drivers/infiniband/ulp/srp/ib_srp.c

   1 /*
   2  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  34
  35 #include <linux/module.h>
  36 #include <linux/init.h>
  37 #include <linux/slab.h>
  38 #include <linux/err.h>
  39 #include <linux/string.h>
  40 #include <linux/parser.h>
  41 #include <linux/random.h>
  42 #include <linux/jiffies.h>
  43 #include <rdma/ib_cache.h>
  44
  45 #include <linux/atomic.h>
  46
  47 #include <scsi/scsi.h>
  48 #include <scsi/scsi_device.h>
  49 #include <scsi/scsi_dbg.h>
  50 #include <scsi/scsi_tcq.h>
  51 #include <scsi/srp.h>
  52 #include <scsi/scsi_transport_srp.h>
  53
  54 #include "ib_srp.h"
  55
  56 #define DRV_NAME        "ib_srp"
  57 #define PFX             DRV_NAME ": "
  58 #define DRV_VERSION     "2.0"
  59 #define DRV_RELDATE     "July 26, 2015"
  60
  61 MODULE_AUTHOR("Roland Dreier");
  62 MODULE_DESCRIPTION("InfiniBand SCSI RDMA Protocol initiator");
  63 MODULE_LICENSE("Dual BSD/GPL");
  64 MODULE_VERSION(DRV_VERSION);
  65 MODULE_INFO(release_date, DRV_RELDATE);
  66
  67 static unsigned int srp_sg_tablesize;
  68 static unsigned int cmd_sg_entries;
  69 static unsigned int indirect_sg_entries;
  70 static bool allow_ext_sg;
  71 static bool prefer_fr;
  72 static bool register_always;
  73 static int topspin_workarounds = 1;
  74
  75 module_param(srp_sg_tablesize, uint, 0444);
  76 MODULE_PARM_DESC(srp_sg_tablesize, "Deprecated name for cmd_sg_entries");
  77
  78 module_param(cmd_sg_entries, uint, 0444);
  79 MODULE_PARM_DESC(cmd_sg_entries,
  80                  "Default number of gather/scatter entries in the SRP command (default is 12, max 255)");
  81
  82 module_param(indirect_sg_entries, uint, 0444);
  83 MODULE_PARM_DESC(indirect_sg_entries,
  84                  "Default max number of gather/scatter entries (default is 12, max is " __stringify(SCSI_MAX_SG_CHAIN_SEGMENTS) ")");
  85
  86 module_param(allow_ext_sg, bool, 0444);
  87 MODULE_PARM_DESC(allow_ext_sg,
  88                   "Default behavior when there are more than cmd_sg_entries S/G entries after mapping; fails the request when false (default false)");
  89
  90 module_param(topspin_workarounds, int, 0444);
  91 MODULE_PARM_DESC(topspin_workarounds,
  92                  "Enable workarounds for Topspin/Cisco SRP target bugs if != 0");
  93
  94 module_param(prefer_fr, bool, 0444);
  95 MODULE_PARM_DESC(prefer_fr,
  96 "Whether to use fast registration if both FMR and fast registration are supported");
  97
  98 module_param(register_always, bool, 0444);
  99 MODULE_PARM_DESC(register_always,
 100                  "Use memory registration even for contiguous memory regions");
 101
 102 static const struct kernel_param_ops srp_tmo_ops;
 103
 104 static int srp_reconnect_delay = 10;
 105 module_param_cb(reconnect_delay, &srp_tmo_ops, &srp_reconnect_delay,
 106                 S_IRUGO | S_IWUSR);
 107 MODULE_PARM_DESC(reconnect_delay, "Time between successive reconnect attempts");
 108
 109 static int srp_fast_io_fail_tmo = 15;
 110 module_param_cb(fast_io_fail_tmo, &srp_tmo_ops, &srp_fast_io_fail_tmo,
 111                 S_IRUGO | S_IWUSR);
 112 MODULE_PARM_DESC(fast_io_fail_tmo,
 113                  "Number of seconds between the observation of a transport"
 114                  " layer error and failing all I/O. \"off\" means that this"
 115                  " functionality is disabled.");
 116
 117 static int srp_dev_loss_tmo = 600;
 118 module_param_cb(dev_loss_tmo, &srp_tmo_ops, &srp_dev_loss_tmo,
 119                 S_IRUGO | S_IWUSR);
 120 MODULE_PARM_DESC(dev_loss_tmo,
 121                  "Maximum number of seconds that the SRP transport should"
 122                  " insulate transport layer errors. After this time has been"
 123                  " exceeded the SCSI host is removed. Should be"
 124                  " between 1 and " __stringify(SCSI_DEVICE_BLOCK_MAX_TIMEOUT)
 125                  " if fast_io_fail_tmo has not been set. \"off\" means that"
 126                  " this functionality is disabled.");
 127
 128 static unsigned ch_count;
 129 module_param(ch_count, uint, 0444);
 130 MODULE_PARM_DESC(ch_count,
 131                  "Number of RDMA channels to use for communication with an SRP target. Using more than one channel improves performance if the HCA supports multiple completion vectors. The default value is the minimum of four times the number of online CPU sockets and the number of completion vectors supported by the HCA.");
 132
 133 static void srp_add_one(struct ib_device *device);
 134 static void srp_remove_one(struct ib_device *device, void *client_data);
 135 static void srp_recv_completion(struct ib_cq *cq, void *ch_ptr);
 136 static void srp_send_completion(struct ib_cq *cq, void *ch_ptr);
 137 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
 138
 139 static struct scsi_transport_template *ib_srp_transport_template;
 140 static struct workqueue_struct *srp_remove_wq;
 141
 142 static struct ib_client srp_client = {
 143         .name   = "srp",
 144         .add    = srp_add_one,
 145         .remove = srp_remove_one
 146 };
 147
 148 static struct ib_sa_client srp_sa_client;
 149
 150 static int srp_tmo_get(char *buffer, const struct kernel_param *kp)
 151 {
 152         int tmo = *(int *)kp->arg;
 153
 154         if (tmo >= 0)
 155                 return sprintf(buffer, "%d", tmo);
 156         else
 157                 return sprintf(buffer, "off");
 158 }
 159
 160 static int srp_tmo_set(const char *val, const struct kernel_param *kp)
 161 {
 162         int tmo, res;
 163
 164         res = srp_parse_tmo(&tmo, val);
 165         if (res)
 166                 goto out;
 167
 168         if (kp->arg == &srp_reconnect_delay)
 169                 res = srp_tmo_valid(tmo, srp_fast_io_fail_tmo,
 170                                     srp_dev_loss_tmo);
 171         else if (kp->arg == &srp_fast_io_fail_tmo)
 172                 res = srp_tmo_valid(srp_reconnect_delay, tmo, srp_dev_loss_tmo);
 173         else
 174                 res = srp_tmo_valid(srp_reconnect_delay, srp_fast_io_fail_tmo,
 175                                     tmo);
 176         if (res)
 177                 goto out;
 178         *(int *)kp->arg = tmo;
 179
 180 out:
 181         return res;
 182 }
 183
 184 static const struct kernel_param_ops srp_tmo_ops = {
 185         .get = srp_tmo_get,
 186         .set = srp_tmo_set,
 187 };
 188
 189 static inline struct srp_target_port *host_to_target(struct Scsi_Host *host)
 190 {
 191         return (struct srp_target_port *) host->hostdata;
 192 }
 193
 194 static const char *srp_target_info(struct Scsi_Host *host)
 195 {
 196         return host_to_target(host)->target_name;
 197 }
 198
 199 static int srp_target_is_topspin(struct srp_target_port *target)
 200 {
 201         static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 202         static const u8 cisco_oui[3]   = { 0x00, 0x1b, 0x0d };
 203
 204         return topspin_workarounds &&
 205                 (!memcmp(&target->ioc_guid, topspin_oui, sizeof topspin_oui) ||
 206                  !memcmp(&target->ioc_guid, cisco_oui, sizeof cisco_oui));
 207 }
 208
 209 static struct srp_iu *srp_alloc_iu(struct srp_host *host, size_t size,
 210                                    gfp_t gfp_mask,
 211                                    enum dma_data_direction direction)
 212 {
 213         struct srp_iu *iu;
 214
 215         iu = kmalloc(sizeof *iu, gfp_mask);
 216         if (!iu)
 217                 goto out;
 218
 219         iu->buf = kzalloc(size, gfp_mask);
 220         if (!iu->buf)
 221                 goto out_free_iu;
 222
 223         iu->dma = ib_dma_map_single(host->srp_dev->dev, iu->buf, size,
 224                                     direction);
 225         if (ib_dma_mapping_error(host->srp_dev->dev, iu->dma))
 226                 goto out_free_buf;
 227
 228         iu->size      = size;
 229         iu->direction = direction;
 230
 231         return iu;
 232
 233 out_free_buf:
 234         kfree(iu->buf);
 235 out_free_iu:
 236         kfree(iu);
 237 out:
 238         return NULL;
 239 }
 240
 241 static void srp_free_iu(struct srp_host *host, struct srp_iu *iu)
 242 {
 243         if (!iu)
 244                 return;
 245
 246         ib_dma_unmap_single(host->srp_dev->dev, iu->dma, iu->size,
 247                             iu->direction);
 248         kfree(iu->buf);
 249         kfree(iu);
 250 }
 251
 252 static void srp_qp_event(struct ib_event *event, void *context)
 253 {
 254         pr_debug("QP event %s (%d)\n",
 255                  ib_event_msg(event->event), event->event);
 256 }
 257
 258 static int srp_init_qp(struct srp_target_port *target,
 259                        struct ib_qp *qp)
 260 {
 261         struct ib_qp_attr *attr;
 262         int ret;
 263
 264         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 265         if (!attr)
 266                 return -ENOMEM;
 267
 268         ret = ib_find_cached_pkey(target->srp_host->srp_dev->dev,
 269                                   target->srp_host->port,
 270                                   be16_to_cpu(target->pkey),
 271                                   &attr->pkey_index);
 272         if (ret)
 273                 goto out;
 274
 275         attr->qp_state        = IB_QPS_INIT;
 276         attr->qp_access_flags = (IB_ACCESS_REMOTE_READ |
 277                                     IB_ACCESS_REMOTE_WRITE);
 278         attr->port_num        = target->srp_host->port;
 279
 280         ret = ib_modify_qp(qp, attr,
 281                            IB_QP_STATE          |
 282                            IB_QP_PKEY_INDEX     |
 283                            IB_QP_ACCESS_FLAGS   |
 284                            IB_QP_PORT);
 285
 286 out:
 287         kfree(attr);
 288         return ret;
 289 }
 290
 291 static int srp_new_cm_id(struct srp_rdma_ch *ch)
 292 {
 293         struct srp_target_port *target = ch->target;
 294         struct ib_cm_id *new_cm_id;
 295
 296         new_cm_id = ib_create_cm_id(target->srp_host->srp_dev->dev,
 297                                     srp_cm_handler, ch);
 298         if (IS_ERR(new_cm_id))
 299                 return PTR_ERR(new_cm_id);
 300
 301         if (ch->cm_id)
 302                 ib_destroy_cm_id(ch->cm_id);
 303         ch->cm_id = new_cm_id;
 304         ch->path.sgid = target->sgid;
 305         ch->path.dgid = target->orig_dgid;
 306         ch->path.pkey = target->pkey;
 307         ch->path.service_id = target->service_id;
 308
 309         return 0;
 310 }
 311
 312 static struct ib_fmr_pool *srp_alloc_fmr_pool(struct srp_target_port *target)
 313 {
 314         struct srp_device *dev = target->srp_host->srp_dev;
 315         struct ib_fmr_pool_param fmr_param;
 316
 317         memset(&fmr_param, 0, sizeof(fmr_param));
 318         fmr_param.pool_size         = target->scsi_host->can_queue;
 319         fmr_param.dirty_watermark   = fmr_param.pool_size / 4;
 320         fmr_param.cache             = 1;
 321         fmr_param.max_pages_per_fmr = dev->max_pages_per_mr;
 322         fmr_param.page_shift        = ilog2(dev->mr_page_size);
 323         fmr_param.access            = (IB_ACCESS_LOCAL_WRITE |
 324                                        IB_ACCESS_REMOTE_WRITE |
 325                                        IB_ACCESS_REMOTE_READ);
 326
 327         return ib_create_fmr_pool(dev->pd, &fmr_param);
 328 }
 329
 330 /**
 331  * srp_destroy_fr_pool() - free the resources owned by a pool
 332  * @pool: Fast registration pool to be destroyed.
 333  */
 334 static void srp_destroy_fr_pool(struct srp_fr_pool *pool)
 335 {
 336         int i;
 337         struct srp_fr_desc *d;
 338
 339         if (!pool)
 340                 return;
 341
 342         for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
 343                 if (d->frpl)
 344                         ib_free_fast_reg_page_list(d->frpl);
 345                 if (d->mr)
 346                         ib_dereg_mr(d->mr);
 347         }
 348         kfree(pool);
 349 }
 350
 351 /**
 352  * srp_create_fr_pool() - allocate and initialize a pool for fast registration
 353  * @device:            IB device to allocate fast registration descriptors for.
 354  * @pd:                Protection domain associated with the FR descriptors.
 355  * @pool_size:         Number of descriptors to allocate.
 356  * @max_page_list_len: Maximum fast registration work request page list length.
 357  */
 358 static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
 359                                               struct ib_pd *pd, int pool_size,
 360                                               int max_page_list_len)
 361 {
 362         struct srp_fr_pool *pool;
 363         struct srp_fr_desc *d;
 364         struct ib_mr *mr;
 365         struct ib_fast_reg_page_list *frpl;
 366         int i, ret = -EINVAL;
 367
 368         if (pool_size <= 0)
 369                 goto err;
 370         ret = -ENOMEM;
 371         pool = kzalloc(sizeof(struct srp_fr_pool) +
 372                        pool_size * sizeof(struct srp_fr_desc), GFP_KERNEL);
 373         if (!pool)
 374                 goto err;
 375         pool->size = pool_size;
 376         pool->max_page_list_len = max_page_list_len;
 377         spin_lock_init(&pool->lock);
 378         INIT_LIST_HEAD(&pool->free_list);
 379
 380         for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
 381                 mr = ib_alloc_mr(pd, IB_MR_TYPE_MEM_REG,
 382                                  max_page_list_len);
 383                 if (IS_ERR(mr)) {
 384                         ret = PTR_ERR(mr);
 385                         goto destroy_pool;
 386                 }
 387                 d->mr = mr;
 388                 frpl = ib_alloc_fast_reg_page_list(device, max_page_list_len);
 389                 if (IS_ERR(frpl)) {
 390                         ret = PTR_ERR(frpl);
 391                         goto destroy_pool;
 392                 }
 393                 d->frpl = frpl;
 394                 list_add_tail(&d->entry, &pool->free_list);
 395         }
 396
 397 out:
 398         return pool;
 399
 400 destroy_pool:
 401         srp_destroy_fr_pool(pool);
 402
 403 err:
 404         pool = ERR_PTR(ret);
 405         goto out;
 406 }
 407
 408 /**
 409  * srp_fr_pool_get() - obtain a descriptor suitable for fast registration
 410  * @pool: Pool to obtain descriptor from.
 411  */
 412 static struct srp_fr_desc *srp_fr_pool_get(struct srp_fr_pool *pool)
 413 {
 414         struct srp_fr_desc *d = NULL;
 415         unsigned long flags;
 416
 417         spin_lock_irqsave(&pool->lock, flags);
 418         if (!list_empty(&pool->free_list)) {
 419                 d = list_first_entry(&pool->free_list, typeof(*d), entry);
 420                 list_del(&d->entry);
 421         }
 422         spin_unlock_irqrestore(&pool->lock, flags);
 423
 424         return d;
 425 }
 426
 427 /**
 428  * srp_fr_pool_put() - put an FR descriptor back in the free list
 429  * @pool: Pool the descriptor was allocated from.
 430  * @desc: Pointer to an array of fast registration descriptor pointers.
 431  * @n:    Number of descriptors to put back.
 432  *
 433  * Note: The caller must already have queued an invalidation request for
 434  * desc->mr->rkey before calling this function.
 435  */
 436 static void srp_fr_pool_put(struct srp_fr_pool *pool, struct srp_fr_desc **desc,
 437                             int n)
 438 {
 439         unsigned long flags;
 440         int i;
 441
 442         spin_lock_irqsave(&pool->lock, flags);
 443         for (i = 0; i < n; i++)
 444                 list_add(&desc[i]->entry, &pool->free_list);
 445         spin_unlock_irqrestore(&pool->lock, flags);
 446 }
 447
 448 static struct srp_fr_pool *srp_alloc_fr_pool(struct srp_target_port *target)
 449 {
 450         struct srp_device *dev = target->srp_host->srp_dev;
 451
 452         return srp_create_fr_pool(dev->dev, dev->pd,
 453                                   target->scsi_host->can_queue,
 454                                   dev->max_pages_per_mr);
 455 }
 456
 457 /**
 458  * srp_destroy_qp() - destroy an RDMA queue pair
 459  * @ch: SRP RDMA channel.
 460  *
 461  * Change a queue pair into the error state and wait until all receive
 462  * completions have been processed before destroying it. This avoids that
 463  * the receive completion handler can access the queue pair while it is
 464  * being destroyed.
 465  */
 466 static void srp_destroy_qp(struct srp_rdma_ch *ch)
 467 {
 468         static struct ib_qp_attr attr = { .qp_state = IB_QPS_ERR };
 469         static struct ib_recv_wr wr = { .wr_id = SRP_LAST_WR_ID };
 470         struct ib_recv_wr *bad_wr;
 471         int ret;
 472
 473         /* Destroying a QP and reusing ch->done is only safe if not connected */
 474         WARN_ON_ONCE(ch->connected);
 475
 476         ret = ib_modify_qp(ch->qp, &attr, IB_QP_STATE);
 477         WARN_ONCE(ret, "ib_cm_init_qp_attr() returned %d\n", ret);
 478         if (ret)
 479                 goto out;
 480
 481         init_completion(&ch->done);
 482         ret = ib_post_recv(ch->qp, &wr, &bad_wr);
 483         WARN_ONCE(ret, "ib_post_recv() returned %d\n", ret);
 484         if (ret == 0)
 485                 wait_for_completion(&ch->done);
 486
 487 out:
 488         ib_destroy_qp(ch->qp);
 489 }
 490
 491 static int srp_create_ch_ib(struct srp_rdma_ch *ch)
 492 {
 493         struct srp_target_port *target = ch->target;
 494         struct srp_device *dev = target->srp_host->srp_dev;
 495         struct ib_qp_init_attr *init_attr;
 496         struct ib_cq *recv_cq, *send_cq;
 497         struct ib_qp *qp;
 498         struct ib_fmr_pool *fmr_pool = NULL;
 499         struct srp_fr_pool *fr_pool = NULL;
 500         const int m = 1 + dev->use_fast_reg;
 501         struct ib_cq_init_attr cq_attr = {};
 502         int ret;
 503
 504         init_attr = kzalloc(sizeof *init_attr, GFP_KERNEL);
 505         if (!init_attr)
 506                 return -ENOMEM;
 507
 508         /* + 1 for SRP_LAST_WR_ID */
 509         cq_attr.cqe = target->queue_size + 1;
 510         cq_attr.comp_vector = ch->comp_vector;
 511         recv_cq = ib_create_cq(dev->dev, srp_recv_completion, NULL, ch,
 512                                &cq_attr);
 513         if (IS_ERR(recv_cq)) {
 514                 ret = PTR_ERR(recv_cq);
 515                 goto err;
 516         }
 517
 518         cq_attr.cqe = m * target->queue_size;
 519         cq_attr.comp_vector = ch->comp_vector;
 520         send_cq = ib_create_cq(dev->dev, srp_send_completion, NULL, ch,
 521                                &cq_attr);
 522         if (IS_ERR(send_cq)) {
 523                 ret = PTR_ERR(send_cq);
 524                 goto err_recv_cq;
 525         }
 526
 527         ib_req_notify_cq(recv_cq, IB_CQ_NEXT_COMP);
 528
 529         init_attr->event_handler       = srp_qp_event;
 530         init_attr->cap.max_send_wr     = m * target->queue_size;
 531         init_attr->cap.max_recv_wr     = target->queue_size + 1;
 532         init_attr->cap.max_recv_sge    = 1;
 533         init_attr->cap.max_send_sge    = 1;
 534         init_attr->sq_sig_type         = IB_SIGNAL_REQ_WR;
 535         init_attr->qp_type             = IB_QPT_RC;
 536         init_attr->send_cq             = send_cq;
 537         init_attr->recv_cq             = recv_cq;
 538
 539         qp = ib_create_qp(dev->pd, init_attr);
 540         if (IS_ERR(qp)) {
 541                 ret = PTR_ERR(qp);
 542                 goto err_send_cq;
 543         }
 544
 545         ret = srp_init_qp(target, qp);
 546         if (ret)
 547                 goto err_qp;
 548
 549         if (dev->use_fast_reg && dev->has_fr) {
 550                 fr_pool = srp_alloc_fr_pool(target);
 551                 if (IS_ERR(fr_pool)) {
 552                         ret = PTR_ERR(fr_pool);
 553                         shost_printk(KERN_WARNING, target->scsi_host, PFX
 554                                      "FR pool allocation failed (%d)\n", ret);
 555                         goto err_qp;
 556                 }
 557                 if (ch->fr_pool)
 558                         srp_destroy_fr_pool(ch->fr_pool);
 559                 ch->fr_pool = fr_pool;
 560         } else if (!dev->use_fast_reg && dev->has_fmr) {
 561                 fmr_pool = srp_alloc_fmr_pool(target);
 562                 if (IS_ERR(fmr_pool)) {
 563                         ret = PTR_ERR(fmr_pool);
 564                         shost_printk(KERN_WARNING, target->scsi_host, PFX
 565                                      "FMR pool allocation failed (%d)\n", ret);
 566                         goto err_qp;
 567                 }
 568                 if (ch->fmr_pool)
 569                         ib_destroy_fmr_pool(ch->fmr_pool);
 570                 ch->fmr_pool = fmr_pool;
 571         }
 572
 573         if (ch->qp)
 574                 srp_destroy_qp(ch);
 575         if (ch->recv_cq)
 576                 ib_destroy_cq(ch->recv_cq);
 577         if (ch->send_cq)
 578                 ib_destroy_cq(ch->send_cq);
 579
 580         ch->qp = qp;
 581         ch->recv_cq = recv_cq;
 582         ch->send_cq = send_cq;
 583
 584         kfree(init_attr);
 585         return 0;
 586
 587 err_qp:
 588         ib_destroy_qp(qp);
 589
 590 err_send_cq:
 591         ib_destroy_cq(send_cq);
 592
 593 err_recv_cq:
 594         ib_destroy_cq(recv_cq);
 595
 596 err:
 597         kfree(init_attr);
 598         return ret;
 599 }
 600
 601 /*
 602  * Note: this function may be called without srp_alloc_iu_bufs() having been
 603  * invoked. Hence the ch->[rt]x_ring checks.
 604  */
 605 static void srp_free_ch_ib(struct srp_target_port *target,
 606                            struct srp_rdma_ch *ch)
 607 {
 608         struct srp_device *dev = target->srp_host->srp_dev;
 609         int i;
 610
 611         if (!ch->target)
 612                 return;
 613
 614         if (ch->cm_id) {
 615                 ib_destroy_cm_id(ch->cm_id);
 616                 ch->cm_id = NULL;
 617         }
 618
 619         /* If srp_new_cm_id() succeeded but srp_create_ch_ib() not, return. */
 620         if (!ch->qp)
 621                 return;
 622
 623         if (dev->use_fast_reg) {
 624                 if (ch->fr_pool)
 625                         srp_destroy_fr_pool(ch->fr_pool);
 626         } else {
 627                 if (ch->fmr_pool)
 628                         ib_destroy_fmr_pool(ch->fmr_pool);
 629         }
 630         srp_destroy_qp(ch);
 631         ib_destroy_cq(ch->send_cq);
 632         ib_destroy_cq(ch->recv_cq);
 633
 634         /*
 635          * Avoid that the SCSI error handler tries to use this channel after
 636          * it has been freed. The SCSI error handler can namely continue
 637          * trying to perform recovery actions after scsi_remove_host()
 638          * returned.
 639          */
 640         ch->target = NULL;
 641
 642         ch->qp = NULL;
 643         ch->send_cq = ch->recv_cq = NULL;
 644
 645         if (ch->rx_ring) {
 646                 for (i = 0; i < target->queue_size; ++i)
 647                         srp_free_iu(target->srp_host, ch->rx_ring[i]);
 648                 kfree(ch->rx_ring);
 649                 ch->rx_ring = NULL;
 650         }
 651         if (ch->tx_ring) {
 652                 for (i = 0; i < target->queue_size; ++i)
 653                         srp_free_iu(target->srp_host, ch->tx_ring[i]);
 654                 kfree(ch->tx_ring);
 655                 ch->tx_ring = NULL;
 656         }
 657 }
 658
 659 static void srp_path_rec_completion(int status,
 660                                     struct ib_sa_path_rec *pathrec,
 661                                     void *ch_ptr)
 662 {
 663         struct srp_rdma_ch *ch = ch_ptr;
 664         struct srp_target_port *target = ch->target;
 665
 666         ch->status = status;
 667         if (status)
 668                 shost_printk(KERN_ERR, target->scsi_host,
 669                              PFX "Got failed path rec status %d\n", status);
 670         else
 671                 ch->path = *pathrec;
 672         complete(&ch->done);
 673 }
 674
 675 static int srp_lookup_path(struct srp_rdma_ch *ch)
 676 {
 677         struct srp_target_port *target = ch->target;
 678         int ret;
 679
 680         ch->path.numb_path = 1;
 681
 682         init_completion(&ch->done);
 683
 684         ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
 685                                                target->srp_host->srp_dev->dev,
 686                                                target->srp_host->port,
 687                                                &ch->path,
 688                                                IB_SA_PATH_REC_SERVICE_ID |
 689                                                IB_SA_PATH_REC_DGID       |
 690                                                IB_SA_PATH_REC_SGID       |
 691                                                IB_SA_PATH_REC_NUMB_PATH  |
 692                                                IB_SA_PATH_REC_PKEY,
 693                                                SRP_PATH_REC_TIMEOUT_MS,
 694                                                GFP_KERNEL,
 695                                                srp_path_rec_completion,
 696                                                ch, &ch->path_query);
 697         if (ch->path_query_id < 0)
 698                 return ch->path_query_id;
 699
 700         ret = wait_for_completion_interruptible(&ch->done);
 701         if (ret < 0)
 702                 return ret;
 703
 704         if (ch->status < 0)
 705                 shost_printk(KERN_WARNING, target->scsi_host,
 706                              PFX "Path record query failed\n");
 707
 708         return ch->status;
 709 }
 710
 711 static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
 712 {
 713         struct srp_target_port *target = ch->target;
 714         struct {
 715                 struct ib_cm_req_param param;
 716                 struct srp_login_req   priv;
 717         } *req = NULL;
 718         int status;
 719
 720         req = kzalloc(sizeof *req, GFP_KERNEL);
 721         if (!req)
 722                 return -ENOMEM;
 723
 724         req->param.primary_path               = &ch->path;
 725         req->param.alternate_path             = NULL;
 726         req->param.service_id                 = target->service_id;
 727         req->param.qp_num                     = ch->qp->qp_num;
 728         req->param.qp_type                    = ch->qp->qp_type;
 729         req->param.private_data               = &req->priv;
 730         req->param.private_data_len           = sizeof req->priv;
 731         req->param.flow_control               = 1;
 732
 733         get_random_bytes(&req->param.starting_psn, 4);
 734         req->param.starting_psn              &= 0xffffff;
 735
 736         /*
 737          * Pick some arbitrary defaults here; we could make these
 738          * module parameters if anyone cared about setting them.
 739          */
 740         req->param.responder_resources        = 4;
 741         req->param.remote_cm_response_timeout = 20;
 742         req->param.local_cm_response_timeout  = 20;
 743         req->param.retry_count                = target->tl_retry_count;
 744         req->param.rnr_retry_count            = 7;
 745         req->param.max_cm_retries             = 15;
 746
 747         req->priv.opcode        = SRP_LOGIN_REQ;
 748         req->priv.tag           = 0;
 749         req->priv.req_it_iu_len = cpu_to_be32(target->max_iu_len);
 750         req->priv.req_buf_fmt   = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
 751                                               SRP_BUF_FORMAT_INDIRECT);
 752         req->priv.req_flags     = (multich ? SRP_MULTICHAN_MULTI :
 753                                    SRP_MULTICHAN_SINGLE);
 754         /*
 755          * In the published SRP specification (draft rev. 16a), the
 756          * port identifier format is 8 bytes of ID extension followed
 757          * by 8 bytes of GUID.  Older drafts put the two halves in the
 758          * opposite order, so that the GUID comes first.
 759          *
 760          * Targets conforming to these obsolete drafts can be
 761          * recognized by the I/O Class they report.
 762          */
 763         if (target->io_class == SRP_REV10_IB_IO_CLASS) {
 764                 memcpy(req->priv.initiator_port_id,
 765                        &target->sgid.global.interface_id, 8);
 766                 memcpy(req->priv.initiator_port_id + 8,
 767                        &target->initiator_ext, 8);
 768                 memcpy(req->priv.target_port_id,     &target->ioc_guid, 8);
 769                 memcpy(req->priv.target_port_id + 8, &target->id_ext, 8);
 770         } else {
 771                 memcpy(req->priv.initiator_port_id,
 772                        &target->initiator_ext, 8);
 773                 memcpy(req->priv.initiator_port_id + 8,
 774                        &target->sgid.global.interface_id, 8);
 775                 memcpy(req->priv.target_port_id,     &target->id_ext, 8);
 776                 memcpy(req->priv.target_port_id + 8, &target->ioc_guid, 8);
 777         }
 778
 779         /*
 780          * Topspin/Cisco SRP targets will reject our login unless we
 781          * zero out the first 8 bytes of our initiator port ID and set
 782          * the second 8 bytes to the local node GUID.
 783          */
 784         if (srp_target_is_topspin(target)) {
 785                 shost_printk(KERN_DEBUG, target->scsi_host,
 786                              PFX "Topspin/Cisco initiator port ID workaround "
 787                              "activated for target GUID %016llx\n",
 788                              be64_to_cpu(target->ioc_guid));
 789                 memset(req->priv.initiator_port_id, 0, 8);
 790                 memcpy(req->priv.initiator_port_id + 8,
 791                        &target->srp_host->srp_dev->dev->node_guid, 8);
 792         }
 793
 794         status = ib_send_cm_req(ch->cm_id, &req->param);
 795
 796         kfree(req);
 797
 798         return status;
 799 }
 800
 801 static bool srp_queue_remove_work(struct srp_target_port *target)
 802 {
 803         bool changed = false;
 804
 805         spin_lock_irq(&target->lock);
 806         if (target->state != SRP_TARGET_REMOVED) {
 807                 target->state = SRP_TARGET_REMOVED;
 808                 changed = true;
 809         }
 810         spin_unlock_irq(&target->lock);
 811
 812         if (changed)
 813                 queue_work(srp_remove_wq, &target->remove_work);
 814
 815         return changed;
 816 }
 817
 818 static void srp_disconnect_target(struct srp_target_port *target)
 819 {
 820         struct srp_rdma_ch *ch;
 821         int i;
 822
 823         /* XXX should send SRP_I_LOGOUT request */
 824
 825         for (i = 0; i < target->ch_count; i++) {
 826                 ch = &target->ch[i];
 827                 ch->connected = false;
 828                 if (ch->cm_id && ib_send_cm_dreq(ch->cm_id, NULL, 0)) {
 829                         shost_printk(KERN_DEBUG, target->scsi_host,
 830                                      PFX "Sending CM DREQ failed\n");
 831                 }
 832         }
 833 }
 834
 835 static void srp_free_req_data(struct srp_target_port *target,
 836                               struct srp_rdma_ch *ch)
 837 {
 838         struct srp_device *dev = target->srp_host->srp_dev;
 839         struct ib_device *ibdev = dev->dev;
 840         struct srp_request *req;
 841         int i;
 842
 843         if (!ch->req_ring)
 844                 return;
 845
 846         for (i = 0; i < target->req_ring_size; ++i) {
 847                 req = &ch->req_ring[i];
 848                 if (dev->use_fast_reg)
 849                         kfree(req->fr_list);
 850                 else
 851                         kfree(req->fmr_list);
 852                 kfree(req->map_page);
 853                 if (req->indirect_dma_addr) {
 854                         ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
 855                                             target->indirect_size,
 856                                             DMA_TO_DEVICE);
 857                 }
 858                 kfree(req->indirect_desc);
 859         }
 860
 861         kfree(ch->req_ring);
 862         ch->req_ring = NULL;
 863 }
 864
 865 static int srp_alloc_req_data(struct srp_rdma_ch *ch)
 866 {
 867         struct srp_target_port *target = ch->target;
 868         struct srp_device *srp_dev = target->srp_host->srp_dev;
 869         struct ib_device *ibdev = srp_dev->dev;
 870         struct srp_request *req;
 871         void *mr_list;
 872         dma_addr_t dma_addr;
 873         int i, ret = -ENOMEM;
 874
 875         ch->req_ring = kcalloc(target->req_ring_size, sizeof(*ch->req_ring),
 876                                GFP_KERNEL);
 877         if (!ch->req_ring)
 878                 goto out;
 879
 880         for (i = 0; i < target->req_ring_size; ++i) {
 881                 req = &ch->req_ring[i];
 882                 mr_list = kmalloc(target->cmd_sg_cnt * sizeof(void *),
 883                                   GFP_KERNEL);
 884                 if (!mr_list)
 885                         goto out;
 886                 if (srp_dev->use_fast_reg)
 887                         req->fr_list = mr_list;
 888                 else
 889                         req->fmr_list = mr_list;
 890                 req->map_page = kmalloc(srp_dev->max_pages_per_mr *
 891                                         sizeof(void *), GFP_KERNEL);
 892                 if (!req->map_page)
 893                         goto out;
 894                 req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
 895                 if (!req->indirect_desc)
 896                         goto out;
 897
 898                 dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
 899                                              target->indirect_size,
 900                                              DMA_TO_DEVICE);
 901                 if (ib_dma_mapping_error(ibdev, dma_addr))
 902                         goto out;
 903
 904                 req->indirect_dma_addr = dma_addr;
 905         }
 906         ret = 0;
 907
 908 out:
 909         return ret;
 910 }
 911
 912 /**
 913  * srp_del_scsi_host_attr() - Remove attributes defined in the host template.
 914  * @shost: SCSI host whose attributes to remove from sysfs.
 915  *
 916  * Note: Any attributes defined in the host template and that did not exist
 917  * before invocation of this function will be ignored.
 918  */
 919 static void srp_del_scsi_host_attr(struct Scsi_Host *shost)
 920 {
 921         struct device_attribute **attr;
 922
 923         for (attr = shost->hostt->shost_attrs; attr && *attr; ++attr)
 924                 device_remove_file(&shost->shost_dev, *attr);
 925 }
 926
 927 static void srp_remove_target(struct srp_target_port *target)
 928 {
 929         struct srp_rdma_ch *ch;
 930         int i;
 931
 932         WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 933
 934         srp_del_scsi_host_attr(target->scsi_host);
 935         srp_rport_get(target->rport);
 936         srp_remove_host(target->scsi_host);
 937         scsi_remove_host(target->scsi_host);
 938         srp_stop_rport_timers(target->rport);
 939         srp_disconnect_target(target);
 940         for (i = 0; i < target->ch_count; i++) {
 941                 ch = &target->ch[i];
 942                 srp_free_ch_ib(target, ch);
 943         }
 944         cancel_work_sync(&target->tl_err_work);
 945         srp_rport_put(target->rport);
 946         for (i = 0; i < target->ch_count; i++) {
 947                 ch = &target->ch[i];
 948                 srp_free_req_data(target, ch);
 949         }
 950         kfree(target->ch);
 951         target->ch = NULL;
 952
 953         spin_lock(&target->srp_host->target_lock);
 954         list_del(&target->list);
 955         spin_unlock(&target->srp_host->target_lock);
 956
 957         scsi_host_put(target->scsi_host);
 958 }
 959
 960 static void srp_remove_work(struct work_struct *work)
 961 {
 962         struct srp_target_port *target =
 963                 container_of(work, struct srp_target_port, remove_work);
 964
 965         WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 966
 967         srp_remove_target(target);
 968 }
 969
 970 static void srp_rport_delete(struct srp_rport *rport)
 971 {
 972         struct srp_target_port *target = rport->lld_data;
 973
 974         srp_queue_remove_work(target);
 975 }
 976
 977 /**
 978  * srp_connected_ch() - number of connected channels
 979  * @target: SRP target port.
 980  */
 981 static int srp_connected_ch(struct srp_target_port *target)
 982 {
 983         int i, c = 0;
 984
 985         for (i = 0; i < target->ch_count; i++)
 986                 c += target->ch[i].connected;
 987
 988         return c;
 989 }
 990
 991 static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
 992 {
 993         struct srp_target_port *target = ch->target;
 994         int ret;
 995
 996         WARN_ON_ONCE(!multich && srp_connected_ch(target) > 0);
 997
 998         ret = srp_lookup_path(ch);
 999         if (ret)
1000                 return ret;
1001
1002         while (1) {
1003                 init_completion(&ch->done);
1004                 ret = srp_send_req(ch, multich);
1005                 if (ret)
1006                         return ret;
1007                 ret = wait_for_completion_interruptible(&ch->done);
1008                 if (ret < 0)
1009                         return ret;
1010
1011                 /*
1012                  * The CM event handling code will set status to
1013                  * SRP_PORT_REDIRECT if we get a port redirect REJ
1014                  * back, or SRP_DLID_REDIRECT if we get a lid/qp
1015                  * redirect REJ back.
1016                  */
1017                 switch (ch->status) {
1018                 case 0:
1019                         ch->connected = true;
1020                         return 0;
1021
1022                 case SRP_PORT_REDIRECT:
1023                         ret = srp_lookup_path(ch);
1024                         if (ret)
1025                                 return ret;
1026                         break;
1027
1028                 case SRP_DLID_REDIRECT:
1029                         break;
1030
1031                 case SRP_STALE_CONN:
1032                         shost_printk(KERN_ERR, target->scsi_host, PFX
1033                                      "giving up on stale connection\n");
1034                         ch->status = -ECONNRESET;
1035                         return ch->status;
1036
1037                 default:
1038                         return ch->status;
1039                 }
1040         }
1041 }
1042
1043 static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
1044 {
1045         struct ib_send_wr *bad_wr;
1046         struct ib_send_wr wr = {
1047                 .opcode             = IB_WR_LOCAL_INV,
1048                 .wr_id              = LOCAL_INV_WR_ID_MASK,
1049                 .next               = NULL,
1050                 .num_sge            = 0,
1051                 .send_flags         = 0,
1052                 .ex.invalidate_rkey = rkey,
1053         };
1054
1055         return ib_post_send(ch->qp, &wr, &bad_wr);
1056 }
1057
1058 static void srp_unmap_data(struct scsi_cmnd *scmnd,
1059                            struct srp_rdma_ch *ch,
1060                            struct srp_request *req)
1061 {
1062         struct srp_target_port *target = ch->target;
1063         struct srp_device *dev = target->srp_host->srp_dev;
1064         struct ib_device *ibdev = dev->dev;
1065         int i, res;
1066
1067         if (!scsi_sglist(scmnd) ||
1068             (scmnd->sc_data_direction != DMA_TO_DEVICE &&
1069              scmnd->sc_data_direction != DMA_FROM_DEVICE))
1070                 return;
1071
1072         if (dev->use_fast_reg) {
1073                 struct srp_fr_desc **pfr;
1074
1075                 for (i = req->nmdesc, pfr = req->fr_list; i > 0; i--, pfr++) {
1076                         res = srp_inv_rkey(ch, (*pfr)->mr->rkey);
1077                         if (res < 0) {
1078                                 shost_printk(KERN_ERR, target->scsi_host, PFX
1079                                   "Queueing INV WR for rkey %#x failed (%d)\n",
1080                                   (*pfr)->mr->rkey, res);
1081                                 queue_work(system_long_wq,
1082                                            &target->tl_err_work);
1083                         }
1084                 }
1085                 if (req->nmdesc)
1086                         srp_fr_pool_put(ch->fr_pool, req->fr_list,
1087                                         req->nmdesc);
1088         } else {
1089                 struct ib_pool_fmr **pfmr;
1090
1091                 for (i = req->nmdesc, pfmr = req->fmr_list; i > 0; i--, pfmr++)
1092                         ib_fmr_pool_unmap(*pfmr);
1093         }
1094
1095         ib_dma_unmap_sg(ibdev, scsi_sglist(scmnd), scsi_sg_count(scmnd),
1096                         scmnd->sc_data_direction);
1097 }
1098
1099 /**
1100  * srp_claim_req - Take ownership of the scmnd associated with a request.
1101  * @ch: SRP RDMA channel.
1102  * @req: SRP request.
1103  * @sdev: If not NULL, only take ownership for this SCSI device.
1104  * @scmnd: If NULL, take ownership of @req->scmnd. If not NULL, only take
1105  *         ownership of @req->scmnd if it equals @scmnd.
1106  *
1107  * Return value:
1108  * Either NULL or a pointer to the SCSI command the caller became owner of.
1109  */
1110 static struct scsi_cmnd *srp_claim_req(struct srp_rdma_ch *ch,
1111                                        struct srp_request *req,
1112                                        struct scsi_device *sdev,
1113                                        struct scsi_cmnd *scmnd)
1114 {
1115         unsigned long flags;
1116
1117         spin_lock_irqsave(&ch->lock, flags);
1118         if (req->scmnd &&
1119             (!sdev || req->scmnd->device == sdev) &&
1120             (!scmnd || req->scmnd == scmnd)) {
1121                 scmnd = req->scmnd;
1122                 req->scmnd = NULL;
1123         } else {
1124                 scmnd = NULL;
1125         }
1126         spin_unlock_irqrestore(&ch->lock, flags);
1127
1128         return scmnd;
1129 }
1130
1131 /**
1132  * srp_free_req() - Unmap data and add request to the free request list.
1133  * @ch:     SRP RDMA channel.
1134  * @req:    Request to be freed.
1135  * @scmnd:  SCSI command associated with @req.
1136  * @req_lim_delta: Amount to be added to @target->req_lim.
1137  */
1138 static void srp_free_req(struct srp_rdma_ch *ch, struct srp_request *req,
1139                          struct scsi_cmnd *scmnd, s32 req_lim_delta)
1140 {
1141         unsigned long flags;
1142
1143         srp_unmap_data(scmnd, ch, req);
1144
1145         spin_lock_irqsave(&ch->lock, flags);
1146         ch->req_lim += req_lim_delta;
1147         spin_unlock_irqrestore(&ch->lock, flags);
1148 }
1149
1150 static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req,
1151                            struct scsi_device *sdev, int result)
1152 {
1153         struct scsi_cmnd *scmnd = srp_claim_req(ch, req, sdev, NULL);
1154
1155         if (scmnd) {
1156                 srp_free_req(ch, req, scmnd, 0);
1157                 scmnd->result = result;
1158                 scmnd->scsi_done(scmnd);
1159         }
1160 }
1161
1162 static void srp_terminate_io(struct srp_rport *rport)
1163 {
1164         struct srp_target_port *target = rport->lld_data;
1165         struct srp_rdma_ch *ch;
1166         struct Scsi_Host *shost = target->scsi_host;
1167         struct scsi_device *sdev;
1168         int i, j;
1169
1170         /*
1171          * Invoking srp_terminate_io() while srp_queuecommand() is running
1172          * is not safe. Hence the warning statement below.
1173          */
1174         shost_for_each_device(sdev, shost)
1175                 WARN_ON_ONCE(sdev->request_queue->request_fn_active);
1176
1177         for (i = 0; i < target->ch_count; i++) {
1178                 ch = &target->ch[i];
1179
1180                 for (j = 0; j < target->req_ring_size; ++j) {
1181                         struct srp_request *req = &ch->req_ring[j];
1182
1183                         srp_finish_req(ch, req, NULL,
1184                                        DID_TRANSPORT_FAILFAST << 16);
1185                 }
1186         }
1187 }
1188
1189 /*
1190  * It is up to the caller to ensure that srp_rport_reconnect() calls are
1191  * serialized and that no concurrent srp_queuecommand(), srp_abort(),
1192  * srp_reset_device() or srp_reset_host() calls will occur while this function
1193  * is in progress. One way to realize that is not to call this function
1194  * directly but to call srp_reconnect_rport() instead since that last function
1195  * serializes calls of this function via rport->mutex and also blocks
1196  * srp_queuecommand() calls before invoking this function.
1197  */
1198 static int srp_rport_reconnect(struct srp_rport *rport)
1199 {
1200         struct srp_target_port *target = rport->lld_data;
1201         struct srp_rdma_ch *ch;
1202         int i, j, ret = 0;
1203         bool multich = false;
1204
1205         srp_disconnect_target(target);
1206
1207         if (target->state == SRP_TARGET_SCANNING)
1208                 return -ENODEV;
1209
1210         /*
1211          * Now get a new local CM ID so that we avoid confusing the target in
1212          * case things are really fouled up. Doing so also ensures that all CM
1213          * callbacks will have finished before a new QP is allocated.
1214          */
1215         for (i = 0; i < target->ch_count; i++) {
1216                 ch = &target->ch[i];
1217                 ret += srp_new_cm_id(ch);
1218         }
1219         for (i = 0; i < target->ch_count; i++) {
1220                 ch = &target->ch[i];
1221                 for (j = 0; j < target->req_ring_size; ++j) {
1222                         struct srp_request *req = &ch->req_ring[j];
1223
1224                         srp_finish_req(ch, req, NULL, DID_RESET << 16);
1225                 }
1226         }
1227         for (i = 0; i < target->ch_count; i++) {
1228                 ch = &target->ch[i];
1229                 /*
1230                  * Whether or not creating a new CM ID succeeded, create a new
1231                  * QP. This guarantees that all completion callback function
1232                  * invocations have finished before request resetting starts.
1233                  */
1234                 ret += srp_create_ch_ib(ch);
1235
1236                 INIT_LIST_HEAD(&ch->free_tx);
1237                 for (j = 0; j < target->queue_size; ++j)
1238                         list_add(&ch->tx_ring[j]->list, &ch->free_tx);
1239         }
1240
1241         target->qp_in_error = false;
1242
1243         for (i = 0; i < target->ch_count; i++) {
1244                 ch = &target->ch[i];
1245                 if (ret)
1246                         break;
1247                 ret = srp_connect_ch(ch, multich);
1248                 multich = true;
1249         }
1250
1251         if (ret == 0)
1252                 shost_printk(KERN_INFO, target->scsi_host,
1253                              PFX "reconnect succeeded\n");
1254
1255         return ret;
1256 }
1257
1258 static void srp_map_desc(struct srp_map_state *state, dma_addr_t dma_addr,
1259                          unsigned int dma_len, u32 rkey)
1260 {
1261         struct srp_direct_buf *desc = state->desc;
1262
1263         WARN_ON_ONCE(!dma_len);
1264
1265         desc->va = cpu_to_be64(dma_addr);
1266         desc->key = cpu_to_be32(rkey);
1267         desc->len = cpu_to_be32(dma_len);
1268
1269         state->total_len += dma_len;
1270         state->desc++;
1271         state->ndesc++;
1272 }
1273
1274 static int srp_map_finish_fmr(struct srp_map_state *state,
1275                               struct srp_rdma_ch *ch)
1276 {
1277         struct srp_target_port *target = ch->target;
1278         struct srp_device *dev = target->srp_host->srp_dev;
1279         struct ib_pool_fmr *fmr;
1280         u64 io_addr = 0;
1281
1282         if (state->fmr.next >= state->fmr.end)
1283                 return -ENOMEM;
1284
1285         fmr = ib_fmr_pool_map_phys(ch->fmr_pool, state->pages,
1286                                    state->npages, io_addr);
1287         if (IS_ERR(fmr))
1288                 return PTR_ERR(fmr);
1289
1290         *state->fmr.next++ = fmr;
1291         state->nmdesc++;
1292
1293         srp_map_desc(state, state->base_dma_addr & ~dev->mr_page_mask,
1294                      state->dma_len, fmr->fmr->rkey);
1295
1296         return 0;
1297 }
1298
1299 static int srp_map_finish_fr(struct srp_map_state *state,
1300                              struct srp_rdma_ch *ch)
1301 {
1302         struct srp_target_port *target = ch->target;
1303         struct srp_device *dev = target->srp_host->srp_dev;
1304         struct ib_send_wr *bad_wr;
1305         struct ib_send_wr wr;
1306         struct srp_fr_desc *desc;
1307         u32 rkey;
1308
1309         if (state->fr.next >= state->fr.end)
1310                 return -ENOMEM;
1311
1312         desc = srp_fr_pool_get(ch->fr_pool);
1313         if (!desc)
1314                 return -ENOMEM;
1315
1316         rkey = ib_inc_rkey(desc->mr->rkey);
1317         ib_update_fast_reg_key(desc->mr, rkey);
1318
1319         memcpy(desc->frpl->page_list, state->pages,
1320                sizeof(state->pages[0]) * state->npages);
1321
1322         memset(&wr, 0, sizeof(wr));
1323         wr.opcode = IB_WR_FAST_REG_MR;
1324         wr.wr_id = FAST_REG_WR_ID_MASK;
1325         wr.wr.fast_reg.iova_start = state->base_dma_addr;
1326         wr.wr.fast_reg.page_list = desc->frpl;
1327         wr.wr.fast_reg.page_list_len = state->npages;
1328         wr.wr.fast_reg.page_shift = ilog2(dev->mr_page_size);
1329         wr.wr.fast_reg.length = state->dma_len;
1330         wr.wr.fast_reg.access_flags = (IB_ACCESS_LOCAL_WRITE |
1331                                        IB_ACCESS_REMOTE_READ |
1332                                        IB_ACCESS_REMOTE_WRITE);
1333         wr.wr.fast_reg.rkey = desc->mr->lkey;
1334
1335         *state->fr.next++ = desc;
1336         state->nmdesc++;
1337
1338         srp_map_desc(state, state->base_dma_addr, state->dma_len,
1339                      desc->mr->rkey);
1340
1341         return ib_post_send(ch->qp, &wr, &bad_wr);
1342 }
1343
1344 static int srp_finish_mapping(struct srp_map_state *state,
1345                               struct srp_rdma_ch *ch)
1346 {
1347         struct srp_target_port *target = ch->target;
1348         int ret = 0;
1349
1350         if (state->npages == 0)
1351                 return 0;
1352
1353         if (state->npages == 1 && !register_always)
1354                 srp_map_desc(state, state->base_dma_addr, state->dma_len,
1355                              target->rkey);
1356         else
1357                 ret = target->srp_host->srp_dev->use_fast_reg ?
1358                         srp_map_finish_fr(state, ch) :
1359                         srp_map_finish_fmr(state, ch);
1360
1361         if (ret == 0) {
1362                 state->npages = 0;
1363                 state->dma_len = 0;
1364         }
1365
1366         return ret;
1367 }
1368
1369 static int srp_map_sg_entry(struct srp_map_state *state,
1370                             struct srp_rdma_ch *ch,
1371                             struct scatterlist *sg, int sg_index)
1372 {
1373         struct srp_target_port *target = ch->target;
1374         struct srp_device *dev = target->srp_host->srp_dev;
1375         struct ib_device *ibdev = dev->dev;
1376         dma_addr_t dma_addr = ib_sg_dma_address(ibdev, sg);
1377         unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
1378         unsigned int len = 0;
1379         int ret;
1380
1381         WARN_ON_ONCE(!dma_len);
1382
1383         while (dma_len) {
1384                 unsigned offset = dma_addr & ~dev->mr_page_mask;
1385                 if (state->npages == dev->max_pages_per_mr || offset != 0) {
1386                         ret = srp_finish_mapping(state, ch);
1387                         if (ret)
1388                                 return ret;
1389                 }
1390
1391                 len = min_t(unsigned int, dma_len, dev->mr_page_size - offset);
1392
1393                 if (!state->npages)
1394                         state->base_dma_addr = dma_addr;
1395                 state->pages[state->npages++] = dma_addr & dev->mr_page_mask;
1396                 state->dma_len += len;
1397                 dma_addr += len;
1398                 dma_len -= len;
1399         }
1400
1401         /*
1402          * If the last entry of the MR wasn't a full page, then we need to
1403          * close it out and start a new one -- we can only merge at page
1404          * boundries.
1405          */
1406         ret = 0;
1407         if (len != dev->mr_page_size)
1408                 ret = srp_finish_mapping(state, ch);
1409         return ret;
1410 }
1411
1412 static int srp_map_sg(struct srp_map_state *state, struct srp_rdma_ch *ch,
1413                       struct srp_request *req, struct scatterlist *scat,
1414                       int count)
1415 {
1416         struct srp_target_port *target = ch->target;
1417         struct srp_device *dev = target->srp_host->srp_dev;
1418         struct scatterlist *sg;
1419         int i, ret;
1420         bool use_mr;
1421
1422         state->desc     = req->indirect_desc;
1423         state->pages    = req->map_page;
1424         if (dev->use_fast_reg) {
1425                 state->fr.next = req->fr_list;
1426                 state->fr.end = req->fr_list + target->cmd_sg_cnt;
1427                 use_mr = !!ch->fr_pool;
1428         } else {
1429                 state->fmr.next = req->fmr_list;
1430                 state->fmr.end = req->fmr_list + target->cmd_sg_cnt;
1431                 use_mr = !!ch->fmr_pool;
1432         }
1433
1434         if (use_mr) {
1435                 for_each_sg(scat, sg, count, i) {
1436                         ret = srp_map_sg_entry(state, ch, sg, i);
1437                         if (ret)
1438                                 goto out;
1439                 }
1440                 ret = srp_finish_mapping(state, ch);
1441                 if (ret)
1442                         goto out;
1443         } else {
1444                 for_each_sg(scat, sg, count, i) {
1445                         srp_map_desc(state, ib_sg_dma_address(dev->dev, sg),
1446                                      ib_sg_dma_len(dev->dev, sg), target->rkey);
1447                 }
1448         }
1449
1450         req->nmdesc = state->nmdesc;
1451         ret = 0;
1452
1453 out:
1454         return ret;
1455 }
1456
1457 static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_rdma_ch *ch,
1458                         struct srp_request *req)
1459 {
1460         struct srp_target_port *target = ch->target;
1461         struct scatterlist *scat;
1462         struct srp_cmd *cmd = req->cmd->buf;
1463         int len, nents, count;
1464         struct srp_device *dev;
1465         struct ib_device *ibdev;
1466         struct srp_map_state state;
1467         struct srp_indirect_buf *indirect_hdr;
1468         u32 table_len;
1469         u8 fmt;
1470
1471         if (!scsi_sglist(scmnd) || scmnd->sc_data_direction == DMA_NONE)
1472                 return sizeof (struct srp_cmd);
1473
1474         if (scmnd->sc_data_direction != DMA_FROM_DEVICE &&
1475             scmnd->sc_data_direction != DMA_TO_DEVICE) {
1476                 shost_printk(KERN_WARNING, target->scsi_host,
1477                              PFX "Unhandled data direction %d\n",
1478                              scmnd->sc_data_direction);
1479                 return -EINVAL;
1480         }
1481
1482         nents = scsi_sg_count(scmnd);
1483         scat  = scsi_sglist(scmnd);
1484
1485         dev = target->srp_host->srp_dev;
1486         ibdev = dev->dev;
1487
1488         count = ib_dma_map_sg(ibdev, scat, nents, scmnd->sc_data_direction);
1489         if (unlikely(count == 0))
1490                 return -EIO;
1491
1492         fmt = SRP_DATA_DESC_DIRECT;
1493         len = sizeof (struct srp_cmd) + sizeof (struct srp_direct_buf);
1494
1495         if (count == 1 && !register_always) {
1496                 /*
1497                  * The midlayer only generated a single gather/scatter
1498                  * entry, or DMA mapping coalesced everything to a
1499                  * single entry.  So a direct descriptor along with
1500                  * the DMA MR suffices.
1501                  */
1502                 struct srp_direct_buf *buf = (void *) cmd->add_data;
1503
1504                 buf->va  = cpu_to_be64(ib_sg_dma_address(ibdev, scat));
1505                 buf->key = cpu_to_be32(target->rkey);
1506                 buf->len = cpu_to_be32(ib_sg_dma_len(ibdev, scat));
1507
1508                 req->nmdesc = 0;
1509                 goto map_complete;
1510         }
1511
1512         /*
1513          * We have more than one scatter/gather entry, so build our indirect
1514          * descriptor table, trying to merge as many entries as we can.
1515          */
1516         indirect_hdr = (void *) cmd->add_data;
1517
1518         ib_dma_sync_single_for_cpu(ibdev, req->indirect_dma_addr,
1519                                    target->indirect_size, DMA_TO_DEVICE);
1520
1521         memset(&state, 0, sizeof(state));
1522         srp_map_sg(&state, ch, req, scat, count);
1523
1524         /* We've mapped the request, now pull as much of the indirect
1525          * descriptor table as we can into the command buffer. If this
1526          * target is not using an external indirect table, we are
1527          * guaranteed to fit into the command, as the SCSI layer won't
1528          * give us more S/G entries than we allow.
1529          */
1530         if (state.ndesc == 1) {
1531                 /*
1532                  * Memory registration collapsed the sg-list into one entry,
1533                  * so use a direct descriptor.
1534                  */
1535                 struct srp_direct_buf *buf = (void *) cmd->add_data;
1536
1537                 *buf = req->indirect_desc[0];
1538                 goto map_complete;
1539         }
1540
1541         if (unlikely(target->cmd_sg_cnt < state.ndesc &&
1542                                                 !target->allow_ext_sg)) {
1543                 shost_printk(KERN_ERR, target->scsi_host,
1544                              "Could not fit S/G list into SRP_CMD\n");
1545                 return -EIO;
1546         }
1547
1548         count = min(state.ndesc, target->cmd_sg_cnt);
1549         table_len = state.ndesc * sizeof (struct srp_direct_buf);
1550
1551         fmt = SRP_DATA_DESC_INDIRECT;
1552         len = sizeof(struct srp_cmd) + sizeof (struct srp_indirect_buf);
1553         len += count * sizeof (struct srp_direct_buf);
1554
1555         memcpy(indirect_hdr->desc_list, req->indirect_desc,
1556                count * sizeof (struct srp_direct_buf));
1557
1558         indirect_hdr->table_desc.va = cpu_to_be64(req->indirect_dma_addr);
1559         indirect_hdr->table_desc.key = cpu_to_be32(target->rkey);
1560         indirect_hdr->table_desc.len = cpu_to_be32(table_len);
1561         indirect_hdr->len = cpu_to_be32(state.total_len);
1562
1563         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
1564                 cmd->data_out_desc_cnt = count;
1565         else
1566                 cmd->data_in_desc_cnt = count;
1567
1568         ib_dma_sync_single_for_device(ibdev, req->indirect_dma_addr, table_len,
1569                                       DMA_TO_DEVICE);
1570
1571 map_complete:
1572         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
1573                 cmd->buf_fmt = fmt << 4;
1574         else
1575                 cmd->buf_fmt = fmt;
1576
1577         return len;
1578 }
1579
1580 /*
1581  * Return an IU and possible credit to the free pool
1582  */
1583 static void srp_put_tx_iu(struct srp_rdma_ch *ch, struct srp_iu *iu,
1584                           enum srp_iu_type iu_type)
1585 {
1586         unsigned long flags;
1587
1588         spin_lock_irqsave(&ch->lock, flags);
1589         list_add(&iu->list, &ch->free_tx);
1590         if (iu_type != SRP_IU_RSP)
1591                 ++ch->req_lim;
1592         spin_unlock_irqrestore(&ch->lock, flags);
1593 }
1594
1595 /*
1596  * Must be called with ch->lock held to protect req_lim and free_tx.
1597  * If IU is not sent, it must be returned using srp_put_tx_iu().
1598  *
1599  * Note:
1600  * An upper limit for the number of allocated information units for each
1601  * request type is:
1602  * - SRP_IU_CMD: SRP_CMD_SQ_SIZE, since the SCSI mid-layer never queues
1603  *   more than Scsi_Host.can_queue requests.
1604  * - SRP_IU_TSK_MGMT: SRP_TSK_MGMT_SQ_SIZE.
1605  * - SRP_IU_RSP: 1, since a conforming SRP target never sends more than
1606  *   one unanswered SRP request to an initiator.
1607  */
1608 static struct srp_iu *__srp_get_tx_iu(struct srp_rdma_ch *ch,
1609                                       enum srp_iu_type iu_type)
1610 {
1611         struct srp_target_port *target = ch->target;
1612         s32 rsv = (iu_type == SRP_IU_TSK_MGMT) ? 0 : SRP_TSK_MGMT_SQ_SIZE;
1613         struct srp_iu *iu;
1614
1615         srp_send_completion(ch->send_cq, ch);
1616
1617         if (list_empty(&ch->free_tx))
1618                 return NULL;
1619
1620         /* Initiator responses to target requests do not consume credits */
1621         if (iu_type != SRP_IU_RSP) {
1622                 if (ch->req_lim <= rsv) {
1623                         ++target->zero_req_lim;
1624                         return NULL;
1625                 }
1626
1627                 --ch->req_lim;
1628         }
1629
1630         iu = list_first_entry(&ch->free_tx, struct srp_iu, list);
1631         list_del(&iu->list);
1632         return iu;
1633 }
1634
1635 static int srp_post_send(struct srp_rdma_ch *ch, struct srp_iu *iu, int len)
1636 {
1637         struct srp_target_port *target = ch->target;
1638         struct ib_sge list;
1639         struct ib_send_wr wr, *bad_wr;
1640
1641         list.addr   = iu->dma;
1642         list.length = len;
1643         list.lkey   = target->lkey;
1644
1645         wr.next       = NULL;
1646         wr.wr_id      = (uintptr_t) iu;
1647         wr.sg_list    = &list;
1648         wr.num_sge    = 1;
1649         wr.opcode     = IB_WR_SEND;
1650         wr.send_flags = IB_SEND_SIGNALED;
1651
1652         return ib_post_send(ch->qp, &wr, &bad_wr);
1653 }
1654
1655 static int srp_post_recv(struct srp_rdma_ch *ch, struct srp_iu *iu)
1656 {
1657         struct srp_target_port *target = ch->target;
1658         struct ib_recv_wr wr, *bad_wr;
1659         struct ib_sge list;
1660
1661         list.addr   = iu->dma;
1662         list.length = iu->size;
1663         list.lkey   = target->lkey;
1664
1665         wr.next     = NULL;
1666         wr.wr_id    = (uintptr_t) iu;
1667         wr.sg_list  = &list;
1668         wr.num_sge  = 1;
1669
1670         return ib_post_recv(ch->qp, &wr, &bad_wr);
1671 }
1672
1673 static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
1674 {
1675         struct srp_target_port *target = ch->target;
1676         struct srp_request *req;
1677         struct scsi_cmnd *scmnd;
1678         unsigned long flags;
1679
1680         if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
1681                 spin_lock_irqsave(&ch->lock, flags);
1682                 ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
1683                 spin_unlock_irqrestore(&ch->lock, flags);
1684
1685                 ch->tsk_mgmt_status = -1;
1686                 if (be32_to_cpu(rsp->resp_data_len) >= 4)
1687                         ch->tsk_mgmt_status = rsp->data[3];
1688                 complete(&ch->tsk_mgmt_done);
1689         } else {
1690                 scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
1691                 if (scmnd) {
1692                         req = (void *)scmnd->host_scribble;
1693                         scmnd = srp_claim_req(ch, req, NULL, scmnd);
1694                 }
1695                 if (!scmnd) {
1696                         shost_printk(KERN_ERR, target->scsi_host,
1697                                      "Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
1698                                      rsp->tag, ch - target->ch, ch->qp->qp_num);
1699
1700                         spin_lock_irqsave(&ch->lock, flags);
1701                         ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
1702                         spin_unlock_irqrestore(&ch->lock, flags);
1703
1704                         return;
1705                 }
1706                 scmnd->result = rsp->status;
1707
1708                 if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
1709                         memcpy(scmnd->sense_buffer, rsp->data +
1710                                be32_to_cpu(rsp->resp_data_len),
1711                                min_t(int, be32_to_cpu(rsp->sense_data_len),
1712                                      SCSI_SENSE_BUFFERSIZE));
1713                 }
1714
1715                 if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER))
1716                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
1717                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DIOVER))
1718                         scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_in_res_cnt));
1719                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOUNDER))
1720                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
1721                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOOVER))
1722                         scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_out_res_cnt));
1723
1724                 srp_free_req(ch, req, scmnd,
1725                              be32_to_cpu(rsp->req_lim_delta));
1726
1727                 scmnd->host_scribble = NULL;
1728                 scmnd->scsi_done(scmnd);
1729         }
1730 }
1731
1732 static int srp_response_common(struct srp_rdma_ch *ch, s32 req_delta,
1733                                void *rsp, int len)
1734 {
1735         struct srp_target_port *target = ch->target;
1736         struct ib_device *dev = target->srp_host->srp_dev->dev;
1737         unsigned long flags;
1738         struct srp_iu *iu;
1739         int err;
1740
1741         spin_lock_irqsave(&ch->lock, flags);
1742         ch->req_lim += req_delta;
1743         iu = __srp_get_tx_iu(ch, SRP_IU_RSP);
1744         spin_unlock_irqrestore(&ch->lock, flags);
1745
1746         if (!iu) {
1747                 shost_printk(KERN_ERR, target->scsi_host, PFX
1748                              "no IU available to send response\n");
1749                 return 1;
1750         }
1751
1752         ib_dma_sync_single_for_cpu(dev, iu->dma, len, DMA_TO_DEVICE);
1753         memcpy(iu->buf, rsp, len);
1754         ib_dma_sync_single_for_device(dev, iu->dma, len, DMA_TO_DEVICE);
1755
1756         err = srp_post_send(ch, iu, len);
1757         if (err) {
1758                 shost_printk(KERN_ERR, target->scsi_host, PFX
1759                              "unable to post response: %d\n", err);
1760                 srp_put_tx_iu(ch, iu, SRP_IU_RSP);
1761         }
1762
1763         return err;
1764 }
1765
1766 static void srp_process_cred_req(struct srp_rdma_ch *ch,
1767                                  struct srp_cred_req *req)
1768 {
1769         struct srp_cred_rsp rsp = {
1770                 .opcode = SRP_CRED_RSP,
1771                 .tag = req->tag,
1772         };
1773         s32 delta = be32_to_cpu(req->req_lim_delta);
1774
1775         if (srp_response_common(ch, delta, &rsp, sizeof(rsp)))
1776                 shost_printk(KERN_ERR, ch->target->scsi_host, PFX
1777                              "problems processing SRP_CRED_REQ\n");
1778 }
1779
1780 static void srp_process_aer_req(struct srp_rdma_ch *ch,
1781                                 struct srp_aer_req *req)
1782 {
1783         struct srp_target_port *target = ch->target;
1784         struct srp_aer_rsp rsp = {
1785                 .opcode = SRP_AER_RSP,
1786                 .tag = req->tag,
1787         };
1788         s32 delta = be32_to_cpu(req->req_lim_delta);
1789
1790         shost_printk(KERN_ERR, target->scsi_host, PFX
1791                      "ignoring AER for LUN %llu\n", scsilun_to_int(&req->lun));
1792
1793         if (srp_response_common(ch, delta, &rsp, sizeof(rsp)))
1794                 shost_printk(KERN_ERR, target->scsi_host, PFX
1795                              "problems processing SRP_AER_REQ\n");
1796 }
1797
1798 static void srp_handle_recv(struct srp_rdma_ch *ch, struct ib_wc *wc)
1799 {
1800         struct srp_target_port *target = ch->target;
1801         struct ib_device *dev = target->srp_host->srp_dev->dev;
1802         struct srp_iu *iu = (struct srp_iu *) (uintptr_t) wc->wr_id;
1803         int res;
1804         u8 opcode;
1805
1806         ib_dma_sync_single_for_cpu(dev, iu->dma, ch->max_ti_iu_len,
1807                                    DMA_FROM_DEVICE);
1808
1809         opcode = *(u8 *) iu->buf;
1810
1811         if (0) {
1812                 shost_printk(KERN_ERR, target->scsi_host,
1813                              PFX "recv completion, opcode 0x%02x\n", opcode);
1814                 print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 8, 1,
1815                                iu->buf, wc->byte_len, true);
1816         }
1817
1818         switch (opcode) {
1819         case SRP_RSP:
1820                 srp_process_rsp(ch, iu->buf);
1821                 break;
1822
1823         case SRP_CRED_REQ:
1824                 srp_process_cred_req(ch, iu->buf);
1825                 break;
1826
1827         case SRP_AER_REQ:
1828                 srp_process_aer_req(ch, iu->buf);
1829                 break;
1830
1831         case SRP_T_LOGOUT:
1832                 /* XXX Handle target logout */
1833                 shost_printk(KERN_WARNING, target->scsi_host,
1834                              PFX "Got target logout request\n");
1835                 break;
1836
1837         default:
1838                 shost_printk(KERN_WARNING, target->scsi_host,
1839                              PFX "Unhandled SRP opcode 0x%02x\n", opcode);
1840                 break;
1841         }
1842
1843         ib_dma_sync_single_for_device(dev, iu->dma, ch->max_ti_iu_len,
1844                                       DMA_FROM_DEVICE);
1845
1846         res = srp_post_recv(ch, iu);
1847         if (res != 0)
1848                 shost_printk(KERN_ERR, target->scsi_host,
1849                              PFX "Recv failed with error code %d\n", res);
1850 }
1851
1852 /**
1853  * srp_tl_err_work() - handle a transport layer error
1854  * @work: Work structure embedded in an SRP target port.
1855  *
1856  * Note: This function may get invoked before the rport has been created,
1857  * hence the target->rport test.
1858  */
1859 static void srp_tl_err_work(struct work_struct *work)
1860 {
1861         struct srp_target_port *target;
1862
1863         target = container_of(work, struct srp_target_port, tl_err_work);
1864         if (target->rport)
1865                 srp_start_tl_fail_timers(target->rport);
1866 }
1867
1868 static void srp_handle_qp_err(u64 wr_id, enum ib_wc_status wc_status,
1869                               bool send_err, struct srp_rdma_ch *ch)
1870 {
1871         struct srp_target_port *target = ch->target;
1872
1873         if (wr_id == SRP_LAST_WR_ID) {
1874                 complete(&ch->done);
1875                 return;
1876         }
1877
1878         if (ch->connected && !target->qp_in_error) {
1879                 if (wr_id & LOCAL_INV_WR_ID_MASK) {
1880                         shost_printk(KERN_ERR, target->scsi_host, PFX
1881                                      "LOCAL_INV failed with status %s (%d)\n",
1882                                      ib_wc_status_msg(wc_status), wc_status);
1883                 } else if (wr_id & FAST_REG_WR_ID_MASK) {
1884                         shost_printk(KERN_ERR, target->scsi_host, PFX
1885                                      "FAST_REG_MR failed status %s (%d)\n",
1886                                      ib_wc_status_msg(wc_status), wc_status);
1887                 } else {
1888                         shost_printk(KERN_ERR, target->scsi_host,
1889                                      PFX "failed %s status %s (%d) for iu %p\n",
1890                                      send_err ? "send" : "receive",
1891                                      ib_wc_status_msg(wc_status), wc_status,
1892                                      (void *)(uintptr_t)wr_id);
1893                 }
1894                 queue_work(system_long_wq, &target->tl_err_work);
1895         }
1896         target->qp_in_error = true;
1897 }
1898
1899 static void srp_recv_completion(struct ib_cq *cq, void *ch_ptr)
1900 {
1901         struct srp_rdma_ch *ch = ch_ptr;
1902         struct ib_wc wc;
1903
1904         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
1905         while (ib_poll_cq(cq, 1, &wc) > 0) {
1906                 if (likely(wc.status == IB_WC_SUCCESS)) {
1907                         srp_handle_recv(ch, &wc);
1908                 } else {
1909                         srp_handle_qp_err(wc.wr_id, wc.status, false, ch);
1910                 }
1911         }
1912 }
1913
1914 static void srp_send_completion(struct ib_cq *cq, void *ch_ptr)
1915 {
1916         struct srp_rdma_ch *ch = ch_ptr;
1917         struct ib_wc wc;
1918         struct srp_iu *iu;
1919
1920         while (ib_poll_cq(cq, 1, &wc) > 0) {
1921                 if (likely(wc.status == IB_WC_SUCCESS)) {
1922                         iu = (struct srp_iu *) (uintptr_t) wc.wr_id;
1923                         list_add(&iu->list, &ch->free_tx);
1924                 } else {
1925                         srp_handle_qp_err(wc.wr_id, wc.status, true, ch);
1926                 }
1927         }
1928 }
1929
1930 static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
1931 {
1932         struct srp_target_port *target = host_to_target(shost);
1933         struct srp_rport *rport = target->rport;
1934         struct srp_rdma_ch *ch;
1935         struct srp_request *req;
1936         struct srp_iu *iu;
1937         struct srp_cmd *cmd;
1938         struct ib_device *dev;
1939         unsigned long flags;
1940         u32 tag;
1941         u16 idx;
1942         int len, ret;
1943         const bool in_scsi_eh = !in_interrupt() && current == shost->ehandler;
1944
1945         /*
1946          * The SCSI EH thread is the only context from which srp_queuecommand()
1947          * can get invoked for blocked devices (SDEV_BLOCK /
1948          * SDEV_CREATED_BLOCK). Avoid racing with srp_reconnect_rport() by
1949          * locking the rport mutex if invoked from inside the SCSI EH.
1950          */
1951         if (in_scsi_eh)
1952                 mutex_lock(&rport->mutex);
1953
1954         scmnd->result = srp_chkready(target->rport);
1955         if (unlikely(scmnd->result))
1956                 goto err;
1957
1958         WARN_ON_ONCE(scmnd->request->tag < 0);
1959         tag = blk_mq_unique_tag(scmnd->request);
1960         ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
1961         idx = blk_mq_unique_tag_to_tag(tag);
1962         WARN_ONCE(idx >= target->req_ring_size, "%s: tag %#x: idx %d >= %d\n",
1963                   dev_name(&shost->shost_gendev), tag, idx,
1964                   target->req_ring_size);
1965
1966         spin_lock_irqsave(&ch->lock, flags);
1967         iu = __srp_get_tx_iu(ch, SRP_IU_CMD);
1968         spin_unlock_irqrestore(&ch->lock, flags);
1969
1970         if (!iu)
1971                 goto err;
1972
1973         req = &ch->req_ring[idx];
1974         dev = target->srp_host->srp_dev->dev;
1975         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_iu_len,
1976                                    DMA_TO_DEVICE);
1977
1978         scmnd->host_scribble = (void *) req;
1979
1980         cmd = iu->buf;
1981         memset(cmd, 0, sizeof *cmd);
1982
1983         cmd->opcode = SRP_CMD;
1984         int_to_scsilun(scmnd->device->lun, &cmd->lun);
1985         cmd->tag    = tag;
1986         memcpy(cmd->cdb, scmnd->cmnd, scmnd->cmd_len);
1987
1988         req->scmnd    = scmnd;
1989         req->cmd      = iu;
1990
1991         len = srp_map_data(scmnd, ch, req);
1992         if (len < 0) {
1993                 shost_printk(KERN_ERR, target->scsi_host,
1994                              PFX "Failed to map data (%d)\n", len);
1995                 /*
1996                  * If we ran out of memory descriptors (-ENOMEM) because an
1997                  * application is queuing many requests with more than
1998                  * max_pages_per_mr sg-list elements, tell the SCSI mid-layer
1999                  * to reduce queue depth temporarily.
2000                  */
2001                 scmnd->result = len == -ENOMEM ?
2002                         DID_OK << 16 | QUEUE_FULL << 1 : DID_ERROR << 16;
2003                 goto err_iu;
2004         }
2005
2006         ib_dma_sync_single_for_device(dev, iu->dma, target->max_iu_len,
2007                                       DMA_TO_DEVICE);
2008
2009         if (srp_post_send(ch, iu, len)) {
2010                 shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
2011                 goto err_unmap;
2012         }
2013
2014         ret = 0;
2015
2016 unlock_rport:
2017         if (in_scsi_eh)
2018                 mutex_unlock(&rport->mutex);
2019
2020         return ret;
2021
2022 err_unmap:
2023         srp_unmap_data(scmnd, ch, req);
2024
2025 err_iu:
2026         srp_put_tx_iu(ch, iu, SRP_IU_CMD);
2027
2028         /*
2029          * Avoid that the loops that iterate over the request ring can
2030          * encounter a dangling SCSI command pointer.
2031          */
2032         req->scmnd = NULL;
2033
2034 err:
2035         if (scmnd->result) {
2036                 scmnd->scsi_done(scmnd);
2037                 ret = 0;
2038         } else {
2039                 ret = SCSI_MLQUEUE_HOST_BUSY;
2040         }
2041
2042         goto unlock_rport;
2043 }
2044
2045 /*
2046  * Note: the resources allocated in this function are freed in
2047  * srp_free_ch_ib().
2048  */
2049 static int srp_alloc_iu_bufs(struct srp_rdma_ch *ch)
2050 {
2051         struct srp_target_port *target = ch->target;
2052         int i;
2053
2054         ch->rx_ring = kcalloc(target->queue_size, sizeof(*ch->rx_ring),
2055                               GFP_KERNEL);
2056         if (!ch->rx_ring)
2057                 goto err_no_ring;
2058         ch->tx_ring = kcalloc(target->queue_size, sizeof(*ch->tx_ring),
2059                               GFP_KERNEL);
2060         if (!ch->tx_ring)
2061                 goto err_no_ring;
2062
2063         for (i = 0; i < target->queue_size; ++i) {
2064                 ch->rx_ring[i] = srp_alloc_iu(target->srp_host,
2065                                               ch->max_ti_iu_len,
2066                                               GFP_KERNEL, DMA_FROM_DEVICE);
2067                 if (!ch->rx_ring[i])
2068                         goto err;
2069         }
2070
2071         for (i = 0; i < target->queue_size; ++i) {
2072                 ch->tx_ring[i] = srp_alloc_iu(target->srp_host,
2073                                               target->max_iu_len,
2074                                               GFP_KERNEL, DMA_TO_DEVICE);
2075                 if (!ch->tx_ring[i])
2076                         goto err;
2077
2078                 list_add(&ch->tx_ring[i]->list, &ch->free_tx);
2079         }
2080
2081         return 0;
2082
2083 err:
2084         for (i = 0; i < target->queue_size; ++i) {
2085                 srp_free_iu(target->srp_host, ch->rx_ring[i]);
2086                 srp_free_iu(target->srp_host, ch->tx_ring[i]);
2087         }
2088
2089
2090 err_no_ring:
2091         kfree(ch->tx_ring);
2092         ch->tx_ring = NULL;
2093         kfree(ch->rx_ring);
2094         ch->rx_ring = NULL;
2095
2096         return -ENOMEM;
2097 }
2098
2099 static uint32_t srp_compute_rq_tmo(struct ib_qp_attr *qp_attr, int attr_mask)
2100 {
2101         uint64_t T_tr_ns, max_compl_time_ms;
2102         uint32_t rq_tmo_jiffies;
2103
2104         /*
2105          * According to section 11.2.4.2 in the IBTA spec (Modify Queue Pair,
2106          * table 91), both the QP timeout and the retry count have to be set
2107          * for RC QP's during the RTR to RTS transition.
2108          */
2109         WARN_ON_ONCE((attr_mask & (IB_QP_TIMEOUT | IB_QP_RETRY_CNT)) !=
2110                      (IB_QP_TIMEOUT | IB_QP_RETRY_CNT));
2111
2112         /*
2113          * Set target->rq_tmo_jiffies to one second more than the largest time
2114          * it can take before an error completion is generated. See also
2115          * C9-140..142 in the IBTA spec for more information about how to
2116          * convert the QP Local ACK Timeout value to nanoseconds.
2117          */
2118         T_tr_ns = 4096 * (1ULL << qp_attr->timeout);
2119         max_compl_time_ms = qp_attr->retry_cnt * 4 * T_tr_ns;
2120         do_div(max_compl_time_ms, NSEC_PER_MSEC);
2121         rq_tmo_jiffies = msecs_to_jiffies(max_compl_time_ms + 1000);
2122
2123         return rq_tmo_jiffies;
2124 }
2125
2126 static void srp_cm_rep_handler(struct ib_cm_id *cm_id,
2127                                const struct srp_login_rsp *lrsp,
2128                                struct srp_rdma_ch *ch)
2129 {
2130         struct srp_target_port *target = ch->target;
2131         struct ib_qp_attr *qp_attr = NULL;
2132         int attr_mask = 0;
2133         int ret;
2134         int i;
2135
2136         if (lrsp->opcode == SRP_LOGIN_RSP) {
2137                 ch->max_ti_iu_len = be32_to_cpu(lrsp->max_ti_iu_len);
2138                 ch->req_lim       = be32_to_cpu(lrsp->req_lim_delta);
2139
2140                 /*
2141                  * Reserve credits for task management so we don't
2142                  * bounce requests back to the SCSI mid-layer.
2143                  */
2144                 target->scsi_host->can_queue
2145                         = min(ch->req_lim - SRP_TSK_MGMT_SQ_SIZE,
2146                               target->scsi_host->can_queue);
2147                 target->scsi_host->cmd_per_lun
2148                         = min_t(int, target->scsi_host->can_queue,
2149                                 target->scsi_host->cmd_per_lun);
2150         } else {
2151                 shost_printk(KERN_WARNING, target->scsi_host,
2152                              PFX "Unhandled RSP opcode %#x\n", lrsp->opcode);
2153                 ret = -ECONNRESET;
2154                 goto error;
2155         }
2156
2157         if (!ch->rx_ring) {
2158                 ret = srp_alloc_iu_bufs(ch);
2159                 if (ret)
2160                         goto error;
2161         }
2162
2163         ret = -ENOMEM;
2164         qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
2165         if (!qp_attr)
2166                 goto error;
2167
2168         qp_attr->qp_state = IB_QPS_RTR;
2169         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
2170         if (ret)
2171                 goto error_free;
2172
2173         ret = ib_modify_qp(ch->qp, qp_attr, attr_mask);
2174         if (ret)
2175                 goto error_free;
2176
2177         for (i = 0; i < target->queue_size; i++) {
2178                 struct srp_iu *iu = ch->rx_ring[i];
2179
2180                 ret = srp_post_recv(ch, iu);
2181                 if (ret)
2182                         goto error_free;
2183         }
2184
2185         qp_attr->qp_state = IB_QPS_RTS;
2186         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
2187         if (ret)
2188                 goto error_free;
2189
2190         target->rq_tmo_jiffies = srp_compute_rq_tmo(qp_attr, attr_mask);
2191
2192         ret = ib_modify_qp(ch->qp, qp_attr, attr_mask);
2193         if (ret)
2194                 goto error_free;
2195
2196         ret = ib_send_cm_rtu(cm_id, NULL, 0);
2197
2198 error_free:
2199         kfree(qp_attr);
2200
2201 error:
2202         ch->status = ret;
2203 }
2204
2205 static void srp_cm_rej_handler(struct ib_cm_id *cm_id,
2206                                struct ib_cm_event *event,
2207                                struct srp_rdma_ch *ch)
2208 {
2209         struct srp_target_port *target = ch->target;
2210         struct Scsi_Host *shost = target->scsi_host;
2211         struct ib_class_port_info *cpi;
2212         int opcode;
2213
2214         switch (event->param.rej_rcvd.reason) {
2215         case IB_CM_REJ_PORT_CM_REDIRECT:
2216                 cpi = event->param.rej_rcvd.ari;
2217                 ch->path.dlid = cpi->redirect_lid;
2218                 ch->path.pkey = cpi->redirect_pkey;
2219                 cm_id->remote_cm_qpn = be32_to_cpu(cpi->redirect_qp) & 0x00ffffff;
2220                 memcpy(ch->path.dgid.raw, cpi->redirect_gid, 16);
2221
2222                 ch->status = ch->path.dlid ?
2223                         SRP_DLID_REDIRECT : SRP_PORT_REDIRECT;
2224                 break;
2225
2226         case IB_CM_REJ_PORT_REDIRECT:
2227                 if (srp_target_is_topspin(target)) {
2228                         /*
2229                          * Topspin/Cisco SRP gateways incorrectly send
2230                          * reject reason code 25 when they mean 24
2231                          * (port redirect).
2232                          */
2233                         memcpy(ch->path.dgid.raw,
2234                                event->param.rej_rcvd.ari, 16);
2235
2236                         shost_printk(KERN_DEBUG, shost,
2237                                      PFX "Topspin/Cisco redirect to target port GID %016llx%016llx\n",
2238                                      be64_to_cpu(ch->path.dgid.global.subnet_prefix),
2239                                      be64_to_cpu(ch->path.dgid.global.interface_id));
2240
2241                         ch->status = SRP_PORT_REDIRECT;
2242                 } else {
2243                         shost_printk(KERN_WARNING, shost,
2244                                      "  REJ reason: IB_CM_REJ_PORT_REDIRECT\n");
2245                         ch->status = -ECONNRESET;
2246                 }
2247                 break;
2248
2249         case IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID:
2250                 shost_printk(KERN_WARNING, shost,
2251                             "  REJ reason: IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID\n");
2252                 ch->status = -ECONNRESET;
2253                 break;
2254
2255         case IB_CM_REJ_CONSUMER_DEFINED:
2256                 opcode = *(u8 *) event->private_data;
2257                 if (opcode == SRP_LOGIN_REJ) {
2258                         struct srp_login_rej *rej = event->private_data;
2259                         u32 reason = be32_to_cpu(rej->reason);
2260
2261                         if (reason == SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE)
2262                                 shost_printk(KERN_WARNING, shost,
2263                                              PFX "SRP_LOGIN_REJ: requested max_it_iu_len too large\n");
2264                         else
2265                                 shost_printk(KERN_WARNING, shost, PFX
2266                                              "SRP LOGIN from %pI6 to %pI6 REJECTED, reason 0x%08x\n",
2267                                              target->sgid.raw,
2268                                              target->orig_dgid.raw, reason);
2269                 } else
2270                         shost_printk(KERN_WARNING, shost,
2271                                      "  REJ reason: IB_CM_REJ_CONSUMER_DEFINED,"
2272                                      " opcode 0x%02x\n", opcode);
2273                 ch->status = -ECONNRESET;
2274                 break;
2275
2276         case IB_CM_REJ_STALE_CONN:
2277                 shost_printk(KERN_WARNING, shost, "  REJ reason: stale connection\n");
2278                 ch->status = SRP_STALE_CONN;
2279                 break;
2280
2281         default:
2282                 shost_printk(KERN_WARNING, shost, "  REJ reason 0x%x\n",
2283                              event->param.rej_rcvd.reason);
2284                 ch->status = -ECONNRESET;
2285         }
2286 }
2287
2288 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
2289 {
2290         struct srp_rdma_ch *ch = cm_id->context;
2291         struct srp_target_port *target = ch->target;
2292         int comp = 0;
2293
2294         switch (event->event) {
2295         case IB_CM_REQ_ERROR:
2296                 shost_printk(KERN_DEBUG, target->scsi_host,
2297                              PFX "Sending CM REQ failed\n");
2298                 comp = 1;
2299                 ch->status = -ECONNRESET;
2300                 break;
2301
2302         case IB_CM_REP_RECEIVED:
2303                 comp = 1;
2304                 srp_cm_rep_handler(cm_id, event->private_data, ch);
2305                 break;
2306
2307         case IB_CM_REJ_RECEIVED:
2308                 shost_printk(KERN_DEBUG, target->scsi_host, PFX "REJ received\n");
2309                 comp = 1;
2310
2311                 srp_cm_rej_handler(cm_id, event, ch);
2312                 break;
2313
2314         case IB_CM_DREQ_RECEIVED:
2315                 shost_printk(KERN_WARNING, target->scsi_host,
2316                              PFX "DREQ received - connection closed\n");
2317                 ch->connected = false;
2318                 if (ib_send_cm_drep(cm_id, NULL, 0))
2319                         shost_printk(KERN_ERR, target->scsi_host,
2320                                      PFX "Sending CM DREP failed\n");
2321                 queue_work(system_long_wq, &target->tl_err_work);
2322                 break;
2323
2324         case IB_CM_TIMEWAIT_EXIT:
2325                 shost_printk(KERN_ERR, target->scsi_host,
2326                              PFX "connection closed\n");
2327                 comp = 1;
2328
2329                 ch->status = 0;
2330                 break;
2331
2332         case IB_CM_MRA_RECEIVED:
2333         case IB_CM_DREQ_ERROR:
2334         case IB_CM_DREP_RECEIVED:
2335                 break;
2336
2337         default:
2338                 shost_printk(KERN_WARNING, target->scsi_host,
2339                              PFX "Unhandled CM event %d\n", event->event);
2340                 break;
2341         }
2342
2343         if (comp)
2344                 complete(&ch->done);
2345
2346         return 0;
2347 }
2348
2349 /**
2350  * srp_change_queue_depth - setting device queue depth
2351  * @sdev: scsi device struct
2352  * @qdepth: requested queue depth
2353  *
2354  * Returns queue depth.
2355  */
2356 static int
2357 srp_change_queue_depth(struct scsi_device *sdev, int qdepth)
2358 {
2359         if (!sdev->tagged_supported)
2360                 qdepth = 1;
2361         return scsi_change_queue_depth(sdev, qdepth);
2362 }
2363
2364 static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
2365                              u8 func)
2366 {
2367         struct srp_target_port *target = ch->target;
2368         struct srp_rport *rport = target->rport;
2369         struct ib_device *dev = target->srp_host->srp_dev->dev;
2370         struct srp_iu *iu;
2371         struct srp_tsk_mgmt *tsk_mgmt;
2372
2373         if (!ch->connected || target->qp_in_error)
2374                 return -1;
2375
2376         init_completion(&ch->tsk_mgmt_done);
2377
2378         /*
2379          * Lock the rport mutex to avoid that srp_create_ch_ib() is
2380          * invoked while a task management function is being sent.
2381          */
2382         mutex_lock(&rport->mutex);
2383         spin_lock_irq(&ch->lock);
2384         iu = __srp_get_tx_iu(ch, SRP_IU_TSK_MGMT);
2385         spin_unlock_irq(&ch->lock);
2386
2387         if (!iu) {
2388                 mutex_unlock(&rport->mutex);
2389
2390                 return -1;
2391         }
2392
2393         ib_dma_sync_single_for_cpu(dev, iu->dma, sizeof *tsk_mgmt,
2394                                    DMA_TO_DEVICE);
2395         tsk_mgmt = iu->buf;
2396         memset(tsk_mgmt, 0, sizeof *tsk_mgmt);
2397
2398         tsk_mgmt->opcode        = SRP_TSK_MGMT;
2399         int_to_scsilun(lun, &tsk_mgmt->lun);
2400         tsk_mgmt->tag           = req_tag | SRP_TAG_TSK_MGMT;
2401         tsk_mgmt->tsk_mgmt_func = func;
2402         tsk_mgmt->task_tag      = req_tag;
2403
2404         ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
2405                                       DMA_TO_DEVICE);
2406         if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) {
2407                 srp_put_tx_iu(ch, iu, SRP_IU_TSK_MGMT);
2408                 mutex_unlock(&rport->mutex);
2409
2410                 return -1;
2411         }
2412         mutex_unlock(&rport->mutex);
2413
2414         if (!wait_for_completion_timeout(&ch->tsk_mgmt_done,
2415                                          msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
2416                 return -1;
2417
2418         return 0;
2419 }
2420
2421 static int srp_abort(struct scsi_cmnd *scmnd)
2422 {
2423         struct srp_target_port *target = host_to_target(scmnd->device->host);
2424         struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
2425         u32 tag;
2426         u16 ch_idx;
2427         struct srp_rdma_ch *ch;
2428         int ret;
2429
2430         shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
2431
2432         if (!req)
2433                 return SUCCESS;
2434         tag = blk_mq_unique_tag(scmnd->request);
2435         ch_idx = blk_mq_unique_tag_to_hwq(tag);
2436         if (WARN_ON_ONCE(ch_idx >= target->ch_count))
2437                 return SUCCESS;
2438         ch = &target->ch[ch_idx];
2439         if (!srp_claim_req(ch, req, NULL, scmnd))
2440                 return SUCCESS;
2441         shost_printk(KERN_ERR, target->scsi_host,
2442                      "Sending SRP abort for tag %#x\n", tag);
2443         if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
2444                               SRP_TSK_ABORT_TASK) == 0)
2445                 ret = SUCCESS;
2446         else if (target->rport->state == SRP_RPORT_LOST)
2447                 ret = FAST_IO_FAIL;
2448         else
2449                 ret = FAILED;
2450         srp_free_req(ch, req, scmnd, 0);
2451         scmnd->result = DID_ABORT << 16;
2452         scmnd->scsi_done(scmnd);
2453
2454         return ret;
2455 }
2456
2457 static int srp_reset_device(struct scsi_cmnd *scmnd)
2458 {
2459         struct srp_target_port *target = host_to_target(scmnd->device->host);
2460         struct srp_rdma_ch *ch;
2461         int i;
2462
2463         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
2464
2465         ch = &target->ch[0];
2466         if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun,
2467                               SRP_TSK_LUN_RESET))
2468                 return FAILED;
2469         if (ch->tsk_mgmt_status)
2470                 return FAILED;
2471
2472         for (i = 0; i < target->ch_count; i++) {
2473                 ch = &target->ch[i];
2474                 for (i = 0; i < target->req_ring_size; ++i) {
2475                         struct srp_request *req = &ch->req_ring[i];
2476
2477                         srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
2478                 }
2479         }
2480
2481         return SUCCESS;
2482 }
2483
2484 static int srp_reset_host(struct scsi_cmnd *scmnd)
2485 {
2486         struct srp_target_port *target = host_to_target(scmnd->device->host);
2487
2488         shost_printk(KERN_ERR, target->scsi_host, PFX "SRP reset_host called\n");
2489
2490         return srp_reconnect_rport(target->rport) == 0 ? SUCCESS : FAILED;
2491 }
2492
2493 static int srp_slave_configure(struct scsi_device *sdev)
2494 {
2495         struct Scsi_Host *shost = sdev->host;
2496         struct srp_target_port *target = host_to_target(shost);
2497         struct request_queue *q = sdev->request_queue;
2498         unsigned long timeout;
2499
2500         if (sdev->type == TYPE_DISK) {
2501                 timeout = max_t(unsigned, 30 * HZ, target->rq_tmo_jiffies);
2502                 blk_queue_rq_timeout(q, timeout);
2503         }
2504
2505         return 0;
2506 }
2507
2508 static ssize_t show_id_ext(struct device *dev, struct device_attribute *attr,
2509                            char *buf)
2510 {
2511         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2512
2513         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->id_ext));
2514 }
2515
2516 static ssize_t show_ioc_guid(struct device *dev, struct device_attribute *attr,
2517                              char *buf)
2518 {
2519         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2520
2521         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->ioc_guid));
2522 }
2523
2524 static ssize_t show_service_id(struct device *dev,
2525                                struct device_attribute *attr, char *buf)
2526 {
2527         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2528
2529         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->service_id));
2530 }
2531
2532 static ssize_t show_pkey(struct device *dev, struct device_attribute *attr,
2533                          char *buf)
2534 {
2535         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2536
2537         return sprintf(buf, "0x%04x\n", be16_to_cpu(target->pkey));
2538 }
2539
2540 static ssize_t show_sgid(struct device *dev, struct device_attribute *attr,
2541                          char *buf)
2542 {
2543         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2544
2545         return sprintf(buf, "%pI6\n", target->sgid.raw);
2546 }
2547
2548 static ssize_t show_dgid(struct device *dev, struct device_attribute *attr,
2549                          char *buf)
2550 {
2551         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2552         struct srp_rdma_ch *ch = &target->ch[0];
2553
2554         return sprintf(buf, "%pI6\n", ch->path.dgid.raw);
2555 }
2556
2557 static ssize_t show_orig_dgid(struct device *dev,
2558                               struct device_attribute *attr, char *buf)
2559 {
2560         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2561
2562         return sprintf(buf, "%pI6\n", target->orig_dgid.raw);
2563 }
2564
2565 static ssize_t show_req_lim(struct device *dev,
2566                             struct device_attribute *attr, char *buf)
2567 {
2568         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2569         struct srp_rdma_ch *ch;
2570         int i, req_lim = INT_MAX;
2571
2572         for (i = 0; i < target->ch_count; i++) {
2573                 ch = &target->ch[i];
2574                 req_lim = min(req_lim, ch->req_lim);
2575         }
2576         return sprintf(buf, "%d\n", req_lim);
2577 }
2578
2579 static ssize_t show_zero_req_lim(struct device *dev,
2580                                  struct device_attribute *attr, char *buf)
2581 {
2582         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2583
2584         return sprintf(buf, "%d\n", target->zero_req_lim);
2585 }
2586
2587 static ssize_t show_local_ib_port(struct device *dev,
2588                                   struct device_attribute *attr, char *buf)
2589 {
2590         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2591
2592         return sprintf(buf, "%d\n", target->srp_host->port);
2593 }
2594
2595 static ssize_t show_local_ib_device(struct device *dev,
2596                                     struct device_attribute *attr, char *buf)
2597 {
2598         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2599
2600         return sprintf(buf, "%s\n", target->srp_host->srp_dev->dev->name);
2601 }
2602
2603 static ssize_t show_ch_count(struct device *dev, struct device_attribute *attr,
2604                              char *buf)
2605 {
2606         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2607
2608         return sprintf(buf, "%d\n", target->ch_count);
2609 }
2610
2611 static ssize_t show_comp_vector(struct device *dev,
2612                                 struct device_attribute *attr, char *buf)
2613 {
2614         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2615
2616         return sprintf(buf, "%d\n", target->comp_vector);
2617 }
2618
2619 static ssize_t show_tl_retry_count(struct device *dev,
2620                                    struct device_attribute *attr, char *buf)
2621 {
2622         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2623
2624         return sprintf(buf, "%d\n", target->tl_retry_count);
2625 }
2626
2627 static ssize_t show_cmd_sg_entries(struct device *dev,
2628                                    struct device_attribute *attr, char *buf)
2629 {
2630         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2631
2632         return sprintf(buf, "%u\n", target->cmd_sg_cnt);
2633 }
2634
2635 static ssize_t show_allow_ext_sg(struct device *dev,
2636                                  struct device_attribute *attr, char *buf)
2637 {
2638         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2639
2640         return sprintf(buf, "%s\n", target->allow_ext_sg ? "true" : "false");
2641 }
2642
2643 static DEVICE_ATTR(id_ext,          S_IRUGO, show_id_ext,          NULL);
2644 static DEVICE_ATTR(ioc_guid,        S_IRUGO, show_ioc_guid,        NULL);
2645 static DEVICE_ATTR(service_id,      S_IRUGO, show_service_id,      NULL);
2646 static DEVICE_ATTR(pkey,            S_IRUGO, show_pkey,            NULL);
2647 static DEVICE_ATTR(sgid,            S_IRUGO, show_sgid,            NULL);
2648 static DEVICE_ATTR(dgid,            S_IRUGO, show_dgid,            NULL);
2649 static DEVICE_ATTR(orig_dgid,       S_IRUGO, show_orig_dgid,       NULL);
2650 static DEVICE_ATTR(req_lim,         S_IRUGO, show_req_lim,         NULL);
2651 static DEVICE_ATTR(zero_req_lim,    S_IRUGO, show_zero_req_lim,    NULL);
2652 static DEVICE_ATTR(local_ib_port,   S_IRUGO, show_local_ib_port,   NULL);
2653 static DEVICE_ATTR(local_ib_device, S_IRUGO, show_local_ib_device, NULL);
2654 static DEVICE_ATTR(ch_count,        S_IRUGO, show_ch_count,        NULL);
2655 static DEVICE_ATTR(comp_vector,     S_IRUGO, show_comp_vector,     NULL);
2656 static DEVICE_ATTR(tl_retry_count,  S_IRUGO, show_tl_retry_count,  NULL);
2657 static DEVICE_ATTR(cmd_sg_entries,  S_IRUGO, show_cmd_sg_entries,  NULL);
2658 static DEVICE_ATTR(allow_ext_sg,    S_IRUGO, show_allow_ext_sg,    NULL);
2659
2660 static struct device_attribute *srp_host_attrs[] = {
2661         &dev_attr_id_ext,
2662         &dev_attr_ioc_guid,
2663         &dev_attr_service_id,
2664         &dev_attr_pkey,
2665         &dev_attr_sgid,
2666         &dev_attr_dgid,
2667         &dev_attr_orig_dgid,
2668         &dev_attr_req_lim,
2669         &dev_attr_zero_req_lim,
2670         &dev_attr_local_ib_port,
2671         &dev_attr_local_ib_device,
2672         &dev_attr_ch_count,
2673         &dev_attr_comp_vector,
2674         &dev_attr_tl_retry_count,
2675         &dev_attr_cmd_sg_entries,
2676         &dev_attr_allow_ext_sg,
2677         NULL
2678 };
2679
2680 static struct scsi_host_template srp_template = {
2681         .module                         = THIS_MODULE,
2682         .name                           = "InfiniBand SRP initiator",
2683         .proc_name                      = DRV_NAME,
2684         .slave_configure                = srp_slave_configure,
2685         .info                           = srp_target_info,
2686         .queuecommand                   = srp_queuecommand,
2687         .change_queue_depth             = srp_change_queue_depth,
2688         .eh_abort_handler               = srp_abort,
2689         .eh_device_reset_handler        = srp_reset_device,
2690         .eh_host_reset_handler          = srp_reset_host,
2691         .skip_settle_delay              = true,
2692         .sg_tablesize                   = SRP_DEF_SG_TABLESIZE,
2693         .can_queue                      = SRP_DEFAULT_CMD_SQ_SIZE,
2694         .this_id                        = -1,
2695         .cmd_per_lun                    = SRP_DEFAULT_CMD_SQ_SIZE,
2696         .use_clustering                 = ENABLE_CLUSTERING,
2697         .shost_attrs                    = srp_host_attrs,
2698         .use_blk_tags                   = 1,
2699         .track_queue_depth              = 1,
2700 };
2701
2702 static int srp_sdev_count(struct Scsi_Host *host)
2703 {
2704         struct scsi_device *sdev;
2705         int c = 0;
2706
2707         shost_for_each_device(sdev, host)
2708                 c++;
2709
2710         return c;
2711 }
2712
2713 /*
2714  * Return values:
2715  * < 0 upon failure. Caller is responsible for SRP target port cleanup.
2716  * 0 and target->state == SRP_TARGET_REMOVED if asynchronous target port
2717  *    removal has been scheduled.
2718  * 0 and target->state != SRP_TARGET_REMOVED upon success.
2719  */
2720 static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
2721 {
2722         struct srp_rport_identifiers ids;
2723         struct srp_rport *rport;
2724
2725         target->state = SRP_TARGET_SCANNING;
2726         sprintf(target->target_name, "SRP.T10:%016llX",
2727                 be64_to_cpu(target->id_ext));
2728
2729         if (scsi_add_host(target->scsi_host, host->srp_dev->dev->dma_device))
2730                 return -ENODEV;
2731
2732         memcpy(ids.port_id, &target->id_ext, 8);
2733         memcpy(ids.port_id + 8, &target->ioc_guid, 8);
2734         ids.roles = SRP_RPORT_ROLE_TARGET;
2735         rport = srp_rport_add(target->scsi_host, &ids);
2736         if (IS_ERR(rport)) {
2737                 scsi_remove_host(target->scsi_host);
2738                 return PTR_ERR(rport);
2739         }
2740
2741         rport->lld_data = target;
2742         target->rport = rport;
2743
2744         spin_lock(&host->target_lock);
2745         list_add_tail(&target->list, &host->target_list);
2746         spin_unlock(&host->target_lock);
2747
2748         scsi_scan_target(&target->scsi_host->shost_gendev,
2749                          0, target->scsi_id, SCAN_WILD_CARD, 0);
2750
2751         if (srp_connected_ch(target) < target->ch_count ||
2752             target->qp_in_error) {
2753                 shost_printk(KERN_INFO, target->scsi_host,
2754                              PFX "SCSI scan failed - removing SCSI host\n");
2755                 srp_queue_remove_work(target);
2756                 goto out;
2757         }
2758
2759         pr_debug(PFX "%s: SCSI scan succeeded - detected %d LUNs\n",
2760                  dev_name(&target->scsi_host->shost_gendev),
2761                  srp_sdev_count(target->scsi_host));
2762
2763         spin_lock_irq(&target->lock);
2764         if (target->state == SRP_TARGET_SCANNING)
2765                 target->state = SRP_TARGET_LIVE;
2766         spin_unlock_irq(&target->lock);
2767
2768 out:
2769         return 0;
2770 }
2771
2772 static void srp_release_dev(struct device *dev)
2773 {
2774         struct srp_host *host =
2775                 container_of(dev, struct srp_host, dev);
2776
2777         complete(&host->released);
2778 }
2779
2780 static struct class srp_class = {
2781         .name    = "infiniband_srp",
2782         .dev_release = srp_release_dev
2783 };
2784
2785 /**
2786  * srp_conn_unique() - check whether the connection to a target is unique
2787  * @host:   SRP host.
2788  * @target: SRP target port.
2789  */
2790 static bool srp_conn_unique(struct srp_host *host,
2791                             struct srp_target_port *target)
2792 {
2793         struct srp_target_port *t;
2794         bool ret = false;
2795
2796         if (target->state == SRP_TARGET_REMOVED)
2797                 goto out;
2798
2799         ret = true;
2800
2801         spin_lock(&host->target_lock);
2802         list_for_each_entry(t, &host->target_list, list) {
2803                 if (t != target &&
2804                     target->id_ext == t->id_ext &&
2805                     target->ioc_guid == t->ioc_guid &&
2806                     target->initiator_ext == t->initiator_ext) {
2807                         ret = false;
2808                         break;
2809                 }
2810         }
2811         spin_unlock(&host->target_lock);
2812
2813 out:
2814         return ret;
2815 }
2816
2817 /*
2818  * Target ports are added by writing
2819  *
2820  *     id_ext=<SRP ID ext>,ioc_guid=<SRP IOC GUID>,dgid=<dest GID>,
2821  *     pkey=<P_Key>,service_id=<service ID>
2822  *
2823  * to the add_target sysfs attribute.
2824  */
2825 enum {
2826         SRP_OPT_ERR             = 0,
2827         SRP_OPT_ID_EXT          = 1 << 0,
2828         SRP_OPT_IOC_GUID        = 1 << 1,
2829         SRP_OPT_DGID            = 1 << 2,
2830         SRP_OPT_PKEY            = 1 << 3,
2831         SRP_OPT_SERVICE_ID      = 1 << 4,
2832         SRP_OPT_MAX_SECT        = 1 << 5,
2833         SRP_OPT_MAX_CMD_PER_LUN = 1 << 6,
2834         SRP_OPT_IO_CLASS        = 1 << 7,
2835         SRP_OPT_INITIATOR_EXT   = 1 << 8,
2836         SRP_OPT_CMD_SG_ENTRIES  = 1 << 9,
2837         SRP_OPT_ALLOW_EXT_SG    = 1 << 10,
2838         SRP_OPT_SG_TABLESIZE    = 1 << 11,
2839         SRP_OPT_COMP_VECTOR     = 1 << 12,
2840         SRP_OPT_TL_RETRY_COUNT  = 1 << 13,
2841         SRP_OPT_QUEUE_SIZE      = 1 << 14,
2842         SRP_OPT_ALL             = (SRP_OPT_ID_EXT       |
2843                                    SRP_OPT_IOC_GUID     |
2844                                    SRP_OPT_DGID         |
2845                                    SRP_OPT_PKEY         |
2846                                    SRP_OPT_SERVICE_ID),
2847 };
2848
2849 static const match_table_t srp_opt_tokens = {
2850         { SRP_OPT_ID_EXT,               "id_ext=%s"             },
2851         { SRP_OPT_IOC_GUID,             "ioc_guid=%s"           },
2852         { SRP_OPT_DGID,                 "dgid=%s"               },
2853         { SRP_OPT_PKEY,                 "pkey=%x"               },
2854         { SRP_OPT_SERVICE_ID,           "service_id=%s"         },
2855         { SRP_OPT_MAX_SECT,             "max_sect=%d"           },
2856         { SRP_OPT_MAX_CMD_PER_LUN,      "max_cmd_per_lun=%d"    },
2857         { SRP_OPT_IO_CLASS,             "io_class=%x"           },
2858         { SRP_OPT_INITIATOR_EXT,        "initiator_ext=%s"      },
2859         { SRP_OPT_CMD_SG_ENTRIES,       "cmd_sg_entries=%u"     },
2860         { SRP_OPT_ALLOW_EXT_SG,         "allow_ext_sg=%u"       },
2861         { SRP_OPT_SG_TABLESIZE,         "sg_tablesize=%u"       },
2862         { SRP_OPT_COMP_VECTOR,          "comp_vector=%u"        },
2863         { SRP_OPT_TL_RETRY_COUNT,       "tl_retry_count=%u"     },
2864         { SRP_OPT_QUEUE_SIZE,           "queue_size=%d"         },
2865         { SRP_OPT_ERR,                  NULL                    }
2866 };
2867
2868 static int srp_parse_options(const char *buf, struct srp_target_port *target)
2869 {
2870         char *options, *sep_opt;
2871         char *p;
2872         char dgid[3];
2873         substring_t args[MAX_OPT_ARGS];
2874         int opt_mask = 0;
2875         int token;
2876         int ret = -EINVAL;
2877         int i;
2878
2879         options = kstrdup(buf, GFP_KERNEL);
2880         if (!options)
2881                 return -ENOMEM;
2882
2883         sep_opt = options;
2884         while ((p = strsep(&sep_opt, ",\n")) != NULL) {
2885                 if (!*p)
2886                         continue;
2887
2888                 token = match_token(p, srp_opt_tokens, args);
2889                 opt_mask |= token;
2890
2891                 switch (token) {
2892                 case SRP_OPT_ID_EXT:
2893                         p = match_strdup(args);
2894                         if (!p) {
2895                                 ret = -ENOMEM;
2896                                 goto out;
2897                         }
2898                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
2899                         kfree(p);
2900                         break;
2901
2902                 case SRP_OPT_IOC_GUID:
2903                         p = match_strdup(args);
2904                         if (!p) {
2905                                 ret = -ENOMEM;
2906                                 goto out;
2907                         }
2908                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
2909                         kfree(p);
2910                         break;
2911
2912                 case SRP_OPT_DGID:
2913                         p = match_strdup(args);
2914                         if (!p) {
2915                                 ret = -ENOMEM;
2916                                 goto out;
2917                         }
2918                         if (strlen(p) != 32) {
2919                                 pr_warn("bad dest GID parameter '%s'\n", p);
2920                                 kfree(p);
2921                                 goto out;
2922                         }
2923
2924                         for (i = 0; i < 16; ++i) {
2925                                 strlcpy(dgid, p + i * 2, sizeof(dgid));
2926                                 if (sscanf(dgid, "%hhx",
2927                                            &target->orig_dgid.raw[i]) < 1) {
2928                                         ret = -EINVAL;
2929                                         kfree(p);
2930                                         goto out;
2931                                 }
2932                         }
2933                         kfree(p);
2934                         break;
2935
2936                 case SRP_OPT_PKEY:
2937                         if (match_hex(args, &token)) {
2938                                 pr_warn("bad P_Key parameter '%s'\n", p);
2939                                 goto out;
2940                         }
2941                         target->pkey = cpu_to_be16(token);
2942                         break;
2943
2944                 case SRP_OPT_SERVICE_ID:
2945                         p = match_strdup(args);
2946                         if (!p) {
2947                                 ret = -ENOMEM;
2948                                 goto out;
2949                         }
2950                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
2951                         kfree(p);
2952                         break;
2953
2954                 case SRP_OPT_MAX_SECT:
2955                         if (match_int(args, &token)) {
2956                                 pr_warn("bad max sect parameter '%s'\n", p);
2957                                 goto out;
2958                         }
2959                         target->scsi_host->max_sectors = token;
2960                         break;
2961
2962                 case SRP_OPT_QUEUE_SIZE:
2963                         if (match_int(args, &token) || token < 1) {
2964                                 pr_warn("bad queue_size parameter '%s'\n", p);
2965                                 goto out;
2966                         }
2967                         target->scsi_host->can_queue = token;
2968                         target->queue_size = token + SRP_RSP_SQ_SIZE +
2969                                              SRP_TSK_MGMT_SQ_SIZE;
2970                         if (!(opt_mask & SRP_OPT_MAX_CMD_PER_LUN))
2971                                 target->scsi_host->cmd_per_lun = token;
2972                         break;
2973
2974                 case SRP_OPT_MAX_CMD_PER_LUN:
2975                         if (match_int(args, &token) || token < 1) {
2976                                 pr_warn("bad max cmd_per_lun parameter '%s'\n",
2977                                         p);
2978                                 goto out;
2979                         }
2980                         target->scsi_host->cmd_per_lun = token;
2981                         break;
2982
2983                 case SRP_OPT_IO_CLASS:
2984                         if (match_hex(args, &token)) {
2985                                 pr_warn("bad IO class parameter '%s'\n", p);
2986                                 goto out;
2987                         }
2988                         if (token != SRP_REV10_IB_IO_CLASS &&
2989                             token != SRP_REV16A_IB_IO_CLASS) {
2990                                 pr_warn("unknown IO class parameter value %x specified (use %x or %x).\n",
2991                                         token, SRP_REV10_IB_IO_CLASS,
2992                                         SRP_REV16A_IB_IO_CLASS);
2993                                 goto out;
2994                         }
2995                         target->io_class = token;
2996                         break;
2997
2998                 case SRP_OPT_INITIATOR_EXT:
2999                         p = match_strdup(args);
3000                         if (!p) {
3001                                 ret = -ENOMEM;
3002                                 goto out;
3003                         }
3004                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
3005                         kfree(p);
3006                         break;
3007
3008                 case SRP_OPT_CMD_SG_ENTRIES:
3009                         if (match_int(args, &token) || token < 1 || token > 255) {
3010                                 pr_warn("bad max cmd_sg_entries parameter '%s'\n",
3011                                         p);
3012                                 goto out;
3013                         }
3014                         target->cmd_sg_cnt = token;
3015                         break;
3016
3017                 case SRP_OPT_ALLOW_EXT_SG:
3018                         if (match_int(args, &token)) {
3019                                 pr_warn("bad allow_ext_sg parameter '%s'\n", p);
3020                                 goto out;
3021                         }
3022                         target->allow_ext_sg = !!token;
3023                         break;
3024
3025                 case SRP_OPT_SG_TABLESIZE:
3026                         if (match_int(args, &token) || token < 1 ||
3027                                         token > SCSI_MAX_SG_CHAIN_SEGMENTS) {
3028                                 pr_warn("bad max sg_tablesize parameter '%s'\n",
3029                                         p);
3030                                 goto out;
3031                         }
3032                         target->sg_tablesize = token;
3033                         break;
3034
3035                 case SRP_OPT_COMP_VECTOR:
3036                         if (match_int(args, &token) || token < 0) {
3037                                 pr_warn("bad comp_vector parameter '%s'\n", p);
3038                                 goto out;
3039                         }
3040                         target->comp_vector = token;
3041                         break;
3042
3043                 case SRP_OPT_TL_RETRY_COUNT:
3044                         if (match_int(args, &token) || token < 2 || token > 7) {
3045                                 pr_warn("bad tl_retry_count parameter '%s' (must be a number between 2 and 7)\n",
3046                                         p);
3047                                 goto out;
3048                         }
3049                         target->tl_retry_count = token;
3050                         break;
3051
3052                 default:
3053                         pr_warn("unknown parameter or missing value '%s' in target creation request\n",
3054                                 p);
3055                         goto out;
3056                 }
3057         }
3058
3059         if ((opt_mask & SRP_OPT_ALL) == SRP_OPT_ALL)
3060                 ret = 0;
3061         else
3062                 for (i = 0; i < ARRAY_SIZE(srp_opt_tokens); ++i)
3063                         if ((srp_opt_tokens[i].token & SRP_OPT_ALL) &&
3064                             !(srp_opt_tokens[i].token & opt_mask))
3065                                 pr_warn("target creation request is missing parameter '%s'\n",
3066                                         srp_opt_tokens[i].pattern);
3067
3068         if (target->scsi_host->cmd_per_lun > target->scsi_host->can_queue
3069             && (opt_mask & SRP_OPT_MAX_CMD_PER_LUN))
3070                 pr_warn("cmd_per_lun = %d > queue_size = %d\n",
3071                         target->scsi_host->cmd_per_lun,
3072                         target->scsi_host->can_queue);
3073
3074 out:
3075         kfree(options);
3076         return ret;
3077 }
3078
3079 static ssize_t srp_create_target(struct device *dev,
3080                                  struct device_attribute *attr,
3081                                  const char *buf, size_t count)
3082 {
3083         struct srp_host *host =
3084                 container_of(dev, struct srp_host, dev);
3085         struct Scsi_Host *target_host;
3086         struct srp_target_port *target;
3087         struct srp_rdma_ch *ch;
3088         struct srp_device *srp_dev = host->srp_dev;
3089         struct ib_device *ibdev = srp_dev->dev;
3090         int ret, node_idx, node, cpu, i;
3091         bool multich = false;
3092
3093         target_host = scsi_host_alloc(&srp_template,
3094                                       sizeof (struct srp_target_port));
3095         if (!target_host)
3096                 return -ENOMEM;
3097
3098         target_host->transportt  = ib_srp_transport_template;
3099         target_host->max_channel = 0;
3100         target_host->max_id      = 1;
3101         target_host->max_lun     = -1LL;
3102         target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
3103
3104         target = host_to_target(target_host);
3105
3106         target->io_class        = SRP_REV16A_IB_IO_CLASS;
3107         target->scsi_host       = target_host;
3108         target->srp_host        = host;
3109         target->lkey            = host->srp_dev->pd->local_dma_lkey;
3110         target->rkey            = host->srp_dev->mr->rkey;
3111         target->cmd_sg_cnt      = cmd_sg_entries;
3112         target->sg_tablesize    = indirect_sg_entries ? : cmd_sg_entries;
3113         target->allow_ext_sg    = allow_ext_sg;
3114         target->tl_retry_count  = 7;
3115         target->queue_size      = SRP_DEFAULT_QUEUE_SIZE;
3116
3117         /*
3118          * Avoid that the SCSI host can be removed by srp_remove_target()
3119          * before this function returns.
3120          */
3121         scsi_host_get(target->scsi_host);
3122
3123         mutex_lock(&host->add_target_mutex);
3124
3125         ret = srp_parse_options(buf, target);
3126         if (ret)
3127                 goto out;
3128
3129         ret = scsi_init_shared_tag_map(target_host, target_host->can_queue);
3130         if (ret)
3131                 goto out;
3132
3133         target->req_ring_size = target->queue_size - SRP_TSK_MGMT_SQ_SIZE;
3134
3135         if (!srp_conn_unique(target->srp_host, target)) {
3136                 shost_printk(KERN_INFO, target->scsi_host,
3137                              PFX "Already connected to target port with id_ext=%016llx;ioc_guid=%016llx;initiator_ext=%016llx\n",
3138                              be64_to_cpu(target->id_ext),
3139                              be64_to_cpu(target->ioc_guid),
3140                              be64_to_cpu(target->initiator_ext));
3141                 ret = -EEXIST;
3142                 goto out;
3143         }
3144
3145         if (!srp_dev->has_fmr && !srp_dev->has_fr && !target->allow_ext_sg &&
3146             target->cmd_sg_cnt < target->sg_tablesize) {
3147                 pr_warn("No MR pool and no external indirect descriptors, limiting sg_tablesize to cmd_sg_cnt\n");
3148                 target->sg_tablesize = target->cmd_sg_cnt;
3149         }
3150
3151         target_host->sg_tablesize = target->sg_tablesize;
3152         target->indirect_size = target->sg_tablesize *
3153                                 sizeof (struct srp_direct_buf);
3154         target->max_iu_len = sizeof (struct srp_cmd) +
3155                              sizeof (struct srp_indirect_buf) +
3156                              target->cmd_sg_cnt * sizeof (struct srp_direct_buf);
3157
3158         INIT_WORK(&target->tl_err_work, srp_tl_err_work);
3159         INIT_WORK(&target->remove_work, srp_remove_work);
3160         spin_lock_init(&target->lock);
3161         ret = ib_query_gid(ibdev, host->port, 0, &target->sgid);
3162         if (ret)
3163                 goto out;
3164
3165         ret = -ENOMEM;
3166         target->ch_count = max_t(unsigned, num_online_nodes(),
3167                                  min(ch_count ? :
3168                                      min(4 * num_online_nodes(),
3169                                          ibdev->num_comp_vectors),
3170                                      num_online_cpus()));
3171         target->ch = kcalloc(target->ch_count, sizeof(*target->ch),
3172                              GFP_KERNEL);
3173         if (!target->ch)
3174                 goto out;
3175
3176         node_idx = 0;
3177         for_each_online_node(node) {
3178                 const int ch_start = (node_idx * target->ch_count /
3179                                       num_online_nodes());
3180                 const int ch_end = ((node_idx + 1) * target->ch_count /
3181                                     num_online_nodes());
3182                 const int cv_start = (node_idx * ibdev->num_comp_vectors /
3183                                       num_online_nodes() + target->comp_vector)
3184                                      % ibdev->num_comp_vectors;
3185                 const int cv_end = ((node_idx + 1) * ibdev->num_comp_vectors /
3186                                     num_online_nodes() + target->comp_vector)
3187                                    % ibdev->num_comp_vectors;
3188                 int cpu_idx = 0;
3189
3190                 for_each_online_cpu(cpu) {
3191                         if (cpu_to_node(cpu) != node)
3192                                 continue;
3193                         if (ch_start + cpu_idx >= ch_end)
3194                                 continue;
3195                         ch = &target->ch[ch_start + cpu_idx];
3196                         ch->target = target;
3197                         ch->comp_vector = cv_start == cv_end ? cv_start :
3198                                 cv_start + cpu_idx % (cv_end - cv_start);
3199                         spin_lock_init(&ch->lock);
3200                         INIT_LIST_HEAD(&ch->free_tx);
3201                         ret = srp_new_cm_id(ch);
3202                         if (ret)
3203                                 goto err_disconnect;
3204
3205                         ret = srp_create_ch_ib(ch);
3206                         if (ret)
3207                                 goto err_disconnect;
3208
3209                         ret = srp_alloc_req_data(ch);
3210                         if (ret)
3211                                 goto err_disconnect;
3212
3213                         ret = srp_connect_ch(ch, multich);
3214                         if (ret) {
3215                                 shost_printk(KERN_ERR, target->scsi_host,
3216                                              PFX "Connection %d/%d failed\n",
3217                                              ch_start + cpu_idx,
3218                                              target->ch_count);
3219                                 if (node_idx == 0 && cpu_idx == 0) {
3220                                         goto err_disconnect;
3221                                 } else {
3222                                         srp_free_ch_ib(target, ch);
3223                                         srp_free_req_data(target, ch);
3224                                         target->ch_count = ch - target->ch;
3225                                         goto connected;
3226                                 }
3227                         }
3228
3229                         multich = true;
3230                         cpu_idx++;
3231                 }
3232                 node_idx++;
3233         }
3234
3235 connected:
3236         target->scsi_host->nr_hw_queues = target->ch_count;
3237
3238         ret = srp_add_target(host, target);
3239         if (ret)
3240                 goto err_disconnect;
3241
3242         if (target->state != SRP_TARGET_REMOVED) {
3243                 shost_printk(KERN_DEBUG, target->scsi_host, PFX
3244                              "new target: id_ext %016llx ioc_guid %016llx pkey %04x service_id %016llx sgid %pI6 dgid %pI6\n",
3245                              be64_to_cpu(target->id_ext),
3246                              be64_to_cpu(target->ioc_guid),
3247                              be16_to_cpu(target->pkey),
3248                              be64_to_cpu(target->service_id),
3249                              target->sgid.raw, target->orig_dgid.raw);
3250         }
3251
3252         ret = count;
3253
3254 out:
3255         mutex_unlock(&host->add_target_mutex);
3256
3257         scsi_host_put(target->scsi_host);
3258         if (ret < 0)
3259                 scsi_host_put(target->scsi_host);
3260
3261         return ret;
3262
3263 err_disconnect:
3264         srp_disconnect_target(target);
3265
3266         for (i = 0; i < target->ch_count; i++) {
3267                 ch = &target->ch[i];
3268                 srp_free_ch_ib(target, ch);
3269                 srp_free_req_data(target, ch);
3270         }
3271
3272         kfree(target->ch);
3273         goto out;
3274 }
3275
3276 static DEVICE_ATTR(add_target, S_IWUSR, NULL, srp_create_target);
3277
3278 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
3279                           char *buf)
3280 {
3281         struct srp_host *host = container_of(dev, struct srp_host, dev);
3282
3283         return sprintf(buf, "%s\n", host->srp_dev->dev->name);
3284 }
3285
3286 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
3287
3288 static ssize_t show_port(struct device *dev, struct device_attribute *attr,
3289                          char *buf)
3290 {
3291         struct srp_host *host = container_of(dev, struct srp_host, dev);
3292
3293         return sprintf(buf, "%d\n", host->port);
3294 }
3295
3296 static DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
3297
3298 static struct srp_host *srp_add_port(struct srp_device *device, u8 port)
3299 {
3300         struct srp_host *host;
3301
3302         host = kzalloc(sizeof *host, GFP_KERNEL);
3303         if (!host)
3304                 return NULL;
3305
3306         INIT_LIST_HEAD(&host->target_list);
3307         spin_lock_init(&host->target_lock);
3308         init_completion(&host->released);
3309         mutex_init(&host->add_target_mutex);
3310         host->srp_dev = device;
3311         host->port = port;
3312
3313         host->dev.class = &srp_class;
3314         host->dev.parent = device->dev->dma_device;
3315         dev_set_name(&host->dev, "srp-%s-%d", device->dev->name, port);
3316
3317         if (device_register(&host->dev))
3318                 goto free_host;
3319         if (device_create_file(&host->dev, &dev_attr_add_target))
3320                 goto err_class;
3321         if (device_create_file(&host->dev, &dev_attr_ibdev))
3322                 goto err_class;
3323         if (device_create_file(&host->dev, &dev_attr_port))
3324                 goto err_class;
3325
3326         return host;
3327
3328 err_class:
3329         device_unregister(&host->dev);
3330
3331 free_host:
3332         kfree(host);
3333
3334         return NULL;
3335 }
3336
3337 static void srp_add_one(struct ib_device *device)
3338 {
3339         struct srp_device *srp_dev;
3340         struct ib_device_attr *dev_attr;
3341         struct srp_host *host;
3342         int mr_page_shift, p;
3343         u64 max_pages_per_mr;
3344
3345         dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
3346         if (!dev_attr)
3347                 return;
3348
3349         if (ib_query_device(device, dev_attr)) {
3350                 pr_warn("Query device failed for %s\n", device->name);
3351                 goto free_attr;
3352         }
3353
3354         srp_dev = kmalloc(sizeof *srp_dev, GFP_KERNEL);
3355         if (!srp_dev)
3356                 goto free_attr;
3357
3358         srp_dev->has_fmr = (device->alloc_fmr && device->dealloc_fmr &&
3359                             device->map_phys_fmr && device->unmap_fmr);
3360         srp_dev->has_fr = (dev_attr->device_cap_flags &
3361                            IB_DEVICE_MEM_MGT_EXTENSIONS);
3362         if (!srp_dev->has_fmr && !srp_dev->has_fr)
3363                 dev_warn(&device->dev, "neither FMR nor FR is supported\n");
3364
3365         srp_dev->use_fast_reg = (srp_dev->has_fr &&
3366                                  (!srp_dev->has_fmr || prefer_fr));
3367
3368         /*
3369          * Use the smallest page size supported by the HCA, down to a
3370          * minimum of 4096 bytes. We're unlikely to build large sglists
3371          * out of smaller entries.
3372          */
3373         mr_page_shift           = max(12, ffs(dev_attr->page_size_cap) - 1);
3374         srp_dev->mr_page_size   = 1 << mr_page_shift;
3375         srp_dev->mr_page_mask   = ~((u64) srp_dev->mr_page_size - 1);
3376         max_pages_per_mr        = dev_attr->max_mr_size;
3377         do_div(max_pages_per_mr, srp_dev->mr_page_size);
3378         srp_dev->max_pages_per_mr = min_t(u64, SRP_MAX_PAGES_PER_MR,
3379                                           max_pages_per_mr);
3380         if (srp_dev->use_fast_reg) {
3381                 srp_dev->max_pages_per_mr =
3382                         min_t(u32, srp_dev->max_pages_per_mr,
3383                               dev_attr->max_fast_reg_page_list_len);
3384         }
3385         srp_dev->mr_max_size    = srp_dev->mr_page_size *
3386                                    srp_dev->max_pages_per_mr;
3387         pr_debug("%s: mr_page_shift = %d, dev_attr->max_mr_size = %#llx, dev_attr->max_fast_reg_page_list_len = %u, max_pages_per_mr = %d, mr_max_size = %#x\n",
3388                  device->name, mr_page_shift, dev_attr->max_mr_size,
3389                  dev_attr->max_fast_reg_page_list_len,
3390                  srp_dev->max_pages_per_mr, srp_dev->mr_max_size);
3391
3392         INIT_LIST_HEAD(&srp_dev->dev_list);
3393
3394         srp_dev->dev = device;
3395         srp_dev->pd  = ib_alloc_pd(device);
3396         if (IS_ERR(srp_dev->pd))
3397                 goto free_dev;
3398
3399         srp_dev->mr = ib_get_dma_mr(srp_dev->pd,
3400                                     IB_ACCESS_LOCAL_WRITE |
3401                                     IB_ACCESS_REMOTE_READ |
3402                                     IB_ACCESS_REMOTE_WRITE);
3403         if (IS_ERR(srp_dev->mr))
3404                 goto err_pd;
3405
3406         for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
3407                 host = srp_add_port(srp_dev, p);
3408                 if (host)
3409                         list_add_tail(&host->list, &srp_dev->dev_list);
3410         }
3411
3412         ib_set_client_data(device, &srp_client, srp_dev);
3413
3414         goto free_attr;
3415
3416 err_pd:
3417         ib_dealloc_pd(srp_dev->pd);
3418
3419 free_dev:
3420         kfree(srp_dev);
3421
3422 free_attr:
3423         kfree(dev_attr);
3424 }
3425
3426 static void srp_remove_one(struct ib_device *device, void *client_data)
3427 {
3428         struct srp_device *srp_dev;
3429         struct srp_host *host, *tmp_host;
3430         struct srp_target_port *target;
3431
3432         srp_dev = client_data;
3433         if (!srp_dev)
3434                 return;
3435
3436         list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
3437                 device_unregister(&host->dev);
3438                 /*
3439                  * Wait for the sysfs entry to go away, so that no new
3440                  * target ports can be created.
3441                  */
3442                 wait_for_completion(&host->released);
3443
3444                 /*
3445                  * Remove all target ports.
3446                  */
3447                 spin_lock(&host->target_lock);
3448                 list_for_each_entry(target, &host->target_list, list)
3449                         srp_queue_remove_work(target);
3450                 spin_unlock(&host->target_lock);
3451
3452                 /*
3453                  * Wait for tl_err and target port removal tasks.
3454                  */
3455                 flush_workqueue(system_long_wq);
3456                 flush_workqueue(srp_remove_wq);
3457
3458                 kfree(host);
3459         }
3460
3461         ib_dereg_mr(srp_dev->mr);
3462         ib_dealloc_pd(srp_dev->pd);
3463
3464         kfree(srp_dev);
3465 }
3466
3467 static struct srp_function_template ib_srp_transport_functions = {
3468         .has_rport_state         = true,
3469         .reset_timer_if_blocked  = true,
3470         .reconnect_delay         = &srp_reconnect_delay,
3471         .fast_io_fail_tmo        = &srp_fast_io_fail_tmo,
3472         .dev_loss_tmo            = &srp_dev_loss_tmo,
3473         .reconnect               = srp_rport_reconnect,
3474         .rport_delete            = srp_rport_delete,
3475         .terminate_rport_io      = srp_terminate_io,
3476 };
3477
3478 static int __init srp_init_module(void)
3479 {
3480         int ret;
3481
3482         BUILD_BUG_ON(FIELD_SIZEOF(struct ib_wc, wr_id) < sizeof(void *));
3483
3484         if (srp_sg_tablesize) {
3485                 pr_warn("srp_sg_tablesize is deprecated, please use cmd_sg_entries\n");
3486                 if (!cmd_sg_entries)
3487                         cmd_sg_entries = srp_sg_tablesize;
3488         }
3489
3490         if (!cmd_sg_entries)
3491                 cmd_sg_entries = SRP_DEF_SG_TABLESIZE;
3492
3493         if (cmd_sg_entries > 255) {
3494                 pr_warn("Clamping cmd_sg_entries to 255\n");
3495                 cmd_sg_entries = 255;
3496         }
3497
3498         if (!indirect_sg_entries)
3499                 indirect_sg_entries = cmd_sg_entries;
3500         else if (indirect_sg_entries < cmd_sg_entries) {
3501                 pr_warn("Bumping up indirect_sg_entries to match cmd_sg_entries (%u)\n",
3502                         cmd_sg_entries);
3503                 indirect_sg_entries = cmd_sg_entries;
3504         }
3505
3506         srp_remove_wq = create_workqueue("srp_remove");
3507         if (!srp_remove_wq) {
3508                 ret = -ENOMEM;
3509                 goto out;
3510         }
3511
3512         ret = -ENOMEM;
3513         ib_srp_transport_template =
3514                 srp_attach_transport(&ib_srp_transport_functions);
3515         if (!ib_srp_transport_template)
3516                 goto destroy_wq;
3517
3518         ret = class_register(&srp_class);
3519         if (ret) {
3520                 pr_err("couldn't register class infiniband_srp\n");
3521                 goto release_tr;
3522         }
3523
3524         ib_sa_register_client(&srp_sa_client);
3525
3526         ret = ib_register_client(&srp_client);
3527         if (ret) {
3528                 pr_err("couldn't register IB client\n");
3529                 goto unreg_sa;
3530         }
3531
3532 out:
3533         return ret;
3534
3535 unreg_sa:
3536         ib_sa_unregister_client(&srp_sa_client);
3537         class_unregister(&srp_class);
3538
3539 release_tr:
3540         srp_release_transport(ib_srp_transport_template);
3541
3542 destroy_wq:
3543         destroy_workqueue(srp_remove_wq);
3544         goto out;
3545 }
3546
3547 static void __exit srp_cleanup_module(void)
3548 {
3549         ib_unregister_client(&srp_client);
3550         ib_sa_unregister_client(&srp_sa_client);
3551         class_unregister(&srp_class);
3552         srp_release_transport(ib_srp_transport_template);
3553         destroy_workqueue(srp_remove_wq);
3554 }
3555
3556 module_init(srp_init_module);
3557 module_exit(srp_cleanup_module);