t4_cpl_io.c revision 331722
1/*-
2 * Copyright (c) 2012, 2015 Chelsio Communications, Inc.
3 * All rights reserved.
4 * Written by: Navdeep Parhar <np@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD: stable/11/sys/dev/cxgbe/tom/t4_cpl_io.c 331722 2018-03-29 02:50:57Z eadler $");
30
31#include "opt_inet.h"
32
33#ifdef TCP_OFFLOAD
34#include <sys/param.h>
35#include <sys/aio.h>
36#include <sys/file.h>
37#include <sys/kernel.h>
38#include <sys/ktr.h>
39#include <sys/module.h>
40#include <sys/proc.h>
41#include <sys/protosw.h>
42#include <sys/domain.h>
43#include <sys/socket.h>
44#include <sys/socketvar.h>
45#include <sys/sglist.h>
46#include <sys/taskqueue.h>
47#include <netinet/in.h>
48#include <netinet/in_pcb.h>
49#include <netinet/ip.h>
50#include <netinet/ip6.h>
51#define TCPSTATES
52#include <netinet/tcp_fsm.h>
53#include <netinet/tcp_seq.h>
54#include <netinet/tcp_var.h>
55#include <netinet/toecore.h>
56
57#include <security/mac/mac_framework.h>
58
59#include <vm/vm.h>
60#include <vm/vm_extern.h>
61#include <vm/pmap.h>
62#include <vm/vm_map.h>
63#include <vm/vm_page.h>
64
65#include "common/common.h"
66#include "common/t4_msg.h"
67#include "common/t4_regs.h"
68#include "common/t4_tcb.h"
69#include "tom/t4_tom_l2t.h"
70#include "tom/t4_tom.h"
71
72VNET_DECLARE(int, tcp_do_autosndbuf);
73#define V_tcp_do_autosndbuf VNET(tcp_do_autosndbuf)
74VNET_DECLARE(int, tcp_autosndbuf_inc);
75#define V_tcp_autosndbuf_inc VNET(tcp_autosndbuf_inc)
76VNET_DECLARE(int, tcp_autosndbuf_max);
77#define V_tcp_autosndbuf_max VNET(tcp_autosndbuf_max)
78VNET_DECLARE(int, tcp_do_autorcvbuf);
79#define V_tcp_do_autorcvbuf VNET(tcp_do_autorcvbuf)
80VNET_DECLARE(int, tcp_autorcvbuf_inc);
81#define V_tcp_autorcvbuf_inc VNET(tcp_autorcvbuf_inc)
82VNET_DECLARE(int, tcp_autorcvbuf_max);
83#define V_tcp_autorcvbuf_max VNET(tcp_autorcvbuf_max)
84
85#define	IS_AIOTX_MBUF(m)						\
86	((m)->m_flags & M_EXT && (m)->m_ext.ext_flags & EXT_FLAG_AIOTX)
87
88static void	t4_aiotx_cancel(struct kaiocb *job);
89static void	t4_aiotx_queue_toep(struct toepcb *toep);
90
91static size_t
92aiotx_mbuf_pgoff(struct mbuf *m)
93{
94	struct aiotx_buffer *ab;
95
96	MPASS(IS_AIOTX_MBUF(m));
97	ab = m->m_ext.ext_arg1;
98	return ((ab->ps.offset + (uintptr_t)m->m_ext.ext_arg2) % PAGE_SIZE);
99}
100
101static vm_page_t *
102aiotx_mbuf_pages(struct mbuf *m)
103{
104	struct aiotx_buffer *ab;
105	int npages;
106
107	MPASS(IS_AIOTX_MBUF(m));
108	ab = m->m_ext.ext_arg1;
109	npages = (ab->ps.offset + (uintptr_t)m->m_ext.ext_arg2) / PAGE_SIZE;
110	return (ab->ps.pages + npages);
111}
112
113void
114send_flowc_wr(struct toepcb *toep, struct flowc_tx_params *ftxp)
115{
116	struct wrqe *wr;
117	struct fw_flowc_wr *flowc;
118	unsigned int nparams = ftxp ? 8 : 6, flowclen;
119	struct vi_info *vi = toep->vi;
120	struct port_info *pi = vi->pi;
121	struct adapter *sc = pi->adapter;
122	unsigned int pfvf = G_FW_VIID_PFN(vi->viid) << S_FW_VIID_PFN;
123	struct ofld_tx_sdesc *txsd = &toep->txsd[toep->txsd_pidx];
124
125	KASSERT(!(toep->flags & TPF_FLOWC_WR_SENT),
126	    ("%s: flowc for tid %u sent already", __func__, toep->tid));
127
128	flowclen = sizeof(*flowc) + nparams * sizeof(struct fw_flowc_mnemval);
129
130	wr = alloc_wrqe(roundup2(flowclen, 16), toep->ofld_txq);
131	if (wr == NULL) {
132		/* XXX */
133		panic("%s: allocation failure.", __func__);
134	}
135	flowc = wrtod(wr);
136	memset(flowc, 0, wr->wr_len);
137
138	flowc->op_to_nparams = htobe32(V_FW_WR_OP(FW_FLOWC_WR) |
139	    V_FW_FLOWC_WR_NPARAMS(nparams));
140	flowc->flowid_len16 = htonl(V_FW_WR_LEN16(howmany(flowclen, 16)) |
141	    V_FW_WR_FLOWID(toep->tid));
142
143	flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
144	flowc->mnemval[0].val = htobe32(pfvf);
145	flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
146	flowc->mnemval[1].val = htobe32(pi->tx_chan);
147	flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
148	flowc->mnemval[2].val = htobe32(pi->tx_chan);
149	flowc->mnemval[3].mnemonic = FW_FLOWC_MNEM_IQID;
150	flowc->mnemval[3].val = htobe32(toep->ofld_rxq->iq.abs_id);
151	if (ftxp) {
152		uint32_t sndbuf = min(ftxp->snd_space, sc->tt.sndbuf);
153
154		flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDNXT;
155		flowc->mnemval[4].val = htobe32(ftxp->snd_nxt);
156		flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_RCVNXT;
157		flowc->mnemval[5].val = htobe32(ftxp->rcv_nxt);
158		flowc->mnemval[6].mnemonic = FW_FLOWC_MNEM_SNDBUF;
159		flowc->mnemval[6].val = htobe32(sndbuf);
160		flowc->mnemval[7].mnemonic = FW_FLOWC_MNEM_MSS;
161		flowc->mnemval[7].val = htobe32(ftxp->mss);
162
163		CTR6(KTR_CXGBE,
164		    "%s: tid %u, mss %u, sndbuf %u, snd_nxt 0x%x, rcv_nxt 0x%x",
165		    __func__, toep->tid, ftxp->mss, sndbuf, ftxp->snd_nxt,
166		    ftxp->rcv_nxt);
167	} else {
168		flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDBUF;
169		flowc->mnemval[4].val = htobe32(512);
170		flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_MSS;
171		flowc->mnemval[5].val = htobe32(512);
172
173		CTR2(KTR_CXGBE, "%s: tid %u", __func__, toep->tid);
174	}
175
176	txsd->tx_credits = howmany(flowclen, 16);
177	txsd->plen = 0;
178	KASSERT(toep->tx_credits >= txsd->tx_credits && toep->txsd_avail > 0,
179	    ("%s: not enough credits (%d)", __func__, toep->tx_credits));
180	toep->tx_credits -= txsd->tx_credits;
181	if (__predict_false(++toep->txsd_pidx == toep->txsd_total))
182		toep->txsd_pidx = 0;
183	toep->txsd_avail--;
184
185	toep->flags |= TPF_FLOWC_WR_SENT;
186        t4_wrq_tx(sc, wr);
187}
188
189void
190send_reset(struct adapter *sc, struct toepcb *toep, uint32_t snd_nxt)
191{
192	struct wrqe *wr;
193	struct cpl_abort_req *req;
194	int tid = toep->tid;
195	struct inpcb *inp = toep->inp;
196	struct tcpcb *tp = intotcpcb(inp);	/* don't use if INP_DROPPED */
197
198	INP_WLOCK_ASSERT(inp);
199
200	CTR6(KTR_CXGBE, "%s: tid %d (%s), toep_flags 0x%x, inp_flags 0x%x%s",
201	    __func__, toep->tid,
202	    inp->inp_flags & INP_DROPPED ? "inp dropped" :
203	    tcpstates[tp->t_state],
204	    toep->flags, inp->inp_flags,
205	    toep->flags & TPF_ABORT_SHUTDOWN ?
206	    " (abort already in progress)" : "");
207
208	if (toep->flags & TPF_ABORT_SHUTDOWN)
209		return;	/* abort already in progress */
210
211	toep->flags |= TPF_ABORT_SHUTDOWN;
212
213	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
214	    ("%s: flowc_wr not sent for tid %d.", __func__, tid));
215
216	wr = alloc_wrqe(sizeof(*req), toep->ofld_txq);
217	if (wr == NULL) {
218		/* XXX */
219		panic("%s: allocation failure.", __func__);
220	}
221	req = wrtod(wr);
222
223	INIT_TP_WR_MIT_CPL(req, CPL_ABORT_REQ, tid);
224	if (inp->inp_flags & INP_DROPPED)
225		req->rsvd0 = htobe32(snd_nxt);
226	else
227		req->rsvd0 = htobe32(tp->snd_nxt);
228	req->rsvd1 = !(toep->flags & TPF_TX_DATA_SENT);
229	req->cmd = CPL_ABORT_SEND_RST;
230
231	/*
232	 * XXX: What's the correct way to tell that the inp hasn't been detached
233	 * from its socket?  Should I even be flushing the snd buffer here?
234	 */
235	if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) == 0) {
236		struct socket *so = inp->inp_socket;
237
238		if (so != NULL)	/* because I'm not sure.  See comment above */
239			sbflush(&so->so_snd);
240	}
241
242	t4_l2t_send(sc, wr, toep->l2te);
243}
244
245/*
246 * Called when a connection is established to translate the TCP options
247 * reported by HW to FreeBSD's native format.
248 */
249static void
250assign_rxopt(struct tcpcb *tp, unsigned int opt)
251{
252	struct toepcb *toep = tp->t_toe;
253	struct inpcb *inp = tp->t_inpcb;
254	struct adapter *sc = td_adapter(toep->td);
255	int n;
256
257	INP_LOCK_ASSERT(inp);
258
259	if (inp->inp_inc.inc_flags & INC_ISIPV6)
260		n = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
261	else
262		n = sizeof(struct ip) + sizeof(struct tcphdr);
263	tp->t_maxseg = sc->params.mtus[G_TCPOPT_MSS(opt)] - n;
264
265	CTR4(KTR_CXGBE, "%s: tid %d, mtu_idx %u (%u)", __func__, toep->tid,
266	    G_TCPOPT_MSS(opt), sc->params.mtus[G_TCPOPT_MSS(opt)]);
267
268	if (G_TCPOPT_TSTAMP(opt)) {
269		tp->t_flags |= TF_RCVD_TSTMP;	/* timestamps ok */
270		tp->ts_recent = 0;		/* hmmm */
271		tp->ts_recent_age = tcp_ts_getticks();
272	}
273
274	if (G_TCPOPT_SACK(opt))
275		tp->t_flags |= TF_SACK_PERMIT;	/* should already be set */
276	else
277		tp->t_flags &= ~TF_SACK_PERMIT;	/* sack disallowed by peer */
278
279	if (G_TCPOPT_WSCALE_OK(opt))
280		tp->t_flags |= TF_RCVD_SCALE;
281
282	/* Doing window scaling? */
283	if ((tp->t_flags & (TF_RCVD_SCALE | TF_REQ_SCALE)) ==
284	    (TF_RCVD_SCALE | TF_REQ_SCALE)) {
285		tp->rcv_scale = tp->request_r_scale;
286		tp->snd_scale = G_TCPOPT_SND_WSCALE(opt);
287	}
288}
289
290/*
291 * Completes some final bits of initialization for just established connections
292 * and changes their state to TCPS_ESTABLISHED.
293 *
294 * The ISNs are from after the exchange of SYNs.  i.e., the true ISN + 1.
295 */
296void
297make_established(struct toepcb *toep, uint32_t snd_isn, uint32_t rcv_isn,
298    uint16_t opt)
299{
300	struct inpcb *inp = toep->inp;
301	struct socket *so = inp->inp_socket;
302	struct tcpcb *tp = intotcpcb(inp);
303	long bufsize;
304	uint32_t iss = be32toh(snd_isn) - 1;	/* true ISS */
305	uint32_t irs = be32toh(rcv_isn) - 1;	/* true IRS */
306	uint16_t tcpopt = be16toh(opt);
307	struct flowc_tx_params ftxp;
308
309	INP_WLOCK_ASSERT(inp);
310	KASSERT(tp->t_state == TCPS_SYN_SENT ||
311	    tp->t_state == TCPS_SYN_RECEIVED,
312	    ("%s: TCP state %s", __func__, tcpstates[tp->t_state]));
313
314	CTR6(KTR_CXGBE, "%s: tid %d, so %p, inp %p, tp %p, toep %p",
315	    __func__, toep->tid, so, inp, tp, toep);
316
317	tp->t_state = TCPS_ESTABLISHED;
318	tp->t_starttime = ticks;
319	TCPSTAT_INC(tcps_connects);
320
321	tp->irs = irs;
322	tcp_rcvseqinit(tp);
323	tp->rcv_wnd = toep->rx_credits << 10;
324	tp->rcv_adv += tp->rcv_wnd;
325	tp->last_ack_sent = tp->rcv_nxt;
326
327	/*
328	 * If we were unable to send all rx credits via opt0, save the remainder
329	 * in rx_credits so that they can be handed over with the next credit
330	 * update.
331	 */
332	SOCKBUF_LOCK(&so->so_rcv);
333	bufsize = select_rcv_wnd(so);
334	SOCKBUF_UNLOCK(&so->so_rcv);
335	toep->rx_credits = bufsize - tp->rcv_wnd;
336
337	tp->iss = iss;
338	tcp_sendseqinit(tp);
339	tp->snd_una = iss + 1;
340	tp->snd_nxt = iss + 1;
341	tp->snd_max = iss + 1;
342
343	assign_rxopt(tp, tcpopt);
344
345	SOCKBUF_LOCK(&so->so_snd);
346	if (so->so_snd.sb_flags & SB_AUTOSIZE && V_tcp_do_autosndbuf)
347		bufsize = V_tcp_autosndbuf_max;
348	else
349		bufsize = sbspace(&so->so_snd);
350	SOCKBUF_UNLOCK(&so->so_snd);
351
352	ftxp.snd_nxt = tp->snd_nxt;
353	ftxp.rcv_nxt = tp->rcv_nxt;
354	ftxp.snd_space = bufsize;
355	ftxp.mss = tp->t_maxseg;
356	send_flowc_wr(toep, &ftxp);
357
358	soisconnected(so);
359}
360
361static int
362send_rx_credits(struct adapter *sc, struct toepcb *toep, int credits)
363{
364	struct wrqe *wr;
365	struct cpl_rx_data_ack *req;
366	uint32_t dack = F_RX_DACK_CHANGE | V_RX_DACK_MODE(1);
367
368	KASSERT(credits >= 0, ("%s: %d credits", __func__, credits));
369
370	wr = alloc_wrqe(sizeof(*req), toep->ctrlq);
371	if (wr == NULL)
372		return (0);
373	req = wrtod(wr);
374
375	INIT_TP_WR_MIT_CPL(req, CPL_RX_DATA_ACK, toep->tid);
376	req->credit_dack = htobe32(dack | V_RX_CREDITS(credits));
377
378	t4_wrq_tx(sc, wr);
379	return (credits);
380}
381
382void
383t4_rcvd_locked(struct toedev *tod, struct tcpcb *tp)
384{
385	struct adapter *sc = tod->tod_softc;
386	struct inpcb *inp = tp->t_inpcb;
387	struct socket *so = inp->inp_socket;
388	struct sockbuf *sb = &so->so_rcv;
389	struct toepcb *toep = tp->t_toe;
390	int credits;
391
392	INP_WLOCK_ASSERT(inp);
393
394	SOCKBUF_LOCK_ASSERT(sb);
395	KASSERT(toep->sb_cc >= sbused(sb),
396	    ("%s: sb %p has more data (%d) than last time (%d).",
397	    __func__, sb, sbused(sb), toep->sb_cc));
398
399	toep->rx_credits += toep->sb_cc - sbused(sb);
400	toep->sb_cc = sbused(sb);
401
402	if (toep->rx_credits > 0 &&
403	    (tp->rcv_wnd <= 32 * 1024 || toep->rx_credits >= 64 * 1024 ||
404	    (toep->rx_credits >= 16 * 1024 && tp->rcv_wnd <= 128 * 1024) ||
405	    toep->sb_cc + tp->rcv_wnd < sb->sb_lowat)) {
406
407		credits = send_rx_credits(sc, toep, toep->rx_credits);
408		toep->rx_credits -= credits;
409		tp->rcv_wnd += credits;
410		tp->rcv_adv += credits;
411	}
412}
413
414void
415t4_rcvd(struct toedev *tod, struct tcpcb *tp)
416{
417	struct inpcb *inp = tp->t_inpcb;
418	struct socket *so = inp->inp_socket;
419	struct sockbuf *sb = &so->so_rcv;
420
421	SOCKBUF_LOCK(sb);
422	t4_rcvd_locked(tod, tp);
423	SOCKBUF_UNLOCK(sb);
424}
425
426/*
427 * Close a connection by sending a CPL_CLOSE_CON_REQ message.
428 */
429static int
430close_conn(struct adapter *sc, struct toepcb *toep)
431{
432	struct wrqe *wr;
433	struct cpl_close_con_req *req;
434	unsigned int tid = toep->tid;
435
436	CTR3(KTR_CXGBE, "%s: tid %u%s", __func__, toep->tid,
437	    toep->flags & TPF_FIN_SENT ? ", IGNORED" : "");
438
439	if (toep->flags & TPF_FIN_SENT)
440		return (0);
441
442	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
443	    ("%s: flowc_wr not sent for tid %u.", __func__, tid));
444
445	wr = alloc_wrqe(sizeof(*req), toep->ofld_txq);
446	if (wr == NULL) {
447		/* XXX */
448		panic("%s: allocation failure.", __func__);
449	}
450	req = wrtod(wr);
451
452        req->wr.wr_hi = htonl(V_FW_WR_OP(FW_TP_WR) |
453	    V_FW_WR_IMMDLEN(sizeof(*req) - sizeof(req->wr)));
454	req->wr.wr_mid = htonl(V_FW_WR_LEN16(howmany(sizeof(*req), 16)) |
455	    V_FW_WR_FLOWID(tid));
456        req->wr.wr_lo = cpu_to_be64(0);
457        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_CLOSE_CON_REQ, tid));
458	req->rsvd = 0;
459
460	toep->flags |= TPF_FIN_SENT;
461	toep->flags &= ~TPF_SEND_FIN;
462	t4_l2t_send(sc, wr, toep->l2te);
463
464	return (0);
465}
466
467#define MAX_OFLD_TX_CREDITS (SGE_MAX_WR_LEN / 16)
468#define MIN_OFLD_TX_CREDITS (howmany(sizeof(struct fw_ofld_tx_data_wr) + 1, 16))
469
470/* Maximum amount of immediate data we could stuff in a WR */
471static inline int
472max_imm_payload(int tx_credits)
473{
474	const int n = 2;	/* Use only up to 2 desc for imm. data WR */
475
476	KASSERT(tx_credits >= 0 &&
477		tx_credits <= MAX_OFLD_TX_CREDITS,
478		("%s: %d credits", __func__, tx_credits));
479
480	if (tx_credits < MIN_OFLD_TX_CREDITS)
481		return (0);
482
483	if (tx_credits >= (n * EQ_ESIZE) / 16)
484		return ((n * EQ_ESIZE) - sizeof(struct fw_ofld_tx_data_wr));
485	else
486		return (tx_credits * 16 - sizeof(struct fw_ofld_tx_data_wr));
487}
488
489/* Maximum number of SGL entries we could stuff in a WR */
490static inline int
491max_dsgl_nsegs(int tx_credits)
492{
493	int nseg = 1;	/* ulptx_sgl has room for 1, rest ulp_tx_sge_pair */
494	int sge_pair_credits = tx_credits - MIN_OFLD_TX_CREDITS;
495
496	KASSERT(tx_credits >= 0 &&
497		tx_credits <= MAX_OFLD_TX_CREDITS,
498		("%s: %d credits", __func__, tx_credits));
499
500	if (tx_credits < MIN_OFLD_TX_CREDITS)
501		return (0);
502
503	nseg += 2 * (sge_pair_credits * 16 / 24);
504	if ((sge_pair_credits * 16) % 24 == 16)
505		nseg++;
506
507	return (nseg);
508}
509
510static inline void
511write_tx_wr(void *dst, struct toepcb *toep, unsigned int immdlen,
512    unsigned int plen, uint8_t credits, int shove, int ulp_submode, int txalign)
513{
514	struct fw_ofld_tx_data_wr *txwr = dst;
515
516	txwr->op_to_immdlen = htobe32(V_WR_OP(FW_OFLD_TX_DATA_WR) |
517	    V_FW_WR_IMMDLEN(immdlen));
518	txwr->flowid_len16 = htobe32(V_FW_WR_FLOWID(toep->tid) |
519	    V_FW_WR_LEN16(credits));
520	txwr->lsodisable_to_flags = htobe32(V_TX_ULP_MODE(toep->ulp_mode) |
521	    V_TX_ULP_SUBMODE(ulp_submode) | V_TX_URG(0) | V_TX_SHOVE(shove));
522	txwr->plen = htobe32(plen);
523
524	if (txalign > 0) {
525		struct tcpcb *tp = intotcpcb(toep->inp);
526
527		if (plen < 2 * tp->t_maxseg || is_10G_port(toep->vi->pi))
528			txwr->lsodisable_to_flags |=
529			    htobe32(F_FW_OFLD_TX_DATA_WR_LSODISABLE);
530		else
531			txwr->lsodisable_to_flags |=
532			    htobe32(F_FW_OFLD_TX_DATA_WR_ALIGNPLD |
533				(tp->t_flags & TF_NODELAY ? 0 :
534				F_FW_OFLD_TX_DATA_WR_ALIGNPLDSHOVE));
535	}
536}
537
538/*
539 * Generate a DSGL from a starting mbuf.  The total number of segments and the
540 * maximum segments in any one mbuf are provided.
541 */
542static void
543write_tx_sgl(void *dst, struct mbuf *start, struct mbuf *stop, int nsegs, int n)
544{
545	struct mbuf *m;
546	struct ulptx_sgl *usgl = dst;
547	int i, j, rc;
548	struct sglist sg;
549	struct sglist_seg segs[n];
550
551	KASSERT(nsegs > 0, ("%s: nsegs 0", __func__));
552
553	sglist_init(&sg, n, segs);
554	usgl->cmd_nsge = htobe32(V_ULPTX_CMD(ULP_TX_SC_DSGL) |
555	    V_ULPTX_NSGE(nsegs));
556
557	i = -1;
558	for (m = start; m != stop; m = m->m_next) {
559		if (IS_AIOTX_MBUF(m))
560			rc = sglist_append_vmpages(&sg, aiotx_mbuf_pages(m),
561			    aiotx_mbuf_pgoff(m), m->m_len);
562		else
563			rc = sglist_append(&sg, mtod(m, void *), m->m_len);
564		if (__predict_false(rc != 0))
565			panic("%s: sglist_append %d", __func__, rc);
566
567		for (j = 0; j < sg.sg_nseg; i++, j++) {
568			if (i < 0) {
569				usgl->len0 = htobe32(segs[j].ss_len);
570				usgl->addr0 = htobe64(segs[j].ss_paddr);
571			} else {
572				usgl->sge[i / 2].len[i & 1] =
573				    htobe32(segs[j].ss_len);
574				usgl->sge[i / 2].addr[i & 1] =
575				    htobe64(segs[j].ss_paddr);
576			}
577#ifdef INVARIANTS
578			nsegs--;
579#endif
580		}
581		sglist_reset(&sg);
582	}
583	if (i & 1)
584		usgl->sge[i / 2].len[1] = htobe32(0);
585	KASSERT(nsegs == 0, ("%s: nsegs %d, start %p, stop %p",
586	    __func__, nsegs, start, stop));
587}
588
589/*
590 * Max number of SGL entries an offload tx work request can have.  This is 41
591 * (1 + 40) for a full 512B work request.
592 * fw_ofld_tx_data_wr(16B) + ulptx_sgl(16B, 1) + ulptx_sge_pair(480B, 40)
593 */
594#define OFLD_SGL_LEN (41)
595
596/*
597 * Send data and/or a FIN to the peer.
598 *
599 * The socket's so_snd buffer consists of a stream of data starting with sb_mb
600 * and linked together with m_next.  sb_sndptr, if set, is the last mbuf that
601 * was transmitted.
602 *
603 * drop indicates the number of bytes that should be dropped from the head of
604 * the send buffer.  It is an optimization that lets do_fw4_ack avoid creating
605 * contention on the send buffer lock (before this change it used to do
606 * sowwakeup and then t4_push_frames right after that when recovering from tx
607 * stalls).  When drop is set this function MUST drop the bytes and wake up any
608 * writers.
609 */
610void
611t4_push_frames(struct adapter *sc, struct toepcb *toep, int drop)
612{
613	struct mbuf *sndptr, *m, *sb_sndptr;
614	struct fw_ofld_tx_data_wr *txwr;
615	struct wrqe *wr;
616	u_int plen, nsegs, credits, max_imm, max_nsegs, max_nsegs_1mbuf;
617	struct inpcb *inp = toep->inp;
618	struct tcpcb *tp = intotcpcb(inp);
619	struct socket *so = inp->inp_socket;
620	struct sockbuf *sb = &so->so_snd;
621	int tx_credits, shove, compl, sowwakeup;
622	struct ofld_tx_sdesc *txsd = &toep->txsd[toep->txsd_pidx];
623	bool aiotx_mbuf_seen;
624
625	INP_WLOCK_ASSERT(inp);
626	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
627	    ("%s: flowc_wr not sent for tid %u.", __func__, toep->tid));
628
629	KASSERT(toep->ulp_mode == ULP_MODE_NONE ||
630	    toep->ulp_mode == ULP_MODE_TCPDDP ||
631	    toep->ulp_mode == ULP_MODE_RDMA,
632	    ("%s: ulp_mode %u for toep %p", __func__, toep->ulp_mode, toep));
633
634#ifdef VERBOSE_TRACES
635	CTR4(KTR_CXGBE, "%s: tid %d toep flags %#x tp flags %#x drop %d",
636	    __func__, toep->tid, toep->flags, tp->t_flags);
637#endif
638	if (__predict_false(toep->flags & TPF_ABORT_SHUTDOWN))
639		return;
640
641	/*
642	 * This function doesn't resume by itself.  Someone else must clear the
643	 * flag and call this function.
644	 */
645	if (__predict_false(toep->flags & TPF_TX_SUSPENDED)) {
646		KASSERT(drop == 0,
647		    ("%s: drop (%d) != 0 but tx is suspended", __func__, drop));
648		return;
649	}
650
651	do {
652		tx_credits = min(toep->tx_credits, MAX_OFLD_TX_CREDITS);
653		max_imm = max_imm_payload(tx_credits);
654		max_nsegs = max_dsgl_nsegs(tx_credits);
655
656		SOCKBUF_LOCK(sb);
657		sowwakeup = drop;
658		if (drop) {
659			sbdrop_locked(sb, drop);
660			drop = 0;
661		}
662		sb_sndptr = sb->sb_sndptr;
663		sndptr = sb_sndptr ? sb_sndptr->m_next : sb->sb_mb;
664		plen = 0;
665		nsegs = 0;
666		max_nsegs_1mbuf = 0; /* max # of SGL segments in any one mbuf */
667		aiotx_mbuf_seen = false;
668		for (m = sndptr; m != NULL; m = m->m_next) {
669			int n;
670
671			if (IS_AIOTX_MBUF(m))
672				n = sglist_count_vmpages(aiotx_mbuf_pages(m),
673				    aiotx_mbuf_pgoff(m), m->m_len);
674			else
675				n = sglist_count(mtod(m, void *), m->m_len);
676
677			nsegs += n;
678			plen += m->m_len;
679
680			/* This mbuf sent us _over_ the nsegs limit, back out */
681			if (plen > max_imm && nsegs > max_nsegs) {
682				nsegs -= n;
683				plen -= m->m_len;
684				if (plen == 0) {
685					/* Too few credits */
686					toep->flags |= TPF_TX_SUSPENDED;
687					if (sowwakeup) {
688						if (!TAILQ_EMPTY(
689						    &toep->aiotx_jobq))
690							t4_aiotx_queue_toep(
691							    toep);
692						sowwakeup_locked(so);
693					} else
694						SOCKBUF_UNLOCK(sb);
695					SOCKBUF_UNLOCK_ASSERT(sb);
696					return;
697				}
698				break;
699			}
700
701			if (IS_AIOTX_MBUF(m))
702				aiotx_mbuf_seen = true;
703			if (max_nsegs_1mbuf < n)
704				max_nsegs_1mbuf = n;
705			sb_sndptr = m;	/* new sb->sb_sndptr if all goes well */
706
707			/* This mbuf put us right at the max_nsegs limit */
708			if (plen > max_imm && nsegs == max_nsegs) {
709				m = m->m_next;
710				break;
711			}
712		}
713
714		if (sbused(sb) > sb->sb_hiwat * 5 / 8 &&
715		    toep->plen_nocompl + plen >= sb->sb_hiwat / 4)
716			compl = 1;
717		else
718			compl = 0;
719
720		if (sb->sb_flags & SB_AUTOSIZE &&
721		    V_tcp_do_autosndbuf &&
722		    sb->sb_hiwat < V_tcp_autosndbuf_max &&
723		    sbused(sb) >= sb->sb_hiwat * 7 / 8) {
724			int newsize = min(sb->sb_hiwat + V_tcp_autosndbuf_inc,
725			    V_tcp_autosndbuf_max);
726
727			if (!sbreserve_locked(sb, newsize, so, NULL))
728				sb->sb_flags &= ~SB_AUTOSIZE;
729			else
730				sowwakeup = 1;	/* room available */
731		}
732		if (sowwakeup) {
733			if (!TAILQ_EMPTY(&toep->aiotx_jobq))
734				t4_aiotx_queue_toep(toep);
735			sowwakeup_locked(so);
736		} else
737			SOCKBUF_UNLOCK(sb);
738		SOCKBUF_UNLOCK_ASSERT(sb);
739
740		/* nothing to send */
741		if (plen == 0) {
742			KASSERT(m == NULL,
743			    ("%s: nothing to send, but m != NULL", __func__));
744			break;
745		}
746
747		if (__predict_false(toep->flags & TPF_FIN_SENT))
748			panic("%s: excess tx.", __func__);
749
750		shove = m == NULL && !(tp->t_flags & TF_MORETOCOME);
751		if (plen <= max_imm && !aiotx_mbuf_seen) {
752
753			/* Immediate data tx */
754
755			wr = alloc_wrqe(roundup2(sizeof(*txwr) + plen, 16),
756					toep->ofld_txq);
757			if (wr == NULL) {
758				/* XXX: how will we recover from this? */
759				toep->flags |= TPF_TX_SUSPENDED;
760				return;
761			}
762			txwr = wrtod(wr);
763			credits = howmany(wr->wr_len, 16);
764			write_tx_wr(txwr, toep, plen, plen, credits, shove, 0,
765			    sc->tt.tx_align);
766			m_copydata(sndptr, 0, plen, (void *)(txwr + 1));
767			nsegs = 0;
768		} else {
769			int wr_len;
770
771			/* DSGL tx */
772
773			wr_len = sizeof(*txwr) + sizeof(struct ulptx_sgl) +
774			    ((3 * (nsegs - 1)) / 2 + ((nsegs - 1) & 1)) * 8;
775			wr = alloc_wrqe(roundup2(wr_len, 16), toep->ofld_txq);
776			if (wr == NULL) {
777				/* XXX: how will we recover from this? */
778				toep->flags |= TPF_TX_SUSPENDED;
779				return;
780			}
781			txwr = wrtod(wr);
782			credits = howmany(wr_len, 16);
783			write_tx_wr(txwr, toep, 0, plen, credits, shove, 0,
784			    sc->tt.tx_align);
785			write_tx_sgl(txwr + 1, sndptr, m, nsegs,
786			    max_nsegs_1mbuf);
787			if (wr_len & 0xf) {
788				uint64_t *pad = (uint64_t *)
789				    ((uintptr_t)txwr + wr_len);
790				*pad = 0;
791			}
792		}
793
794		KASSERT(toep->tx_credits >= credits,
795			("%s: not enough credits", __func__));
796
797		toep->tx_credits -= credits;
798		toep->tx_nocompl += credits;
799		toep->plen_nocompl += plen;
800		if (toep->tx_credits <= toep->tx_total * 3 / 8 &&
801		    toep->tx_nocompl >= toep->tx_total / 4)
802			compl = 1;
803
804		if (compl || toep->ulp_mode == ULP_MODE_RDMA) {
805			txwr->op_to_immdlen |= htobe32(F_FW_WR_COMPL);
806			toep->tx_nocompl = 0;
807			toep->plen_nocompl = 0;
808		}
809
810		tp->snd_nxt += plen;
811		tp->snd_max += plen;
812
813		SOCKBUF_LOCK(sb);
814		KASSERT(sb_sndptr, ("%s: sb_sndptr is NULL", __func__));
815		sb->sb_sndptr = sb_sndptr;
816		SOCKBUF_UNLOCK(sb);
817
818		toep->flags |= TPF_TX_DATA_SENT;
819		if (toep->tx_credits < MIN_OFLD_TX_CREDITS)
820			toep->flags |= TPF_TX_SUSPENDED;
821
822		KASSERT(toep->txsd_avail > 0, ("%s: no txsd", __func__));
823		txsd->plen = plen;
824		txsd->tx_credits = credits;
825		txsd++;
826		if (__predict_false(++toep->txsd_pidx == toep->txsd_total)) {
827			toep->txsd_pidx = 0;
828			txsd = &toep->txsd[0];
829		}
830		toep->txsd_avail--;
831
832		t4_l2t_send(sc, wr, toep->l2te);
833	} while (m != NULL);
834
835	/* Send a FIN if requested, but only if there's no more data to send */
836	if (m == NULL && toep->flags & TPF_SEND_FIN)
837		close_conn(sc, toep);
838}
839
840static inline void
841rqdrop_locked(struct mbufq *q, int plen)
842{
843	struct mbuf *m;
844
845	while (plen > 0) {
846		m = mbufq_dequeue(q);
847
848		/* Too many credits. */
849		MPASS(m != NULL);
850		M_ASSERTPKTHDR(m);
851
852		/* Partial credits. */
853		MPASS(plen >= m->m_pkthdr.len);
854
855		plen -= m->m_pkthdr.len;
856		m_freem(m);
857	}
858}
859
860void
861t4_push_pdus(struct adapter *sc, struct toepcb *toep, int drop)
862{
863	struct mbuf *sndptr, *m;
864	struct fw_ofld_tx_data_wr *txwr;
865	struct wrqe *wr;
866	u_int plen, nsegs, credits, max_imm, max_nsegs, max_nsegs_1mbuf;
867	u_int adjusted_plen, ulp_submode;
868	struct inpcb *inp = toep->inp;
869	struct tcpcb *tp = intotcpcb(inp);
870	int tx_credits, shove;
871	struct ofld_tx_sdesc *txsd = &toep->txsd[toep->txsd_pidx];
872	struct mbufq *pduq = &toep->ulp_pduq;
873	static const u_int ulp_extra_len[] = {0, 4, 4, 8};
874
875	INP_WLOCK_ASSERT(inp);
876	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
877	    ("%s: flowc_wr not sent for tid %u.", __func__, toep->tid));
878	KASSERT(toep->ulp_mode == ULP_MODE_ISCSI,
879	    ("%s: ulp_mode %u for toep %p", __func__, toep->ulp_mode, toep));
880
881	if (__predict_false(toep->flags & TPF_ABORT_SHUTDOWN))
882		return;
883
884	/*
885	 * This function doesn't resume by itself.  Someone else must clear the
886	 * flag and call this function.
887	 */
888	if (__predict_false(toep->flags & TPF_TX_SUSPENDED)) {
889		KASSERT(drop == 0,
890		    ("%s: drop (%d) != 0 but tx is suspended", __func__, drop));
891		return;
892	}
893
894	if (drop)
895		rqdrop_locked(&toep->ulp_pdu_reclaimq, drop);
896
897	while ((sndptr = mbufq_first(pduq)) != NULL) {
898		M_ASSERTPKTHDR(sndptr);
899
900		tx_credits = min(toep->tx_credits, MAX_OFLD_TX_CREDITS);
901		max_imm = max_imm_payload(tx_credits);
902		max_nsegs = max_dsgl_nsegs(tx_credits);
903
904		plen = 0;
905		nsegs = 0;
906		max_nsegs_1mbuf = 0; /* max # of SGL segments in any one mbuf */
907		for (m = sndptr; m != NULL; m = m->m_next) {
908			int n = sglist_count(mtod(m, void *), m->m_len);
909
910			nsegs += n;
911			plen += m->m_len;
912
913			/*
914			 * This mbuf would send us _over_ the nsegs limit.
915			 * Suspend tx because the PDU can't be sent out.
916			 */
917			if (plen > max_imm && nsegs > max_nsegs) {
918				toep->flags |= TPF_TX_SUSPENDED;
919				return;
920			}
921
922			if (max_nsegs_1mbuf < n)
923				max_nsegs_1mbuf = n;
924		}
925
926		if (__predict_false(toep->flags & TPF_FIN_SENT))
927			panic("%s: excess tx.", __func__);
928
929		/*
930		 * We have a PDU to send.  All of it goes out in one WR so 'm'
931		 * is NULL.  A PDU's length is always a multiple of 4.
932		 */
933		MPASS(m == NULL);
934		MPASS((plen & 3) == 0);
935		MPASS(sndptr->m_pkthdr.len == plen);
936
937		shove = !(tp->t_flags & TF_MORETOCOME);
938		ulp_submode = mbuf_ulp_submode(sndptr);
939		MPASS(ulp_submode < nitems(ulp_extra_len));
940
941		/*
942		 * plen doesn't include header and data digests, which are
943		 * generated and inserted in the right places by the TOE, but
944		 * they do occupy TCP sequence space and need to be accounted
945		 * for.
946		 */
947		adjusted_plen = plen + ulp_extra_len[ulp_submode];
948		if (plen <= max_imm) {
949
950			/* Immediate data tx */
951
952			wr = alloc_wrqe(roundup2(sizeof(*txwr) + plen, 16),
953					toep->ofld_txq);
954			if (wr == NULL) {
955				/* XXX: how will we recover from this? */
956				toep->flags |= TPF_TX_SUSPENDED;
957				return;
958			}
959			txwr = wrtod(wr);
960			credits = howmany(wr->wr_len, 16);
961			write_tx_wr(txwr, toep, plen, adjusted_plen, credits,
962			    shove, ulp_submode, sc->tt.tx_align);
963			m_copydata(sndptr, 0, plen, (void *)(txwr + 1));
964			nsegs = 0;
965		} else {
966			int wr_len;
967
968			/* DSGL tx */
969			wr_len = sizeof(*txwr) + sizeof(struct ulptx_sgl) +
970			    ((3 * (nsegs - 1)) / 2 + ((nsegs - 1) & 1)) * 8;
971			wr = alloc_wrqe(roundup2(wr_len, 16), toep->ofld_txq);
972			if (wr == NULL) {
973				/* XXX: how will we recover from this? */
974				toep->flags |= TPF_TX_SUSPENDED;
975				return;
976			}
977			txwr = wrtod(wr);
978			credits = howmany(wr_len, 16);
979			write_tx_wr(txwr, toep, 0, adjusted_plen, credits,
980			    shove, ulp_submode, sc->tt.tx_align);
981			write_tx_sgl(txwr + 1, sndptr, m, nsegs,
982			    max_nsegs_1mbuf);
983			if (wr_len & 0xf) {
984				uint64_t *pad = (uint64_t *)
985				    ((uintptr_t)txwr + wr_len);
986				*pad = 0;
987			}
988		}
989
990		KASSERT(toep->tx_credits >= credits,
991			("%s: not enough credits", __func__));
992
993		m = mbufq_dequeue(pduq);
994		MPASS(m == sndptr);
995		mbufq_enqueue(&toep->ulp_pdu_reclaimq, m);
996
997		toep->tx_credits -= credits;
998		toep->tx_nocompl += credits;
999		toep->plen_nocompl += plen;
1000		if (toep->tx_credits <= toep->tx_total * 3 / 8 &&
1001		    toep->tx_nocompl >= toep->tx_total / 4) {
1002			txwr->op_to_immdlen |= htobe32(F_FW_WR_COMPL);
1003			toep->tx_nocompl = 0;
1004			toep->plen_nocompl = 0;
1005		}
1006
1007		tp->snd_nxt += adjusted_plen;
1008		tp->snd_max += adjusted_plen;
1009
1010		toep->flags |= TPF_TX_DATA_SENT;
1011		if (toep->tx_credits < MIN_OFLD_TX_CREDITS)
1012			toep->flags |= TPF_TX_SUSPENDED;
1013
1014		KASSERT(toep->txsd_avail > 0, ("%s: no txsd", __func__));
1015		txsd->plen = plen;
1016		txsd->tx_credits = credits;
1017		txsd++;
1018		if (__predict_false(++toep->txsd_pidx == toep->txsd_total)) {
1019			toep->txsd_pidx = 0;
1020			txsd = &toep->txsd[0];
1021		}
1022		toep->txsd_avail--;
1023
1024		t4_l2t_send(sc, wr, toep->l2te);
1025	}
1026
1027	/* Send a FIN if requested, but only if there are no more PDUs to send */
1028	if (mbufq_first(pduq) == NULL && toep->flags & TPF_SEND_FIN)
1029		close_conn(sc, toep);
1030}
1031
1032int
1033t4_tod_output(struct toedev *tod, struct tcpcb *tp)
1034{
1035	struct adapter *sc = tod->tod_softc;
1036#ifdef INVARIANTS
1037	struct inpcb *inp = tp->t_inpcb;
1038#endif
1039	struct toepcb *toep = tp->t_toe;
1040
1041	INP_WLOCK_ASSERT(inp);
1042	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1043	    ("%s: inp %p dropped.", __func__, inp));
1044	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
1045
1046	if (toep->ulp_mode == ULP_MODE_ISCSI)
1047		t4_push_pdus(sc, toep, 0);
1048	else
1049		t4_push_frames(sc, toep, 0);
1050
1051	return (0);
1052}
1053
1054int
1055t4_send_fin(struct toedev *tod, struct tcpcb *tp)
1056{
1057	struct adapter *sc = tod->tod_softc;
1058#ifdef INVARIANTS
1059	struct inpcb *inp = tp->t_inpcb;
1060#endif
1061	struct toepcb *toep = tp->t_toe;
1062
1063	INP_WLOCK_ASSERT(inp);
1064	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1065	    ("%s: inp %p dropped.", __func__, inp));
1066	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
1067
1068	toep->flags |= TPF_SEND_FIN;
1069	if (tp->t_state >= TCPS_ESTABLISHED) {
1070		if (toep->ulp_mode == ULP_MODE_ISCSI)
1071			t4_push_pdus(sc, toep, 0);
1072		else
1073			t4_push_frames(sc, toep, 0);
1074	}
1075
1076	return (0);
1077}
1078
1079int
1080t4_send_rst(struct toedev *tod, struct tcpcb *tp)
1081{
1082	struct adapter *sc = tod->tod_softc;
1083#if defined(INVARIANTS)
1084	struct inpcb *inp = tp->t_inpcb;
1085#endif
1086	struct toepcb *toep = tp->t_toe;
1087
1088	INP_WLOCK_ASSERT(inp);
1089	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1090	    ("%s: inp %p dropped.", __func__, inp));
1091	KASSERT(toep != NULL, ("%s: toep is NULL", __func__));
1092
1093	/* hmmmm */
1094	KASSERT(toep->flags & TPF_FLOWC_WR_SENT,
1095	    ("%s: flowc for tid %u [%s] not sent already",
1096	    __func__, toep->tid, tcpstates[tp->t_state]));
1097
1098	send_reset(sc, toep, 0);
1099	return (0);
1100}
1101
1102/*
1103 * Peer has sent us a FIN.
1104 */
1105static int
1106do_peer_close(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1107{
1108	struct adapter *sc = iq->adapter;
1109	const struct cpl_peer_close *cpl = (const void *)(rss + 1);
1110	unsigned int tid = GET_TID(cpl);
1111	struct toepcb *toep = lookup_tid(sc, tid);
1112	struct inpcb *inp = toep->inp;
1113	struct tcpcb *tp = NULL;
1114	struct socket *so;
1115#ifdef INVARIANTS
1116	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1117#endif
1118
1119	KASSERT(opcode == CPL_PEER_CLOSE,
1120	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1121	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1122
1123	if (__predict_false(toep->flags & TPF_SYNQE)) {
1124#ifdef INVARIANTS
1125		struct synq_entry *synqe = (void *)toep;
1126
1127		INP_WLOCK(synqe->lctx->inp);
1128		if (synqe->flags & TPF_SYNQE_HAS_L2TE) {
1129			KASSERT(synqe->flags & TPF_ABORT_SHUTDOWN,
1130			    ("%s: listen socket closed but tid %u not aborted.",
1131			    __func__, tid));
1132		} else {
1133			/*
1134			 * do_pass_accept_req is still running and will
1135			 * eventually take care of this tid.
1136			 */
1137		}
1138		INP_WUNLOCK(synqe->lctx->inp);
1139#endif
1140		CTR4(KTR_CXGBE, "%s: tid %u, synqe %p (0x%x)", __func__, tid,
1141		    toep, toep->flags);
1142		return (0);
1143	}
1144
1145	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1146
1147	CURVNET_SET(toep->vnet);
1148	INP_INFO_RLOCK(&V_tcbinfo);
1149	INP_WLOCK(inp);
1150	tp = intotcpcb(inp);
1151
1152	CTR5(KTR_CXGBE, "%s: tid %u (%s), toep_flags 0x%x, inp %p", __func__,
1153	    tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags, inp);
1154
1155	if (toep->flags & TPF_ABORT_SHUTDOWN)
1156		goto done;
1157
1158	tp->rcv_nxt++;	/* FIN */
1159
1160	so = inp->inp_socket;
1161	if (toep->ulp_mode == ULP_MODE_TCPDDP) {
1162		DDP_LOCK(toep);
1163		if (__predict_false(toep->ddp.flags &
1164		    (DDP_BUF0_ACTIVE | DDP_BUF1_ACTIVE)))
1165			handle_ddp_close(toep, tp, cpl->rcv_nxt);
1166		DDP_UNLOCK(toep);
1167	}
1168	socantrcvmore(so);
1169
1170	if (toep->ulp_mode != ULP_MODE_RDMA) {
1171		KASSERT(tp->rcv_nxt == be32toh(cpl->rcv_nxt),
1172	    		("%s: rcv_nxt mismatch: %u %u", __func__, tp->rcv_nxt,
1173	    		be32toh(cpl->rcv_nxt)));
1174	}
1175
1176	switch (tp->t_state) {
1177	case TCPS_SYN_RECEIVED:
1178		tp->t_starttime = ticks;
1179		/* FALLTHROUGH */
1180
1181	case TCPS_ESTABLISHED:
1182		tp->t_state = TCPS_CLOSE_WAIT;
1183		break;
1184
1185	case TCPS_FIN_WAIT_1:
1186		tp->t_state = TCPS_CLOSING;
1187		break;
1188
1189	case TCPS_FIN_WAIT_2:
1190		tcp_twstart(tp);
1191		INP_UNLOCK_ASSERT(inp);	 /* safe, we have a ref on the inp */
1192		INP_INFO_RUNLOCK(&V_tcbinfo);
1193		CURVNET_RESTORE();
1194
1195		INP_WLOCK(inp);
1196		final_cpl_received(toep);
1197		return (0);
1198
1199	default:
1200		log(LOG_ERR, "%s: TID %u received CPL_PEER_CLOSE in state %d\n",
1201		    __func__, tid, tp->t_state);
1202	}
1203done:
1204	INP_WUNLOCK(inp);
1205	INP_INFO_RUNLOCK(&V_tcbinfo);
1206	CURVNET_RESTORE();
1207	return (0);
1208}
1209
1210/*
1211 * Peer has ACK'd our FIN.
1212 */
1213static int
1214do_close_con_rpl(struct sge_iq *iq, const struct rss_header *rss,
1215    struct mbuf *m)
1216{
1217	struct adapter *sc = iq->adapter;
1218	const struct cpl_close_con_rpl *cpl = (const void *)(rss + 1);
1219	unsigned int tid = GET_TID(cpl);
1220	struct toepcb *toep = lookup_tid(sc, tid);
1221	struct inpcb *inp = toep->inp;
1222	struct tcpcb *tp = NULL;
1223	struct socket *so = NULL;
1224#ifdef INVARIANTS
1225	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1226#endif
1227
1228	KASSERT(opcode == CPL_CLOSE_CON_RPL,
1229	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1230	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1231	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1232
1233	CURVNET_SET(toep->vnet);
1234	INP_INFO_RLOCK(&V_tcbinfo);
1235	INP_WLOCK(inp);
1236	tp = intotcpcb(inp);
1237
1238	CTR4(KTR_CXGBE, "%s: tid %u (%s), toep_flags 0x%x",
1239	    __func__, tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags);
1240
1241	if (toep->flags & TPF_ABORT_SHUTDOWN)
1242		goto done;
1243
1244	so = inp->inp_socket;
1245	tp->snd_una = be32toh(cpl->snd_nxt) - 1;	/* exclude FIN */
1246
1247	switch (tp->t_state) {
1248	case TCPS_CLOSING:	/* see TCPS_FIN_WAIT_2 in do_peer_close too */
1249		tcp_twstart(tp);
1250release:
1251		INP_UNLOCK_ASSERT(inp);	/* safe, we have a ref on the  inp */
1252		INP_INFO_RUNLOCK(&V_tcbinfo);
1253		CURVNET_RESTORE();
1254
1255		INP_WLOCK(inp);
1256		final_cpl_received(toep);	/* no more CPLs expected */
1257
1258		return (0);
1259	case TCPS_LAST_ACK:
1260		if (tcp_close(tp))
1261			INP_WUNLOCK(inp);
1262		goto release;
1263
1264	case TCPS_FIN_WAIT_1:
1265		if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
1266			soisdisconnected(so);
1267		tp->t_state = TCPS_FIN_WAIT_2;
1268		break;
1269
1270	default:
1271		log(LOG_ERR,
1272		    "%s: TID %u received CPL_CLOSE_CON_RPL in state %s\n",
1273		    __func__, tid, tcpstates[tp->t_state]);
1274	}
1275done:
1276	INP_WUNLOCK(inp);
1277	INP_INFO_RUNLOCK(&V_tcbinfo);
1278	CURVNET_RESTORE();
1279	return (0);
1280}
1281
1282void
1283send_abort_rpl(struct adapter *sc, struct sge_wrq *ofld_txq, int tid,
1284    int rst_status)
1285{
1286	struct wrqe *wr;
1287	struct cpl_abort_rpl *cpl;
1288
1289	wr = alloc_wrqe(sizeof(*cpl), ofld_txq);
1290	if (wr == NULL) {
1291		/* XXX */
1292		panic("%s: allocation failure.", __func__);
1293	}
1294	cpl = wrtod(wr);
1295
1296	INIT_TP_WR_MIT_CPL(cpl, CPL_ABORT_RPL, tid);
1297	cpl->cmd = rst_status;
1298
1299	t4_wrq_tx(sc, wr);
1300}
1301
1302static int
1303abort_status_to_errno(struct tcpcb *tp, unsigned int abort_reason)
1304{
1305	switch (abort_reason) {
1306	case CPL_ERR_BAD_SYN:
1307	case CPL_ERR_CONN_RESET:
1308		return (tp->t_state == TCPS_CLOSE_WAIT ? EPIPE : ECONNRESET);
1309	case CPL_ERR_XMIT_TIMEDOUT:
1310	case CPL_ERR_PERSIST_TIMEDOUT:
1311	case CPL_ERR_FINWAIT2_TIMEDOUT:
1312	case CPL_ERR_KEEPALIVE_TIMEDOUT:
1313		return (ETIMEDOUT);
1314	default:
1315		return (EIO);
1316	}
1317}
1318
1319/*
1320 * TCP RST from the peer, timeout, or some other such critical error.
1321 */
1322static int
1323do_abort_req(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1324{
1325	struct adapter *sc = iq->adapter;
1326	const struct cpl_abort_req_rss *cpl = (const void *)(rss + 1);
1327	unsigned int tid = GET_TID(cpl);
1328	struct toepcb *toep = lookup_tid(sc, tid);
1329	struct sge_wrq *ofld_txq = toep->ofld_txq;
1330	struct inpcb *inp;
1331	struct tcpcb *tp;
1332#ifdef INVARIANTS
1333	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1334#endif
1335
1336	KASSERT(opcode == CPL_ABORT_REQ_RSS,
1337	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1338	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1339
1340	if (toep->flags & TPF_SYNQE)
1341		return (do_abort_req_synqe(iq, rss, m));
1342
1343	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1344
1345	if (negative_advice(cpl->status)) {
1346		CTR4(KTR_CXGBE, "%s: negative advice %d for tid %d (0x%x)",
1347		    __func__, cpl->status, tid, toep->flags);
1348		return (0);	/* Ignore negative advice */
1349	}
1350
1351	inp = toep->inp;
1352	CURVNET_SET(toep->vnet);
1353	INP_INFO_RLOCK(&V_tcbinfo);	/* for tcp_close */
1354	INP_WLOCK(inp);
1355
1356	tp = intotcpcb(inp);
1357
1358	CTR6(KTR_CXGBE,
1359	    "%s: tid %d (%s), toep_flags 0x%x, inp_flags 0x%x, status %d",
1360	    __func__, tid, tp ? tcpstates[tp->t_state] : "no tp", toep->flags,
1361	    inp->inp_flags, cpl->status);
1362
1363	/*
1364	 * If we'd initiated an abort earlier the reply to it is responsible for
1365	 * cleaning up resources.  Otherwise we tear everything down right here
1366	 * right now.  We owe the T4 a CPL_ABORT_RPL no matter what.
1367	 */
1368	if (toep->flags & TPF_ABORT_SHUTDOWN) {
1369		INP_WUNLOCK(inp);
1370		goto done;
1371	}
1372	toep->flags |= TPF_ABORT_SHUTDOWN;
1373
1374	if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) == 0) {
1375		struct socket *so = inp->inp_socket;
1376
1377		if (so != NULL)
1378			so_error_set(so, abort_status_to_errno(tp,
1379			    cpl->status));
1380		tp = tcp_close(tp);
1381		if (tp == NULL)
1382			INP_WLOCK(inp);	/* re-acquire */
1383	}
1384
1385	final_cpl_received(toep);
1386done:
1387	INP_INFO_RUNLOCK(&V_tcbinfo);
1388	CURVNET_RESTORE();
1389	send_abort_rpl(sc, ofld_txq, tid, CPL_ABORT_NO_RST);
1390	return (0);
1391}
1392
1393/*
1394 * Reply to the CPL_ABORT_REQ (send_reset)
1395 */
1396static int
1397do_abort_rpl(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1398{
1399	struct adapter *sc = iq->adapter;
1400	const struct cpl_abort_rpl_rss *cpl = (const void *)(rss + 1);
1401	unsigned int tid = GET_TID(cpl);
1402	struct toepcb *toep = lookup_tid(sc, tid);
1403	struct inpcb *inp = toep->inp;
1404#ifdef INVARIANTS
1405	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1406#endif
1407
1408	KASSERT(opcode == CPL_ABORT_RPL_RSS,
1409	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1410	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1411
1412	if (toep->flags & TPF_SYNQE)
1413		return (do_abort_rpl_synqe(iq, rss, m));
1414
1415	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1416
1417	CTR5(KTR_CXGBE, "%s: tid %u, toep %p, inp %p, status %d",
1418	    __func__, tid, toep, inp, cpl->status);
1419
1420	KASSERT(toep->flags & TPF_ABORT_SHUTDOWN,
1421	    ("%s: wasn't expecting abort reply", __func__));
1422
1423	INP_WLOCK(inp);
1424	final_cpl_received(toep);
1425
1426	return (0);
1427}
1428
1429static int
1430do_rx_data(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1431{
1432	struct adapter *sc = iq->adapter;
1433	const struct cpl_rx_data *cpl = mtod(m, const void *);
1434	unsigned int tid = GET_TID(cpl);
1435	struct toepcb *toep = lookup_tid(sc, tid);
1436	struct inpcb *inp = toep->inp;
1437	struct tcpcb *tp;
1438	struct socket *so;
1439	struct sockbuf *sb;
1440	int len;
1441	uint32_t ddp_placed = 0;
1442
1443	if (__predict_false(toep->flags & TPF_SYNQE)) {
1444#ifdef INVARIANTS
1445		struct synq_entry *synqe = (void *)toep;
1446
1447		INP_WLOCK(synqe->lctx->inp);
1448		if (synqe->flags & TPF_SYNQE_HAS_L2TE) {
1449			KASSERT(synqe->flags & TPF_ABORT_SHUTDOWN,
1450			    ("%s: listen socket closed but tid %u not aborted.",
1451			    __func__, tid));
1452		} else {
1453			/*
1454			 * do_pass_accept_req is still running and will
1455			 * eventually take care of this tid.
1456			 */
1457		}
1458		INP_WUNLOCK(synqe->lctx->inp);
1459#endif
1460		CTR4(KTR_CXGBE, "%s: tid %u, synqe %p (0x%x)", __func__, tid,
1461		    toep, toep->flags);
1462		m_freem(m);
1463		return (0);
1464	}
1465
1466	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1467
1468	/* strip off CPL header */
1469	m_adj(m, sizeof(*cpl));
1470	len = m->m_pkthdr.len;
1471
1472	INP_WLOCK(inp);
1473	if (inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) {
1474		CTR4(KTR_CXGBE, "%s: tid %u, rx (%d bytes), inp_flags 0x%x",
1475		    __func__, tid, len, inp->inp_flags);
1476		INP_WUNLOCK(inp);
1477		m_freem(m);
1478		return (0);
1479	}
1480
1481	tp = intotcpcb(inp);
1482
1483	if (__predict_false(tp->rcv_nxt != be32toh(cpl->seq)))
1484		ddp_placed = be32toh(cpl->seq) - tp->rcv_nxt;
1485
1486	tp->rcv_nxt += len;
1487	if (tp->rcv_wnd < len) {
1488		KASSERT(toep->ulp_mode == ULP_MODE_RDMA,
1489				("%s: negative window size", __func__));
1490	}
1491
1492	tp->rcv_wnd -= len;
1493	tp->t_rcvtime = ticks;
1494
1495	if (toep->ulp_mode == ULP_MODE_TCPDDP)
1496		DDP_LOCK(toep);
1497	so = inp_inpcbtosocket(inp);
1498	sb = &so->so_rcv;
1499	SOCKBUF_LOCK(sb);
1500
1501	if (__predict_false(sb->sb_state & SBS_CANTRCVMORE)) {
1502		CTR3(KTR_CXGBE, "%s: tid %u, excess rx (%d bytes)",
1503		    __func__, tid, len);
1504		m_freem(m);
1505		SOCKBUF_UNLOCK(sb);
1506		if (toep->ulp_mode == ULP_MODE_TCPDDP)
1507			DDP_UNLOCK(toep);
1508		INP_WUNLOCK(inp);
1509
1510		CURVNET_SET(toep->vnet);
1511		INP_INFO_RLOCK(&V_tcbinfo);
1512		INP_WLOCK(inp);
1513		tp = tcp_drop(tp, ECONNRESET);
1514		if (tp)
1515			INP_WUNLOCK(inp);
1516		INP_INFO_RUNLOCK(&V_tcbinfo);
1517		CURVNET_RESTORE();
1518
1519		return (0);
1520	}
1521
1522	/* receive buffer autosize */
1523	MPASS(toep->vnet == so->so_vnet);
1524	CURVNET_SET(toep->vnet);
1525	if (sb->sb_flags & SB_AUTOSIZE &&
1526	    V_tcp_do_autorcvbuf &&
1527	    sb->sb_hiwat < V_tcp_autorcvbuf_max &&
1528	    len > (sbspace(sb) / 8 * 7)) {
1529		unsigned int hiwat = sb->sb_hiwat;
1530		unsigned int newsize = min(hiwat + V_tcp_autorcvbuf_inc,
1531		    V_tcp_autorcvbuf_max);
1532
1533		if (!sbreserve_locked(sb, newsize, so, NULL))
1534			sb->sb_flags &= ~SB_AUTOSIZE;
1535		else
1536			toep->rx_credits += newsize - hiwat;
1537	}
1538
1539	if (toep->ulp_mode == ULP_MODE_TCPDDP) {
1540		int changed = !(toep->ddp.flags & DDP_ON) ^ cpl->ddp_off;
1541
1542		if (toep->ddp.waiting_count != 0 || toep->ddp.active_count != 0)
1543			CTR3(KTR_CXGBE, "%s: tid %u, non-ddp rx (%d bytes)",
1544			    __func__, tid, len);
1545
1546		if (changed) {
1547			if (toep->ddp.flags & DDP_SC_REQ)
1548				toep->ddp.flags ^= DDP_ON | DDP_SC_REQ;
1549			else {
1550				KASSERT(cpl->ddp_off == 1,
1551				    ("%s: DDP switched on by itself.",
1552				    __func__));
1553
1554				/* Fell out of DDP mode */
1555				toep->ddp.flags &= ~DDP_ON;
1556				CTR1(KTR_CXGBE, "%s: fell out of DDP mode",
1557				    __func__);
1558
1559				insert_ddp_data(toep, ddp_placed);
1560			}
1561		}
1562
1563		if (toep->ddp.flags & DDP_ON) {
1564			/*
1565			 * CPL_RX_DATA with DDP on can only be an indicate.
1566			 * Start posting queued AIO requests via DDP.  The
1567			 * payload that arrived in this indicate is appended
1568			 * to the socket buffer as usual.
1569			 */
1570			handle_ddp_indicate(toep);
1571		}
1572	}
1573
1574	KASSERT(toep->sb_cc >= sbused(sb),
1575	    ("%s: sb %p has more data (%d) than last time (%d).",
1576	    __func__, sb, sbused(sb), toep->sb_cc));
1577	toep->rx_credits += toep->sb_cc - sbused(sb);
1578	sbappendstream_locked(sb, m, 0);
1579	toep->sb_cc = sbused(sb);
1580	if (toep->rx_credits > 0 && toep->sb_cc + tp->rcv_wnd < sb->sb_lowat) {
1581		int credits;
1582
1583		credits = send_rx_credits(sc, toep, toep->rx_credits);
1584		toep->rx_credits -= credits;
1585		tp->rcv_wnd += credits;
1586		tp->rcv_adv += credits;
1587	}
1588
1589	if (toep->ulp_mode == ULP_MODE_TCPDDP && toep->ddp.waiting_count > 0 &&
1590	    sbavail(sb) != 0) {
1591		CTR2(KTR_CXGBE, "%s: tid %u queueing AIO task", __func__,
1592		    tid);
1593		ddp_queue_toep(toep);
1594	}
1595	sorwakeup_locked(so);
1596	SOCKBUF_UNLOCK_ASSERT(sb);
1597	if (toep->ulp_mode == ULP_MODE_TCPDDP)
1598		DDP_UNLOCK(toep);
1599
1600	INP_WUNLOCK(inp);
1601	CURVNET_RESTORE();
1602	return (0);
1603}
1604
1605#define S_CPL_FW4_ACK_OPCODE    24
1606#define M_CPL_FW4_ACK_OPCODE    0xff
1607#define V_CPL_FW4_ACK_OPCODE(x) ((x) << S_CPL_FW4_ACK_OPCODE)
1608#define G_CPL_FW4_ACK_OPCODE(x) \
1609    (((x) >> S_CPL_FW4_ACK_OPCODE) & M_CPL_FW4_ACK_OPCODE)
1610
1611#define S_CPL_FW4_ACK_FLOWID    0
1612#define M_CPL_FW4_ACK_FLOWID    0xffffff
1613#define V_CPL_FW4_ACK_FLOWID(x) ((x) << S_CPL_FW4_ACK_FLOWID)
1614#define G_CPL_FW4_ACK_FLOWID(x) \
1615    (((x) >> S_CPL_FW4_ACK_FLOWID) & M_CPL_FW4_ACK_FLOWID)
1616
1617#define S_CPL_FW4_ACK_CR        24
1618#define M_CPL_FW4_ACK_CR        0xff
1619#define V_CPL_FW4_ACK_CR(x)     ((x) << S_CPL_FW4_ACK_CR)
1620#define G_CPL_FW4_ACK_CR(x)     (((x) >> S_CPL_FW4_ACK_CR) & M_CPL_FW4_ACK_CR)
1621
1622#define S_CPL_FW4_ACK_SEQVAL    0
1623#define M_CPL_FW4_ACK_SEQVAL    0x1
1624#define V_CPL_FW4_ACK_SEQVAL(x) ((x) << S_CPL_FW4_ACK_SEQVAL)
1625#define G_CPL_FW4_ACK_SEQVAL(x) \
1626    (((x) >> S_CPL_FW4_ACK_SEQVAL) & M_CPL_FW4_ACK_SEQVAL)
1627#define F_CPL_FW4_ACK_SEQVAL    V_CPL_FW4_ACK_SEQVAL(1U)
1628
1629static int
1630do_fw4_ack(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1631{
1632	struct adapter *sc = iq->adapter;
1633	const struct cpl_fw4_ack *cpl = (const void *)(rss + 1);
1634	unsigned int tid = G_CPL_FW4_ACK_FLOWID(be32toh(OPCODE_TID(cpl)));
1635	struct toepcb *toep = lookup_tid(sc, tid);
1636	struct inpcb *inp;
1637	struct tcpcb *tp;
1638	struct socket *so;
1639	uint8_t credits = cpl->credits;
1640	struct ofld_tx_sdesc *txsd;
1641	int plen;
1642#ifdef INVARIANTS
1643	unsigned int opcode = G_CPL_FW4_ACK_OPCODE(be32toh(OPCODE_TID(cpl)));
1644#endif
1645
1646	/*
1647	 * Very unusual case: we'd sent a flowc + abort_req for a synq entry and
1648	 * now this comes back carrying the credits for the flowc.
1649	 */
1650	if (__predict_false(toep->flags & TPF_SYNQE)) {
1651		KASSERT(toep->flags & TPF_ABORT_SHUTDOWN,
1652		    ("%s: credits for a synq entry %p", __func__, toep));
1653		return (0);
1654	}
1655
1656	inp = toep->inp;
1657
1658	KASSERT(opcode == CPL_FW4_ACK,
1659	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1660	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1661	KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__));
1662
1663	INP_WLOCK(inp);
1664
1665	if (__predict_false(toep->flags & TPF_ABORT_SHUTDOWN)) {
1666		INP_WUNLOCK(inp);
1667		return (0);
1668	}
1669
1670	KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0,
1671	    ("%s: inp_flags 0x%x", __func__, inp->inp_flags));
1672
1673	tp = intotcpcb(inp);
1674
1675	if (cpl->flags & CPL_FW4_ACK_FLAGS_SEQVAL) {
1676		tcp_seq snd_una = be32toh(cpl->snd_una);
1677
1678#ifdef INVARIANTS
1679		if (__predict_false(SEQ_LT(snd_una, tp->snd_una))) {
1680			log(LOG_ERR,
1681			    "%s: unexpected seq# %x for TID %u, snd_una %x\n",
1682			    __func__, snd_una, toep->tid, tp->snd_una);
1683		}
1684#endif
1685
1686		if (tp->snd_una != snd_una) {
1687			tp->snd_una = snd_una;
1688			tp->ts_recent_age = tcp_ts_getticks();
1689		}
1690	}
1691
1692#ifdef VERBOSE_TRACES
1693	CTR3(KTR_CXGBE, "%s: tid %d credits %u", __func__, tid, credits);
1694#endif
1695	so = inp->inp_socket;
1696	txsd = &toep->txsd[toep->txsd_cidx];
1697	plen = 0;
1698	while (credits) {
1699		KASSERT(credits >= txsd->tx_credits,
1700		    ("%s: too many (or partial) credits", __func__));
1701		credits -= txsd->tx_credits;
1702		toep->tx_credits += txsd->tx_credits;
1703		plen += txsd->plen;
1704		txsd++;
1705		toep->txsd_avail++;
1706		KASSERT(toep->txsd_avail <= toep->txsd_total,
1707		    ("%s: txsd avail > total", __func__));
1708		if (__predict_false(++toep->txsd_cidx == toep->txsd_total)) {
1709			txsd = &toep->txsd[0];
1710			toep->txsd_cidx = 0;
1711		}
1712	}
1713
1714	if (toep->tx_credits == toep->tx_total) {
1715		toep->tx_nocompl = 0;
1716		toep->plen_nocompl = 0;
1717	}
1718
1719	if (toep->flags & TPF_TX_SUSPENDED &&
1720	    toep->tx_credits >= toep->tx_total / 4) {
1721#ifdef VERBOSE_TRACES
1722		CTR2(KTR_CXGBE, "%s: tid %d calling t4_push_frames", __func__,
1723		    tid);
1724#endif
1725		toep->flags &= ~TPF_TX_SUSPENDED;
1726		CURVNET_SET(toep->vnet);
1727		if (toep->ulp_mode == ULP_MODE_ISCSI)
1728			t4_push_pdus(sc, toep, plen);
1729		else
1730			t4_push_frames(sc, toep, plen);
1731		CURVNET_RESTORE();
1732	} else if (plen > 0) {
1733		struct sockbuf *sb = &so->so_snd;
1734		int sbu;
1735
1736		SOCKBUF_LOCK(sb);
1737		sbu = sbused(sb);
1738		if (toep->ulp_mode == ULP_MODE_ISCSI) {
1739
1740			if (__predict_false(sbu > 0)) {
1741				/*
1742				 * The data trasmitted before the tid's ULP mode
1743				 * changed to ISCSI is still in so_snd.
1744				 * Incoming credits should account for so_snd
1745				 * first.
1746				 */
1747				sbdrop_locked(sb, min(sbu, plen));
1748				plen -= min(sbu, plen);
1749			}
1750			sowwakeup_locked(so);	/* unlocks so_snd */
1751			rqdrop_locked(&toep->ulp_pdu_reclaimq, plen);
1752		} else {
1753#ifdef VERBOSE_TRACES
1754			CTR3(KTR_CXGBE, "%s: tid %d dropped %d bytes", __func__,
1755			    tid, plen);
1756#endif
1757			sbdrop_locked(sb, plen);
1758			if (!TAILQ_EMPTY(&toep->aiotx_jobq))
1759				t4_aiotx_queue_toep(toep);
1760			sowwakeup_locked(so);	/* unlocks so_snd */
1761		}
1762		SOCKBUF_UNLOCK_ASSERT(sb);
1763	}
1764
1765	INP_WUNLOCK(inp);
1766
1767	return (0);
1768}
1769
1770int
1771do_set_tcb_rpl(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m)
1772{
1773	struct adapter *sc = iq->adapter;
1774	const struct cpl_set_tcb_rpl *cpl = (const void *)(rss + 1);
1775	unsigned int tid = GET_TID(cpl);
1776	struct toepcb *toep;
1777#ifdef INVARIANTS
1778	unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl)));
1779#endif
1780
1781	KASSERT(opcode == CPL_SET_TCB_RPL,
1782	    ("%s: unexpected opcode 0x%x", __func__, opcode));
1783	KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__));
1784	MPASS(iq != &sc->sge.fwq);
1785
1786	toep = lookup_tid(sc, tid);
1787	if (toep->ulp_mode == ULP_MODE_TCPDDP) {
1788		handle_ddp_tcb_rpl(toep, cpl);
1789		return (0);
1790	}
1791
1792	/*
1793	 * TOM and/or other ULPs don't request replies for CPL_SET_TCB or
1794	 * CPL_SET_TCB_FIELD requests.  This can easily change and when it does
1795	 * the dispatch code will go here.
1796	 */
1797#ifdef INVARIANTS
1798	panic("%s: Unexpected CPL_SET_TCB_RPL for tid %u on iq %p", __func__,
1799	    tid, iq);
1800#else
1801	log(LOG_ERR, "%s: Unexpected CPL_SET_TCB_RPL for tid %u on iq %p\n",
1802	    __func__, tid, iq);
1803#endif
1804
1805	return (0);
1806}
1807
1808void
1809t4_set_tcb_field(struct adapter *sc, struct sge_wrq *wrq, int tid,
1810    uint16_t word, uint64_t mask, uint64_t val, int reply, int cookie, int iqid)
1811{
1812	struct wrqe *wr;
1813	struct cpl_set_tcb_field *req;
1814
1815	MPASS((cookie & ~M_COOKIE) == 0);
1816	MPASS((iqid & ~M_QUEUENO) == 0);
1817
1818	wr = alloc_wrqe(sizeof(*req), wrq);
1819	if (wr == NULL) {
1820		/* XXX */
1821		panic("%s: allocation failure.", __func__);
1822	}
1823	req = wrtod(wr);
1824
1825	INIT_TP_WR_MIT_CPL(req, CPL_SET_TCB_FIELD, tid);
1826	req->reply_ctrl = htobe16(V_QUEUENO(iqid));
1827	if (reply == 0)
1828		req->reply_ctrl |= htobe16(F_NO_REPLY);
1829	req->word_cookie = htobe16(V_WORD(word) | V_COOKIE(cookie));
1830	req->mask = htobe64(mask);
1831	req->val = htobe64(val);
1832
1833	t4_wrq_tx(sc, wr);
1834}
1835
1836void
1837t4_init_cpl_io_handlers(void)
1838{
1839
1840	t4_register_cpl_handler(CPL_PEER_CLOSE, do_peer_close);
1841	t4_register_cpl_handler(CPL_CLOSE_CON_RPL, do_close_con_rpl);
1842	t4_register_cpl_handler(CPL_ABORT_REQ_RSS, do_abort_req);
1843	t4_register_cpl_handler(CPL_ABORT_RPL_RSS, do_abort_rpl);
1844	t4_register_cpl_handler(CPL_RX_DATA, do_rx_data);
1845	t4_register_cpl_handler(CPL_FW4_ACK, do_fw4_ack);
1846}
1847
1848void
1849t4_uninit_cpl_io_handlers(void)
1850{
1851
1852	t4_register_cpl_handler(CPL_PEER_CLOSE, NULL);
1853	t4_register_cpl_handler(CPL_CLOSE_CON_RPL, NULL);
1854	t4_register_cpl_handler(CPL_ABORT_REQ_RSS, NULL);
1855	t4_register_cpl_handler(CPL_ABORT_RPL_RSS, NULL);
1856	t4_register_cpl_handler(CPL_RX_DATA, NULL);
1857	t4_register_cpl_handler(CPL_FW4_ACK, NULL);
1858}
1859
1860/*
1861 * Use the 'backend3' field in AIO jobs to store the amount of data
1862 * sent by the AIO job so far and the 'backend4' field to hold an
1863 * error that should be reported when the job is completed.
1864 */
1865#define	aio_sent	backend3
1866#define	aio_error	backend4
1867
1868#define	jobtotid(job)							\
1869	(((struct toepcb *)(so_sototcpcb((job)->fd_file->f_data)->t_toe))->tid)
1870
1871static void
1872free_aiotx_buffer(struct aiotx_buffer *ab)
1873{
1874	struct kaiocb *job;
1875	long status;
1876	int error;
1877
1878	if (refcount_release(&ab->refcount) == 0)
1879		return;
1880
1881	job = ab->job;
1882	error = job->aio_error;
1883	status = job->aio_sent;
1884	vm_page_unhold_pages(ab->ps.pages, ab->ps.npages);
1885	free(ab, M_CXGBE);
1886#ifdef VERBOSE_TRACES
1887	CTR5(KTR_CXGBE, "%s: tid %d completed %p len %ld, error %d", __func__,
1888	    jobtotid(job), job, status, error);
1889#endif
1890	if (error == ECANCELED && status != 0)
1891		error = 0;
1892	if (error == ECANCELED)
1893		aio_cancel(job);
1894	else if (error)
1895		aio_complete(job, -1, error);
1896	else
1897		aio_complete(job, status, 0);
1898}
1899
1900static void
1901t4_aiotx_mbuf_free(struct mbuf *m, void *buffer, void *arg)
1902{
1903	struct aiotx_buffer *ab = buffer;
1904
1905#ifdef VERBOSE_TRACES
1906	CTR3(KTR_CXGBE, "%s: completed %d bytes for tid %d", __func__,
1907	    m->m_len, jobtotid(ab->job));
1908#endif
1909	free_aiotx_buffer(ab);
1910}
1911
1912/*
1913 * Hold the buffer backing an AIO request and return an AIO transmit
1914 * buffer.
1915 */
1916static int
1917hold_aio(struct kaiocb *job)
1918{
1919	struct aiotx_buffer *ab;
1920	struct vmspace *vm;
1921	vm_map_t map;
1922	vm_offset_t start, end, pgoff;
1923	int n;
1924
1925	MPASS(job->backend1 == NULL);
1926
1927	/*
1928	 * The AIO subsystem will cancel and drain all requests before
1929	 * permitting a process to exit or exec, so p_vmspace should
1930	 * be stable here.
1931	 */
1932	vm = job->userproc->p_vmspace;
1933	map = &vm->vm_map;
1934	start = (uintptr_t)job->uaiocb.aio_buf;
1935	pgoff = start & PAGE_MASK;
1936	end = round_page(start + job->uaiocb.aio_nbytes);
1937	start = trunc_page(start);
1938	n = atop(end - start);
1939
1940	ab = malloc(sizeof(*ab) + n * sizeof(vm_page_t), M_CXGBE, M_WAITOK |
1941	    M_ZERO);
1942	refcount_init(&ab->refcount, 1);
1943	ab->ps.pages = (vm_page_t *)(ab + 1);
1944	ab->ps.npages = vm_fault_quick_hold_pages(map, start, end - start,
1945	    VM_PROT_WRITE, ab->ps.pages, n);
1946	if (ab->ps.npages < 0) {
1947		free(ab, M_CXGBE);
1948		return (EFAULT);
1949	}
1950
1951	KASSERT(ab->ps.npages == n,
1952	    ("hold_aio: page count mismatch: %d vs %d", ab->ps.npages, n));
1953
1954	ab->ps.offset = pgoff;
1955	ab->ps.len = job->uaiocb.aio_nbytes;
1956	ab->job = job;
1957	job->backend1 = ab;
1958#ifdef VERBOSE_TRACES
1959	CTR5(KTR_CXGBE, "%s: tid %d, new pageset %p for job %p, npages %d",
1960	    __func__, jobtotid(job), &ab->ps, job, ab->ps.npages);
1961#endif
1962	return (0);
1963}
1964
1965static void
1966t4_aiotx_process_job(struct toepcb *toep, struct socket *so, struct kaiocb *job)
1967{
1968	struct adapter *sc;
1969	struct sockbuf *sb;
1970	struct file *fp;
1971	struct aiotx_buffer *ab;
1972	struct inpcb *inp;
1973	struct tcpcb *tp;
1974	struct mbuf *m;
1975	int error;
1976	bool moretocome, sendmore;
1977
1978	sc = td_adapter(toep->td);
1979	sb = &so->so_snd;
1980	SOCKBUF_UNLOCK(sb);
1981	fp = job->fd_file;
1982	ab = job->backend1;
1983	m = NULL;
1984
1985#ifdef MAC
1986	error = mac_socket_check_send(fp->f_cred, so);
1987	if (error != 0)
1988		goto out;
1989#endif
1990
1991	if (ab == NULL) {
1992		error = hold_aio(job);
1993		if (error != 0)
1994			goto out;
1995		ab = job->backend1;
1996	}
1997
1998	/* Inline sosend_generic(). */
1999
2000	job->msgsnd = 1;
2001
2002	error = sblock(sb, SBL_WAIT);
2003	MPASS(error == 0);
2004
2005sendanother:
2006	m = m_get(M_WAITOK, MT_DATA);
2007
2008	SOCKBUF_LOCK(sb);
2009	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
2010		SOCKBUF_UNLOCK(sb);
2011		sbunlock(sb);
2012		if ((so->so_options & SO_NOSIGPIPE) == 0) {
2013			PROC_LOCK(job->userproc);
2014			kern_psignal(job->userproc, SIGPIPE);
2015			PROC_UNLOCK(job->userproc);
2016		}
2017		error = EPIPE;
2018		goto out;
2019	}
2020	if (so->so_error) {
2021		error = so->so_error;
2022		so->so_error = 0;
2023		SOCKBUF_UNLOCK(sb);
2024		sbunlock(sb);
2025		goto out;
2026	}
2027	if ((so->so_state & SS_ISCONNECTED) == 0) {
2028		SOCKBUF_UNLOCK(sb);
2029		sbunlock(sb);
2030		error = ENOTCONN;
2031		goto out;
2032	}
2033	if (sbspace(sb) < sb->sb_lowat) {
2034		MPASS(job->aio_sent == 0 || !(so->so_state & SS_NBIO));
2035
2036		/*
2037		 * Don't block if there is too little room in the socket
2038		 * buffer.  Instead, requeue the request.
2039		 */
2040		if (!aio_set_cancel_function(job, t4_aiotx_cancel)) {
2041			SOCKBUF_UNLOCK(sb);
2042			sbunlock(sb);
2043			error = ECANCELED;
2044			goto out;
2045		}
2046		TAILQ_INSERT_HEAD(&toep->aiotx_jobq, job, list);
2047		SOCKBUF_UNLOCK(sb);
2048		sbunlock(sb);
2049		goto out;
2050	}
2051
2052	/*
2053	 * Write as much data as the socket permits, but no more than a
2054	 * a single sndbuf at a time.
2055	 */
2056	m->m_len = sbspace(sb);
2057	if (m->m_len > ab->ps.len - job->aio_sent) {
2058		m->m_len = ab->ps.len - job->aio_sent;
2059		moretocome = false;
2060	} else
2061		moretocome = true;
2062	if (m->m_len > sc->tt.sndbuf) {
2063		m->m_len = sc->tt.sndbuf;
2064		sendmore = true;
2065	} else
2066		sendmore = false;
2067
2068	if (!TAILQ_EMPTY(&toep->aiotx_jobq))
2069		moretocome = true;
2070	SOCKBUF_UNLOCK(sb);
2071	MPASS(m->m_len != 0);
2072
2073	/* Inlined tcp_usr_send(). */
2074
2075	inp = toep->inp;
2076	INP_WLOCK(inp);
2077	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
2078		INP_WUNLOCK(inp);
2079		sbunlock(sb);
2080		error = ECONNRESET;
2081		goto out;
2082	}
2083
2084	refcount_acquire(&ab->refcount);
2085	m_extadd(m, NULL, ab->ps.len, t4_aiotx_mbuf_free, ab,
2086	    (void *)(uintptr_t)job->aio_sent, 0, EXT_NET_DRV);
2087	m->m_ext.ext_flags |= EXT_FLAG_AIOTX;
2088	job->aio_sent += m->m_len;
2089
2090	sbappendstream(sb, m, 0);
2091	m = NULL;
2092
2093	if (!(inp->inp_flags & INP_DROPPED)) {
2094		tp = intotcpcb(inp);
2095		if (moretocome)
2096			tp->t_flags |= TF_MORETOCOME;
2097		error = tp->t_fb->tfb_tcp_output(tp);
2098		if (moretocome)
2099			tp->t_flags &= ~TF_MORETOCOME;
2100	}
2101
2102	INP_WUNLOCK(inp);
2103	if (sendmore)
2104		goto sendanother;
2105	sbunlock(sb);
2106
2107	if (error)
2108		goto out;
2109
2110	/*
2111	 * If this is a non-blocking socket and the request has not
2112	 * been fully completed, requeue it until the socket is ready
2113	 * again.
2114	 */
2115	if (job->aio_sent < job->uaiocb.aio_nbytes &&
2116	    !(so->so_state & SS_NBIO)) {
2117		SOCKBUF_LOCK(sb);
2118		if (!aio_set_cancel_function(job, t4_aiotx_cancel)) {
2119			SOCKBUF_UNLOCK(sb);
2120			error = ECANCELED;
2121			goto out;
2122		}
2123		TAILQ_INSERT_HEAD(&toep->aiotx_jobq, job, list);
2124		return;
2125	}
2126
2127	/*
2128	 * If the request will not be requeued, drop a reference on
2129	 * the the aiotx buffer.  Any mbufs in flight should still
2130	 * contain a reference, but this drops the reference that the
2131	 * job owns while it is waiting to queue mbufs to the socket.
2132	 */
2133	free_aiotx_buffer(ab);
2134
2135out:
2136	if (error) {
2137		if (ab != NULL) {
2138			job->aio_error = error;
2139			free_aiotx_buffer(ab);
2140		} else {
2141			MPASS(job->aio_sent == 0);
2142			aio_complete(job, -1, error);
2143		}
2144	}
2145	if (m != NULL)
2146		m_free(m);
2147	SOCKBUF_LOCK(sb);
2148}
2149
2150static void
2151t4_aiotx_task(void *context, int pending)
2152{
2153	struct toepcb *toep = context;
2154	struct inpcb *inp = toep->inp;
2155	struct socket *so = inp->inp_socket;
2156	struct kaiocb *job;
2157
2158	CURVNET_SET(toep->vnet);
2159	SOCKBUF_LOCK(&so->so_snd);
2160	while (!TAILQ_EMPTY(&toep->aiotx_jobq) && sowriteable(so)) {
2161		job = TAILQ_FIRST(&toep->aiotx_jobq);
2162		TAILQ_REMOVE(&toep->aiotx_jobq, job, list);
2163		if (!aio_clear_cancel_function(job))
2164			continue;
2165
2166		t4_aiotx_process_job(toep, so, job);
2167	}
2168	toep->aiotx_task_active = false;
2169	SOCKBUF_UNLOCK(&so->so_snd);
2170	CURVNET_RESTORE();
2171
2172	free_toepcb(toep);
2173}
2174
2175static void
2176t4_aiotx_queue_toep(struct toepcb *toep)
2177{
2178
2179	SOCKBUF_LOCK_ASSERT(&toep->inp->inp_socket->so_snd);
2180#ifdef VERBOSE_TRACES
2181	CTR3(KTR_CXGBE, "%s: queueing aiotx task for tid %d, active = %s",
2182	    __func__, toep->tid, toep->aiotx_task_active ? "true" : "false");
2183#endif
2184	if (toep->aiotx_task_active)
2185		return;
2186	toep->aiotx_task_active = true;
2187	hold_toepcb(toep);
2188	soaio_enqueue(&toep->aiotx_task);
2189}
2190
2191static void
2192t4_aiotx_cancel(struct kaiocb *job)
2193{
2194	struct aiotx_buffer *ab;
2195	struct socket *so;
2196	struct sockbuf *sb;
2197	struct tcpcb *tp;
2198	struct toepcb *toep;
2199
2200	so = job->fd_file->f_data;
2201	tp = so_sototcpcb(so);
2202	toep = tp->t_toe;
2203	MPASS(job->uaiocb.aio_lio_opcode == LIO_WRITE);
2204	sb = &so->so_snd;
2205
2206	SOCKBUF_LOCK(sb);
2207	if (!aio_cancel_cleared(job))
2208		TAILQ_REMOVE(&toep->aiotx_jobq, job, list);
2209	SOCKBUF_UNLOCK(sb);
2210
2211	ab = job->backend1;
2212	if (ab != NULL)
2213		free_aiotx_buffer(ab);
2214	else
2215		aio_cancel(job);
2216}
2217
2218int
2219t4_aio_queue_aiotx(struct socket *so, struct kaiocb *job)
2220{
2221	struct tcpcb *tp = so_sototcpcb(so);
2222	struct toepcb *toep = tp->t_toe;
2223	struct adapter *sc = td_adapter(toep->td);
2224
2225	/* This only handles writes. */
2226	if (job->uaiocb.aio_lio_opcode != LIO_WRITE)
2227		return (EOPNOTSUPP);
2228
2229	if (!sc->tt.tx_zcopy)
2230		return (EOPNOTSUPP);
2231
2232	SOCKBUF_LOCK(&so->so_snd);
2233#ifdef VERBOSE_TRACES
2234	CTR2(KTR_CXGBE, "%s: queueing %p", __func__, job);
2235#endif
2236	if (!aio_set_cancel_function(job, t4_aiotx_cancel))
2237		panic("new job was cancelled");
2238	TAILQ_INSERT_TAIL(&toep->aiotx_jobq, job, list);
2239	if (sowriteable(so))
2240		t4_aiotx_queue_toep(toep);
2241	SOCKBUF_UNLOCK(&so->so_snd);
2242	return (0);
2243}
2244
2245void
2246aiotx_init_toep(struct toepcb *toep)
2247{
2248
2249	TAILQ_INIT(&toep->aiotx_jobq);
2250	TASK_INIT(&toep->aiotx_task, 0, t4_aiotx_task, toep);
2251}
2252#endif
2253