -data_len & 0x3;
740	}
741	c_tx->bytes_unsent = data_len;
742
743	c_tx->pkt.ctrl.mpa_len =
744		htons(c_tx->ctrl_len + data_len - MPA_HDR_SIZE);
745
746	/*
747	 * Init MPA CRC computation
748	 */
749	if (c_tx->mpa_crc_hd) {
750		crypto_shash_init(c_tx->mpa_crc_hd);
751		crypto_shash_update(c_tx->mpa_crc_hd, (u8 *)&c_tx->pkt,
752				    c_tx->ctrl_len);
753		c_tx->do_crc = 1;
754	}
755}
756
757/*
758 * siw_check_sgl_tx()
759 *
760 * Check permissions for a list of SGE's (SGL).
761 * A successful check will have all memory referenced
762 * for transmission resolved and assigned to the WQE.
763 *
764 * @pd:		Protection Domain SGL should belong to
765 * @wqe:	WQE to be checked
766 * @perms:	requested access permissions
767 *
768 */
769
770static int siw_check_sgl_tx(struct ib_pd *pd, struct siw_wqe *wqe,
771			    enum ib_access_flags perms)
772{
773	struct siw_sge *sge = &wqe->sqe.sge[0];
774	int i, len, num_sge = wqe->sqe.num_sge;
775
776	if (unlikely(num_sge > SIW_MAX_SGE))
777		return -EINVAL;
778
779	for (i = 0, len = 0; num_sge; num_sge--, i++, sge++) {
780		/*
781		 * rdma verbs: do not check stag for a zero length sge
782		 */
783		if (sge->length) {
784			int rv = siw_check_sge(pd, sge, &wqe->mem[i], perms, 0,
785					       sge->length);
786
787			if (unlikely(rv != E_ACCESS_OK))
788				return rv;
789		}
790		len += sge->length;
791	}
792	return len;
793}
794
795/*
796 * siw_qp_sq_proc_tx()
797 *
798 * Process one WQE which needs transmission on the wire.
799 */
800static int siw_qp_sq_proc_tx(struct siw_qp *qp, struct siw_wqe *wqe)
801{
802	struct siw_iwarp_tx *c_tx = &qp->tx_ctx;
803	struct socket *s = qp->attrs.sk;
804	int rv = 0, burst_len = qp->tx_ctx.burst;
805	enum rdmap_ecode ecode = RDMAP_ECODE_CATASTROPHIC_STREAM;
806
807	if (unlikely(wqe->wr_status == SIW_WR_IDLE))
808		return 0;
809
810	if (!burst_len)
811		burst_len = SQ_USER_MAXBURST;
812
813	if (wqe->wr_status == SIW_WR_QUEUED) {
814		if (!(wqe->sqe.flags & SIW_WQE_INLINE)) {
815			if (tx_type(wqe) == SIW_OP_READ_RESPONSE)
816				wqe->sqe.num_sge = 1;
817
818			if (tx_type(wqe) != SIW_OP_READ &&
819			    tx_type(wqe) != SIW_OP_READ_LOCAL_INV) {
820				/*
821				 * Reference memory to be tx'd w/o checking
822				 * access for LOCAL_READ permission, since
823				 * not defined in RDMA core.
824				 */
825				rv = siw_check_sgl_tx(qp->pd, wqe, 0);
826				if (rv < 0) {
827					if (tx_type(wqe) ==
828					    SIW_OP_READ_RESPONSE)
829						ecode = siw_rdmap_error(-rv);
830					rv = -EINVAL;
831					goto tx_error;
832				}
833				wqe->bytes = rv;
834			} else {
835				wqe->bytes = 0;
836			}
837		} else {
838			wqe->bytes = wqe->sqe.sge[0].length;
839			if (!rdma_is_kernel_res(&qp->base_qp.res)) {
840				if (wqe->bytes > SIW_MAX_INLINE) {
841					rv = -EINVAL;
842					goto tx_error;
843				}
844				wqe->sqe.sge[0].laddr =
845					(u64)(uintptr_t)&wqe->sqe.sge[1];
846			}
847		}
848		wqe->wr_status = SIW_WR_INPROGRESS;
849		wqe->processed = 0;
850
851		siw_update_tcpseg(c_tx, s);
852
853		rv = siw_qp_prepare_tx(c_tx);
854		if (rv == PKT_FRAGMENTED) {
855			c_tx->state = SIW_SEND_HDR;
856			siw_prepare_fpdu(qp, wqe);
857		} else if (rv == PKT_COMPLETE) {
858			c_tx->state = SIW_SEND_SHORT_FPDU;
859		} else {
860			goto tx_error;
861		}
862	}
863
864next_segment:
865	siw_dbg_qp(qp, "wr type %d, state %d, data %u, sent %u, id %llx\n",
866		   tx_type(wqe), wqe->wr_status, wqe->bytes, wqe->processed,
867		   wqe->sqe.id);
868
869	if (--burst_len == 0) {
870		rv = -EINPROGRESS;
871		goto tx_done;
872	}
873	if (c_tx->state == SIW_SEND_SHORT_FPDU) {
874		enum siw_opcode tx_type = tx_type(wqe);
875		unsigned int msg_flags;
876
877		if (siw_sq_empty(qp) || !siw_tcp_nagle || burst_len == 1)
878			/*
879			 * End current TCP segment, if SQ runs empty,
880			 * or siw_tcp_nagle is not set, or we bail out
881			 * soon due to no burst credit left.
882			 */
883			msg_flags = MSG_DONTWAIT;
884		else
885			msg_flags = MSG_DONTWAIT | MSG_MORE;
886
887		rv = siw_tx_ctrl(c_tx, s, msg_flags);
888
889		if (!rv && tx_type != SIW_OP_READ &&
890		    tx_type != SIW_OP_READ_LOCAL_INV)
891			wqe->processed = wqe->bytes;
892
893		goto tx_done;
894
895	} else {
896		rv = siw_tx_hdt(c_tx, s);
897	}
898	if (!rv) {
899		/*
900		 * One segment sent. Processing completed if last
901		 * segment, Do next segment otherwise.
902		 */
903		if (unlikely(c_tx->tx_suspend)) {
904			/*
905			 * Verbs, 6.4.: Try stopping sending after a full
906			 * DDP segment if the connection goes down
907			 * (== peer halfclose)
908			 */
909			rv = -ECONNABORTED;
910			goto tx_done;
911		}
912		if (c_tx->pkt.ctrl.ddp_rdmap_ctrl & DDP_FLAG_LAST) {
913			siw_dbg_qp(qp, "WQE completed\n");
914			goto tx_done;
915		}
916		c_tx->state = SIW_SEND_HDR;
917
918		siw_update_tcpseg(c_tx, s);
919
920		siw_prepare_fpdu(qp, wqe);
921		goto next_segment;
922	}
923tx_done:
924	qp->tx_ctx.burst = burst_len;
925	return rv;
926
927tx_error:
928	if (ecode != RDMAP_ECODE_CATASTROPHIC_STREAM)
929		siw_init_terminate(qp, TERM_ERROR_LAYER_RDMAP,
930				   RDMAP_ETYPE_REMOTE_PROTECTION, ecode, 1);
931	else
932		siw_init_terminate(qp, TERM_ERROR_LAYER_RDMAP,
933				   RDMAP_ETYPE_CATASTROPHIC,
934				   RDMAP_ECODE_UNSPECIFIED, 1);
935	return rv;
936}
937
938static int siw_fastreg_mr(struct ib_pd *pd, struct siw_sqe *sqe)
939{
940	struct ib_mr *base_mr = (struct ib_mr *)(uintptr_t)sqe->base_mr;
941	struct siw_device *sdev = to_siw_dev(pd->device);
942	struct siw_mem *mem;
943	int rv = 0;
944
945	siw_dbg_pd(pd, "STag 0x%08x\n", sqe->rkey);
946
947	if (unlikely(!base_mr)) {
948		pr_warn("siw: fastreg: STag 0x%08x unknown\n", sqe->rkey);
949		return -EINVAL;
950	}
951
952	if (unlikely(base_mr->rkey >> 8 != sqe->rkey  >> 8)) {
953		pr_warn("siw: fastreg: STag 0x%08x: bad MR\n", sqe->rkey);
954		return -EINVAL;
955	}
956
957	mem = siw_mem_id2obj(sdev, sqe->rkey  >> 8);
958	if (unlikely(!mem)) {
959		pr_warn("siw: fastreg: STag 0x%08x unknown\n", sqe->rkey);
960		return -EINVAL;
961	}
962
963	if (unlikely(mem->pd != pd)) {
964		pr_warn("siw: fastreg: PD mismatch\n");
965		rv = -EINVAL;
966		goto out;
967	}
968	if (unlikely(mem->stag_valid)) {
969		pr_warn("siw: fastreg: STag 0x%08x already valid\n", sqe->rkey);
970		rv = -EINVAL;
971		goto out;
972	}
973	/* Refresh STag since user may have changed key part */
974	mem->stag = sqe->rkey;
975	mem->perms = sqe->access;
976
977	siw_dbg_mem(mem, "STag 0x%08x now valid\n", sqe->rkey);
978	mem->va = base_mr->iova;
979	mem->stag_valid = 1;
980out:
981	siw_mem_put(mem);
982	return rv;
983}
984
985static int siw_qp_sq_proc_local(struct siw_qp *qp, struct siw_wqe *wqe)
986{
987	int rv;
988
989	switch (tx_type(wqe)) {
990	case SIW_OP_REG_MR:
991		rv = siw_fastreg_mr(qp->pd, &wqe->sqe);
992		break;
993
994	case SIW_OP_INVAL_STAG:
995		rv = siw_invalidate_stag(qp->pd, wqe->sqe.rkey);
996		break;
997
998	default:
999		rv = -EINVAL;
1000	}
1001	return rv;
1002}
1003
1004/*
1005 * siw_qp_sq_process()
1006 *
1007 * Core TX path routine for RDMAP/DDP/MPA using a TCP kernel socket.
1008 * Sends RDMAP payload for the current SQ WR @wqe of @qp in one or more
1009 * MPA FPDUs, each containing a DDP segment.
1010 *
1011 * SQ processing may occur in user context as a result of posting
1012 * new WQE's or from siw_sq_work_handler() context. Processing in
1013 * user context is limited to non-kernel verbs users.
1014 *
1015 * SQ processing may get paused anytime, possibly in the middle of a WR
1016 * or FPDU, if insufficient send space is available. SQ processing
1017 * gets resumed from siw_sq_work_handler(), if send space becomes
1018 * available again.
1019 *
1020 * Must be called with the QP state read-locked.
1021 *
1022 * Note:
1023 * An outbound RREQ can be satisfied by the corresponding RRESP
1024 * _before_ it gets assigned to the ORQ. This happens regularly
1025 * in RDMA READ via loopback case. Since both outbound RREQ and
1026 * inbound RRESP can be handled by the same CPU, locking the ORQ
1027 * is dead-lock prone and thus not an option. With that, the
1028 * RREQ gets assigned to the ORQ _before_ being sent - see
1029 * siw_activate_tx() - and pulled back in case of send failure.
1030 */
1031int siw_qp_sq_process(struct siw_qp *qp)
1032{
1033	struct siw_wqe *wqe = tx_wqe(qp);
1034	enum siw_opcode tx_type;
1035	unsigned long flags;
1036	int rv = 0;
1037
1038	siw_dbg_qp(qp, "enter for type %d\n", tx_type(wqe));
1039
1040next_wqe:
1041	/*
1042	 * Stop QP processing if SQ state changed
1043	 */
1044	if (unlikely(qp->tx_ctx.tx_suspend)) {
1045		siw_dbg_qp(qp, "tx suspended\n");
1046		goto done;
1047	}
1048	tx_type = tx_type(wqe);
1049
1050	if (tx_type <= SIW_OP_READ_RESPONSE)
1051		rv = siw_qp_sq_proc_tx(qp, wqe);
1052	else
1053		rv = siw_qp_sq_proc_local(qp, wqe);
1054
1055	if (!rv) {
1056		/*
1057		 * WQE processing done
1058		 */
1059		switch (tx_type) {
1060		case SIW_OP_SEND:
1061		case SIW_OP_SEND_REMOTE_INV:
1062		case SIW_OP_WRITE:
1063			siw_wqe_put_mem(wqe, tx_type);
1064			fallthrough;
1065
1066		case SIW_OP_INVAL_STAG:
1067		case SIW_OP_REG_MR:
1068			if (tx_flags(wqe) & SIW_WQE_SIGNALLED)
1069				siw_sqe_complete(qp, &wqe->sqe, wqe->bytes,
1070						 SIW_WC_SUCCESS);
1071			break;
1072
1073		case SIW_OP_READ:
1074		case SIW_OP_READ_LOCAL_INV:
1075			/*
1076			 * already enqueued to ORQ queue
1077			 */
1078			break;
1079
1080		case SIW_OP_READ_RESPONSE:
1081			siw_wqe_put_mem(wqe, tx_type);
1082			break;
1083
1084		default:
1085			WARN(1, "undefined WQE type %d\n", tx_type);
1086			rv = -EINVAL;
1087			goto done;
1088		}
1089
1090		spin_lock_irqsave(&qp->sq_lock, flags);
1091		wqe->wr_status = SIW_WR_IDLE;
1092		rv = siw_activate_tx(qp);
1093		spin_unlock_irqrestore(&qp->sq_lock, flags);
1094
1095		if (rv <= 0)
1096			goto done;
1097
1098		goto next_wqe;
1099
1100	} else if (rv == -EAGAIN) {
1101		siw_dbg_qp(qp, "sq paused: hd/tr %d of %d, data %d\n",
1102			   qp->tx_ctx.ctrl_sent, qp->tx_ctx.ctrl_len,
1103			   qp->tx_ctx.bytes_unsent);
1104		rv = 0;
1105		goto done;
1106	} else if (rv == -EINPROGRESS) {
1107		rv = siw_sq_start(qp);
1108		goto done;
1109	} else {
1110		/*
1111		 * WQE processing failed.
1112		 * Verbs 8.3.2:
1113		 * o It turns any WQE into a signalled WQE.
1114		 * o Local catastrophic error must be surfaced
1115		 * o QP must be moved into Terminate state: done by code
1116		 *   doing socket state change processing
1117		 *
1118		 * o TODO: Termination message must be sent.
1119		 * o TODO: Implement more precise work completion errors,
1120		 *         see enum ib_wc_status in ib_verbs.h
1121		 */
1122		siw_dbg_qp(qp, "wqe type %d processing failed: %d\n",
1123			   tx_type(wqe), rv);
1124
1125		spin_lock_irqsave(&qp->sq_lock, flags);
1126		/*
1127		 * RREQ may have already been completed by inbound RRESP!
1128		 */
1129		if ((tx_type == SIW_OP_READ ||
1130		     tx_type == SIW_OP_READ_LOCAL_INV) && qp->attrs.orq_size) {
1131			/* Cleanup pending entry in ORQ */
1132			qp->orq_put--;
1133			qp->orq[qp->orq_put % qp->attrs.orq_size].flags = 0;
1134		}
1135		spin_unlock_irqrestore(&qp->sq_lock, flags);
1136		/*
1137		 * immediately suspends further TX processing
1138		 */
1139		if (!qp->tx_ctx.tx_suspend)
1140			siw_qp_cm_drop(qp, 0);
1141
1142		switch (tx_type) {
1143		case SIW_OP_SEND:
1144		case SIW_OP_SEND_REMOTE_INV:
1145		case SIW_OP_SEND_WITH_IMM:
1146		case SIW_OP_WRITE:
1147		case SIW_OP_READ:
1148		case SIW_OP_READ_LOCAL_INV:
1149			siw_wqe_put_mem(wqe, tx_type);
1150			fallthrough;
1151
1152		case SIW_OP_INVAL_STAG:
1153		case SIW_OP_REG_MR:
1154			siw_sqe_complete(qp, &wqe->sqe, wqe->bytes,
1155					 SIW_WC_LOC_QP_OP_ERR);
1156
1157			siw_qp_event(qp, IB_EVENT_QP_FATAL);
1158
1159			break;
1160
1161		case SIW_OP_READ_RESPONSE:
1162			siw_dbg_qp(qp, "proc. read.response failed: %d\n", rv);
1163
1164			siw_qp_event(qp, IB_EVENT_QP_REQ_ERR);
1165
1166			siw_wqe_put_mem(wqe, SIW_OP_READ_RESPONSE);
1167
1168			break;
1169
1170		default:
1171			WARN(1, "undefined WQE type %d\n", tx_type);
1172			rv = -EINVAL;
1173		}
1174		wqe->wr_status = SIW_WR_IDLE;
1175	}
1176done:
1177	return rv;
1178}
1179
1180static void siw_sq_resume(struct siw_qp *qp)
1181{
1182	if (down_read_trylock(&qp->state_lock)) {
1183		if (likely(qp->attrs.state == SIW_QP_STATE_RTS &&
1184			   !qp->tx_ctx.tx_suspend)) {
1185			int rv = siw_qp_sq_process(qp);
1186
1187			up_read(&qp->state_lock);
1188
1189			if (unlikely(rv < 0)) {
1190				siw_dbg_qp(qp, "SQ task failed: err %d\n", rv);
1191
1192				if (!qp->tx_ctx.tx_suspend)
1193					siw_qp_cm_drop(qp, 0);
1194			}
1195		} else {
1196			up_read(&qp->state_lock);
1197		}
1198	} else {
1199		siw_dbg_qp(qp, "Resume SQ while QP locked\n");
1200	}
1201	siw_qp_put(qp);
1202}
1203
1204struct tx_task_t {
1205	struct llist_head active;
1206	wait_queue_head_t waiting;
1207};
1208
1209static DEFINE_PER_CPU(struct tx_task_t, siw_tx_task_g);
1210
1211int siw_create_tx_threads(void)
1212{
1213	int cpu, assigned = 0;
1214
1215	for_each_online_cpu(cpu) {
1216		struct tx_task_t *tx_task;
1217
1218		/* Skip HT cores */
1219		if (cpu % cpumask_weight(topology_sibling_cpumask(cpu)))
1220			continue;
1221
1222		tx_task = &per_cpu(siw_tx_task_g, cpu);
1223		init_llist_head(&tx_task->active);
1224		init_waitqueue_head(&tx_task->waiting);
1225
1226		siw_tx_thread[cpu] =
1227			kthread_run_on_cpu(siw_run_sq,
1228					   (unsigned long *)(long)cpu,
1229					   cpu, "siw_tx/%u");
1230		if (IS_ERR(siw_tx_thread[cpu])) {
1231			siw_tx_thread[cpu] = NULL;
1232			continue;
1233		}
1234		assigned++;
1235	}
1236	return assigned;
1237}
1238
1239void siw_stop_tx_threads(void)
1240{
1241	int cpu;
1242
1243	for_each_possible_cpu(cpu) {
1244		if (siw_tx_thread[cpu]) {
1245			kthread_stop(siw_tx_thread[cpu]);
1246			wake_up(&per_cpu(siw_tx_task_g, cpu).waiting);
1247			siw_tx_thread[cpu] = NULL;
1248		}
1249	}
1250}
1251
1252int siw_run_sq(void *data)
1253{
1254	const int nr_cpu = (unsigned int)(long)data;
1255	struct llist_node *active;
1256	struct siw_qp *qp;
1257	struct tx_task_t *tx_task = &per_cpu(siw_tx_task_g, nr_cpu);
1258
1259	while (1) {
1260		struct llist_node *fifo_list = NULL;
1261
1262		wait_event_interruptible(tx_task->waiting,
1263					 !llist_empty(&tx_task->active) ||
1264						 kthread_should_stop());
1265
1266		if (kthread_should_stop())
1267			break;
1268
1269		active = llist_del_all(&tx_task->active);
1270		/*
1271		 * llist_del_all returns a list with newest entry first.
1272		 * Re-order list for fairness among QP's.
1273		 */
1274		fifo_list = llist_reverse_order(active);
1275		while (fifo_list) {
1276			qp = container_of(fifo_list, struct siw_qp, tx_list);
1277			fifo_list = llist_next(fifo_list);
1278			qp->tx_list.next = NULL;
1279
1280			siw_sq_resume(qp);
1281		}
1282	}
1283	active = llist_del_all(&tx_task->active);
1284	if (active) {
1285		llist_for_each_entry(qp, active, tx_list) {
1286			qp->tx_list.next = NULL;
1287			siw_sq_resume(qp);
1288		}
1289	}
1290	return 0;
1291}
1292
1293int siw_sq_start(struct siw_qp *qp)
1294{
1295	if (tx_wqe(qp)->wr_status == SIW_WR_IDLE)
1296		return 0;
1297
1298	if (unlikely(!cpu_online(qp->tx_cpu))) {
1299		siw_put_tx_cpu(qp->tx_cpu);
1300		qp->tx_cpu = siw_get_tx_cpu(qp->sdev);
1301		if (qp->tx_cpu < 0) {
1302			pr_warn("siw: no tx cpu available\n");
1303
1304			return -EIO;
1305		}
1306	}
1307	siw_qp_get(qp);
1308
1309	llist_add(&qp->tx_list, &per_cpu(siw_tx_task_g, qp->tx_cpu).active);
1310
1311	wake_up(&per_cpu(siw_tx_task_g, qp->tx_cpu).waiting);
1312
1313	return 0;
1314}
1315