drivers/infiniband/ulp/srp/ib_srp.c

   1 /*
   2  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  34
  35 #include <linux/module.h>
  36 #include <linux/init.h>
  37 #include <linux/slab.h>
  38 #include <linux/err.h>
  39 #include <linux/string.h>
  40 #include <linux/parser.h>
  41 #include <linux/random.h>
  42 #include <linux/jiffies.h>
  43 #include <rdma/ib_cache.h>
  44
  45 #include <linux/atomic.h>
  46
  47 #include <scsi/scsi.h>
  48 #include <scsi/scsi_device.h>
  49 #include <scsi/scsi_dbg.h>
  50 #include <scsi/scsi_tcq.h>
  51 #include <scsi/srp.h>
  52 #include <scsi/scsi_transport_srp.h>
  53
  54 #include "ib_srp.h"
  55
  56 #define DRV_NAME        "ib_srp"
  57 #define PFX             DRV_NAME ": "
  58 #define DRV_VERSION     "2.0"
  59 #define DRV_RELDATE     "July 26, 2015"
  60
  61 MODULE_AUTHOR("Roland Dreier");
  62 MODULE_DESCRIPTION("InfiniBand SCSI RDMA Protocol initiator");
  63 MODULE_LICENSE("Dual BSD/GPL");
  64 MODULE_VERSION(DRV_VERSION);
  65 MODULE_INFO(release_date, DRV_RELDATE);
  66
  67 static unsigned int srp_sg_tablesize;
  68 static unsigned int cmd_sg_entries;
  69 static unsigned int indirect_sg_entries;
  70 static bool allow_ext_sg;
  71 static bool prefer_fr;
  72 static bool register_always;
  73 static int topspin_workarounds = 1;
  74
  75 module_param(srp_sg_tablesize, uint, 0444);
  76 MODULE_PARM_DESC(srp_sg_tablesize, "Deprecated name for cmd_sg_entries");
  77
  78 module_param(cmd_sg_entries, uint, 0444);
  79 MODULE_PARM_DESC(cmd_sg_entries,
  80                  "Default number of gather/scatter entries in the SRP command (default is 12, max 255)");
  81
  82 module_param(indirect_sg_entries, uint, 0444);
  83 MODULE_PARM_DESC(indirect_sg_entries,
  84                  "Default max number of gather/scatter entries (default is 12, max is " __stringify(SCSI_MAX_SG_CHAIN_SEGMENTS) ")");
  85
  86 module_param(allow_ext_sg, bool, 0444);
  87 MODULE_PARM_DESC(allow_ext_sg,
  88                   "Default behavior when there are more than cmd_sg_entries S/G entries after mapping; fails the request when false (default false)");
  89
  90 module_param(topspin_workarounds, int, 0444);
  91 MODULE_PARM_DESC(topspin_workarounds,
  92                  "Enable workarounds for Topspin/Cisco SRP target bugs if != 0");
  93
  94 module_param(prefer_fr, bool, 0444);
  95 MODULE_PARM_DESC(prefer_fr,
  96 "Whether to use fast registration if both FMR and fast registration are supported");
  97
  98 module_param(register_always, bool, 0444);
  99 MODULE_PARM_DESC(register_always,
 100                  "Use memory registration even for contiguous memory regions");
 101
 102 static const struct kernel_param_ops srp_tmo_ops;
 103
 104 static int srp_reconnect_delay = 10;
 105 module_param_cb(reconnect_delay, &srp_tmo_ops, &srp_reconnect_delay,
 106                 S_IRUGO | S_IWUSR);
 107 MODULE_PARM_DESC(reconnect_delay, "Time between successive reconnect attempts");
 108
 109 static int srp_fast_io_fail_tmo = 15;
 110 module_param_cb(fast_io_fail_tmo, &srp_tmo_ops, &srp_fast_io_fail_tmo,
 111                 S_IRUGO | S_IWUSR);
 112 MODULE_PARM_DESC(fast_io_fail_tmo,
 113                  "Number of seconds between the observation of a transport"
 114                  " layer error and failing all I/O. \"off\" means that this"
 115                  " functionality is disabled.");
 116
 117 static int srp_dev_loss_tmo = 600;
 118 module_param_cb(dev_loss_tmo, &srp_tmo_ops, &srp_dev_loss_tmo,
 119                 S_IRUGO | S_IWUSR);
 120 MODULE_PARM_DESC(dev_loss_tmo,
 121                  "Maximum number of seconds that the SRP transport should"
 122                  " insulate transport layer errors. After this time has been"
 123                  " exceeded the SCSI host is removed. Should be"
 124                  " between 1 and " __stringify(SCSI_DEVICE_BLOCK_MAX_TIMEOUT)
 125                  " if fast_io_fail_tmo has not been set. \"off\" means that"
 126                  " this functionality is disabled.");
 127
 128 static unsigned ch_count;
 129 module_param(ch_count, uint, 0444);
 130 MODULE_PARM_DESC(ch_count,
 131                  "Number of RDMA channels to use for communication with an SRP target. Using more than one channel improves performance if the HCA supports multiple completion vectors. The default value is the minimum of four times the number of online CPU sockets and the number of completion vectors supported by the HCA.");
 132
 133 static void srp_add_one(struct ib_device *device);
 134 static void srp_remove_one(struct ib_device *device, void *client_data);
 135 static void srp_recv_completion(struct ib_cq *cq, void *ch_ptr);
 136 static void srp_send_completion(struct ib_cq *cq, void *ch_ptr);
 137 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
 138
 139 static struct scsi_transport_template *ib_srp_transport_template;
 140 static struct workqueue_struct *srp_remove_wq;
 141
 142 static struct ib_client srp_client = {
 143         .name   = "srp",
 144         .add    = srp_add_one,
 145         .remove = srp_remove_one
 146 };
 147
 148 static struct ib_sa_client srp_sa_client;
 149
 150 static int srp_tmo_get(char *buffer, const struct kernel_param *kp)
 151 {
 152         int tmo = *(int *)kp->arg;
 153
 154         if (tmo >= 0)
 155                 return sprintf(buffer, "%d", tmo);
 156         else
 157                 return sprintf(buffer, "off");
 158 }
 159
 160 static int srp_tmo_set(const char *val, const struct kernel_param *kp)
 161 {
 162         int tmo, res;
 163
 164         res = srp_parse_tmo(&tmo, val);
 165         if (res)
 166                 goto out;
 167
 168         if (kp->arg == &srp_reconnect_delay)
 169                 res = srp_tmo_valid(tmo, srp_fast_io_fail_tmo,
 170                                     srp_dev_loss_tmo);
 171         else if (kp->arg == &srp_fast_io_fail_tmo)
 172                 res = srp_tmo_valid(srp_reconnect_delay, tmo, srp_dev_loss_tmo);
 173         else
 174                 res = srp_tmo_valid(srp_reconnect_delay, srp_fast_io_fail_tmo,
 175                                     tmo);
 176         if (res)
 177                 goto out;
 178         *(int *)kp->arg = tmo;
 179
 180 out:
 181         return res;
 182 }
 183
 184 static const struct kernel_param_ops srp_tmo_ops = {
 185         .get = srp_tmo_get,
 186         .set = srp_tmo_set,
 187 };
 188
 189 static inline struct srp_target_port *host_to_target(struct Scsi_Host *host)
 190 {
 191         return (struct srp_target_port *) host->hostdata;
 192 }
 193
 194 static const char *srp_target_info(struct Scsi_Host *host)
 195 {
 196         return host_to_target(host)->target_name;
 197 }
 198
 199 static int srp_target_is_topspin(struct srp_target_port *target)
 200 {
 201         static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 202         static const u8 cisco_oui[3]   = { 0x00, 0x1b, 0x0d };
 203
 204         return topspin_workarounds &&
 205                 (!memcmp(&target->ioc_guid, topspin_oui, sizeof topspin_oui) ||
 206                  !memcmp(&target->ioc_guid, cisco_oui, sizeof cisco_oui));
 207 }
 208
 209 static struct srp_iu *srp_alloc_iu(struct srp_host *host, size_t size,
 210                                    gfp_t gfp_mask,
 211                                    enum dma_data_direction direction)
 212 {
 213         struct srp_iu *iu;
 214
 215         iu = kmalloc(sizeof *iu, gfp_mask);
 216         if (!iu)
 217                 goto out;
 218
 219         iu->buf = kzalloc(size, gfp_mask);
 220         if (!iu->buf)
 221                 goto out_free_iu;
 222
 223         iu->dma = ib_dma_map_single(host->srp_dev->dev, iu->buf, size,
 224                                     direction);
 225         if (ib_dma_mapping_error(host->srp_dev->dev, iu->dma))
 226                 goto out_free_buf;
 227
 228         iu->size      = size;
 229         iu->direction = direction;
 230
 231         return iu;
 232
 233 out_free_buf:
 234         kfree(iu->buf);
 235 out_free_iu:
 236         kfree(iu);
 237 out:
 238         return NULL;
 239 }
 240
 241 static void srp_free_iu(struct srp_host *host, struct srp_iu *iu)
 242 {
 243         if (!iu)
 244                 return;
 245
 246         ib_dma_unmap_single(host->srp_dev->dev, iu->dma, iu->size,
 247                             iu->direction);
 248         kfree(iu->buf);
 249         kfree(iu);
 250 }
 251
 252 static void srp_qp_event(struct ib_event *event, void *context)
 253 {
 254         pr_debug("QP event %s (%d)\n",
 255                  ib_event_msg(event->event), event->event);
 256 }
 257
 258 static int srp_init_qp(struct srp_target_port *target,
 259                        struct ib_qp *qp)
 260 {
 261         struct ib_qp_attr *attr;
 262         int ret;
 263
 264         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 265         if (!attr)
 266                 return -ENOMEM;
 267
 268         ret = ib_find_cached_pkey(target->srp_host->srp_dev->dev,
 269                                   target->srp_host->port,
 270                                   be16_to_cpu(target->pkey),
 271                                   &attr->pkey_index);
 272         if (ret)
 273                 goto out;
 274
 275         attr->qp_state        = IB_QPS_INIT;
 276         attr->qp_access_flags = (IB_ACCESS_REMOTE_READ |
 277                                     IB_ACCESS_REMOTE_WRITE);
 278         attr->port_num        = target->srp_host->port;
 279
 280         ret = ib_modify_qp(qp, attr,
 281                            IB_QP_STATE          |
 282                            IB_QP_PKEY_INDEX     |
 283                            IB_QP_ACCESS_FLAGS   |
 284                            IB_QP_PORT);
 285
 286 out:
 287         kfree(attr);
 288         return ret;
 289 }
 290
 291 static int srp_new_cm_id(struct srp_rdma_ch *ch)
 292 {
 293         struct srp_target_port *target = ch->target;
 294         struct ib_cm_id *new_cm_id;
 295
 296         new_cm_id = ib_create_cm_id(target->srp_host->srp_dev->dev,
 297                                     srp_cm_handler, ch);
 298         if (IS_ERR(new_cm_id))
 299                 return PTR_ERR(new_cm_id);
 300
 301         if (ch->cm_id)
 302                 ib_destroy_cm_id(ch->cm_id);
 303         ch->cm_id = new_cm_id;
 304         ch->path.sgid = target->sgid;
 305         ch->path.dgid = target->orig_dgid;
 306         ch->path.pkey = target->pkey;
 307         ch->path.service_id = target->service_id;
 308
 309         return 0;
 310 }
 311
 312 static struct ib_fmr_pool *srp_alloc_fmr_pool(struct srp_target_port *target)
 313 {
 314         struct srp_device *dev = target->srp_host->srp_dev;
 315         struct ib_fmr_pool_param fmr_param;
 316
 317         memset(&fmr_param, 0, sizeof(fmr_param));
 318         fmr_param.pool_size         = target->scsi_host->can_queue;
 319         fmr_param.dirty_watermark   = fmr_param.pool_size / 4;
 320         fmr_param.cache             = 1;
 321         fmr_param.max_pages_per_fmr = dev->max_pages_per_mr;
 322         fmr_param.page_shift        = ilog2(dev->mr_page_size);
 323         fmr_param.access            = (IB_ACCESS_LOCAL_WRITE |
 324                                        IB_ACCESS_REMOTE_WRITE |
 325                                        IB_ACCESS_REMOTE_READ);
 326
 327         return ib_create_fmr_pool(dev->pd, &fmr_param);
 328 }
 329
 330 /**
 331  * srp_destroy_fr_pool() - free the resources owned by a pool
 332  * @pool: Fast registration pool to be destroyed.
 333  */
 334 static void srp_destroy_fr_pool(struct srp_fr_pool *pool)
 335 {
 336         int i;
 337         struct srp_fr_desc *d;
 338
 339         if (!pool)
 340                 return;
 341
 342         for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
 343                 if (d->frpl)
 344                         ib_free_fast_reg_page_list(d->frpl);
 345                 if (d->mr)
 346                         ib_dereg_mr(d->mr);
 347         }
 348         kfree(pool);
 349 }
 350
 351 /**
 352  * srp_create_fr_pool() - allocate and initialize a pool for fast registration
 353  * @device:            IB device to allocate fast registration descriptors for.
 354  * @pd:                Protection domain associated with the FR descriptors.
 355  * @pool_size:         Number of descriptors to allocate.
 356  * @max_page_list_len: Maximum fast registration work request page list length.
 357  */
 358 static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
 359                                               struct ib_pd *pd, int pool_size,
 360                                               int max_page_list_len)
 361 {
 362         struct srp_fr_pool *pool;
 363         struct srp_fr_desc *d;
 364         struct ib_mr *mr;
 365         struct ib_fast_reg_page_list *frpl;
 366         int i, ret = -EINVAL;
 367
 368         if (pool_size <= 0)
 369                 goto err;
 370         ret = -ENOMEM;
 371         pool = kzalloc(sizeof(struct srp_fr_pool) +
 372                        pool_size * sizeof(struct srp_fr_desc), GFP_KERNEL);
 373         if (!pool)
 374                 goto err;
 375         pool->size = pool_size;
 376         pool->max_page_list_len = max_page_list_len;
 377         spin_lock_init(&pool->lock);
 378         INIT_LIST_HEAD(&pool->free_list);
 379
 380         for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
 381                 mr = ib_alloc_mr(pd, IB_MR_TYPE_MEM_REG,
 382                                  max_page_list_len);
 383                 if (IS_ERR(mr)) {
 384                         ret = PTR_ERR(mr);
 385                         goto destroy_pool;
 386                 }
 387                 d->mr = mr;
 388                 frpl = ib_alloc_fast_reg_page_list(device, max_page_list_len);
 389                 if (IS_ERR(frpl)) {
 390                         ret = PTR_ERR(frpl);
 391                         goto destroy_pool;
 392                 }
 393                 d->frpl = frpl;
 394                 list_add_tail(&d->entry, &pool->free_list);
 395         }
 396
 397 out:
 398         return pool;
 399
 400 destroy_pool:
 401         srp_destroy_fr_pool(pool);
 402
 403 err:
 404         pool = ERR_PTR(ret);
 405         goto out;
 406 }
 407
 408 /**
 409  * srp_fr_pool_get() - obtain a descriptor suitable for fast registration
 410  * @pool: Pool to obtain descriptor from.
 411  */
 412 static struct srp_fr_desc *srp_fr_pool_get(struct srp_fr_pool *pool)
 413 {
 414         struct srp_fr_desc *d = NULL;
 415         unsigned long flags;
 416
 417         spin_lock_irqsave(&pool->lock, flags);
 418         if (!list_empty(&pool->free_list)) {
 419                 d = list_first_entry(&pool->free_list, typeof(*d), entry);
 420                 list_del(&d->entry);
 421         }
 422         spin_unlock_irqrestore(&pool->lock, flags);
 423
 424         return d;
 425 }
 426
 427 /**
 428  * srp_fr_pool_put() - put an FR descriptor back in the free list
 429  * @pool: Pool the descriptor was allocated from.
 430  * @desc: Pointer to an array of fast registration descriptor pointers.
 431  * @n:    Number of descriptors to put back.
 432  *
 433  * Note: The caller must already have queued an invalidation request for
 434  * desc->mr->rkey before calling this function.
 435  */
 436 static void srp_fr_pool_put(struct srp_fr_pool *pool, struct srp_fr_desc **desc,
 437                             int n)
 438 {
 439         unsigned long flags;
 440         int i;
 441
 442         spin_lock_irqsave(&pool->lock, flags);
 443         for (i = 0; i < n; i++)
 444                 list_add(&desc[i]->entry, &pool->free_list);
 445         spin_unlock_irqrestore(&pool->lock, flags);
 446 }
 447
 448 static struct srp_fr_pool *srp_alloc_fr_pool(struct srp_target_port *target)
 449 {
 450         struct srp_device *dev = target->srp_host->srp_dev;
 451
 452         return srp_create_fr_pool(dev->dev, dev->pd,
 453                                   target->scsi_host->can_queue,
 454                                   dev->max_pages_per_mr);
 455 }
 456
 457 /**
 458  * srp_destroy_qp() - destroy an RDMA queue pair
 459  * @ch: SRP RDMA channel.
 460  *
 461  * Change a queue pair into the error state and wait until all receive
 462  * completions have been processed before destroying it. This avoids that
 463  * the receive completion handler can access the queue pair while it is
 464  * being destroyed.
 465  */
 466 static void srp_destroy_qp(struct srp_rdma_ch *ch)
 467 {
 468         static struct ib_qp_attr attr = { .qp_state = IB_QPS_ERR };
 469         static struct ib_recv_wr wr = { .wr_id = SRP_LAST_WR_ID };
 470         struct ib_recv_wr *bad_wr;
 471         int ret;
 472
 473         /* Destroying a QP and reusing ch->done is only safe if not connected */
 474         WARN_ON_ONCE(ch->connected);
 475
 476         ret = ib_modify_qp(ch->qp, &attr, IB_QP_STATE);
 477         WARN_ONCE(ret, "ib_cm_init_qp_attr() returned %d\n", ret);
 478         if (ret)
 479                 goto out;
 480
 481         init_completion(&ch->done);
 482         ret = ib_post_recv(ch->qp, &wr, &bad_wr);
 483         WARN_ONCE(ret, "ib_post_recv() returned %d\n", ret);
 484         if (ret == 0)
 485                 wait_for_completion(&ch->done);
 486
 487 out:
 488         ib_destroy_qp(ch->qp);
 489 }
 490
 491 static int srp_create_ch_ib(struct srp_rdma_ch *ch)
 492 {
 493         struct srp_target_port *target = ch->target;
 494         struct srp_device *dev = target->srp_host->srp_dev;
 495         struct ib_qp_init_attr *init_attr;
 496         struct ib_cq *recv_cq, *send_cq;
 497         struct ib_qp *qp;
 498         struct ib_fmr_pool *fmr_pool = NULL;
 499         struct srp_fr_pool *fr_pool = NULL;
 500         const int m = 1 + dev->use_fast_reg;
 501         struct ib_cq_init_attr cq_attr = {};
 502         int ret;
 503
 504         init_attr = kzalloc(sizeof *init_attr, GFP_KERNEL);
 505         if (!init_attr)
 506                 return -ENOMEM;
 507
 508         /* + 1 for SRP_LAST_WR_ID */
 509         cq_attr.cqe = target->queue_size + 1;
 510         cq_attr.comp_vector = ch->comp_vector;
 511         recv_cq = ib_create_cq(dev->dev, srp_recv_completion, NULL, ch,
 512                                &cq_attr);
 513         if (IS_ERR(recv_cq)) {
 514                 ret = PTR_ERR(recv_cq);
 515                 goto err;
 516         }
 517
 518         cq_attr.cqe = m * target->queue_size;
 519         cq_attr.comp_vector = ch->comp_vector;
 520         send_cq = ib_create_cq(dev->dev, srp_send_completion, NULL, ch,
 521                                &cq_attr);
 522         if (IS_ERR(send_cq)) {
 523                 ret = PTR_ERR(send_cq);
 524                 goto err_recv_cq;
 525         }
 526
 527         ib_req_notify_cq(recv_cq, IB_CQ_NEXT_COMP);
 528
 529         init_attr->event_handler       = srp_qp_event;
 530         init_attr->cap.max_send_wr     = m * target->queue_size;
 531         init_attr->cap.max_recv_wr     = target->queue_size + 1;
 532         init_attr->cap.max_recv_sge    = 1;
 533         init_attr->cap.max_send_sge    = 1;
 534         init_attr->sq_sig_type         = IB_SIGNAL_REQ_WR;
 535         init_attr->qp_type             = IB_QPT_RC;
 536         init_attr->send_cq             = send_cq;
 537         init_attr->recv_cq             = recv_cq;
 538
 539         qp = ib_create_qp(dev->pd, init_attr);
 540         if (IS_ERR(qp)) {
 541                 ret = PTR_ERR(qp);
 542                 goto err_send_cq;
 543         }
 544
 545         ret = srp_init_qp(target, qp);
 546         if (ret)
 547                 goto err_qp;
 548
 549         if (dev->use_fast_reg && dev->has_fr) {
 550                 fr_pool = srp_alloc_fr_pool(target);
 551                 if (IS_ERR(fr_pool)) {
 552                         ret = PTR_ERR(fr_pool);
 553                         shost_printk(KERN_WARNING, target->scsi_host, PFX
 554                                      "FR pool allocation failed (%d)\n", ret);
 555                         goto err_qp;
 556                 }
 557                 if (ch->fr_pool)
 558                         srp_destroy_fr_pool(ch->fr_pool);
 559                 ch->fr_pool = fr_pool;
 560         } else if (!dev->use_fast_reg && dev->has_fmr) {
 561                 fmr_pool = srp_alloc_fmr_pool(target);
 562                 if (IS_ERR(fmr_pool)) {
 563                         ret = PTR_ERR(fmr_pool);
 564                         shost_printk(KERN_WARNING, target->scsi_host, PFX
 565                                      "FMR pool allocation failed (%d)\n", ret);
 566                         goto err_qp;
 567                 }
 568                 if (ch->fmr_pool)
 569                         ib_destroy_fmr_pool(ch->fmr_pool);
 570                 ch->fmr_pool = fmr_pool;
 571         }
 572
 573         if (ch->qp)
 574                 srp_destroy_qp(ch);
 575         if (ch->recv_cq)
 576                 ib_destroy_cq(ch->recv_cq);
 577         if (ch->send_cq)
 578                 ib_destroy_cq(ch->send_cq);
 579
 580         ch->qp = qp;
 581         ch->recv_cq = recv_cq;
 582         ch->send_cq = send_cq;
 583
 584         kfree(init_attr);
 585         return 0;
 586
 587 err_qp:
 588         ib_destroy_qp(qp);
 589
 590 err_send_cq:
 591         ib_destroy_cq(send_cq);
 592
 593 err_recv_cq:
 594         ib_destroy_cq(recv_cq);
 595
 596 err:
 597         kfree(init_attr);
 598         return ret;
 599 }
 600
 601 /*
 602  * Note: this function may be called without srp_alloc_iu_bufs() having been
 603  * invoked. Hence the ch->[rt]x_ring checks.
 604  */
 605 static void srp_free_ch_ib(struct srp_target_port *target,
 606                            struct srp_rdma_ch *ch)
 607 {
 608         struct srp_device *dev = target->srp_host->srp_dev;
 609         int i;
 610
 611         if (!ch->target)
 612                 return;
 613
 614         if (ch->cm_id) {
 615                 ib_destroy_cm_id(ch->cm_id);
 616                 ch->cm_id = NULL;
 617         }
 618
 619         /* If srp_new_cm_id() succeeded but srp_create_ch_ib() not, return. */
 620         if (!ch->qp)
 621                 return;
 622
 623         if (dev->use_fast_reg) {
 624                 if (ch->fr_pool)
 625                         srp_destroy_fr_pool(ch->fr_pool);
 626         } else {
 627                 if (ch->fmr_pool)
 628                         ib_destroy_fmr_pool(ch->fmr_pool);
 629         }
 630         srp_destroy_qp(ch);
 631         ib_destroy_cq(ch->send_cq);
 632         ib_destroy_cq(ch->recv_cq);
 633
 634         /*
 635          * Avoid that the SCSI error handler tries to use this channel after
 636          * it has been freed. The SCSI error handler can namely continue
 637          * trying to perform recovery actions after scsi_remove_host()
 638          * returned.
 639          */
 640         ch->target = NULL;
 641
 642         ch->qp = NULL;
 643         ch->send_cq = ch->recv_cq = NULL;
 644
 645         if (ch->rx_ring) {
 646                 for (i = 0; i < target->queue_size; ++i)
 647                         srp_free_iu(target->srp_host, ch->rx_ring[i]);
 648                 kfree(ch->rx_ring);
 649                 ch->rx_ring = NULL;
 650         }
 651         if (ch->tx_ring) {
 652                 for (i = 0; i < target->queue_size; ++i)
 653                         srp_free_iu(target->srp_host, ch->tx_ring[i]);
 654                 kfree(ch->tx_ring);
 655                 ch->tx_ring = NULL;
 656         }
 657 }
 658
 659 static void srp_path_rec_completion(int status,
 660                                     struct ib_sa_path_rec *pathrec,
 661                                     void *ch_ptr)
 662 {
 663         struct srp_rdma_ch *ch = ch_ptr;
 664         struct srp_target_port *target = ch->target;
 665
 666         ch->status = status;
 667         if (status)
 668                 shost_printk(KERN_ERR, target->scsi_host,
 669                              PFX "Got failed path rec status %d\n", status);
 670         else
 671                 ch->path = *pathrec;
 672         complete(&ch->done);
 673 }
 674
 675 static int srp_lookup_path(struct srp_rdma_ch *ch)
 676 {
 677         struct srp_target_port *target = ch->target;
 678         int ret;
 679
 680         ch->path.numb_path = 1;
 681
 682         init_completion(&ch->done);
 683
 684         ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
 685                                                target->srp_host->srp_dev->dev,
 686                                                target->srp_host->port,
 687                                                &ch->path,
 688                                                IB_SA_PATH_REC_SERVICE_ID |
 689                                                IB_SA_PATH_REC_DGID       |
 690                                                IB_SA_PATH_REC_SGID       |
 691                                                IB_SA_PATH_REC_NUMB_PATH  |
 692                                                IB_SA_PATH_REC_PKEY,
 693                                                SRP_PATH_REC_TIMEOUT_MS,
 694                                                GFP_KERNEL,
 695                                                srp_path_rec_completion,
 696                                                ch, &ch->path_query);
 697         if (ch->path_query_id < 0)
 698                 return ch->path_query_id;
 699
 700         ret = wait_for_completion_interruptible(&ch->done);
 701         if (ret < 0)
 702                 return ret;
 703
 704         if (ch->status < 0)
 705                 shost_printk(KERN_WARNING, target->scsi_host,
 706                              PFX "Path record query failed\n");
 707
 708         return ch->status;
 709 }
 710
 711 static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
 712 {
 713         struct srp_target_port *target = ch->target;
 714         struct {
 715                 struct ib_cm_req_param param;
 716                 struct srp_login_req   priv;
 717         } *req = NULL;
 718         int status;
 719
 720         req = kzalloc(sizeof *req, GFP_KERNEL);
 721         if (!req)
 722                 return -ENOMEM;
 723
 724         req->param.primary_path               = &ch->path;
 725         req->param.alternate_path             = NULL;
 726         req->param.service_id                 = target->service_id;
 727         req->param.qp_num                     = ch->qp->qp_num;
 728         req->param.qp_type                    = ch->qp->qp_type;
 729         req->param.private_data               = &req->priv;
 730         req->param.private_data_len           = sizeof req->priv;
 731         req->param.flow_control               = 1;
 732
 733         get_random_bytes(&req->param.starting_psn, 4);
 734         req->param.starting_psn              &= 0xffffff;
 735
 736         /*
 737          * Pick some arbitrary defaults here; we could make these
 738          * module parameters if anyone cared about setting them.
 739          */
 740         req->param.responder_resources        = 4;
 741         req->param.remote_cm_response_timeout = 20;
 742         req->param.local_cm_response_timeout  = 20;
 743         req->param.retry_count                = target->tl_retry_count;
 744         req->param.rnr_retry_count            = 7;
 745         req->param.max_cm_retries             = 15;
 746
 747         req->priv.opcode        = SRP_LOGIN_REQ;
 748         req->priv.tag           = 0;
 749         req->priv.req_it_iu_len = cpu_to_be32(target->max_iu_len);
 750         req->priv.req_buf_fmt   = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
 751                                               SRP_BUF_FORMAT_INDIRECT);
 752         req->priv.req_flags     = (multich ? SRP_MULTICHAN_MULTI :
 753                                    SRP_MULTICHAN_SINGLE);
 754         /*
 755          * In the published SRP specification (draft rev. 16a), the
 756          * port identifier format is 8 bytes of ID extension followed
 757          * by 8 bytes of GUID.  Older drafts put the two halves in the
 758          * opposite order, so that the GUID comes first.
 759          *
 760          * Targets conforming to these obsolete drafts can be
 761          * recognized by the I/O Class they report.
 762          */
 763         if (target->io_class == SRP_REV10_IB_IO_CLASS) {
 764                 memcpy(req->priv.initiator_port_id,
 765                        &target->sgid.global.interface_id, 8);
 766                 memcpy(req->priv.initiator_port_id + 8,
 767                        &target->initiator_ext, 8);
 768                 memcpy(req->priv.target_port_id,     &target->ioc_guid, 8);
 769                 memcpy(req->priv.target_port_id + 8, &target->id_ext, 8);
 770         } else {
 771                 memcpy(req->priv.initiator_port_id,
 772                        &target->initiator_ext, 8);
 773                 memcpy(req->priv.initiator_port_id + 8,
 774                        &target->sgid.global.interface_id, 8);
 775                 memcpy(req->priv.target_port_id,     &target->id_ext, 8);
 776                 memcpy(req->priv.target_port_id + 8, &target->ioc_guid, 8);
 777         }
 778
 779         /*
 780          * Topspin/Cisco SRP targets will reject our login unless we
 781          * zero out the first 8 bytes of our initiator port ID and set
 782          * the second 8 bytes to the local node GUID.
 783          */
 784         if (srp_target_is_topspin(target)) {
 785                 shost_printk(KERN_DEBUG, target->scsi_host,
 786                              PFX "Topspin/Cisco initiator port ID workaround "
 787                              "activated for target GUID %016llx\n",
 788                              be64_to_cpu(target->ioc_guid));
 789                 memset(req->priv.initiator_port_id, 0, 8);
 790                 memcpy(req->priv.initiator_port_id + 8,
 791                        &target->srp_host->srp_dev->dev->node_guid, 8);
 792         }
 793
 794         status = ib_send_cm_req(ch->cm_id, &req->param);
 795
 796         kfree(req);
 797
 798         return status;
 799 }
 800
 801 static bool srp_queue_remove_work(struct srp_target_port *target)
 802 {
 803         bool changed = false;
 804
 805         spin_lock_irq(&target->lock);
 806         if (target->state != SRP_TARGET_REMOVED) {
 807                 target->state = SRP_TARGET_REMOVED;
 808                 changed = true;
 809         }
 810         spin_unlock_irq(&target->lock);
 811
 812         if (changed)
 813                 queue_work(srp_remove_wq, &target->remove_work);
 814
 815         return changed;
 816 }
 817
 818 static void srp_disconnect_target(struct srp_target_port *target)
 819 {
 820         struct srp_rdma_ch *ch;
 821         int i;
 822
 823         /* XXX should send SRP_I_LOGOUT request */
 824
 825         for (i = 0; i < target->ch_count; i++) {
 826                 ch = &target->ch[i];
 827                 ch->connected = false;
 828                 if (ch->cm_id && ib_send_cm_dreq(ch->cm_id, NULL, 0)) {
 829                         shost_printk(KERN_DEBUG, target->scsi_host,
 830                                      PFX "Sending CM DREQ failed\n");
 831                 }
 832         }
 833 }
 834
 835 static void srp_free_req_data(struct srp_target_port *target,
 836                               struct srp_rdma_ch *ch)
 837 {
 838         struct srp_device *dev = target->srp_host->srp_dev;
 839         struct ib_device *ibdev = dev->dev;
 840         struct srp_request *req;
 841         int i;
 842
 843         if (!ch->req_ring)
 844                 return;
 845
 846         for (i = 0; i < target->req_ring_size; ++i) {
 847                 req = &ch->req_ring[i];
 848                 if (dev->use_fast_reg)
 849                         kfree(req->fr_list);
 850                 else
 851                         kfree(req->fmr_list);
 852                 kfree(req->map_page);
 853                 if (req->indirect_dma_addr) {
 854                         ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
 855                                             target->indirect_size,
 856                                             DMA_TO_DEVICE);
 857                 }
 858                 kfree(req->indirect_desc);
 859         }
 860
 861         kfree(ch->req_ring);
 862         ch->req_ring = NULL;
 863 }
 864
 865 static int srp_alloc_req_data(struct srp_rdma_ch *ch)
 866 {
 867         struct srp_target_port *target = ch->target;
 868         struct srp_device *srp_dev = target->srp_host->srp_dev;
 869         struct ib_device *ibdev = srp_dev->dev;
 870         struct srp_request *req;
 871         void *mr_list;
 872         dma_addr_t dma_addr;
 873         int i, ret = -ENOMEM;
 874
 875         ch->req_ring = kcalloc(target->req_ring_size, sizeof(*ch->req_ring),
 876                                GFP_KERNEL);
 877         if (!ch->req_ring)
 878                 goto out;
 879
 880         for (i = 0; i < target->req_ring_size; ++i) {
 881                 req = &ch->req_ring[i];
 882                 mr_list = kmalloc(target->cmd_sg_cnt * sizeof(void *),
 883                                   GFP_KERNEL);
 884                 if (!mr_list)
 885                         goto out;
 886                 if (srp_dev->use_fast_reg)
 887                         req->fr_list = mr_list;
 888                 else
 889                         req->fmr_list = mr_list;
 890                 req->map_page = kmalloc(srp_dev->max_pages_per_mr *
 891                                         sizeof(void *), GFP_KERNEL);
 892                 if (!req->map_page)
 893                         goto out;
 894                 req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
 895                 if (!req->indirect_desc)
 896                         goto out;
 897
 898                 dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
 899                                              target->indirect_size,
 900                                              DMA_TO_DEVICE);
 901                 if (ib_dma_mapping_error(ibdev, dma_addr))
 902                         goto out;
 903
 904                 req->indirect_dma_addr = dma_addr;
 905         }
 906         ret = 0;
 907
 908 out:
 909         return ret;
 910 }
 911
 912 /**
 913  * srp_del_scsi_host_attr() - Remove attributes defined in the host template.
 914  * @shost: SCSI host whose attributes to remove from sysfs.
 915  *
 916  * Note: Any attributes defined in the host template and that did not exist
 917  * before invocation of this function will be ignored.
 918  */
 919 static void srp_del_scsi_host_attr(struct Scsi_Host *shost)
 920 {
 921         struct device_attribute **attr;
 922
 923         for (attr = shost->hostt->shost_attrs; attr && *attr; ++attr)
 924                 device_remove_file(&shost->shost_dev, *attr);
 925 }
 926
 927 static void srp_remove_target(struct srp_target_port *target)
 928 {
 929         struct srp_rdma_ch *ch;
 930         int i;
 931
 932         WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 933
 934         srp_del_scsi_host_attr(target->scsi_host);
 935         srp_rport_get(target->rport);
 936         srp_remove_host(target->scsi_host);
 937         scsi_remove_host(target->scsi_host);
 938         srp_stop_rport_timers(target->rport);
 939         srp_disconnect_target(target);
 940         for (i = 0; i < target->ch_count; i++) {
 941                 ch = &target->ch[i];
 942                 srp_free_ch_ib(target, ch);
 943         }
 944         cancel_work_sync(&target->tl_err_work);
 945         srp_rport_put(target->rport);
 946         for (i = 0; i < target->ch_count; i++) {
 947                 ch = &target->ch[i];
 948                 srp_free_req_data(target, ch);
 949         }
 950         kfree(target->ch);
 951         target->ch = NULL;
 952
 953         spin_lock(&target->srp_host->target_lock);
 954         list_del(&target->list);
 955         spin_unlock(&target->srp_host->target_lock);
 956
 957         scsi_host_put(target->scsi_host);
 958 }
 959
 960 static void srp_remove_work(struct work_struct *work)
 961 {
 962         struct srp_target_port *target =
 963                 container_of(work, struct srp_target_port, remove_work);
 964
 965         WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 966
 967         srp_remove_target(target);
 968 }
 969
 970 static void srp_rport_delete(struct srp_rport *rport)
 971 {
 972         struct srp_target_port *target = rport->lld_data;
 973
 974         srp_queue_remove_work(target);
 975 }
 976
 977 /**
 978  * srp_connected_ch() - number of connected channels
 979  * @target: SRP target port.
 980  */
 981 static int srp_connected_ch(struct srp_target_port *target)
 982 {
 983         int i, c = 0;
 984
 985         for (i = 0; i < target->ch_count; i++)
 986                 c += target->ch[i].connected;
 987
 988         return c;
 989 }
 990
 991 static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
 992 {
 993         struct srp_target_port *target = ch->target;
 994         int ret;
 995
 996         WARN_ON_ONCE(!multich && srp_connected_ch(target) > 0);
 997
 998         ret = srp_lookup_path(ch);
 999         if (ret)
1000                 return ret;
1001
1002         while (1) {
1003                 init_completion(&ch->done);
1004                 ret = srp_send_req(ch, multich);
1005                 if (ret)
1006                         return ret;
1007                 ret = wait_for_completion_interruptible(&ch->done);
1008                 if (ret < 0)
1009                         return ret;
1010
1011                 /*
1012                  * The CM event handling code will set status to
1013                  * SRP_PORT_REDIRECT if we get a port redirect REJ
1014                  * back, or SRP_DLID_REDIRECT if we get a lid/qp
1015                  * redirect REJ back.
1016                  */
1017                 switch (ch->status) {
1018                 case 0:
1019                         ch->connected = true;
1020                         return 0;
1021
1022                 case SRP_PORT_REDIRECT:
1023                         ret = srp_lookup_path(ch);
1024                         if (ret)
1025                                 return ret;
1026                         break;
1027
1028                 case SRP_DLID_REDIRECT:
1029                         break;
1030
1031                 case SRP_STALE_CONN:
1032                         shost_printk(KERN_ERR, target->scsi_host, PFX
1033                                      "giving up on stale connection\n");
1034                         ch->status = -ECONNRESET;
1035                         return ch->status;
1036
1037                 default:
1038                         return ch->status;
1039                 }
1040         }
1041 }
1042
1043 static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
1044 {
1045         struct ib_send_wr *bad_wr;
1046         struct ib_send_wr wr = {
1047                 .opcode             = IB_WR_LOCAL_INV,
1048                 .wr_id              = LOCAL_INV_WR_ID_MASK,
1049                 .next               = NULL,
1050                 .num_sge            = 0,
1051                 .send_flags         = 0,
1052                 .ex.invalidate_rkey = rkey,
1053         };
1054
1055         return ib_post_send(ch->qp, &wr, &bad_wr);
1056 }
1057
1058 static void srp_unmap_data(struct scsi_cmnd *scmnd,
1059                            struct srp_rdma_ch *ch,
1060                            struct srp_request *req)
1061 {
1062         struct srp_target_port *target = ch->target;
1063         struct srp_device *dev = target->srp_host->srp_dev;
1064         struct ib_device *ibdev = dev->dev;
1065         int i, res;
1066
1067         if (!scsi_sglist(scmnd) ||
1068             (scmnd->sc_data_direction != DMA_TO_DEVICE &&
1069              scmnd->sc_data_direction != DMA_FROM_DEVICE))
1070                 return;
1071
1072         if (dev->use_fast_reg) {
1073                 struct srp_fr_desc **pfr;
1074
1075                 for (i = req->nmdesc, pfr = req->fr_list; i > 0; i--, pfr++) {
1076                         res = srp_inv_rkey(ch, (*pfr)->mr->rkey);
1077                         if (res < 0) {
1078                                 shost_printk(KERN_ERR, target->scsi_host, PFX
1079                                   "Queueing INV WR for rkey %#x failed (%d)\n",
1080                                   (*pfr)->mr->rkey, res);
1081                                 queue_work(system_long_wq,
1082                                            &target->tl_err_work);
1083                         }
1084                 }
1085                 if (req->nmdesc)
1086                         srp_fr_pool_put(ch->fr_pool, req->fr_list,
1087                                         req->nmdesc);
1088         } else {
1089                 struct ib_pool_fmr **pfmr;
1090
1091                 for (i = req->nmdesc, pfmr = req->fmr_list; i > 0; i--, pfmr++)
1092                         ib_fmr_pool_unmap(*pfmr);
1093         }
1094
1095         ib_dma_unmap_sg(ibdev, scsi_sglist(scmnd), scsi_sg_count(scmnd),
1096                         scmnd->sc_data_direction);
1097 }
1098
1099 /**
1100  * srp_claim_req - Take ownership of the scmnd associated with a request.
1101  * @ch: SRP RDMA channel.
1102  * @req: SRP request.
1103  * @sdev: If not NULL, only take ownership for this SCSI device.
1104  * @scmnd: If NULL, take ownership of @req->scmnd. If not NULL, only take
1105  *         ownership of @req->scmnd if it equals @scmnd.
1106  *
1107  * Return value:
1108  * Either NULL or a pointer to the SCSI command the caller became owner of.
1109  */
1110 static struct scsi_cmnd *srp_claim_req(struct srp_rdma_ch *ch,
1111                                        struct srp_request *req,
1112                                        struct scsi_device *sdev,
1113                                        struct scsi_cmnd *scmnd)
1114 {
1115         unsigned long flags;
1116
1117         spin_lock_irqsave(&ch->lock, flags);
1118         if (req->scmnd &&
1119             (!sdev || req->scmnd->device == sdev) &&
1120             (!scmnd || req->scmnd == scmnd)) {
1121                 scmnd = req->scmnd;
1122                 req->scmnd = NULL;
1123         } else {
1124                 scmnd = NULL;
1125         }
1126         spin_unlock_irqrestore(&ch->lock, flags);
1127
1128         return scmnd;
1129 }
1130
1131 /**
1132  * srp_free_req() - Unmap data and add request to the free request list.
1133  * @ch:     SRP RDMA channel.
1134  * @req:    Request to be freed.
1135  * @scmnd:  SCSI command associated with @req.
1136  * @req_lim_delta: Amount to be added to @target->req_lim.
1137  */
1138 static void srp_free_req(struct srp_rdma_ch *ch, struct srp_request *req,
1139                          struct scsi_cmnd *scmnd, s32 req_lim_delta)
1140 {
1141         unsigned long flags;
1142
1143         srp_unmap_data(scmnd, ch, req);
1144
1145         spin_lock_irqsave(&ch->lock, flags);
1146         ch->req_lim += req_lim_delta;
1147         spin_unlock_irqrestore(&ch->lock, flags);
1148 }
1149
1150 static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req,
1151                            struct scsi_device *sdev, int result)
1152 {
1153         struct scsi_cmnd *scmnd = srp_claim_req(ch, req, sdev, NULL);
1154
1155         if (scmnd) {
1156                 srp_free_req(ch, req, scmnd, 0);
1157                 scmnd->result = result;
1158                 scmnd->scsi_done(scmnd);
1159         }
1160 }
1161
1162 static void srp_terminate_io(struct srp_rport *rport)
1163 {
1164         struct srp_target_port *target = rport->lld_data;
1165         struct srp_rdma_ch *ch;
1166         struct Scsi_Host *shost = target->scsi_host;
1167         struct scsi_device *sdev;
1168         int i, j;
1169
1170         /*
1171          * Invoking srp_terminate_io() while srp_queuecommand() is running
1172          * is not safe. Hence the warning statement below.
1173          */
1174         shost_for_each_device(sdev, shost)
1175                 WARN_ON_ONCE(sdev->request_queue->request_fn_active);
1176
1177         for (i = 0; i < target->ch_count; i++) {
1178                 ch = &target->ch[i];
1179
1180                 for (j = 0; j < target->req_ring_size; ++j) {
1181                         struct srp_request *req = &ch->req_ring[j];
1182
1183                         srp_finish_req(ch, req, NULL,
1184                                        DID_TRANSPORT_FAILFAST << 16);
1185                 }
1186         }
1187 }
1188
1189 /*
1190  * It is up to the caller to ensure that srp_rport_reconnect() calls are
1191  * serialized and that no concurrent srp_queuecommand(), srp_abort(),
1192  * srp_reset_device() or srp_reset_host() calls will occur while this function
1193  * is in progress. One way to realize that is not to call this function
1194  * directly but to call srp_reconnect_rport() instead since that last function
1195  * serializes calls of this function via rport->mutex and also blocks
1196  * srp_queuecommand() calls before invoking this function.
1197  */
1198 static int srp_rport_reconnect(struct srp_rport *rport)
1199 {
1200         struct srp_target_port *target = rport->lld_data;
1201         struct srp_rdma_ch *ch;
1202         int i, j, ret = 0;
1203         bool multich = false;
1204
1205         srp_disconnect_target(target);
1206
1207         if (target->state == SRP_TARGET_SCANNING)
1208                 return -ENODEV;
1209
1210         /*
1211          * Now get a new local CM ID so that we avoid confusing the target in
1212          * case things are really fouled up. Doing so also ensures that all CM
1213          * callbacks will have finished before a new QP is allocated.
1214          */
1215         for (i = 0; i < target->ch_count; i++) {
1216                 ch = &target->ch[i];
1217                 ret += srp_new_cm_id(ch);
1218         }
1219         for (i = 0; i < target->ch_count; i++) {
1220                 ch = &target->ch[i];
1221                 for (j = 0; j < target->req_ring_size; ++j) {
1222                         struct srp_request *req = &ch->req_ring[j];
1223
1224                         srp_finish_req(ch, req, NULL, DID_RESET << 16);
1225                 }
1226         }
1227         for (i = 0; i < target->ch_count; i++) {
1228                 ch = &target->ch[i];
1229                 /*
1230                  * Whether or not creating a new CM ID succeeded, create a new
1231                  * QP. This guarantees that all completion callback function
1232                  * invocations have finished before request resetting starts.
1233                  */
1234                 ret += srp_create_ch_ib(ch);
1235
1236                 INIT_LIST_HEAD(&ch->free_tx);
1237                 for (j = 0; j < target->queue_size; ++j)
1238                         list_add(&ch->tx_ring[j]->list, &ch->free_tx);
1239         }
1240
1241         target->qp_in_error = false;
1242
1243         for (i = 0; i < target->ch_count; i++) {
1244                 ch = &target->ch[i];
1245                 if (ret)
1246                         break;
1247                 ret = srp_connect_ch(ch, multich);
1248                 multich = true;
1249         }
1250
1251         if (ret == 0)
1252                 shost_printk(KERN_INFO, target->scsi_host,
1253                              PFX "reconnect succeeded\n");
1254
1255         return ret;
1256 }
1257
1258 static void srp_map_desc(struct srp_map_state *state, dma_addr_t dma_addr,
1259                          unsigned int dma_len, u32 rkey)
1260 {
1261         struct srp_direct_buf *desc = state->desc;
1262
1263         desc->va = cpu_to_be64(dma_addr);
1264         desc->key = cpu_to_be32(rkey);
1265         desc->len = cpu_to_be32(dma_len);
1266
1267         state->total_len += dma_len;
1268         state->desc++;
1269         state->ndesc++;
1270 }
1271
1272 static int srp_map_finish_fmr(struct srp_map_state *state,
1273                               struct srp_rdma_ch *ch)
1274 {
1275         struct srp_target_port *target = ch->target;
1276         struct srp_device *dev = target->srp_host->srp_dev;
1277         struct ib_pool_fmr *fmr;
1278         u64 io_addr = 0;
1279
1280         if (state->fmr.next >= state->fmr.end)
1281                 return -ENOMEM;
1282
1283         fmr = ib_fmr_pool_map_phys(ch->fmr_pool, state->pages,
1284                                    state->npages, io_addr);
1285         if (IS_ERR(fmr))
1286                 return PTR_ERR(fmr);
1287
1288         *state->fmr.next++ = fmr;
1289         state->nmdesc++;
1290
1291         srp_map_desc(state, state->base_dma_addr & ~dev->mr_page_mask,
1292                      state->dma_len, fmr->fmr->rkey);
1293
1294         return 0;
1295 }
1296
1297 static int srp_map_finish_fr(struct srp_map_state *state,
1298                              struct srp_rdma_ch *ch)
1299 {
1300         struct srp_target_port *target = ch->target;
1301         struct srp_device *dev = target->srp_host->srp_dev;
1302         struct ib_send_wr *bad_wr;
1303         struct ib_send_wr wr;
1304         struct srp_fr_desc *desc;
1305         u32 rkey;
1306
1307         if (state->fr.next >= state->fr.end)
1308                 return -ENOMEM;
1309
1310         desc = srp_fr_pool_get(ch->fr_pool);
1311         if (!desc)
1312                 return -ENOMEM;
1313
1314         rkey = ib_inc_rkey(desc->mr->rkey);
1315         ib_update_fast_reg_key(desc->mr, rkey);
1316
1317         memcpy(desc->frpl->page_list, state->pages,
1318                sizeof(state->pages[0]) * state->npages);
1319
1320         memset(&wr, 0, sizeof(wr));
1321         wr.opcode = IB_WR_FAST_REG_MR;
1322         wr.wr_id = FAST_REG_WR_ID_MASK;
1323         wr.wr.fast_reg.iova_start = state->base_dma_addr;
1324         wr.wr.fast_reg.page_list = desc->frpl;
1325         wr.wr.fast_reg.page_list_len = state->npages;
1326         wr.wr.fast_reg.page_shift = ilog2(dev->mr_page_size);
1327         wr.wr.fast_reg.length = state->dma_len;
1328         wr.wr.fast_reg.access_flags = (IB_ACCESS_LOCAL_WRITE |
1329                                        IB_ACCESS_REMOTE_READ |
1330                                        IB_ACCESS_REMOTE_WRITE);
1331         wr.wr.fast_reg.rkey = desc->mr->lkey;
1332
1333         *state->fr.next++ = desc;
1334         state->nmdesc++;
1335
1336         srp_map_desc(state, state->base_dma_addr, state->dma_len,
1337                      desc->mr->rkey);
1338
1339         return ib_post_send(ch->qp, &wr, &bad_wr);
1340 }
1341
1342 static int srp_finish_mapping(struct srp_map_state *state,
1343                               struct srp_rdma_ch *ch)
1344 {
1345         struct srp_target_port *target = ch->target;
1346         int ret = 0;
1347
1348         if (state->npages == 0)
1349                 return 0;
1350
1351         if (state->npages == 1 && !register_always)
1352                 srp_map_desc(state, state->base_dma_addr, state->dma_len,
1353                              target->rkey);
1354         else
1355                 ret = target->srp_host->srp_dev->use_fast_reg ?
1356                         srp_map_finish_fr(state, ch) :
1357                         srp_map_finish_fmr(state, ch);
1358
1359         if (ret == 0) {
1360                 state->npages = 0;
1361                 state->dma_len = 0;
1362         }
1363
1364         return ret;
1365 }
1366
1367 static void srp_map_update_start(struct srp_map_state *state,
1368                                  struct scatterlist *sg, int sg_index,
1369                                  dma_addr_t dma_addr)
1370 {
1371         state->unmapped_sg = sg;
1372         state->unmapped_index = sg_index;
1373         state->unmapped_addr = dma_addr;
1374 }
1375
1376 static int srp_map_sg_entry(struct srp_map_state *state,
1377                             struct srp_rdma_ch *ch,
1378                             struct scatterlist *sg, int sg_index,
1379                             bool use_mr)
1380 {
1381         struct srp_target_port *target = ch->target;
1382         struct srp_device *dev = target->srp_host->srp_dev;
1383         struct ib_device *ibdev = dev->dev;
1384         dma_addr_t dma_addr = ib_sg_dma_address(ibdev, sg);
1385         unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
1386         unsigned int len;
1387         int ret;
1388
1389         if (!dma_len)
1390                 return 0;
1391
1392         if (!use_mr) {
1393                 /*
1394                  * Once we're in direct map mode for a request, we don't
1395                  * go back to FMR or FR mode, so no need to update anything
1396                  * other than the descriptor.
1397                  */
1398                 srp_map_desc(state, dma_addr, dma_len, target->rkey);
1399                 return 0;
1400         }
1401
1402         /*
1403          * If this is the first sg that will be mapped via FMR or via FR, save
1404          * our position. We need to know the first unmapped entry, its index,
1405          * and the first unmapped address within that entry to be able to
1406          * restart mapping after an error.
1407          */
1408         if (!state->unmapped_sg)
1409                 srp_map_update_start(state, sg, sg_index, dma_addr);
1410
1411         while (dma_len) {
1412                 unsigned offset = dma_addr & ~dev->mr_page_mask;
1413                 if (state->npages == dev->max_pages_per_mr || offset != 0) {
1414                         ret = srp_finish_mapping(state, ch);
1415                         if (ret)
1416                                 return ret;
1417
1418                         srp_map_update_start(state, sg, sg_index, dma_addr);
1419                 }
1420
1421                 len = min_t(unsigned int, dma_len, dev->mr_page_size - offset);
1422
1423                 if (!state->npages)
1424                         state->base_dma_addr = dma_addr;
1425                 state->pages[state->npages++] = dma_addr & dev->mr_page_mask;
1426                 state->dma_len += len;
1427                 dma_addr += len;
1428                 dma_len -= len;
1429         }
1430
1431         /*
1432          * If the last entry of the MR wasn't a full page, then we need to
1433          * close it out and start a new one -- we can only merge at page
1434          * boundries.
1435          */
1436         ret = 0;
1437         if (len != dev->mr_page_size) {
1438                 ret = srp_finish_mapping(state, ch);
1439                 if (!ret)
1440                         srp_map_update_start(state, NULL, 0, 0);
1441         }
1442         return ret;
1443 }
1444
1445 static int srp_map_sg(struct srp_map_state *state, struct srp_rdma_ch *ch,
1446                       struct srp_request *req, struct scatterlist *scat,
1447                       int count)
1448 {
1449         struct srp_target_port *target = ch->target;
1450         struct srp_device *dev = target->srp_host->srp_dev;
1451         struct ib_device *ibdev = dev->dev;
1452         struct scatterlist *sg;
1453         int i;
1454         bool use_mr;
1455
1456         state->desc     = req->indirect_desc;
1457         state->pages    = req->map_page;
1458         if (dev->use_fast_reg) {
1459                 state->fr.next = req->fr_list;
1460                 state->fr.end = req->fr_list + target->cmd_sg_cnt;
1461                 use_mr = !!ch->fr_pool;
1462         } else {
1463                 state->fmr.next = req->fmr_list;
1464                 state->fmr.end = req->fmr_list + target->cmd_sg_cnt;
1465                 use_mr = !!ch->fmr_pool;
1466         }
1467
1468         for_each_sg(scat, sg, count, i) {
1469                 if (srp_map_sg_entry(state, ch, sg, i, use_mr)) {
1470                         /*
1471                          * Memory registration failed, so backtrack to the
1472                          * first unmapped entry and continue on without using
1473                          * memory registration.
1474                          */
1475                         dma_addr_t dma_addr;
1476                         unsigned int dma_len;
1477
1478 backtrack:
1479                         sg = state->unmapped_sg;
1480                         i = state->unmapped_index;
1481
1482                         dma_addr = ib_sg_dma_address(ibdev, sg);
1483                         dma_len = ib_sg_dma_len(ibdev, sg);
1484                         dma_len -= (state->unmapped_addr - dma_addr);
1485                         dma_addr = state->unmapped_addr;
1486                         use_mr = false;
1487                         srp_map_desc(state, dma_addr, dma_len, target->rkey);
1488                 }
1489         }
1490
1491         if (use_mr && srp_finish_mapping(state, ch))
1492                 goto backtrack;
1493
1494         req->nmdesc = state->nmdesc;
1495
1496         return 0;
1497 }
1498
1499 static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_rdma_ch *ch,
1500                         struct srp_request *req)
1501 {
1502         struct srp_target_port *target = ch->target;
1503         struct scatterlist *scat;
1504         struct srp_cmd *cmd = req->cmd->buf;
1505         int len, nents, count;
1506         struct srp_device *dev;
1507         struct ib_device *ibdev;
1508         struct srp_map_state state;
1509         struct srp_indirect_buf *indirect_hdr;
1510         u32 table_len;
1511         u8 fmt;
1512
1513         if (!scsi_sglist(scmnd) || scmnd->sc_data_direction == DMA_NONE)
1514                 return sizeof (struct srp_cmd);
1515
1516         if (scmnd->sc_data_direction != DMA_FROM_DEVICE &&
1517             scmnd->sc_data_direction != DMA_TO_DEVICE) {
1518                 shost_printk(KERN_WARNING, target->scsi_host,
1519                              PFX "Unhandled data direction %d\n",
1520                              scmnd->sc_data_direction);
1521                 return -EINVAL;
1522         }
1523
1524         nents = scsi_sg_count(scmnd);
1525         scat  = scsi_sglist(scmnd);
1526
1527         dev = target->srp_host->srp_dev;
1528         ibdev = dev->dev;
1529
1530         count = ib_dma_map_sg(ibdev, scat, nents, scmnd->sc_data_direction);
1531         if (unlikely(count == 0))
1532                 return -EIO;
1533
1534         fmt = SRP_DATA_DESC_DIRECT;
1535         len = sizeof (struct srp_cmd) + sizeof (struct srp_direct_buf);
1536
1537         if (count == 1 && !register_always) {
1538                 /*
1539                  * The midlayer only generated a single gather/scatter
1540                  * entry, or DMA mapping coalesced everything to a
1541                  * single entry.  So a direct descriptor along with
1542                  * the DMA MR suffices.
1543                  */
1544                 struct srp_direct_buf *buf = (void *) cmd->add_data;
1545
1546                 buf->va  = cpu_to_be64(ib_sg_dma_address(ibdev, scat));
1547                 buf->key = cpu_to_be32(target->rkey);
1548                 buf->len = cpu_to_be32(ib_sg_dma_len(ibdev, scat));
1549
1550                 req->nmdesc = 0;
1551                 goto map_complete;
1552         }
1553
1554         /*
1555          * We have more than one scatter/gather entry, so build our indirect
1556          * descriptor table, trying to merge as many entries as we can.
1557          */
1558         indirect_hdr = (void *) cmd->add_data;
1559
1560         ib_dma_sync_single_for_cpu(ibdev, req->indirect_dma_addr,
1561                                    target->indirect_size, DMA_TO_DEVICE);
1562
1563         memset(&state, 0, sizeof(state));
1564         srp_map_sg(&state, ch, req, scat, count);
1565
1566         /* We've mapped the request, now pull as much of the indirect
1567          * descriptor table as we can into the command buffer. If this
1568          * target is not using an external indirect table, we are
1569          * guaranteed to fit into the command, as the SCSI layer won't
1570          * give us more S/G entries than we allow.
1571          */
1572         if (state.ndesc == 1) {
1573                 /*
1574                  * Memory registration collapsed the sg-list into one entry,
1575                  * so use a direct descriptor.
1576                  */
1577                 struct srp_direct_buf *buf = (void *) cmd->add_data;
1578
1579                 *buf = req->indirect_desc[0];
1580                 goto map_complete;
1581         }
1582
1583         if (unlikely(target->cmd_sg_cnt < state.ndesc &&
1584                                                 !target->allow_ext_sg)) {
1585                 shost_printk(KERN_ERR, target->scsi_host,
1586                              "Could not fit S/G list into SRP_CMD\n");
1587                 return -EIO;
1588         }
1589
1590         count = min(state.ndesc, target->cmd_sg_cnt);
1591         table_len = state.ndesc * sizeof (struct srp_direct_buf);
1592
1593         fmt = SRP_DATA_DESC_INDIRECT;
1594         len = sizeof(struct srp_cmd) + sizeof (struct srp_indirect_buf);
1595         len += count * sizeof (struct srp_direct_buf);
1596
1597         memcpy(indirect_hdr->desc_list, req->indirect_desc,
1598                count * sizeof (struct srp_direct_buf));
1599
1600         indirect_hdr->table_desc.va = cpu_to_be64(req->indirect_dma_addr);
1601         indirect_hdr->table_desc.key = cpu_to_be32(target->rkey);
1602         indirect_hdr->table_desc.len = cpu_to_be32(table_len);
1603         indirect_hdr->len = cpu_to_be32(state.total_len);
1604
1605         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
1606                 cmd->data_out_desc_cnt = count;
1607         else
1608                 cmd->data_in_desc_cnt = count;
1609
1610         ib_dma_sync_single_for_device(ibdev, req->indirect_dma_addr, table_len,
1611                                       DMA_TO_DEVICE);
1612
1613 map_complete:
1614         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
1615                 cmd->buf_fmt = fmt << 4;
1616         else
1617                 cmd->buf_fmt = fmt;
1618
1619         return len;
1620 }
1621
1622 /*
1623  * Return an IU and possible credit to the free pool
1624  */
1625 static void srp_put_tx_iu(struct srp_rdma_ch *ch, struct srp_iu *iu,
1626                           enum srp_iu_type iu_type)
1627 {
1628         unsigned long flags;
1629
1630         spin_lock_irqsave(&ch->lock, flags);
1631         list_add(&iu->list, &ch->free_tx);
1632         if (iu_type != SRP_IU_RSP)
1633                 ++ch->req_lim;
1634         spin_unlock_irqrestore(&ch->lock, flags);
1635 }
1636
1637 /*
1638  * Must be called with ch->lock held to protect req_lim and free_tx.
1639  * If IU is not sent, it must be returned using srp_put_tx_iu().
1640  *
1641  * Note:
1642  * An upper limit for the number of allocated information units for each
1643  * request type is:
1644  * - SRP_IU_CMD: SRP_CMD_SQ_SIZE, since the SCSI mid-layer never queues
1645  *   more than Scsi_Host.can_queue requests.
1646  * - SRP_IU_TSK_MGMT: SRP_TSK_MGMT_SQ_SIZE.
1647  * - SRP_IU_RSP: 1, since a conforming SRP target never sends more than
1648  *   one unanswered SRP request to an initiator.
1649  */
1650 static struct srp_iu *__srp_get_tx_iu(struct srp_rdma_ch *ch,
1651                                       enum srp_iu_type iu_type)
1652 {
1653         struct srp_target_port *target = ch->target;
1654         s32 rsv = (iu_type == SRP_IU_TSK_MGMT) ? 0 : SRP_TSK_MGMT_SQ_SIZE;
1655         struct srp_iu *iu;
1656
1657         srp_send_completion(ch->send_cq, ch);
1658
1659         if (list_empty(&ch->free_tx))
1660                 return NULL;
1661
1662         /* Initiator responses to target requests do not consume credits */
1663         if (iu_type != SRP_IU_RSP) {
1664                 if (ch->req_lim <= rsv) {
1665                         ++target->zero_req_lim;
1666                         return NULL;
1667                 }
1668
1669                 --ch->req_lim;
1670         }
1671
1672         iu = list_first_entry(&ch->free_tx, struct srp_iu, list);
1673         list_del(&iu->list);
1674         return iu;
1675 }
1676
1677 static int srp_post_send(struct srp_rdma_ch *ch, struct srp_iu *iu, int len)
1678 {
1679         struct srp_target_port *target = ch->target;
1680         struct ib_sge list;
1681         struct ib_send_wr wr, *bad_wr;
1682
1683         list.addr   = iu->dma;
1684         list.length = len;
1685         list.lkey   = target->lkey;
1686
1687         wr.next       = NULL;
1688         wr.wr_id      = (uintptr_t) iu;
1689         wr.sg_list    = &list;
1690         wr.num_sge    = 1;
1691         wr.opcode     = IB_WR_SEND;
1692         wr.send_flags = IB_SEND_SIGNALED;
1693
1694         return ib_post_send(ch->qp, &wr, &bad_wr);
1695 }
1696
1697 static int srp_post_recv(struct srp_rdma_ch *ch, struct srp_iu *iu)
1698 {
1699         struct srp_target_port *target = ch->target;
1700         struct ib_recv_wr wr, *bad_wr;
1701         struct ib_sge list;
1702
1703         list.addr   = iu->dma;
1704         list.length = iu->size;
1705         list.lkey   = target->lkey;
1706
1707         wr.next     = NULL;
1708         wr.wr_id    = (uintptr_t) iu;
1709         wr.sg_list  = &list;
1710         wr.num_sge  = 1;
1711
1712         return ib_post_recv(ch->qp, &wr, &bad_wr);
1713 }
1714
1715 static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
1716 {
1717         struct srp_target_port *target = ch->target;
1718         struct srp_request *req;
1719         struct scsi_cmnd *scmnd;
1720         unsigned long flags;
1721
1722         if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
1723                 spin_lock_irqsave(&ch->lock, flags);
1724                 ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
1725                 spin_unlock_irqrestore(&ch->lock, flags);
1726
1727                 ch->tsk_mgmt_status = -1;
1728                 if (be32_to_cpu(rsp->resp_data_len) >= 4)
1729                         ch->tsk_mgmt_status = rsp->data[3];
1730                 complete(&ch->tsk_mgmt_done);
1731         } else {
1732                 scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
1733                 if (scmnd) {
1734                         req = (void *)scmnd->host_scribble;
1735                         scmnd = srp_claim_req(ch, req, NULL, scmnd);
1736                 }
1737                 if (!scmnd) {
1738                         shost_printk(KERN_ERR, target->scsi_host,
1739                                      "Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
1740                                      rsp->tag, ch - target->ch, ch->qp->qp_num);
1741
1742                         spin_lock_irqsave(&ch->lock, flags);
1743                         ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
1744                         spin_unlock_irqrestore(&ch->lock, flags);
1745
1746                         return;
1747                 }
1748                 scmnd->result = rsp->status;
1749
1750                 if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
1751                         memcpy(scmnd->sense_buffer, rsp->data +
1752                                be32_to_cpu(rsp->resp_data_len),
1753                                min_t(int, be32_to_cpu(rsp->sense_data_len),
1754                                      SCSI_SENSE_BUFFERSIZE));
1755                 }
1756
1757                 if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER))
1758                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
1759                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DIOVER))
1760                         scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_in_res_cnt));
1761                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOUNDER))
1762                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
1763                 else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOOVER))
1764                         scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_out_res_cnt));
1765
1766                 srp_free_req(ch, req, scmnd,
1767                              be32_to_cpu(rsp->req_lim_delta));
1768
1769                 scmnd->host_scribble = NULL;
1770                 scmnd->scsi_done(scmnd);
1771         }
1772 }
1773
1774 static int srp_response_common(struct srp_rdma_ch *ch, s32 req_delta,
1775                                void *rsp, int len)
1776 {
1777         struct srp_target_port *target = ch->target;
1778         struct ib_device *dev = target->srp_host->srp_dev->dev;
1779         unsigned long flags;
1780         struct srp_iu *iu;
1781         int err;
1782
1783         spin_lock_irqsave(&ch->lock, flags);
1784         ch->req_lim += req_delta;
1785         iu = __srp_get_tx_iu(ch, SRP_IU_RSP);
1786         spin_unlock_irqrestore(&ch->lock, flags);
1787
1788         if (!iu) {
1789                 shost_printk(KERN_ERR, target->scsi_host, PFX
1790                              "no IU available to send response\n");
1791                 return 1;
1792         }
1793
1794         ib_dma_sync_single_for_cpu(dev, iu->dma, len, DMA_TO_DEVICE);
1795         memcpy(iu->buf, rsp, len);
1796         ib_dma_sync_single_for_device(dev, iu->dma, len, DMA_TO_DEVICE);
1797
1798         err = srp_post_send(ch, iu, len);
1799         if (err) {
1800                 shost_printk(KERN_ERR, target->scsi_host, PFX
1801                              "unable to post response: %d\n", err);
1802                 srp_put_tx_iu(ch, iu, SRP_IU_RSP);
1803         }
1804
1805         return err;
1806 }
1807
1808 static void srp_process_cred_req(struct srp_rdma_ch *ch,
1809                                  struct srp_cred_req *req)
1810 {
1811         struct srp_cred_rsp rsp = {
1812                 .opcode = SRP_CRED_RSP,
1813                 .tag = req->tag,
1814         };
1815         s32 delta = be32_to_cpu(req->req_lim_delta);
1816
1817         if (srp_response_common(ch, delta, &rsp, sizeof(rsp)))
1818                 shost_printk(KERN_ERR, ch->target->scsi_host, PFX
1819                              "problems processing SRP_CRED_REQ\n");
1820 }
1821
1822 static void srp_process_aer_req(struct srp_rdma_ch *ch,
1823                                 struct srp_aer_req *req)
1824 {
1825         struct srp_target_port *target = ch->target;
1826         struct srp_aer_rsp rsp = {
1827                 .opcode = SRP_AER_RSP,
1828                 .tag = req->tag,
1829         };
1830         s32 delta = be32_to_cpu(req->req_lim_delta);
1831
1832         shost_printk(KERN_ERR, target->scsi_host, PFX
1833                      "ignoring AER for LUN %llu\n", scsilun_to_int(&req->lun));
1834
1835         if (srp_response_common(ch, delta, &rsp, sizeof(rsp)))
1836                 shost_printk(KERN_ERR, target->scsi_host, PFX
1837                              "problems processing SRP_AER_REQ\n");
1838 }
1839
1840 static void srp_handle_recv(struct srp_rdma_ch *ch, struct ib_wc *wc)
1841 {
1842         struct srp_target_port *target = ch->target;
1843         struct ib_device *dev = target->srp_host->srp_dev->dev;
1844         struct srp_iu *iu = (struct srp_iu *) (uintptr_t) wc->wr_id;
1845         int res;
1846         u8 opcode;
1847
1848         ib_dma_sync_single_for_cpu(dev, iu->dma, ch->max_ti_iu_len,
1849                                    DMA_FROM_DEVICE);
1850
1851         opcode = *(u8 *) iu->buf;
1852
1853         if (0) {
1854                 shost_printk(KERN_ERR, target->scsi_host,
1855                              PFX "recv completion, opcode 0x%02x\n", opcode);
1856                 print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 8, 1,
1857                                iu->buf, wc->byte_len, true);
1858         }
1859
1860         switch (opcode) {
1861         case SRP_RSP:
1862                 srp_process_rsp(ch, iu->buf);
1863                 break;
1864
1865         case SRP_CRED_REQ:
1866                 srp_process_cred_req(ch, iu->buf);
1867                 break;
1868
1869         case SRP_AER_REQ:
1870                 srp_process_aer_req(ch, iu->buf);
1871                 break;
1872
1873         case SRP_T_LOGOUT:
1874                 /* XXX Handle target logout */
1875                 shost_printk(KERN_WARNING, target->scsi_host,
1876                              PFX "Got target logout request\n");
1877                 break;
1878
1879         default:
1880                 shost_printk(KERN_WARNING, target->scsi_host,
1881                              PFX "Unhandled SRP opcode 0x%02x\n", opcode);
1882                 break;
1883         }
1884
1885         ib_dma_sync_single_for_device(dev, iu->dma, ch->max_ti_iu_len,
1886                                       DMA_FROM_DEVICE);
1887
1888         res = srp_post_recv(ch, iu);
1889         if (res != 0)
1890                 shost_printk(KERN_ERR, target->scsi_host,
1891                              PFX "Recv failed with error code %d\n", res);
1892 }
1893
1894 /**
1895  * srp_tl_err_work() - handle a transport layer error
1896  * @work: Work structure embedded in an SRP target port.
1897  *
1898  * Note: This function may get invoked before the rport has been created,
1899  * hence the target->rport test.
1900  */
1901 static void srp_tl_err_work(struct work_struct *work)
1902 {
1903         struct srp_target_port *target;
1904
1905         target = container_of(work, struct srp_target_port, tl_err_work);
1906         if (target->rport)
1907                 srp_start_tl_fail_timers(target->rport);
1908 }
1909
1910 static void srp_handle_qp_err(u64 wr_id, enum ib_wc_status wc_status,
1911                               bool send_err, struct srp_rdma_ch *ch)
1912 {
1913         struct srp_target_port *target = ch->target;
1914
1915         if (wr_id == SRP_LAST_WR_ID) {
1916                 complete(&ch->done);
1917                 return;
1918         }
1919
1920         if (ch->connected && !target->qp_in_error) {
1921                 if (wr_id & LOCAL_INV_WR_ID_MASK) {
1922                         shost_printk(KERN_ERR, target->scsi_host, PFX
1923                                      "LOCAL_INV failed with status %s (%d)\n",
1924                                      ib_wc_status_msg(wc_status), wc_status);
1925                 } else if (wr_id & FAST_REG_WR_ID_MASK) {
1926                         shost_printk(KERN_ERR, target->scsi_host, PFX
1927                                      "FAST_REG_MR failed status %s (%d)\n",
1928                                      ib_wc_status_msg(wc_status), wc_status);
1929                 } else {
1930                         shost_printk(KERN_ERR, target->scsi_host,
1931                                      PFX "failed %s status %s (%d) for iu %p\n",
1932                                      send_err ? "send" : "receive",
1933                                      ib_wc_status_msg(wc_status), wc_status,
1934                                      (void *)(uintptr_t)wr_id);
1935                 }
1936                 queue_work(system_long_wq, &target->tl_err_work);
1937         }
1938         target->qp_in_error = true;
1939 }
1940
1941 static void srp_recv_completion(struct ib_cq *cq, void *ch_ptr)
1942 {
1943         struct srp_rdma_ch *ch = ch_ptr;
1944         struct ib_wc wc;
1945
1946         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
1947         while (ib_poll_cq(cq, 1, &wc) > 0) {
1948                 if (likely(wc.status == IB_WC_SUCCESS)) {
1949                         srp_handle_recv(ch, &wc);
1950                 } else {
1951                         srp_handle_qp_err(wc.wr_id, wc.status, false, ch);
1952                 }
1953         }
1954 }
1955
1956 static void srp_send_completion(struct ib_cq *cq, void *ch_ptr)
1957 {
1958         struct srp_rdma_ch *ch = ch_ptr;
1959         struct ib_wc wc;
1960         struct srp_iu *iu;
1961
1962         while (ib_poll_cq(cq, 1, &wc) > 0) {
1963                 if (likely(wc.status == IB_WC_SUCCESS)) {
1964                         iu = (struct srp_iu *) (uintptr_t) wc.wr_id;
1965                         list_add(&iu->list, &ch->free_tx);
1966                 } else {
1967                         srp_handle_qp_err(wc.wr_id, wc.status, true, ch);
1968                 }
1969         }
1970 }
1971
1972 static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
1973 {
1974         struct srp_target_port *target = host_to_target(shost);
1975         struct srp_rport *rport = target->rport;
1976         struct srp_rdma_ch *ch;
1977         struct srp_request *req;
1978         struct srp_iu *iu;
1979         struct srp_cmd *cmd;
1980         struct ib_device *dev;
1981         unsigned long flags;
1982         u32 tag;
1983         u16 idx;
1984         int len, ret;
1985         const bool in_scsi_eh = !in_interrupt() && current == shost->ehandler;
1986
1987         /*
1988          * The SCSI EH thread is the only context from which srp_queuecommand()
1989          * can get invoked for blocked devices (SDEV_BLOCK /
1990          * SDEV_CREATED_BLOCK). Avoid racing with srp_reconnect_rport() by
1991          * locking the rport mutex if invoked from inside the SCSI EH.
1992          */
1993         if (in_scsi_eh)
1994                 mutex_lock(&rport->mutex);
1995
1996         scmnd->result = srp_chkready(target->rport);
1997         if (unlikely(scmnd->result))
1998                 goto err;
1999
2000         WARN_ON_ONCE(scmnd->request->tag < 0);
2001         tag = blk_mq_unique_tag(scmnd->request);
2002         ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
2003         idx = blk_mq_unique_tag_to_tag(tag);
2004         WARN_ONCE(idx >= target->req_ring_size, "%s: tag %#x: idx %d >= %d\n",
2005                   dev_name(&shost->shost_gendev), tag, idx,
2006                   target->req_ring_size);
2007
2008         spin_lock_irqsave(&ch->lock, flags);
2009         iu = __srp_get_tx_iu(ch, SRP_IU_CMD);
2010         spin_unlock_irqrestore(&ch->lock, flags);
2011
2012         if (!iu)
2013                 goto err;
2014
2015         req = &ch->req_ring[idx];
2016         dev = target->srp_host->srp_dev->dev;
2017         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_iu_len,
2018                                    DMA_TO_DEVICE);
2019
2020         scmnd->host_scribble = (void *) req;
2021
2022         cmd = iu->buf;
2023         memset(cmd, 0, sizeof *cmd);
2024
2025         cmd->opcode = SRP_CMD;
2026         int_to_scsilun(scmnd->device->lun, &cmd->lun);
2027         cmd->tag    = tag;
2028         memcpy(cmd->cdb, scmnd->cmnd, scmnd->cmd_len);
2029
2030         req->scmnd    = scmnd;
2031         req->cmd      = iu;
2032
2033         len = srp_map_data(scmnd, ch, req);
2034         if (len < 0) {
2035                 shost_printk(KERN_ERR, target->scsi_host,
2036                              PFX "Failed to map data (%d)\n", len);
2037                 /*
2038                  * If we ran out of memory descriptors (-ENOMEM) because an
2039                  * application is queuing many requests with more than
2040                  * max_pages_per_mr sg-list elements, tell the SCSI mid-layer
2041                  * to reduce queue depth temporarily.
2042                  */
2043                 scmnd->result = len == -ENOMEM ?
2044                         DID_OK << 16 | QUEUE_FULL << 1 : DID_ERROR << 16;
2045                 goto err_iu;
2046         }
2047
2048         ib_dma_sync_single_for_device(dev, iu->dma, target->max_iu_len,
2049                                       DMA_TO_DEVICE);
2050
2051         if (srp_post_send(ch, iu, len)) {
2052                 shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
2053                 goto err_unmap;
2054         }
2055
2056         ret = 0;
2057
2058 unlock_rport:
2059         if (in_scsi_eh)
2060                 mutex_unlock(&rport->mutex);
2061
2062         return ret;
2063
2064 err_unmap:
2065         srp_unmap_data(scmnd, ch, req);
2066
2067 err_iu:
2068         srp_put_tx_iu(ch, iu, SRP_IU_CMD);
2069
2070         /*
2071          * Avoid that the loops that iterate over the request ring can
2072          * encounter a dangling SCSI command pointer.
2073          */
2074         req->scmnd = NULL;
2075
2076 err:
2077         if (scmnd->result) {
2078                 scmnd->scsi_done(scmnd);
2079                 ret = 0;
2080         } else {
2081                 ret = SCSI_MLQUEUE_HOST_BUSY;
2082         }
2083
2084         goto unlock_rport;
2085 }
2086
2087 /*
2088  * Note: the resources allocated in this function are freed in
2089  * srp_free_ch_ib().
2090  */
2091 static int srp_alloc_iu_bufs(struct srp_rdma_ch *ch)
2092 {
2093         struct srp_target_port *target = ch->target;
2094         int i;
2095
2096         ch->rx_ring = kcalloc(target->queue_size, sizeof(*ch->rx_ring),
2097                               GFP_KERNEL);
2098         if (!ch->rx_ring)
2099                 goto err_no_ring;
2100         ch->tx_ring = kcalloc(target->queue_size, sizeof(*ch->tx_ring),
2101                               GFP_KERNEL);
2102         if (!ch->tx_ring)
2103                 goto err_no_ring;
2104
2105         for (i = 0; i < target->queue_size; ++i) {
2106                 ch->rx_ring[i] = srp_alloc_iu(target->srp_host,
2107                                               ch->max_ti_iu_len,
2108                                               GFP_KERNEL, DMA_FROM_DEVICE);
2109                 if (!ch->rx_ring[i])
2110                         goto err;
2111         }
2112
2113         for (i = 0; i < target->queue_size; ++i) {
2114                 ch->tx_ring[i] = srp_alloc_iu(target->srp_host,
2115                                               target->max_iu_len,
2116                                               GFP_KERNEL, DMA_TO_DEVICE);
2117                 if (!ch->tx_ring[i])
2118                         goto err;
2119
2120                 list_add(&ch->tx_ring[i]->list, &ch->free_tx);
2121         }
2122
2123         return 0;
2124
2125 err:
2126         for (i = 0; i < target->queue_size; ++i) {
2127                 srp_free_iu(target->srp_host, ch->rx_ring[i]);
2128                 srp_free_iu(target->srp_host, ch->tx_ring[i]);
2129         }
2130
2131
2132 err_no_ring:
2133         kfree(ch->tx_ring);
2134         ch->tx_ring = NULL;
2135         kfree(ch->rx_ring);
2136         ch->rx_ring = NULL;
2137
2138         return -ENOMEM;
2139 }
2140
2141 static uint32_t srp_compute_rq_tmo(struct ib_qp_attr *qp_attr, int attr_mask)
2142 {
2143         uint64_t T_tr_ns, max_compl_time_ms;
2144         uint32_t rq_tmo_jiffies;
2145
2146         /*
2147          * According to section 11.2.4.2 in the IBTA spec (Modify Queue Pair,
2148          * table 91), both the QP timeout and the retry count have to be set
2149          * for RC QP's during the RTR to RTS transition.
2150          */
2151         WARN_ON_ONCE((attr_mask & (IB_QP_TIMEOUT | IB_QP_RETRY_CNT)) !=
2152                      (IB_QP_TIMEOUT | IB_QP_RETRY_CNT));
2153
2154         /*
2155          * Set target->rq_tmo_jiffies to one second more than the largest time
2156          * it can take before an error completion is generated. See also
2157          * C9-140..142 in the IBTA spec for more information about how to
2158          * convert the QP Local ACK Timeout value to nanoseconds.
2159          */
2160         T_tr_ns = 4096 * (1ULL << qp_attr->timeout);
2161         max_compl_time_ms = qp_attr->retry_cnt * 4 * T_tr_ns;
2162         do_div(max_compl_time_ms, NSEC_PER_MSEC);
2163         rq_tmo_jiffies = msecs_to_jiffies(max_compl_time_ms + 1000);
2164
2165         return rq_tmo_jiffies;
2166 }
2167
2168 static void srp_cm_rep_handler(struct ib_cm_id *cm_id,
2169                                const struct srp_login_rsp *lrsp,
2170                                struct srp_rdma_ch *ch)
2171 {
2172         struct srp_target_port *target = ch->target;
2173         struct ib_qp_attr *qp_attr = NULL;
2174         int attr_mask = 0;
2175         int ret;
2176         int i;
2177
2178         if (lrsp->opcode == SRP_LOGIN_RSP) {
2179                 ch->max_ti_iu_len = be32_to_cpu(lrsp->max_ti_iu_len);
2180                 ch->req_lim       = be32_to_cpu(lrsp->req_lim_delta);
2181
2182                 /*
2183                  * Reserve credits for task management so we don't
2184                  * bounce requests back to the SCSI mid-layer.
2185                  */
2186                 target->scsi_host->can_queue
2187                         = min(ch->req_lim - SRP_TSK_MGMT_SQ_SIZE,
2188                               target->scsi_host->can_queue);
2189                 target->scsi_host->cmd_per_lun
2190                         = min_t(int, target->scsi_host->can_queue,
2191                                 target->scsi_host->cmd_per_lun);
2192         } else {
2193                 shost_printk(KERN_WARNING, target->scsi_host,
2194                              PFX "Unhandled RSP opcode %#x\n", lrsp->opcode);
2195                 ret = -ECONNRESET;
2196                 goto error;
2197         }
2198
2199         if (!ch->rx_ring) {
2200                 ret = srp_alloc_iu_bufs(ch);
2201                 if (ret)
2202                         goto error;
2203         }
2204
2205         ret = -ENOMEM;
2206         qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
2207         if (!qp_attr)
2208                 goto error;
2209
2210         qp_attr->qp_state = IB_QPS_RTR;
2211         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
2212         if (ret)
2213                 goto error_free;
2214
2215         ret = ib_modify_qp(ch->qp, qp_attr, attr_mask);
2216         if (ret)
2217                 goto error_free;
2218
2219         for (i = 0; i < target->queue_size; i++) {
2220                 struct srp_iu *iu = ch->rx_ring[i];
2221
2222                 ret = srp_post_recv(ch, iu);
2223                 if (ret)
2224                         goto error_free;
2225         }
2226
2227         qp_attr->qp_state = IB_QPS_RTS;
2228         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
2229         if (ret)
2230                 goto error_free;
2231
2232         target->rq_tmo_jiffies = srp_compute_rq_tmo(qp_attr, attr_mask);
2233
2234         ret = ib_modify_qp(ch->qp, qp_attr, attr_mask);
2235         if (ret)
2236                 goto error_free;
2237
2238         ret = ib_send_cm_rtu(cm_id, NULL, 0);
2239
2240 error_free:
2241         kfree(qp_attr);
2242
2243 error:
2244         ch->status = ret;
2245 }
2246
2247 static void srp_cm_rej_handler(struct ib_cm_id *cm_id,
2248                                struct ib_cm_event *event,
2249                                struct srp_rdma_ch *ch)
2250 {
2251         struct srp_target_port *target = ch->target;
2252         struct Scsi_Host *shost = target->scsi_host;
2253         struct ib_class_port_info *cpi;
2254         int opcode;
2255
2256         switch (event->param.rej_rcvd.reason) {
2257         case IB_CM_REJ_PORT_CM_REDIRECT:
2258                 cpi = event->param.rej_rcvd.ari;
2259                 ch->path.dlid = cpi->redirect_lid;
2260                 ch->path.pkey = cpi->redirect_pkey;
2261                 cm_id->remote_cm_qpn = be32_to_cpu(cpi->redirect_qp) & 0x00ffffff;
2262                 memcpy(ch->path.dgid.raw, cpi->redirect_gid, 16);
2263
2264                 ch->status = ch->path.dlid ?
2265                         SRP_DLID_REDIRECT : SRP_PORT_REDIRECT;
2266                 break;
2267
2268         case IB_CM_REJ_PORT_REDIRECT:
2269                 if (srp_target_is_topspin(target)) {
2270                         /*
2271                          * Topspin/Cisco SRP gateways incorrectly send
2272                          * reject reason code 25 when they mean 24
2273                          * (port redirect).
2274                          */
2275                         memcpy(ch->path.dgid.raw,
2276                                event->param.rej_rcvd.ari, 16);
2277
2278                         shost_printk(KERN_DEBUG, shost,
2279                                      PFX "Topspin/Cisco redirect to target port GID %016llx%016llx\n",
2280                                      be64_to_cpu(ch->path.dgid.global.subnet_prefix),
2281                                      be64_to_cpu(ch->path.dgid.global.interface_id));
2282
2283                         ch->status = SRP_PORT_REDIRECT;
2284                 } else {
2285                         shost_printk(KERN_WARNING, shost,
2286                                      "  REJ reason: IB_CM_REJ_PORT_REDIRECT\n");
2287                         ch->status = -ECONNRESET;
2288                 }
2289                 break;
2290
2291         case IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID:
2292                 shost_printk(KERN_WARNING, shost,
2293                             "  REJ reason: IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID\n");
2294                 ch->status = -ECONNRESET;
2295                 break;
2296
2297         case IB_CM_REJ_CONSUMER_DEFINED:
2298                 opcode = *(u8 *) event->private_data;
2299                 if (opcode == SRP_LOGIN_REJ) {
2300                         struct srp_login_rej *rej = event->private_data;
2301                         u32 reason = be32_to_cpu(rej->reason);
2302
2303                         if (reason == SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE)
2304                                 shost_printk(KERN_WARNING, shost,
2305                                              PFX "SRP_LOGIN_REJ: requested max_it_iu_len too large\n");
2306                         else
2307                                 shost_printk(KERN_WARNING, shost, PFX
2308                                              "SRP LOGIN from %pI6 to %pI6 REJECTED, reason 0x%08x\n",
2309                                              target->sgid.raw,
2310                                              target->orig_dgid.raw, reason);
2311                 } else
2312                         shost_printk(KERN_WARNING, shost,
2313                                      "  REJ reason: IB_CM_REJ_CONSUMER_DEFINED,"
2314                                      " opcode 0x%02x\n", opcode);
2315                 ch->status = -ECONNRESET;
2316                 break;
2317
2318         case IB_CM_REJ_STALE_CONN:
2319                 shost_printk(KERN_WARNING, shost, "  REJ reason: stale connection\n");
2320                 ch->status = SRP_STALE_CONN;
2321                 break;
2322
2323         default:
2324                 shost_printk(KERN_WARNING, shost, "  REJ reason 0x%x\n",
2325                              event->param.rej_rcvd.reason);
2326                 ch->status = -ECONNRESET;
2327         }
2328 }
2329
2330 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
2331 {
2332         struct srp_rdma_ch *ch = cm_id->context;
2333         struct srp_target_port *target = ch->target;
2334         int comp = 0;
2335
2336         switch (event->event) {
2337         case IB_CM_REQ_ERROR:
2338                 shost_printk(KERN_DEBUG, target->scsi_host,
2339                              PFX "Sending CM REQ failed\n");
2340                 comp = 1;
2341                 ch->status = -ECONNRESET;
2342                 break;
2343
2344         case IB_CM_REP_RECEIVED:
2345                 comp = 1;
2346                 srp_cm_rep_handler(cm_id, event->private_data, ch);
2347                 break;
2348
2349         case IB_CM_REJ_RECEIVED:
2350                 shost_printk(KERN_DEBUG, target->scsi_host, PFX "REJ received\n");
2351                 comp = 1;
2352
2353                 srp_cm_rej_handler(cm_id, event, ch);
2354                 break;
2355
2356         case IB_CM_DREQ_RECEIVED:
2357                 shost_printk(KERN_WARNING, target->scsi_host,
2358                              PFX "DREQ received - connection closed\n");
2359                 ch->connected = false;
2360                 if (ib_send_cm_drep(cm_id, NULL, 0))
2361                         shost_printk(KERN_ERR, target->scsi_host,
2362                                      PFX "Sending CM DREP failed\n");
2363                 queue_work(system_long_wq, &target->tl_err_work);
2364                 break;
2365
2366         case IB_CM_TIMEWAIT_EXIT:
2367                 shost_printk(KERN_ERR, target->scsi_host,
2368                              PFX "connection closed\n");
2369                 comp = 1;
2370
2371                 ch->status = 0;
2372                 break;
2373
2374         case IB_CM_MRA_RECEIVED:
2375         case IB_CM_DREQ_ERROR:
2376         case IB_CM_DREP_RECEIVED:
2377                 break;
2378
2379         default:
2380                 shost_printk(KERN_WARNING, target->scsi_host,
2381                              PFX "Unhandled CM event %d\n", event->event);
2382                 break;
2383         }
2384
2385         if (comp)
2386                 complete(&ch->done);
2387
2388         return 0;
2389 }
2390
2391 /**
2392  * srp_change_queue_depth - setting device queue depth
2393  * @sdev: scsi device struct
2394  * @qdepth: requested queue depth
2395  *
2396  * Returns queue depth.
2397  */
2398 static int
2399 srp_change_queue_depth(struct scsi_device *sdev, int qdepth)
2400 {
2401         if (!sdev->tagged_supported)
2402                 qdepth = 1;
2403         return scsi_change_queue_depth(sdev, qdepth);
2404 }
2405
2406 static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
2407                              u8 func)
2408 {
2409         struct srp_target_port *target = ch->target;
2410         struct srp_rport *rport = target->rport;
2411         struct ib_device *dev = target->srp_host->srp_dev->dev;
2412         struct srp_iu *iu;
2413         struct srp_tsk_mgmt *tsk_mgmt;
2414
2415         if (!ch->connected || target->qp_in_error)
2416                 return -1;
2417
2418         init_completion(&ch->tsk_mgmt_done);
2419
2420         /*
2421          * Lock the rport mutex to avoid that srp_create_ch_ib() is
2422          * invoked while a task management function is being sent.
2423          */
2424         mutex_lock(&rport->mutex);
2425         spin_lock_irq(&ch->lock);
2426         iu = __srp_get_tx_iu(ch, SRP_IU_TSK_MGMT);
2427         spin_unlock_irq(&ch->lock);
2428
2429         if (!iu) {
2430                 mutex_unlock(&rport->mutex);
2431
2432                 return -1;
2433         }
2434
2435         ib_dma_sync_single_for_cpu(dev, iu->dma, sizeof *tsk_mgmt,
2436                                    DMA_TO_DEVICE);
2437         tsk_mgmt = iu->buf;
2438         memset(tsk_mgmt, 0, sizeof *tsk_mgmt);
2439
2440         tsk_mgmt->opcode        = SRP_TSK_MGMT;
2441         int_to_scsilun(lun, &tsk_mgmt->lun);
2442         tsk_mgmt->tag           = req_tag | SRP_TAG_TSK_MGMT;
2443         tsk_mgmt->tsk_mgmt_func = func;
2444         tsk_mgmt->task_tag      = req_tag;
2445
2446         ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
2447                                       DMA_TO_DEVICE);
2448         if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) {
2449                 srp_put_tx_iu(ch, iu, SRP_IU_TSK_MGMT);
2450                 mutex_unlock(&rport->mutex);
2451
2452                 return -1;
2453         }
2454         mutex_unlock(&rport->mutex);
2455
2456         if (!wait_for_completion_timeout(&ch->tsk_mgmt_done,
2457                                          msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
2458                 return -1;
2459
2460         return 0;
2461 }
2462
2463 static int srp_abort(struct scsi_cmnd *scmnd)
2464 {
2465         struct srp_target_port *target = host_to_target(scmnd->device->host);
2466         struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
2467         u32 tag;
2468         u16 ch_idx;
2469         struct srp_rdma_ch *ch;
2470         int ret;
2471
2472         shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
2473
2474         if (!req)
2475                 return SUCCESS;
2476         tag = blk_mq_unique_tag(scmnd->request);
2477         ch_idx = blk_mq_unique_tag_to_hwq(tag);
2478         if (WARN_ON_ONCE(ch_idx >= target->ch_count))
2479                 return SUCCESS;
2480         ch = &target->ch[ch_idx];
2481         if (!srp_claim_req(ch, req, NULL, scmnd))
2482                 return SUCCESS;
2483         shost_printk(KERN_ERR, target->scsi_host,
2484                      "Sending SRP abort for tag %#x\n", tag);
2485         if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
2486                               SRP_TSK_ABORT_TASK) == 0)
2487                 ret = SUCCESS;
2488         else if (target->rport->state == SRP_RPORT_LOST)
2489                 ret = FAST_IO_FAIL;
2490         else
2491                 ret = FAILED;
2492         srp_free_req(ch, req, scmnd, 0);
2493         scmnd->result = DID_ABORT << 16;
2494         scmnd->scsi_done(scmnd);
2495
2496         return ret;
2497 }
2498
2499 static int srp_reset_device(struct scsi_cmnd *scmnd)
2500 {
2501         struct srp_target_port *target = host_to_target(scmnd->device->host);
2502         struct srp_rdma_ch *ch;
2503         int i;
2504
2505         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
2506
2507         ch = &target->ch[0];
2508         if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun,
2509                               SRP_TSK_LUN_RESET))
2510                 return FAILED;
2511         if (ch->tsk_mgmt_status)
2512                 return FAILED;
2513
2514         for (i = 0; i < target->ch_count; i++) {
2515                 ch = &target->ch[i];
2516                 for (i = 0; i < target->req_ring_size; ++i) {
2517                         struct srp_request *req = &ch->req_ring[i];
2518
2519                         srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
2520                 }
2521         }
2522
2523         return SUCCESS;
2524 }
2525
2526 static int srp_reset_host(struct scsi_cmnd *scmnd)
2527 {
2528         struct srp_target_port *target = host_to_target(scmnd->device->host);
2529
2530         shost_printk(KERN_ERR, target->scsi_host, PFX "SRP reset_host called\n");
2531
2532         return srp_reconnect_rport(target->rport) == 0 ? SUCCESS : FAILED;
2533 }
2534
2535 static int srp_slave_configure(struct scsi_device *sdev)
2536 {
2537         struct Scsi_Host *shost = sdev->host;
2538         struct srp_target_port *target = host_to_target(shost);
2539         struct request_queue *q = sdev->request_queue;
2540         unsigned long timeout;
2541
2542         if (sdev->type == TYPE_DISK) {
2543                 timeout = max_t(unsigned, 30 * HZ, target->rq_tmo_jiffies);
2544                 blk_queue_rq_timeout(q, timeout);
2545         }
2546
2547         return 0;
2548 }
2549
2550 static ssize_t show_id_ext(struct device *dev, struct device_attribute *attr,
2551                            char *buf)
2552 {
2553         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2554
2555         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->id_ext));
2556 }
2557
2558 static ssize_t show_ioc_guid(struct device *dev, struct device_attribute *attr,
2559                              char *buf)
2560 {
2561         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2562
2563         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->ioc_guid));
2564 }
2565
2566 static ssize_t show_service_id(struct device *dev,
2567                                struct device_attribute *attr, char *buf)
2568 {
2569         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2570
2571         return sprintf(buf, "0x%016llx\n", be64_to_cpu(target->service_id));
2572 }
2573
2574 static ssize_t show_pkey(struct device *dev, struct device_attribute *attr,
2575                          char *buf)
2576 {
2577         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2578
2579         return sprintf(buf, "0x%04x\n", be16_to_cpu(target->pkey));
2580 }
2581
2582 static ssize_t show_sgid(struct device *dev, struct device_attribute *attr,
2583                          char *buf)
2584 {
2585         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2586
2587         return sprintf(buf, "%pI6\n", target->sgid.raw);
2588 }
2589
2590 static ssize_t show_dgid(struct device *dev, struct device_attribute *attr,
2591                          char *buf)
2592 {
2593         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2594         struct srp_rdma_ch *ch = &target->ch[0];
2595
2596         return sprintf(buf, "%pI6\n", ch->path.dgid.raw);
2597 }
2598
2599 static ssize_t show_orig_dgid(struct device *dev,
2600                               struct device_attribute *attr, char *buf)
2601 {
2602         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2603
2604         return sprintf(buf, "%pI6\n", target->orig_dgid.raw);
2605 }
2606
2607 static ssize_t show_req_lim(struct device *dev,
2608                             struct device_attribute *attr, char *buf)
2609 {
2610         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2611         struct srp_rdma_ch *ch;
2612         int i, req_lim = INT_MAX;
2613
2614         for (i = 0; i < target->ch_count; i++) {
2615                 ch = &target->ch[i];
2616                 req_lim = min(req_lim, ch->req_lim);
2617         }
2618         return sprintf(buf, "%d\n", req_lim);
2619 }
2620
2621 static ssize_t show_zero_req_lim(struct device *dev,
2622                                  struct device_attribute *attr, char *buf)
2623 {
2624         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2625
2626         return sprintf(buf, "%d\n", target->zero_req_lim);
2627 }
2628
2629 static ssize_t show_local_ib_port(struct device *dev,
2630                                   struct device_attribute *attr, char *buf)
2631 {
2632         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2633
2634         return sprintf(buf, "%d\n", target->srp_host->port);
2635 }
2636
2637 static ssize_t show_local_ib_device(struct device *dev,
2638                                     struct device_attribute *attr, char *buf)
2639 {
2640         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2641
2642         return sprintf(buf, "%s\n", target->srp_host->srp_dev->dev->name);
2643 }
2644
2645 static ssize_t show_ch_count(struct device *dev, struct device_attribute *attr,
2646                              char *buf)
2647 {
2648         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2649
2650         return sprintf(buf, "%d\n", target->ch_count);
2651 }
2652
2653 static ssize_t show_comp_vector(struct device *dev,
2654                                 struct device_attribute *attr, char *buf)
2655 {
2656         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2657
2658         return sprintf(buf, "%d\n", target->comp_vector);
2659 }
2660
2661 static ssize_t show_tl_retry_count(struct device *dev,
2662                                    struct device_attribute *attr, char *buf)
2663 {
2664         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2665
2666         return sprintf(buf, "%d\n", target->tl_retry_count);
2667 }
2668
2669 static ssize_t show_cmd_sg_entries(struct device *dev,
2670                                    struct device_attribute *attr, char *buf)
2671 {
2672         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2673
2674         return sprintf(buf, "%u\n", target->cmd_sg_cnt);
2675 }
2676
2677 static ssize_t show_allow_ext_sg(struct device *dev,
2678                                  struct device_attribute *attr, char *buf)
2679 {
2680         struct srp_target_port *target = host_to_target(class_to_shost(dev));
2681
2682         return sprintf(buf, "%s\n", target->allow_ext_sg ? "true" : "false");
2683 }
2684
2685 static DEVICE_ATTR(id_ext,          S_IRUGO, show_id_ext,          NULL);
2686 static DEVICE_ATTR(ioc_guid,        S_IRUGO, show_ioc_guid,        NULL);
2687 static DEVICE_ATTR(service_id,      S_IRUGO, show_service_id,      NULL);
2688 static DEVICE_ATTR(pkey,            S_IRUGO, show_pkey,            NULL);
2689 static DEVICE_ATTR(sgid,            S_IRUGO, show_sgid,            NULL);
2690 static DEVICE_ATTR(dgid,            S_IRUGO, show_dgid,            NULL);
2691 static DEVICE_ATTR(orig_dgid,       S_IRUGO, show_orig_dgid,       NULL);
2692 static DEVICE_ATTR(req_lim,         S_IRUGO, show_req_lim,         NULL);
2693 static DEVICE_ATTR(zero_req_lim,    S_IRUGO, show_zero_req_lim,    NULL);
2694 static DEVICE_ATTR(local_ib_port,   S_IRUGO, show_local_ib_port,   NULL);
2695 static DEVICE_ATTR(local_ib_device, S_IRUGO, show_local_ib_device, NULL);
2696 static DEVICE_ATTR(ch_count,        S_IRUGO, show_ch_count,        NULL);
2697 static DEVICE_ATTR(comp_vector,     S_IRUGO, show_comp_vector,     NULL);
2698 static DEVICE_ATTR(tl_retry_count,  S_IRUGO, show_tl_retry_count,  NULL);
2699 static DEVICE_ATTR(cmd_sg_entries,  S_IRUGO, show_cmd_sg_entries,  NULL);
2700 static DEVICE_ATTR(allow_ext_sg,    S_IRUGO, show_allow_ext_sg,    NULL);
2701
2702 static struct device_attribute *srp_host_attrs[] = {
2703         &dev_attr_id_ext,
2704         &dev_attr_ioc_guid,
2705         &dev_attr_service_id,
2706         &dev_attr_pkey,
2707         &dev_attr_sgid,
2708         &dev_attr_dgid,
2709         &dev_attr_orig_dgid,
2710         &dev_attr_req_lim,
2711         &dev_attr_zero_req_lim,
2712         &dev_attr_local_ib_port,
2713         &dev_attr_local_ib_device,
2714         &dev_attr_ch_count,
2715         &dev_attr_comp_vector,
2716         &dev_attr_tl_retry_count,
2717         &dev_attr_cmd_sg_entries,
2718         &dev_attr_allow_ext_sg,
2719         NULL
2720 };
2721
2722 static struct scsi_host_template srp_template = {
2723         .module                         = THIS_MODULE,
2724         .name                           = "InfiniBand SRP initiator",
2725         .proc_name                      = DRV_NAME,
2726         .slave_configure                = srp_slave_configure,
2727         .info                           = srp_target_info,
2728         .queuecommand                   = srp_queuecommand,
2729         .change_queue_depth             = srp_change_queue_depth,
2730         .eh_abort_handler               = srp_abort,
2731         .eh_device_reset_handler        = srp_reset_device,
2732         .eh_host_reset_handler          = srp_reset_host,
2733         .skip_settle_delay              = true,
2734         .sg_tablesize                   = SRP_DEF_SG_TABLESIZE,
2735         .can_queue                      = SRP_DEFAULT_CMD_SQ_SIZE,
2736         .this_id                        = -1,
2737         .cmd_per_lun                    = SRP_DEFAULT_CMD_SQ_SIZE,
2738         .use_clustering                 = ENABLE_CLUSTERING,
2739         .shost_attrs                    = srp_host_attrs,
2740         .use_blk_tags                   = 1,
2741         .track_queue_depth              = 1,
2742 };
2743
2744 static int srp_sdev_count(struct Scsi_Host *host)
2745 {
2746         struct scsi_device *sdev;
2747         int c = 0;
2748
2749         shost_for_each_device(sdev, host)
2750                 c++;
2751
2752         return c;
2753 }
2754
2755 /*
2756  * Return values:
2757  * < 0 upon failure. Caller is responsible for SRP target port cleanup.
2758  * 0 and target->state == SRP_TARGET_REMOVED if asynchronous target port
2759  *    removal has been scheduled.
2760  * 0 and target->state != SRP_TARGET_REMOVED upon success.
2761  */
2762 static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
2763 {
2764         struct srp_rport_identifiers ids;
2765         struct srp_rport *rport;
2766
2767         target->state = SRP_TARGET_SCANNING;
2768         sprintf(target->target_name, "SRP.T10:%016llX",
2769                 be64_to_cpu(target->id_ext));
2770
2771         if (scsi_add_host(target->scsi_host, host->srp_dev->dev->dma_device))
2772                 return -ENODEV;
2773
2774         memcpy(ids.port_id, &target->id_ext, 8);
2775         memcpy(ids.port_id + 8, &target->ioc_guid, 8);
2776         ids.roles = SRP_RPORT_ROLE_TARGET;
2777         rport = srp_rport_add(target->scsi_host, &ids);
2778         if (IS_ERR(rport)) {
2779                 scsi_remove_host(target->scsi_host);
2780                 return PTR_ERR(rport);
2781         }
2782
2783         rport->lld_data = target;
2784         target->rport = rport;
2785
2786         spin_lock(&host->target_lock);
2787         list_add_tail(&target->list, &host->target_list);
2788         spin_unlock(&host->target_lock);
2789
2790         scsi_scan_target(&target->scsi_host->shost_gendev,
2791                          0, target->scsi_id, SCAN_WILD_CARD, 0);
2792
2793         if (srp_connected_ch(target) < target->ch_count ||
2794             target->qp_in_error) {
2795                 shost_printk(KERN_INFO, target->scsi_host,
2796                              PFX "SCSI scan failed - removing SCSI host\n");
2797                 srp_queue_remove_work(target);
2798                 goto out;
2799         }
2800
2801         pr_debug(PFX "%s: SCSI scan succeeded - detected %d LUNs\n",
2802                  dev_name(&target->scsi_host->shost_gendev),
2803                  srp_sdev_count(target->scsi_host));
2804
2805         spin_lock_irq(&target->lock);
2806         if (target->state == SRP_TARGET_SCANNING)
2807                 target->state = SRP_TARGET_LIVE;
2808         spin_unlock_irq(&target->lock);
2809
2810 out:
2811         return 0;
2812 }
2813
2814 static void srp_release_dev(struct device *dev)
2815 {
2816         struct srp_host *host =
2817                 container_of(dev, struct srp_host, dev);
2818
2819         complete(&host->released);
2820 }
2821
2822 static struct class srp_class = {
2823         .name    = "infiniband_srp",
2824         .dev_release = srp_release_dev
2825 };
2826
2827 /**
2828  * srp_conn_unique() - check whether the connection to a target is unique
2829  * @host:   SRP host.
2830  * @target: SRP target port.
2831  */
2832 static bool srp_conn_unique(struct srp_host *host,
2833                             struct srp_target_port *target)
2834 {
2835         struct srp_target_port *t;
2836         bool ret = false;
2837
2838         if (target->state == SRP_TARGET_REMOVED)
2839                 goto out;
2840
2841         ret = true;
2842
2843         spin_lock(&host->target_lock);
2844         list_for_each_entry(t, &host->target_list, list) {
2845                 if (t != target &&
2846                     target->id_ext == t->id_ext &&
2847                     target->ioc_guid == t->ioc_guid &&
2848                     target->initiator_ext == t->initiator_ext) {
2849                         ret = false;
2850                         break;
2851                 }
2852         }
2853         spin_unlock(&host->target_lock);
2854
2855 out:
2856         return ret;
2857 }
2858
2859 /*
2860  * Target ports are added by writing
2861  *
2862  *     id_ext=<SRP ID ext>,ioc_guid=<SRP IOC GUID>,dgid=<dest GID>,
2863  *     pkey=<P_Key>,service_id=<service ID>
2864  *
2865  * to the add_target sysfs attribute.
2866  */
2867 enum {
2868         SRP_OPT_ERR             = 0,
2869         SRP_OPT_ID_EXT          = 1 << 0,
2870         SRP_OPT_IOC_GUID        = 1 << 1,
2871         SRP_OPT_DGID            = 1 << 2,
2872         SRP_OPT_PKEY            = 1 << 3,
2873         SRP_OPT_SERVICE_ID      = 1 << 4,
2874         SRP_OPT_MAX_SECT        = 1 << 5,
2875         SRP_OPT_MAX_CMD_PER_LUN = 1 << 6,
2876         SRP_OPT_IO_CLASS        = 1 << 7,
2877         SRP_OPT_INITIATOR_EXT   = 1 << 8,
2878         SRP_OPT_CMD_SG_ENTRIES  = 1 << 9,
2879         SRP_OPT_ALLOW_EXT_SG    = 1 << 10,
2880         SRP_OPT_SG_TABLESIZE    = 1 << 11,
2881         SRP_OPT_COMP_VECTOR     = 1 << 12,
2882         SRP_OPT_TL_RETRY_COUNT  = 1 << 13,
2883         SRP_OPT_QUEUE_SIZE      = 1 << 14,
2884         SRP_OPT_ALL             = (SRP_OPT_ID_EXT       |
2885                                    SRP_OPT_IOC_GUID     |
2886                                    SRP_OPT_DGID         |
2887                                    SRP_OPT_PKEY         |
2888                                    SRP_OPT_SERVICE_ID),
2889 };
2890
2891 static const match_table_t srp_opt_tokens = {
2892         { SRP_OPT_ID_EXT,               "id_ext=%s"             },
2893         { SRP_OPT_IOC_GUID,             "ioc_guid=%s"           },
2894         { SRP_OPT_DGID,                 "dgid=%s"               },
2895         { SRP_OPT_PKEY,                 "pkey=%x"               },
2896         { SRP_OPT_SERVICE_ID,           "service_id=%s"         },
2897         { SRP_OPT_MAX_SECT,             "max_sect=%d"           },
2898         { SRP_OPT_MAX_CMD_PER_LUN,      "max_cmd_per_lun=%d"    },
2899         { SRP_OPT_IO_CLASS,             "io_class=%x"           },
2900         { SRP_OPT_INITIATOR_EXT,        "initiator_ext=%s"      },
2901         { SRP_OPT_CMD_SG_ENTRIES,       "cmd_sg_entries=%u"     },
2902         { SRP_OPT_ALLOW_EXT_SG,         "allow_ext_sg=%u"       },
2903         { SRP_OPT_SG_TABLESIZE,         "sg_tablesize=%u"       },
2904         { SRP_OPT_COMP_VECTOR,          "comp_vector=%u"        },
2905         { SRP_OPT_TL_RETRY_COUNT,       "tl_retry_count=%u"     },
2906         { SRP_OPT_QUEUE_SIZE,           "queue_size=%d"         },
2907         { SRP_OPT_ERR,                  NULL                    }
2908 };
2909
2910 static int srp_parse_options(const char *buf, struct srp_target_port *target)
2911 {
2912         char *options, *sep_opt;
2913         char *p;
2914         char dgid[3];
2915         substring_t args[MAX_OPT_ARGS];
2916         int opt_mask = 0;
2917         int token;
2918         int ret = -EINVAL;
2919         int i;
2920
2921         options = kstrdup(buf, GFP_KERNEL);
2922         if (!options)
2923                 return -ENOMEM;
2924
2925         sep_opt = options;
2926         while ((p = strsep(&sep_opt, ",\n")) != NULL) {
2927                 if (!*p)
2928                         continue;
2929
2930                 token = match_token(p, srp_opt_tokens, args);
2931                 opt_mask |= token;
2932
2933                 switch (token) {
2934                 case SRP_OPT_ID_EXT:
2935                         p = match_strdup(args);
2936                         if (!p) {
2937                                 ret = -ENOMEM;
2938                                 goto out;
2939                         }
2940                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
2941                         kfree(p);
2942                         break;
2943
2944                 case SRP_OPT_IOC_GUID:
2945                         p = match_strdup(args);
2946                         if (!p) {
2947                                 ret = -ENOMEM;
2948                                 goto out;
2949                         }
2950                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
2951                         kfree(p);
2952                         break;
2953
2954                 case SRP_OPT_DGID:
2955                         p = match_strdup(args);
2956                         if (!p) {
2957                                 ret = -ENOMEM;
2958                                 goto out;
2959                         }
2960                         if (strlen(p) != 32) {
2961                                 pr_warn("bad dest GID parameter '%s'\n", p);
2962                                 kfree(p);
2963                                 goto out;
2964                         }
2965
2966                         for (i = 0; i < 16; ++i) {
2967                                 strlcpy(dgid, p + i * 2, sizeof(dgid));
2968                                 if (sscanf(dgid, "%hhx",
2969                                            &target->orig_dgid.raw[i]) < 1) {
2970                                         ret = -EINVAL;
2971                                         kfree(p);
2972                                         goto out;
2973                                 }
2974                         }
2975                         kfree(p);
2976                         break;
2977
2978                 case SRP_OPT_PKEY:
2979                         if (match_hex(args, &token)) {
2980                                 pr_warn("bad P_Key parameter '%s'\n", p);
2981                                 goto out;
2982                         }
2983                         target->pkey = cpu_to_be16(token);
2984                         break;
2985
2986                 case SRP_OPT_SERVICE_ID:
2987                         p = match_strdup(args);
2988                         if (!p) {
2989                                 ret = -ENOMEM;
2990                                 goto out;
2991                         }
2992                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
2993                         kfree(p);
2994                         break;
2995
2996                 case SRP_OPT_MAX_SECT:
2997                         if (match_int(args, &token)) {
2998                                 pr_warn("bad max sect parameter '%s'\n", p);
2999                                 goto out;
3000                         }
3001                         target->scsi_host->max_sectors = token;
3002                         break;
3003
3004                 case SRP_OPT_QUEUE_SIZE:
3005                         if (match_int(args, &token) || token < 1) {
3006                                 pr_warn("bad queue_size parameter '%s'\n", p);
3007                                 goto out;
3008                         }
3009                         target->scsi_host->can_queue = token;
3010                         target->queue_size = token + SRP_RSP_SQ_SIZE +
3011                                              SRP_TSK_MGMT_SQ_SIZE;
3012                         if (!(opt_mask & SRP_OPT_MAX_CMD_PER_LUN))
3013                                 target->scsi_host->cmd_per_lun = token;
3014                         break;
3015
3016                 case SRP_OPT_MAX_CMD_PER_LUN:
3017                         if (match_int(args, &token) || token < 1) {
3018                                 pr_warn("bad max cmd_per_lun parameter '%s'\n",
3019                                         p);
3020                                 goto out;
3021                         }
3022                         target->scsi_host->cmd_per_lun = token;
3023                         break;
3024
3025                 case SRP_OPT_IO_CLASS:
3026                         if (match_hex(args, &token)) {
3027                                 pr_warn("bad IO class parameter '%s'\n", p);
3028                                 goto out;
3029                         }
3030                         if (token != SRP_REV10_IB_IO_CLASS &&
3031                             token != SRP_REV16A_IB_IO_CLASS) {
3032                                 pr_warn("unknown IO class parameter value %x specified (use %x or %x).\n",
3033                                         token, SRP_REV10_IB_IO_CLASS,
3034                                         SRP_REV16A_IB_IO_CLASS);
3035                                 goto out;
3036                         }
3037                         target->io_class = token;
3038                         break;
3039
3040                 case SRP_OPT_INITIATOR_EXT:
3041                         p = match_strdup(args);
3042                         if (!p) {
3043                                 ret = -ENOMEM;
3044                                 goto out;
3045                         }
3046                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
3047                         kfree(p);
3048                         break;
3049
3050                 case SRP_OPT_CMD_SG_ENTRIES:
3051                         if (match_int(args, &token) || token < 1 || token > 255) {
3052                                 pr_warn("bad max cmd_sg_entries parameter '%s'\n",
3053                                         p);
3054                                 goto out;
3055                         }
3056                         target->cmd_sg_cnt = token;
3057                         break;
3058
3059                 case SRP_OPT_ALLOW_EXT_SG:
3060                         if (match_int(args, &token)) {
3061                                 pr_warn("bad allow_ext_sg parameter '%s'\n", p);
3062                                 goto out;
3063                         }
3064                         target->allow_ext_sg = !!token;
3065                         break;
3066
3067                 case SRP_OPT_SG_TABLESIZE:
3068                         if (match_int(args, &token) || token < 1 ||
3069                                         token > SCSI_MAX_SG_CHAIN_SEGMENTS) {
3070                                 pr_warn("bad max sg_tablesize parameter '%s'\n",
3071                                         p);
3072                                 goto out;
3073                         }
3074                         target->sg_tablesize = token;
3075                         break;
3076
3077                 case SRP_OPT_COMP_VECTOR:
3078                         if (match_int(args, &token) || token < 0) {
3079                                 pr_warn("bad comp_vector parameter '%s'\n", p);
3080                                 goto out;
3081                         }
3082                         target->comp_vector = token;
3083                         break;
3084
3085                 case SRP_OPT_TL_RETRY_COUNT:
3086                         if (match_int(args, &token) || token < 2 || token > 7) {
3087                                 pr_warn("bad tl_retry_count parameter '%s' (must be a number between 2 and 7)\n",
3088                                         p);
3089                                 goto out;
3090                         }
3091                         target->tl_retry_count = token;
3092                         break;
3093
3094                 default:
3095                         pr_warn("unknown parameter or missing value '%s' in target creation request\n",
3096                                 p);
3097                         goto out;
3098                 }
3099         }
3100
3101         if ((opt_mask & SRP_OPT_ALL) == SRP_OPT_ALL)
3102                 ret = 0;
3103         else
3104                 for (i = 0; i < ARRAY_SIZE(srp_opt_tokens); ++i)
3105                         if ((srp_opt_tokens[i].token & SRP_OPT_ALL) &&
3106                             !(srp_opt_tokens[i].token & opt_mask))
3107                                 pr_warn("target creation request is missing parameter '%s'\n",
3108                                         srp_opt_tokens[i].pattern);
3109
3110         if (target->scsi_host->cmd_per_lun > target->scsi_host->can_queue
3111             && (opt_mask & SRP_OPT_MAX_CMD_PER_LUN))
3112                 pr_warn("cmd_per_lun = %d > queue_size = %d\n",
3113                         target->scsi_host->cmd_per_lun,
3114                         target->scsi_host->can_queue);
3115
3116 out:
3117         kfree(options);
3118         return ret;
3119 }
3120
3121 static ssize_t srp_create_target(struct device *dev,
3122                                  struct device_attribute *attr,
3123                                  const char *buf, size_t count)
3124 {
3125         struct srp_host *host =
3126                 container_of(dev, struct srp_host, dev);
3127         struct Scsi_Host *target_host;
3128         struct srp_target_port *target;
3129         struct srp_rdma_ch *ch;
3130         struct srp_device *srp_dev = host->srp_dev;
3131         struct ib_device *ibdev = srp_dev->dev;
3132         int ret, node_idx, node, cpu, i;
3133         bool multich = false;
3134
3135         target_host = scsi_host_alloc(&srp_template,
3136                                       sizeof (struct srp_target_port));
3137         if (!target_host)
3138                 return -ENOMEM;
3139
3140         target_host->transportt  = ib_srp_transport_template;
3141         target_host->max_channel = 0;
3142         target_host->max_id      = 1;
3143         target_host->max_lun     = -1LL;
3144         target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
3145
3146         target = host_to_target(target_host);
3147
3148         target->io_class        = SRP_REV16A_IB_IO_CLASS;
3149         target->scsi_host       = target_host;
3150         target->srp_host        = host;
3151         target->lkey            = host->srp_dev->pd->local_dma_lkey;
3152         target->rkey            = host->srp_dev->mr->rkey;
3153         target->cmd_sg_cnt      = cmd_sg_entries;
3154         target->sg_tablesize    = indirect_sg_entries ? : cmd_sg_entries;
3155         target->allow_ext_sg    = allow_ext_sg;
3156         target->tl_retry_count  = 7;
3157         target->queue_size      = SRP_DEFAULT_QUEUE_SIZE;
3158
3159         /*
3160          * Avoid that the SCSI host can be removed by srp_remove_target()
3161          * before this function returns.
3162          */
3163         scsi_host_get(target->scsi_host);
3164
3165         mutex_lock(&host->add_target_mutex);
3166
3167         ret = srp_parse_options(buf, target);
3168         if (ret)
3169                 goto out;
3170
3171         ret = scsi_init_shared_tag_map(target_host, target_host->can_queue);
3172         if (ret)
3173                 goto out;
3174
3175         target->req_ring_size = target->queue_size - SRP_TSK_MGMT_SQ_SIZE;
3176
3177         if (!srp_conn_unique(target->srp_host, target)) {
3178                 shost_printk(KERN_INFO, target->scsi_host,
3179                              PFX "Already connected to target port with id_ext=%016llx;ioc_guid=%016llx;initiator_ext=%016llx\n",
3180                              be64_to_cpu(target->id_ext),
3181                              be64_to_cpu(target->ioc_guid),
3182                              be64_to_cpu(target->initiator_ext));
3183                 ret = -EEXIST;
3184                 goto out;
3185         }
3186
3187         if (!srp_dev->has_fmr && !srp_dev->has_fr && !target->allow_ext_sg &&
3188             target->cmd_sg_cnt < target->sg_tablesize) {
3189                 pr_warn("No MR pool and no external indirect descriptors, limiting sg_tablesize to cmd_sg_cnt\n");
3190                 target->sg_tablesize = target->cmd_sg_cnt;
3191         }
3192
3193         target_host->sg_tablesize = target->sg_tablesize;
3194         target->indirect_size = target->sg_tablesize *
3195                                 sizeof (struct srp_direct_buf);
3196         target->max_iu_len = sizeof (struct srp_cmd) +
3197                              sizeof (struct srp_indirect_buf) +
3198                              target->cmd_sg_cnt * sizeof (struct srp_direct_buf);
3199
3200         INIT_WORK(&target->tl_err_work, srp_tl_err_work);
3201         INIT_WORK(&target->remove_work, srp_remove_work);
3202         spin_lock_init(&target->lock);
3203         ret = ib_query_gid(ibdev, host->port, 0, &target->sgid);
3204         if (ret)
3205                 goto out;
3206
3207         ret = -ENOMEM;
3208         target->ch_count = max_t(unsigned, num_online_nodes(),
3209                                  min(ch_count ? :
3210                                      min(4 * num_online_nodes(),
3211                                          ibdev->num_comp_vectors),
3212                                      num_online_cpus()));
3213         target->ch = kcalloc(target->ch_count, sizeof(*target->ch),
3214                              GFP_KERNEL);
3215         if (!target->ch)
3216                 goto out;
3217
3218         node_idx = 0;
3219         for_each_online_node(node) {
3220                 const int ch_start = (node_idx * target->ch_count /
3221                                       num_online_nodes());
3222                 const int ch_end = ((node_idx + 1) * target->ch_count /
3223                                     num_online_nodes());
3224                 const int cv_start = (node_idx * ibdev->num_comp_vectors /
3225                                       num_online_nodes() + target->comp_vector)
3226                                      % ibdev->num_comp_vectors;
3227                 const int cv_end = ((node_idx + 1) * ibdev->num_comp_vectors /
3228                                     num_online_nodes() + target->comp_vector)
3229                                    % ibdev->num_comp_vectors;
3230                 int cpu_idx = 0;
3231
3232                 for_each_online_cpu(cpu) {
3233                         if (cpu_to_node(cpu) != node)
3234                                 continue;
3235                         if (ch_start + cpu_idx >= ch_end)
3236                                 continue;
3237                         ch = &target->ch[ch_start + cpu_idx];
3238                         ch->target = target;
3239                         ch->comp_vector = cv_start == cv_end ? cv_start :
3240                                 cv_start + cpu_idx % (cv_end - cv_start);
3241                         spin_lock_init(&ch->lock);
3242                         INIT_LIST_HEAD(&ch->free_tx);
3243                         ret = srp_new_cm_id(ch);
3244                         if (ret)
3245                                 goto err_disconnect;
3246
3247                         ret = srp_create_ch_ib(ch);
3248                         if (ret)
3249                                 goto err_disconnect;
3250
3251                         ret = srp_alloc_req_data(ch);
3252                         if (ret)
3253                                 goto err_disconnect;
3254
3255                         ret = srp_connect_ch(ch, multich);
3256                         if (ret) {
3257                                 shost_printk(KERN_ERR, target->scsi_host,
3258                                              PFX "Connection %d/%d failed\n",
3259                                              ch_start + cpu_idx,
3260                                              target->ch_count);
3261                                 if (node_idx == 0 && cpu_idx == 0) {
3262                                         goto err_disconnect;
3263                                 } else {
3264                                         srp_free_ch_ib(target, ch);
3265                                         srp_free_req_data(target, ch);
3266                                         target->ch_count = ch - target->ch;
3267                                         goto connected;
3268                                 }
3269                         }
3270
3271                         multich = true;
3272                         cpu_idx++;
3273                 }
3274                 node_idx++;
3275         }
3276
3277 connected:
3278         target->scsi_host->nr_hw_queues = target->ch_count;
3279
3280         ret = srp_add_target(host, target);
3281         if (ret)
3282                 goto err_disconnect;
3283
3284         if (target->state != SRP_TARGET_REMOVED) {
3285                 shost_printk(KERN_DEBUG, target->scsi_host, PFX
3286                              "new target: id_ext %016llx ioc_guid %016llx pkey %04x service_id %016llx sgid %pI6 dgid %pI6\n",
3287                              be64_to_cpu(target->id_ext),
3288                              be64_to_cpu(target->ioc_guid),
3289                              be16_to_cpu(target->pkey),
3290                              be64_to_cpu(target->service_id),
3291                              target->sgid.raw, target->orig_dgid.raw);
3292         }
3293
3294         ret = count;
3295
3296 out:
3297         mutex_unlock(&host->add_target_mutex);
3298
3299         scsi_host_put(target->scsi_host);
3300         if (ret < 0)
3301                 scsi_host_put(target->scsi_host);
3302
3303         return ret;
3304
3305 err_disconnect:
3306         srp_disconnect_target(target);
3307
3308         for (i = 0; i < target->ch_count; i++) {
3309                 ch = &target->ch[i];
3310                 srp_free_ch_ib(target, ch);
3311                 srp_free_req_data(target, ch);
3312         }
3313
3314         kfree(target->ch);
3315         goto out;
3316 }
3317
3318 static DEVICE_ATTR(add_target, S_IWUSR, NULL, srp_create_target);
3319
3320 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
3321                           char *buf)
3322 {
3323         struct srp_host *host = container_of(dev, struct srp_host, dev);
3324
3325         return sprintf(buf, "%s\n", host->srp_dev->dev->name);
3326 }
3327
3328 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
3329
3330 static ssize_t show_port(struct device *dev, struct device_attribute *attr,
3331                          char *buf)
3332 {
3333         struct srp_host *host = container_of(dev, struct srp_host, dev);
3334
3335         return sprintf(buf, "%d\n", host->port);
3336 }
3337
3338 static DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
3339
3340 static struct srp_host *srp_add_port(struct srp_device *device, u8 port)
3341 {
3342         struct srp_host *host;
3343
3344         host = kzalloc(sizeof *host, GFP_KERNEL);
3345         if (!host)
3346                 return NULL;
3347
3348         INIT_LIST_HEAD(&host->target_list);
3349         spin_lock_init(&host->target_lock);
3350         init_completion(&host->released);
3351         mutex_init(&host->add_target_mutex);
3352         host->srp_dev = device;
3353         host->port = port;
3354
3355         host->dev.class = &srp_class;
3356         host->dev.parent = device->dev->dma_device;
3357         dev_set_name(&host->dev, "srp-%s-%d", device->dev->name, port);
3358
3359         if (device_register(&host->dev))
3360                 goto free_host;
3361         if (device_create_file(&host->dev, &dev_attr_add_target))
3362                 goto err_class;
3363         if (device_create_file(&host->dev, &dev_attr_ibdev))
3364                 goto err_class;
3365         if (device_create_file(&host->dev, &dev_attr_port))
3366                 goto err_class;
3367
3368         return host;
3369
3370 err_class:
3371         device_unregister(&host->dev);
3372
3373 free_host:
3374         kfree(host);
3375
3376         return NULL;
3377 }
3378
3379 static void srp_add_one(struct ib_device *device)
3380 {
3381         struct srp_device *srp_dev;
3382         struct ib_device_attr *dev_attr;
3383         struct srp_host *host;
3384         int mr_page_shift, p;
3385         u64 max_pages_per_mr;
3386
3387         dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
3388         if (!dev_attr)
3389                 return;
3390
3391         if (ib_query_device(device, dev_attr)) {
3392                 pr_warn("Query device failed for %s\n", device->name);
3393                 goto free_attr;
3394         }
3395
3396         srp_dev = kmalloc(sizeof *srp_dev, GFP_KERNEL);
3397         if (!srp_dev)
3398                 goto free_attr;
3399
3400         srp_dev->has_fmr = (device->alloc_fmr && device->dealloc_fmr &&
3401                             device->map_phys_fmr && device->unmap_fmr);
3402         srp_dev->has_fr = (dev_attr->device_cap_flags &
3403                            IB_DEVICE_MEM_MGT_EXTENSIONS);
3404         if (!srp_dev->has_fmr && !srp_dev->has_fr)
3405                 dev_warn(&device->dev, "neither FMR nor FR is supported\n");
3406
3407         srp_dev->use_fast_reg = (srp_dev->has_fr &&
3408                                  (!srp_dev->has_fmr || prefer_fr));
3409
3410         /*
3411          * Use the smallest page size supported by the HCA, down to a
3412          * minimum of 4096 bytes. We're unlikely to build large sglists
3413          * out of smaller entries.
3414          */
3415         mr_page_shift           = max(12, ffs(dev_attr->page_size_cap) - 1);
3416         srp_dev->mr_page_size   = 1 << mr_page_shift;
3417         srp_dev->mr_page_mask   = ~((u64) srp_dev->mr_page_size - 1);
3418         max_pages_per_mr        = dev_attr->max_mr_size;
3419         do_div(max_pages_per_mr, srp_dev->mr_page_size);
3420         srp_dev->max_pages_per_mr = min_t(u64, SRP_MAX_PAGES_PER_MR,
3421                                           max_pages_per_mr);
3422         if (srp_dev->use_fast_reg) {
3423                 srp_dev->max_pages_per_mr =
3424                         min_t(u32, srp_dev->max_pages_per_mr,
3425                               dev_attr->max_fast_reg_page_list_len);
3426         }
3427         srp_dev->mr_max_size    = srp_dev->mr_page_size *
3428                                    srp_dev->max_pages_per_mr;
3429         pr_debug("%s: mr_page_shift = %d, dev_attr->max_mr_size = %#llx, dev_attr->max_fast_reg_page_list_len = %u, max_pages_per_mr = %d, mr_max_size = %#x\n",
3430                  device->name, mr_page_shift, dev_attr->max_mr_size,
3431                  dev_attr->max_fast_reg_page_list_len,
3432                  srp_dev->max_pages_per_mr, srp_dev->mr_max_size);
3433
3434         INIT_LIST_HEAD(&srp_dev->dev_list);
3435
3436         srp_dev->dev = device;
3437         srp_dev->pd  = ib_alloc_pd(device);
3438         if (IS_ERR(srp_dev->pd))
3439                 goto free_dev;
3440
3441         srp_dev->mr = ib_get_dma_mr(srp_dev->pd,
3442                                     IB_ACCESS_LOCAL_WRITE |
3443                                     IB_ACCESS_REMOTE_READ |
3444                                     IB_ACCESS_REMOTE_WRITE);
3445         if (IS_ERR(srp_dev->mr))
3446                 goto err_pd;
3447
3448         for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
3449                 host = srp_add_port(srp_dev, p);
3450                 if (host)
3451                         list_add_tail(&host->list, &srp_dev->dev_list);
3452         }
3453
3454         ib_set_client_data(device, &srp_client, srp_dev);
3455
3456         goto free_attr;
3457
3458 err_pd:
3459         ib_dealloc_pd(srp_dev->pd);
3460
3461 free_dev:
3462         kfree(srp_dev);
3463
3464 free_attr:
3465         kfree(dev_attr);
3466 }
3467
3468 static void srp_remove_one(struct ib_device *device, void *client_data)
3469 {
3470         struct srp_device *srp_dev;
3471         struct srp_host *host, *tmp_host;
3472         struct srp_target_port *target;
3473
3474         srp_dev = client_data;
3475         if (!srp_dev)
3476                 return;
3477
3478         list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
3479                 device_unregister(&host->dev);
3480                 /*
3481                  * Wait for the sysfs entry to go away, so that no new
3482                  * target ports can be created.
3483                  */
3484                 wait_for_completion(&host->released);
3485
3486                 /*
3487                  * Remove all target ports.
3488                  */
3489                 spin_lock(&host->target_lock);
3490                 list_for_each_entry(target, &host->target_list, list)
3491                         srp_queue_remove_work(target);
3492                 spin_unlock(&host->target_lock);
3493
3494                 /*
3495                  * Wait for tl_err and target port removal tasks.
3496                  */
3497                 flush_workqueue(system_long_wq);
3498                 flush_workqueue(srp_remove_wq);
3499
3500                 kfree(host);
3501         }
3502
3503         ib_dereg_mr(srp_dev->mr);
3504         ib_dealloc_pd(srp_dev->pd);
3505
3506         kfree(srp_dev);
3507 }
3508
3509 static struct srp_function_template ib_srp_transport_functions = {
3510         .has_rport_state         = true,
3511         .reset_timer_if_blocked  = true,
3512         .reconnect_delay         = &srp_reconnect_delay,
3513         .fast_io_fail_tmo        = &srp_fast_io_fail_tmo,
3514         .dev_loss_tmo            = &srp_dev_loss_tmo,
3515         .reconnect               = srp_rport_reconnect,
3516         .rport_delete            = srp_rport_delete,
3517         .terminate_rport_io      = srp_terminate_io,
3518 };
3519
3520 static int __init srp_init_module(void)
3521 {
3522         int ret;
3523
3524         BUILD_BUG_ON(FIELD_SIZEOF(struct ib_wc, wr_id) < sizeof(void *));
3525
3526         if (srp_sg_tablesize) {
3527                 pr_warn("srp_sg_tablesize is deprecated, please use cmd_sg_entries\n");
3528                 if (!cmd_sg_entries)
3529                         cmd_sg_entries = srp_sg_tablesize;
3530         }
3531
3532         if (!cmd_sg_entries)
3533                 cmd_sg_entries = SRP_DEF_SG_TABLESIZE;
3534
3535         if (cmd_sg_entries > 255) {
3536                 pr_warn("Clamping cmd_sg_entries to 255\n");
3537                 cmd_sg_entries = 255;
3538         }
3539
3540         if (!indirect_sg_entries)
3541                 indirect_sg_entries = cmd_sg_entries;
3542         else if (indirect_sg_entries < cmd_sg_entries) {
3543                 pr_warn("Bumping up indirect_sg_entries to match cmd_sg_entries (%u)\n",
3544                         cmd_sg_entries);
3545                 indirect_sg_entries = cmd_sg_entries;
3546         }
3547
3548         srp_remove_wq = create_workqueue("srp_remove");
3549         if (!srp_remove_wq) {
3550                 ret = -ENOMEM;
3551                 goto out;
3552         }
3553
3554         ret = -ENOMEM;
3555         ib_srp_transport_template =
3556                 srp_attach_transport(&ib_srp_transport_functions);
3557         if (!ib_srp_transport_template)
3558                 goto destroy_wq;
3559
3560         ret = class_register(&srp_class);
3561         if (ret) {
3562                 pr_err("couldn't register class infiniband_srp\n");
3563                 goto release_tr;
3564         }
3565
3566         ib_sa_register_client(&srp_sa_client);
3567
3568         ret = ib_register_client(&srp_client);
3569         if (ret) {
3570                 pr_err("couldn't register IB client\n");
3571                 goto unreg_sa;
3572         }
3573
3574 out:
3575         return ret;
3576
3577 unreg_sa:
3578         ib_sa_unregister_client(&srp_sa_client);
3579         class_unregister(&srp_class);
3580
3581 release_tr:
3582         srp_release_transport(ib_srp_transport_template);
3583
3584 destroy_wq:
3585         destroy_workqueue(srp_remove_wq);
3586         goto out;
3587 }
3588
3589 static void __exit srp_cleanup_module(void)
3590 {
3591         ib_unregister_client(&srp_client);
3592         ib_sa_unregister_client(&srp_sa_client);
3593         class_unregister(&srp_class);
3594         srp_release_transport(ib_srp_transport_template);
3595         destroy_workqueue(srp_remove_wq);
3596 }
3597
3598 module_init(srp_init_module);
3599 module_exit(srp_cleanup_module);