drivers/infiniband/ulp/srp/ib_srp.c

   1 /*
   2  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #include <linux/module.h>
  34 #include <linux/init.h>
  35 #include <linux/slab.h>
  36 #include <linux/err.h>
  37 #include <linux/string.h>
  38 #include <linux/parser.h>
  39 #include <linux/random.h>
  40 #include <linux/jiffies.h>
  41
  42 #include <asm/atomic.h>
  43
  44 #include <scsi/scsi.h>
  45 #include <scsi/scsi_device.h>
  46 #include <scsi/scsi_dbg.h>
  47 #include <scsi/srp.h>
  48 #include <scsi/scsi_transport_srp.h>
  49
  50 #include "ib_srp.h"
  51
  52 #define DRV_NAME        "ib_srp"
  53 #define PFX             DRV_NAME ": "
  54 #define DRV_VERSION     "0.2"
  55 #define DRV_RELDATE     "November 1, 2005"
  56
  57 MODULE_AUTHOR("Roland Dreier");
  58 MODULE_DESCRIPTION("InfiniBand SCSI RDMA Protocol initiator "
  59                    "v" DRV_VERSION " (" DRV_RELDATE ")");
  60 MODULE_LICENSE("Dual BSD/GPL");
  61
  62 static unsigned int srp_sg_tablesize;
  63 static unsigned int cmd_sg_entries;
  64 static int topspin_workarounds = 1;
  65
  66 module_param(srp_sg_tablesize, uint, 0444);
  67 MODULE_PARM_DESC(srp_sg_tablesize, "Deprecated name for cmd_sg_entries");
  68
  69 module_param(cmd_sg_entries, uint, 0444);
  70 MODULE_PARM_DESC(cmd_sg_entries,
  71                  "Default number of gather/scatter entries in the SRP command (default is 12, max 255)");
  72
  73 module_param(topspin_workarounds, int, 0444);
  74 MODULE_PARM_DESC(topspin_workarounds,
  75                  "Enable workarounds for Topspin/Cisco SRP target bugs if != 0");
  76
  77 static void srp_add_one(struct ib_device *device);
  78 static void srp_remove_one(struct ib_device *device);
  79 static void srp_recv_completion(struct ib_cq *cq, void *target_ptr);
  80 static void srp_send_completion(struct ib_cq *cq, void *target_ptr);
  81 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
  82
  83 static struct scsi_transport_template *ib_srp_transport_template;
  84
  85 static struct ib_client srp_client = {
  86         .name   = "srp",
  87         .add    = srp_add_one,
  88         .remove = srp_remove_one
  89 };
  90
  91 static struct ib_sa_client srp_sa_client;
  92
  93 static inline struct srp_target_port *host_to_target(struct Scsi_Host *host)
  94 {
  95         return (struct srp_target_port *) host->hostdata;
  96 }
  97
  98 static const char *srp_target_info(struct Scsi_Host *host)
  99 {
 100         return host_to_target(host)->target_name;
 101 }
 102
 103 static int srp_target_is_topspin(struct srp_target_port *target)
 104 {
 105         static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 106         static const u8 cisco_oui[3]   = { 0x00, 0x1b, 0x0d };
 107
 108         return topspin_workarounds &&
 109                 (!memcmp(&target->ioc_guid, topspin_oui, sizeof topspin_oui) ||
 110                  !memcmp(&target->ioc_guid, cisco_oui, sizeof cisco_oui));
 111 }
 112
 113 static struct srp_iu *srp_alloc_iu(struct srp_host *host, size_t size,
 114                                    gfp_t gfp_mask,
 115                                    enum dma_data_direction direction)
 116 {
 117         struct srp_iu *iu;
 118
 119         iu = kmalloc(sizeof *iu, gfp_mask);
 120         if (!iu)
 121                 goto out;
 122
 123         iu->buf = kzalloc(size, gfp_mask);
 124         if (!iu->buf)
 125                 goto out_free_iu;
 126
 127         iu->dma = ib_dma_map_single(host->srp_dev->dev, iu->buf, size,
 128                                     direction);
 129         if (ib_dma_mapping_error(host->srp_dev->dev, iu->dma))
 130                 goto out_free_buf;
 131
 132         iu->size      = size;
 133         iu->direction = direction;
 134
 135         return iu;
 136
 137 out_free_buf:
 138         kfree(iu->buf);
 139 out_free_iu:
 140         kfree(iu);
 141 out:
 142         return NULL;
 143 }
 144
 145 static void srp_free_iu(struct srp_host *host, struct srp_iu *iu)
 146 {
 147         if (!iu)
 148                 return;
 149
 150         ib_dma_unmap_single(host->srp_dev->dev, iu->dma, iu->size,
 151                             iu->direction);
 152         kfree(iu->buf);
 153         kfree(iu);
 154 }
 155
 156 static void srp_qp_event(struct ib_event *event, void *context)
 157 {
 158         printk(KERN_ERR PFX "QP event %d\n", event->event);
 159 }
 160
 161 static int srp_init_qp(struct srp_target_port *target,
 162                        struct ib_qp *qp)
 163 {
 164         struct ib_qp_attr *attr;
 165         int ret;
 166
 167         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 168         if (!attr)
 169                 return -ENOMEM;
 170
 171         ret = ib_find_pkey(target->srp_host->srp_dev->dev,
 172                            target->srp_host->port,
 173                            be16_to_cpu(target->path.pkey),
 174                            &attr->pkey_index);
 175         if (ret)
 176                 goto out;
 177
 178         attr->qp_state        = IB_QPS_INIT;
 179         attr->qp_access_flags = (IB_ACCESS_REMOTE_READ |
 180                                     IB_ACCESS_REMOTE_WRITE);
 181         attr->port_num        = target->srp_host->port;
 182
 183         ret = ib_modify_qp(qp, attr,
 184                            IB_QP_STATE          |
 185                            IB_QP_PKEY_INDEX     |
 186                            IB_QP_ACCESS_FLAGS   |
 187                            IB_QP_PORT);
 188
 189 out:
 190         kfree(attr);
 191         return ret;
 192 }
 193
 194 static int srp_new_cm_id(struct srp_target_port *target)
 195 {
 196         struct ib_cm_id *new_cm_id;
 197
 198         new_cm_id = ib_create_cm_id(target->srp_host->srp_dev->dev,
 199                                     srp_cm_handler, target);
 200         if (IS_ERR(new_cm_id))
 201                 return PTR_ERR(new_cm_id);
 202
 203         if (target->cm_id)
 204                 ib_destroy_cm_id(target->cm_id);
 205         target->cm_id = new_cm_id;
 206
 207         return 0;
 208 }
 209
 210 static int srp_create_target_ib(struct srp_target_port *target)
 211 {
 212         struct ib_qp_init_attr *init_attr;
 213         int ret;
 214
 215         init_attr = kzalloc(sizeof *init_attr, GFP_KERNEL);
 216         if (!init_attr)
 217                 return -ENOMEM;
 218
 219         target->recv_cq = ib_create_cq(target->srp_host->srp_dev->dev,
 220                                        srp_recv_completion, NULL, target, SRP_RQ_SIZE, 0);
 221         if (IS_ERR(target->recv_cq)) {
 222                 ret = PTR_ERR(target->recv_cq);
 223                 goto err;
 224         }
 225
 226         target->send_cq = ib_create_cq(target->srp_host->srp_dev->dev,
 227                                        srp_send_completion, NULL, target, SRP_SQ_SIZE, 0);
 228         if (IS_ERR(target->send_cq)) {
 229                 ret = PTR_ERR(target->send_cq);
 230                 goto err_recv_cq;
 231         }
 232
 233         ib_req_notify_cq(target->recv_cq, IB_CQ_NEXT_COMP);
 234
 235         init_attr->event_handler       = srp_qp_event;
 236         init_attr->cap.max_send_wr     = SRP_SQ_SIZE;
 237         init_attr->cap.max_recv_wr     = SRP_RQ_SIZE;
 238         init_attr->cap.max_recv_sge    = 1;
 239         init_attr->cap.max_send_sge    = 1;
 240         init_attr->sq_sig_type         = IB_SIGNAL_ALL_WR;
 241         init_attr->qp_type             = IB_QPT_RC;
 242         init_attr->send_cq             = target->send_cq;
 243         init_attr->recv_cq             = target->recv_cq;
 244
 245         target->qp = ib_create_qp(target->srp_host->srp_dev->pd, init_attr);
 246         if (IS_ERR(target->qp)) {
 247                 ret = PTR_ERR(target->qp);
 248                 goto err_send_cq;
 249         }
 250
 251         ret = srp_init_qp(target, target->qp);
 252         if (ret)
 253                 goto err_qp;
 254
 255         kfree(init_attr);
 256         return 0;
 257
 258 err_qp:
 259         ib_destroy_qp(target->qp);
 260
 261 err_send_cq:
 262         ib_destroy_cq(target->send_cq);
 263
 264 err_recv_cq:
 265         ib_destroy_cq(target->recv_cq);
 266
 267 err:
 268         kfree(init_attr);
 269         return ret;
 270 }
 271
 272 static void srp_free_target_ib(struct srp_target_port *target)
 273 {
 274         int i;
 275
 276         ib_destroy_qp(target->qp);
 277         ib_destroy_cq(target->send_cq);
 278         ib_destroy_cq(target->recv_cq);
 279
 280         for (i = 0; i < SRP_RQ_SIZE; ++i)
 281                 srp_free_iu(target->srp_host, target->rx_ring[i]);
 282         for (i = 0; i < SRP_SQ_SIZE; ++i)
 283                 srp_free_iu(target->srp_host, target->tx_ring[i]);
 284 }
 285
 286 static void srp_path_rec_completion(int status,
 287                                     struct ib_sa_path_rec *pathrec,
 288                                     void *target_ptr)
 289 {
 290         struct srp_target_port *target = target_ptr;
 291
 292         target->status = status;
 293         if (status)
 294                 shost_printk(KERN_ERR, target->scsi_host,
 295                              PFX "Got failed path rec status %d\n", status);
 296         else
 297                 target->path = *pathrec;
 298         complete(&target->done);
 299 }
 300
 301 static int srp_lookup_path(struct srp_target_port *target)
 302 {
 303         target->path.numb_path = 1;
 304
 305         init_completion(&target->done);
 306
 307         target->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
 308                                                    target->srp_host->srp_dev->dev,
 309                                                    target->srp_host->port,
 310                                                    &target->path,
 311                                                    IB_SA_PATH_REC_SERVICE_ID    |
 312                                                    IB_SA_PATH_REC_DGID          |
 313                                                    IB_SA_PATH_REC_SGID          |
 314                                                    IB_SA_PATH_REC_NUMB_PATH     |
 315                                                    IB_SA_PATH_REC_PKEY,
 316                                                    SRP_PATH_REC_TIMEOUT_MS,
 317                                                    GFP_KERNEL,
 318                                                    srp_path_rec_completion,
 319                                                    target, &target->path_query);
 320         if (target->path_query_id < 0)
 321                 return target->path_query_id;
 322
 323         wait_for_completion(&target->done);
 324
 325         if (target->status < 0)
 326                 shost_printk(KERN_WARNING, target->scsi_host,
 327                              PFX "Path record query failed\n");
 328
 329         return target->status;
 330 }
 331
 332 static int srp_send_req(struct srp_target_port *target)
 333 {
 334         struct {
 335                 struct ib_cm_req_param param;
 336                 struct srp_login_req   priv;
 337         } *req = NULL;
 338         int status;
 339
 340         req = kzalloc(sizeof *req, GFP_KERNEL);
 341         if (!req)
 342                 return -ENOMEM;
 343
 344         req->param.primary_path               = &target->path;
 345         req->param.alternate_path             = NULL;
 346         req->param.service_id                 = target->service_id;
 347         req->param.qp_num                     = target->qp->qp_num;
 348         req->param.qp_type                    = target->qp->qp_type;
 349         req->param.private_data               = &req->priv;
 350         req->param.private_data_len           = sizeof req->priv;
 351         req->param.flow_control               = 1;
 352
 353         get_random_bytes(&req->param.starting_psn, 4);
 354         req->param.starting_psn              &= 0xffffff;
 355
 356         /*
 357          * Pick some arbitrary defaults here; we could make these
 358          * module parameters if anyone cared about setting them.
 359          */
 360         req->param.responder_resources        = 4;
 361         req->param.remote_cm_response_timeout = 20;
 362         req->param.local_cm_response_timeout  = 20;
 363         req->param.retry_count                = 7;
 364         req->param.rnr_retry_count            = 7;
 365         req->param.max_cm_retries             = 15;
 366
 367         req->priv.opcode        = SRP_LOGIN_REQ;
 368         req->priv.tag           = 0;
 369         req->priv.req_it_iu_len = cpu_to_be32(target->max_iu_len);
 370         req->priv.req_buf_fmt   = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
 371                                               SRP_BUF_FORMAT_INDIRECT);
 372         /*
 373          * In the published SRP specification (draft rev. 16a), the
 374          * port identifier format is 8 bytes of ID extension followed
 375          * by 8 bytes of GUID.  Older drafts put the two halves in the
 376          * opposite order, so that the GUID comes first.
 377          *
 378          * Targets conforming to these obsolete drafts can be
 379          * recognized by the I/O Class they report.
 380          */
 381         if (target->io_class == SRP_REV10_IB_IO_CLASS) {
 382                 memcpy(req->priv.initiator_port_id,
 383                        &target->path.sgid.global.interface_id, 8);
 384                 memcpy(req->priv.initiator_port_id + 8,
 385                        &target->initiator_ext, 8);
 386                 memcpy(req->priv.target_port_id,     &target->ioc_guid, 8);
 387                 memcpy(req->priv.target_port_id + 8, &target->id_ext, 8);
 388         } else {
 389                 memcpy(req->priv.initiator_port_id,
 390                        &target->initiator_ext, 8);
 391                 memcpy(req->priv.initiator_port_id + 8,
 392                        &target->path.sgid.global.interface_id, 8);
 393                 memcpy(req->priv.target_port_id,     &target->id_ext, 8);
 394                 memcpy(req->priv.target_port_id + 8, &target->ioc_guid, 8);
 395         }
 396
 397         /*
 398          * Topspin/Cisco SRP targets will reject our login unless we
 399          * zero out the first 8 bytes of our initiator port ID and set
 400          * the second 8 bytes to the local node GUID.
 401          */
 402         if (srp_target_is_topspin(target)) {
 403                 shost_printk(KERN_DEBUG, target->scsi_host,
 404                              PFX "Topspin/Cisco initiator port ID workaround "
 405                              "activated for target GUID %016llx\n",
 406                              (unsigned long long) be64_to_cpu(target->ioc_guid));
 407                 memset(req->priv.initiator_port_id, 0, 8);
 408                 memcpy(req->priv.initiator_port_id + 8,
 409                        &target->srp_host->srp_dev->dev->node_guid, 8);
 410         }
 411
 412         status = ib_send_cm_req(target->cm_id, &req->param);
 413
 414         kfree(req);
 415
 416         return status;
 417 }
 418
 419 static void srp_disconnect_target(struct srp_target_port *target)
 420 {
 421         /* XXX should send SRP_I_LOGOUT request */
 422
 423         init_completion(&target->done);
 424         if (ib_send_cm_dreq(target->cm_id, NULL, 0)) {
 425                 shost_printk(KERN_DEBUG, target->scsi_host,
 426                              PFX "Sending CM DREQ failed\n");
 427                 return;
 428         }
 429         wait_for_completion(&target->done);
 430 }
 431
 432 static bool srp_change_state(struct srp_target_port *target,
 433                             enum srp_target_state old,
 434                             enum srp_target_state new)
 435 {
 436         bool changed = false;
 437
 438         spin_lock_irq(&target->lock);
 439         if (target->state == old) {
 440                 target->state = new;
 441                 changed = true;
 442         }
 443         spin_unlock_irq(&target->lock);
 444         return changed;
 445 }
 446
 447 static void srp_remove_work(struct work_struct *work)
 448 {
 449         struct srp_target_port *target =
 450                 container_of(work, struct srp_target_port, work);
 451
 452         if (!srp_change_state(target, SRP_TARGET_DEAD, SRP_TARGET_REMOVED))
 453                 return;
 454
 455         spin_lock(&target->srp_host->target_lock);
 456         list_del(&target->list);
 457         spin_unlock(&target->srp_host->target_lock);
 458
 459         srp_remove_host(target->scsi_host);
 460         scsi_remove_host(target->scsi_host);
 461         ib_destroy_cm_id(target->cm_id);
 462         srp_free_target_ib(target);
 463         scsi_host_put(target->scsi_host);
 464 }
 465
 466 static int srp_connect_target(struct srp_target_port *target)
 467 {
 468         int retries = 3;
 469         int ret;
 470
 471         ret = srp_lookup_path(target);
 472         if (ret)
 473                 return ret;
 474
 475         while (1) {
 476                 init_completion(&target->done);
 477                 ret = srp_send_req(target);
 478                 if (ret)
 479                         return ret;
 480                 wait_for_completion(&target->done);
 481
 482                 /*
 483                  * The CM event handling code will set status to
 484                  * SRP_PORT_REDIRECT if we get a port redirect REJ
 485                  * back, or SRP_DLID_REDIRECT if we get a lid/qp
 486                  * redirect REJ back.
 487                  */
 488                 switch (target->status) {
 489                 case 0:
 490                         return 0;
 491
 492                 case SRP_PORT_REDIRECT:
 493                         ret = srp_lookup_path(target);
 494                         if (ret)
 495                                 return ret;
 496                         break;
 497
 498                 case SRP_DLID_REDIRECT:
 499                         break;
 500
 501                 case SRP_STALE_CONN:
 502                         /* Our current CM id was stale, and is now in timewait.
 503                          * Try to reconnect with a new one.
 504                          */
 505                         if (!retries-- || srp_new_cm_id(target)) {
 506                                 shost_printk(KERN_ERR, target->scsi_host, PFX
 507                                              "giving up on stale connection\n");
 508                                 target->status = -ECONNRESET;
 509                                 return target->status;
 510                         }
 511
 512                         shost_printk(KERN_ERR, target->scsi_host, PFX
 513                                      "retrying stale connection\n");
 514                         break;
 515
 516                 default:
 517                         return target->status;
 518                 }
 519         }
 520 }
 521
 522 static void srp_unmap_data(struct scsi_cmnd *scmnd,
 523                            struct srp_target_port *target,
 524                            struct srp_request *req)
 525 {
 526         if (!scsi_sglist(scmnd) ||
 527             (scmnd->sc_data_direction != DMA_TO_DEVICE &&
 528              scmnd->sc_data_direction != DMA_FROM_DEVICE))
 529                 return;
 530
 531         if (req->fmr) {
 532                 ib_fmr_pool_unmap(req->fmr);
 533                 req->fmr = NULL;
 534         }
 535
 536         ib_dma_unmap_sg(target->srp_host->srp_dev->dev, scsi_sglist(scmnd),
 537                         scsi_sg_count(scmnd), scmnd->sc_data_direction);
 538 }
 539
 540 static void srp_remove_req(struct srp_target_port *target,
 541                            struct srp_request *req, s32 req_lim_delta)
 542 {
 543         unsigned long flags;
 544
 545         srp_unmap_data(req->scmnd, target, req);
 546         spin_lock_irqsave(&target->lock, flags);
 547         target->req_lim += req_lim_delta;
 548         req->scmnd = NULL;
 549         list_add_tail(&req->list, &target->free_reqs);
 550         spin_unlock_irqrestore(&target->lock, flags);
 551 }
 552
 553 static void srp_reset_req(struct srp_target_port *target, struct srp_request *req)
 554 {
 555         req->scmnd->result = DID_RESET << 16;
 556         req->scmnd->scsi_done(req->scmnd);
 557         srp_remove_req(target, req, 0);
 558 }
 559
 560 static int srp_reconnect_target(struct srp_target_port *target)
 561 {
 562         struct ib_qp_attr qp_attr;
 563         struct ib_wc wc;
 564         int i, ret;
 565
 566         if (!srp_change_state(target, SRP_TARGET_LIVE, SRP_TARGET_CONNECTING))
 567                 return -EAGAIN;
 568
 569         srp_disconnect_target(target);
 570         /*
 571          * Now get a new local CM ID so that we avoid confusing the
 572          * target in case things are really fouled up.
 573          */
 574         ret = srp_new_cm_id(target);
 575         if (ret)
 576                 goto err;
 577
 578         qp_attr.qp_state = IB_QPS_RESET;
 579         ret = ib_modify_qp(target->qp, &qp_attr, IB_QP_STATE);
 580         if (ret)
 581                 goto err;
 582
 583         ret = srp_init_qp(target, target->qp);
 584         if (ret)
 585                 goto err;
 586
 587         while (ib_poll_cq(target->recv_cq, 1, &wc) > 0)
 588                 ; /* nothing */
 589         while (ib_poll_cq(target->send_cq, 1, &wc) > 0)
 590                 ; /* nothing */
 591
 592         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
 593                 struct srp_request *req = &target->req_ring[i];
 594                 if (req->scmnd)
 595                         srp_reset_req(target, req);
 596         }
 597
 598         INIT_LIST_HEAD(&target->free_tx);
 599         for (i = 0; i < SRP_SQ_SIZE; ++i)
 600                 list_add(&target->tx_ring[i]->list, &target->free_tx);
 601
 602         target->qp_in_error = 0;
 603         ret = srp_connect_target(target);
 604         if (ret)
 605                 goto err;
 606
 607         if (!srp_change_state(target, SRP_TARGET_CONNECTING, SRP_TARGET_LIVE))
 608                 ret = -EAGAIN;
 609
 610         return ret;
 611
 612 err:
 613         shost_printk(KERN_ERR, target->scsi_host,
 614                      PFX "reconnect failed (%d), removing target port.\n", ret);
 615
 616         /*
 617          * We couldn't reconnect, so kill our target port off.
 618          * However, we have to defer the real removal because we
 619          * are in the context of the SCSI error handler now, which
 620          * will deadlock if we call scsi_remove_host().
 621          *
 622          * Schedule our work inside the lock to avoid a race with
 623          * the flush_scheduled_work() in srp_remove_one().
 624          */
 625         spin_lock_irq(&target->lock);
 626         if (target->state == SRP_TARGET_CONNECTING) {
 627                 target->state = SRP_TARGET_DEAD;
 628                 INIT_WORK(&target->work, srp_remove_work);
 629                 queue_work(ib_wq, &target->work);
 630         }
 631         spin_unlock_irq(&target->lock);
 632
 633         return ret;
 634 }
 635
 636 static int srp_map_fmr(struct srp_target_port *target, struct scatterlist *scat,
 637                        int sg_cnt, struct srp_request *req,
 638                        struct srp_direct_buf *buf)
 639 {
 640         u64 io_addr = 0;
 641         u64 *dma_pages;
 642         u32 len;
 643         int page_cnt;
 644         int i, j;
 645         int ret;
 646         struct srp_device *dev = target->srp_host->srp_dev;
 647         struct ib_device *ibdev = dev->dev;
 648         struct scatterlist *sg;
 649
 650         if (!dev->fmr_pool)
 651                 return -ENODEV;
 652
 653         if (ib_sg_dma_address(ibdev, &scat[0]) & ~dev->fmr_page_mask)
 654                 return -EINVAL;
 655
 656         len = page_cnt = 0;
 657         scsi_for_each_sg(req->scmnd, sg, sg_cnt, i) {
 658                 unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
 659
 660                 if (ib_sg_dma_address(ibdev, sg) & ~dev->fmr_page_mask) {
 661                         if (i > 0)
 662                                 return -EINVAL;
 663                         else
 664                                 ++page_cnt;
 665                 }
 666                 if ((ib_sg_dma_address(ibdev, sg) + dma_len) &
 667                     ~dev->fmr_page_mask) {
 668                         if (i < sg_cnt - 1)
 669                                 return -EINVAL;
 670                         else
 671                                 ++page_cnt;
 672                 }
 673
 674                 len += dma_len;
 675         }
 676
 677         page_cnt += len >> dev->fmr_page_shift;
 678         if (page_cnt > SRP_FMR_SIZE)
 679                 return -ENOMEM;
 680
 681         dma_pages = kmalloc(sizeof (u64) * page_cnt, GFP_ATOMIC);
 682         if (!dma_pages)
 683                 return -ENOMEM;
 684
 685         page_cnt = 0;
 686         scsi_for_each_sg(req->scmnd, sg, sg_cnt, i) {
 687                 unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
 688
 689                 for (j = 0; j < dma_len; j += dev->fmr_page_size)
 690                         dma_pages[page_cnt++] =
 691                                 (ib_sg_dma_address(ibdev, sg) &
 692                                  dev->fmr_page_mask) + j;
 693         }
 694
 695         req->fmr = ib_fmr_pool_map_phys(dev->fmr_pool,
 696                                         dma_pages, page_cnt, io_addr);
 697         if (IS_ERR(req->fmr)) {
 698                 ret = PTR_ERR(req->fmr);
 699                 req->fmr = NULL;
 700                 goto out;
 701         }
 702
 703         buf->va  = cpu_to_be64(ib_sg_dma_address(ibdev, &scat[0]) &
 704                                ~dev->fmr_page_mask);
 705         buf->key = cpu_to_be32(req->fmr->fmr->rkey);
 706         buf->len = cpu_to_be32(len);
 707
 708         ret = 0;
 709
 710 out:
 711         kfree(dma_pages);
 712
 713         return ret;
 714 }
 715
 716 static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_target_port *target,
 717                         struct srp_request *req)
 718 {
 719         struct scatterlist *scat;
 720         struct srp_cmd *cmd = req->cmd->buf;
 721         int len, nents, count;
 722         u8 fmt = SRP_DATA_DESC_DIRECT;
 723         struct srp_device *dev;
 724         struct ib_device *ibdev;
 725
 726         if (!scsi_sglist(scmnd) || scmnd->sc_data_direction == DMA_NONE)
 727                 return sizeof (struct srp_cmd);
 728
 729         if (scmnd->sc_data_direction != DMA_FROM_DEVICE &&
 730             scmnd->sc_data_direction != DMA_TO_DEVICE) {
 731                 shost_printk(KERN_WARNING, target->scsi_host,
 732                              PFX "Unhandled data direction %d\n",
 733                              scmnd->sc_data_direction);
 734                 return -EINVAL;
 735         }
 736
 737         nents = scsi_sg_count(scmnd);
 738         scat  = scsi_sglist(scmnd);
 739
 740         dev = target->srp_host->srp_dev;
 741         ibdev = dev->dev;
 742
 743         count = ib_dma_map_sg(ibdev, scat, nents, scmnd->sc_data_direction);
 744
 745         fmt = SRP_DATA_DESC_DIRECT;
 746         len = sizeof (struct srp_cmd) + sizeof (struct srp_direct_buf);
 747
 748         if (count == 1) {
 749                 /*
 750                  * The midlayer only generated a single gather/scatter
 751                  * entry, or DMA mapping coalesced everything to a
 752                  * single entry.  So a direct descriptor along with
 753                  * the DMA MR suffices.
 754                  */
 755                 struct srp_direct_buf *buf = (void *) cmd->add_data;
 756
 757                 buf->va  = cpu_to_be64(ib_sg_dma_address(ibdev, scat));
 758                 buf->key = cpu_to_be32(target->rkey);
 759                 buf->len = cpu_to_be32(ib_sg_dma_len(ibdev, scat));
 760         } else if (srp_map_fmr(target, scat, count, req,
 761                                (void *) cmd->add_data)) {
 762                 /*
 763                  * FMR mapping failed, and the scatterlist has more
 764                  * than one entry.  Generate an indirect memory
 765                  * descriptor.
 766                  */
 767                 struct srp_indirect_buf *buf = (void *) cmd->add_data;
 768                 struct scatterlist *sg;
 769                 u32 datalen = 0;
 770                 int i;
 771
 772                 fmt = SRP_DATA_DESC_INDIRECT;
 773                 len = sizeof (struct srp_cmd) +
 774                         sizeof (struct srp_indirect_buf) +
 775                         count * sizeof (struct srp_direct_buf);
 776
 777                 scsi_for_each_sg(scmnd, sg, count, i) {
 778                         unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
 779
 780                         buf->desc_list[i].va  =
 781                                 cpu_to_be64(ib_sg_dma_address(ibdev, sg));
 782                         buf->desc_list[i].key =
 783                                 cpu_to_be32(target->rkey);
 784                         buf->desc_list[i].len = cpu_to_be32(dma_len);
 785                         datalen += dma_len;
 786                 }
 787
 788                 if (scmnd->sc_data_direction == DMA_TO_DEVICE)
 789                         cmd->data_out_desc_cnt = count;
 790                 else
 791                         cmd->data_in_desc_cnt = count;
 792
 793                 buf->table_desc.va  =
 794                         cpu_to_be64(req->cmd->dma + sizeof *cmd + sizeof *buf);
 795                 buf->table_desc.key =
 796                         cpu_to_be32(target->rkey);
 797                 buf->table_desc.len =
 798                         cpu_to_be32(count * sizeof (struct srp_direct_buf));
 799
 800                 buf->len = cpu_to_be32(datalen);
 801         }
 802
 803         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
 804                 cmd->buf_fmt = fmt << 4;
 805         else
 806                 cmd->buf_fmt = fmt;
 807
 808         return len;
 809 }
 810
 811 /*
 812  * Return an IU and possible credit to the free pool
 813  */
 814 static void srp_put_tx_iu(struct srp_target_port *target, struct srp_iu *iu,
 815                           enum srp_iu_type iu_type)
 816 {
 817         unsigned long flags;
 818
 819         spin_lock_irqsave(&target->lock, flags);
 820         list_add(&iu->list, &target->free_tx);
 821         if (iu_type != SRP_IU_RSP)
 822                 ++target->req_lim;
 823         spin_unlock_irqrestore(&target->lock, flags);
 824 }
 825
 826 /*
 827  * Must be called with target->lock held to protect req_lim and free_tx.
 828  * If IU is not sent, it must be returned using srp_put_tx_iu().
 829  *
 830  * Note:
 831  * An upper limit for the number of allocated information units for each
 832  * request type is:
 833  * - SRP_IU_CMD: SRP_CMD_SQ_SIZE, since the SCSI mid-layer never queues
 834  *   more than Scsi_Host.can_queue requests.
 835  * - SRP_IU_TSK_MGMT: SRP_TSK_MGMT_SQ_SIZE.
 836  * - SRP_IU_RSP: 1, since a conforming SRP target never sends more than
 837  *   one unanswered SRP request to an initiator.
 838  */
 839 static struct srp_iu *__srp_get_tx_iu(struct srp_target_port *target,
 840                                       enum srp_iu_type iu_type)
 841 {
 842         s32 rsv = (iu_type == SRP_IU_TSK_MGMT) ? 0 : SRP_TSK_MGMT_SQ_SIZE;
 843         struct srp_iu *iu;
 844
 845         srp_send_completion(target->send_cq, target);
 846
 847         if (list_empty(&target->free_tx))
 848                 return NULL;
 849
 850         /* Initiator responses to target requests do not consume credits */
 851         if (iu_type != SRP_IU_RSP) {
 852                 if (target->req_lim <= rsv) {
 853                         ++target->zero_req_lim;
 854                         return NULL;
 855                 }
 856
 857                 --target->req_lim;
 858         }
 859
 860         iu = list_first_entry(&target->free_tx, struct srp_iu, list);
 861         list_del(&iu->list);
 862         return iu;
 863 }
 864
 865 static int srp_post_send(struct srp_target_port *target,
 866                          struct srp_iu *iu, int len)
 867 {
 868         struct ib_sge list;
 869         struct ib_send_wr wr, *bad_wr;
 870
 871         list.addr   = iu->dma;
 872         list.length = len;
 873         list.lkey   = target->lkey;
 874
 875         wr.next       = NULL;
 876         wr.wr_id      = (uintptr_t) iu;
 877         wr.sg_list    = &list;
 878         wr.num_sge    = 1;
 879         wr.opcode     = IB_WR_SEND;
 880         wr.send_flags = IB_SEND_SIGNALED;
 881
 882         return ib_post_send(target->qp, &wr, &bad_wr);
 883 }
 884
 885 static int srp_post_recv(struct srp_target_port *target, struct srp_iu *iu)
 886 {
 887         struct ib_recv_wr wr, *bad_wr;
 888         struct ib_sge list;
 889
 890         list.addr   = iu->dma;
 891         list.length = iu->size;
 892         list.lkey   = target->lkey;
 893
 894         wr.next     = NULL;
 895         wr.wr_id    = (uintptr_t) iu;
 896         wr.sg_list  = &list;
 897         wr.num_sge  = 1;
 898
 899         return ib_post_recv(target->qp, &wr, &bad_wr);
 900 }
 901
 902 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
 903 {
 904         struct srp_request *req;
 905         struct scsi_cmnd *scmnd;
 906         unsigned long flags;
 907
 908         if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
 909                 spin_lock_irqsave(&target->lock, flags);
 910                 target->req_lim += be32_to_cpu(rsp->req_lim_delta);
 911                 spin_unlock_irqrestore(&target->lock, flags);
 912
 913                 target->tsk_mgmt_status = -1;
 914                 if (be32_to_cpu(rsp->resp_data_len) >= 4)
 915                         target->tsk_mgmt_status = rsp->data[3];
 916                 complete(&target->tsk_mgmt_done);
 917         } else {
 918                 req = &target->req_ring[rsp->tag];
 919                 scmnd = req->scmnd;
 920                 if (!scmnd)
 921                         shost_printk(KERN_ERR, target->scsi_host,
 922                                      "Null scmnd for RSP w/tag %016llx\n",
 923                                      (unsigned long long) rsp->tag);
 924                 scmnd->result = rsp->status;
 925
 926                 if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
 927                         memcpy(scmnd->sense_buffer, rsp->data +
 928                                be32_to_cpu(rsp->resp_data_len),
 929                                min_t(int, be32_to_cpu(rsp->sense_data_len),
 930                                      SCSI_SENSE_BUFFERSIZE));
 931                 }
 932
 933                 if (rsp->flags & (SRP_RSP_FLAG_DOOVER | SRP_RSP_FLAG_DOUNDER))
 934                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
 935                 else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
 936                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
 937
 938                 srp_remove_req(target, req, be32_to_cpu(rsp->req_lim_delta));
 939                 scmnd->host_scribble = NULL;
 940                 scmnd->scsi_done(scmnd);
 941         }
 942 }
 943
 944 static int srp_response_common(struct srp_target_port *target, s32 req_delta,
 945                                void *rsp, int len)
 946 {
 947         struct ib_device *dev = target->srp_host->srp_dev->dev;
 948         unsigned long flags;
 949         struct srp_iu *iu;
 950         int err;
 951
 952         spin_lock_irqsave(&target->lock, flags);
 953         target->req_lim += req_delta;
 954         iu = __srp_get_tx_iu(target, SRP_IU_RSP);
 955         spin_unlock_irqrestore(&target->lock, flags);
 956
 957         if (!iu) {
 958                 shost_printk(KERN_ERR, target->scsi_host, PFX
 959                              "no IU available to send response\n");
 960                 return 1;
 961         }
 962
 963         ib_dma_sync_single_for_cpu(dev, iu->dma, len, DMA_TO_DEVICE);
 964         memcpy(iu->buf, rsp, len);
 965         ib_dma_sync_single_for_device(dev, iu->dma, len, DMA_TO_DEVICE);
 966
 967         err = srp_post_send(target, iu, len);
 968         if (err) {
 969                 shost_printk(KERN_ERR, target->scsi_host, PFX
 970                              "unable to post response: %d\n", err);
 971                 srp_put_tx_iu(target, iu, SRP_IU_RSP);
 972         }
 973
 974         return err;
 975 }
 976
 977 static void srp_process_cred_req(struct srp_target_port *target,
 978                                  struct srp_cred_req *req)
 979 {
 980         struct srp_cred_rsp rsp = {
 981                 .opcode = SRP_CRED_RSP,
 982                 .tag = req->tag,
 983         };
 984         s32 delta = be32_to_cpu(req->req_lim_delta);
 985
 986         if (srp_response_common(target, delta, &rsp, sizeof rsp))
 987                 shost_printk(KERN_ERR, target->scsi_host, PFX
 988                              "problems processing SRP_CRED_REQ\n");
 989 }
 990
 991 static void srp_process_aer_req(struct srp_target_port *target,
 992                                 struct srp_aer_req *req)
 993 {
 994         struct srp_aer_rsp rsp = {
 995                 .opcode = SRP_AER_RSP,
 996                 .tag = req->tag,
 997         };
 998         s32 delta = be32_to_cpu(req->req_lim_delta);
 999
1000         shost_printk(KERN_ERR, target->scsi_host, PFX
1001                      "ignoring AER for LUN %llu\n", be64_to_cpu(req->lun));
1002
1003         if (srp_response_common(target, delta, &rsp, sizeof rsp))
1004                 shost_printk(KERN_ERR, target->scsi_host, PFX
1005                              "problems processing SRP_AER_REQ\n");
1006 }
1007
1008 static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
1009 {
1010         struct ib_device *dev = target->srp_host->srp_dev->dev;
1011         struct srp_iu *iu = (struct srp_iu *) wc->wr_id;
1012         int res;
1013         u8 opcode;
1014
1015         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_ti_iu_len,
1016                                    DMA_FROM_DEVICE);
1017
1018         opcode = *(u8 *) iu->buf;
1019
1020         if (0) {
1021                 shost_printk(KERN_ERR, target->scsi_host,
1022                              PFX "recv completion, opcode 0x%02x\n", opcode);
1023                 print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 8, 1,
1024                                iu->buf, wc->byte_len, true);
1025         }
1026
1027         switch (opcode) {
1028         case SRP_RSP:
1029                 srp_process_rsp(target, iu->buf);
1030                 break;
1031
1032         case SRP_CRED_REQ:
1033                 srp_process_cred_req(target, iu->buf);
1034                 break;
1035
1036         case SRP_AER_REQ:
1037                 srp_process_aer_req(target, iu->buf);
1038                 break;
1039
1040         case SRP_T_LOGOUT:
1041                 /* XXX Handle target logout */
1042                 shost_printk(KERN_WARNING, target->scsi_host,
1043                              PFX "Got target logout request\n");
1044                 break;
1045
1046         default:
1047                 shost_printk(KERN_WARNING, target->scsi_host,
1048                              PFX "Unhandled SRP opcode 0x%02x\n", opcode);
1049                 break;
1050         }
1051
1052         ib_dma_sync_single_for_device(dev, iu->dma, target->max_ti_iu_len,
1053                                       DMA_FROM_DEVICE);
1054
1055         res = srp_post_recv(target, iu);
1056         if (res != 0)
1057                 shost_printk(KERN_ERR, target->scsi_host,
1058                              PFX "Recv failed with error code %d\n", res);
1059 }
1060
1061 static void srp_recv_completion(struct ib_cq *cq, void *target_ptr)
1062 {
1063         struct srp_target_port *target = target_ptr;
1064         struct ib_wc wc;
1065
1066         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
1067         while (ib_poll_cq(cq, 1, &wc) > 0) {
1068                 if (wc.status) {
1069                         shost_printk(KERN_ERR, target->scsi_host,
1070                                      PFX "failed receive status %d\n",
1071                                      wc.status);
1072                         target->qp_in_error = 1;
1073                         break;
1074                 }
1075
1076                 srp_handle_recv(target, &wc);
1077         }
1078 }
1079
1080 static void srp_send_completion(struct ib_cq *cq, void *target_ptr)
1081 {
1082         struct srp_target_port *target = target_ptr;
1083         struct ib_wc wc;
1084         struct srp_iu *iu;
1085
1086         while (ib_poll_cq(cq, 1, &wc) > 0) {
1087                 if (wc.status) {
1088                         shost_printk(KERN_ERR, target->scsi_host,
1089                                      PFX "failed send status %d\n",
1090                                      wc.status);
1091                         target->qp_in_error = 1;
1092                         break;
1093                 }
1094
1095                 iu = (struct srp_iu *) wc.wr_id;
1096                 list_add(&iu->list, &target->free_tx);
1097         }
1098 }
1099
1100 static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
1101 {
1102         struct srp_target_port *target = host_to_target(shost);
1103         struct srp_request *req;
1104         struct srp_iu *iu;
1105         struct srp_cmd *cmd;
1106         struct ib_device *dev;
1107         unsigned long flags;
1108         int len;
1109
1110         if (target->state == SRP_TARGET_CONNECTING)
1111                 goto err;
1112
1113         if (target->state == SRP_TARGET_DEAD ||
1114             target->state == SRP_TARGET_REMOVED) {
1115                 scmnd->result = DID_BAD_TARGET << 16;
1116                 scmnd->scsi_done(scmnd);
1117                 return 0;
1118         }
1119
1120         spin_lock_irqsave(&target->lock, flags);
1121         iu = __srp_get_tx_iu(target, SRP_IU_CMD);
1122         if (!iu)
1123                 goto err_unlock;
1124
1125         req = list_first_entry(&target->free_reqs, struct srp_request, list);
1126         list_del(&req->list);
1127         spin_unlock_irqrestore(&target->lock, flags);
1128
1129         dev = target->srp_host->srp_dev->dev;
1130         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_iu_len,
1131                                    DMA_TO_DEVICE);
1132
1133         scmnd->result        = 0;
1134         scmnd->host_scribble = (void *) req;
1135
1136         cmd = iu->buf;
1137         memset(cmd, 0, sizeof *cmd);
1138
1139         cmd->opcode = SRP_CMD;
1140         cmd->lun    = cpu_to_be64((u64) scmnd->device->lun << 48);
1141         cmd->tag    = req->index;
1142         memcpy(cmd->cdb, scmnd->cmnd, scmnd->cmd_len);
1143
1144         req->scmnd    = scmnd;
1145         req->cmd      = iu;
1146
1147         len = srp_map_data(scmnd, target, req);
1148         if (len < 0) {
1149                 shost_printk(KERN_ERR, target->scsi_host,
1150                              PFX "Failed to map data\n");
1151                 goto err_iu;
1152         }
1153
1154         ib_dma_sync_single_for_device(dev, iu->dma, target->max_iu_len,
1155                                       DMA_TO_DEVICE);
1156
1157         if (srp_post_send(target, iu, len)) {
1158                 shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
1159                 goto err_unmap;
1160         }
1161
1162         return 0;
1163
1164 err_unmap:
1165         srp_unmap_data(scmnd, target, req);
1166
1167 err_iu:
1168         srp_put_tx_iu(target, iu, SRP_IU_CMD);
1169
1170         spin_lock_irqsave(&target->lock, flags);
1171         list_add(&req->list, &target->free_reqs);
1172
1173 err_unlock:
1174         spin_unlock_irqrestore(&target->lock, flags);
1175
1176 err:
1177         return SCSI_MLQUEUE_HOST_BUSY;
1178 }
1179
1180 static int srp_alloc_iu_bufs(struct srp_target_port *target)
1181 {
1182         int i;
1183
1184         for (i = 0; i < SRP_RQ_SIZE; ++i) {
1185                 target->rx_ring[i] = srp_alloc_iu(target->srp_host,
1186                                                   target->max_ti_iu_len,
1187                                                   GFP_KERNEL, DMA_FROM_DEVICE);
1188                 if (!target->rx_ring[i])
1189                         goto err;
1190         }
1191
1192         for (i = 0; i < SRP_SQ_SIZE; ++i) {
1193                 target->tx_ring[i] = srp_alloc_iu(target->srp_host,
1194                                                   target->max_iu_len,
1195                                                   GFP_KERNEL, DMA_TO_DEVICE);
1196                 if (!target->tx_ring[i])
1197                         goto err;
1198
1199                 list_add(&target->tx_ring[i]->list, &target->free_tx);
1200         }
1201
1202         return 0;
1203
1204 err:
1205         for (i = 0; i < SRP_RQ_SIZE; ++i) {
1206                 srp_free_iu(target->srp_host, target->rx_ring[i]);
1207                 target->rx_ring[i] = NULL;
1208         }
1209
1210         for (i = 0; i < SRP_SQ_SIZE; ++i) {
1211                 srp_free_iu(target->srp_host, target->tx_ring[i]);
1212                 target->tx_ring[i] = NULL;
1213         }
1214
1215         return -ENOMEM;
1216 }
1217
1218 static void srp_cm_rep_handler(struct ib_cm_id *cm_id,
1219                                struct srp_login_rsp *lrsp,
1220                                struct srp_target_port *target)
1221 {
1222         struct ib_qp_attr *qp_attr = NULL;
1223         int attr_mask = 0;
1224         int ret;
1225         int i;
1226
1227         if (lrsp->opcode == SRP_LOGIN_RSP) {
1228                 target->max_ti_iu_len = be32_to_cpu(lrsp->max_ti_iu_len);
1229                 target->req_lim       = be32_to_cpu(lrsp->req_lim_delta);
1230
1231                 /*
1232                  * Reserve credits for task management so we don't
1233                  * bounce requests back to the SCSI mid-layer.
1234                  */
1235                 target->scsi_host->can_queue
1236                         = min(target->req_lim - SRP_TSK_MGMT_SQ_SIZE,
1237                               target->scsi_host->can_queue);
1238         } else {
1239                 shost_printk(KERN_WARNING, target->scsi_host,
1240                              PFX "Unhandled RSP opcode %#x\n", lrsp->opcode);
1241                 ret = -ECONNRESET;
1242                 goto error;
1243         }
1244
1245         if (!target->rx_ring[0]) {
1246                 ret = srp_alloc_iu_bufs(target);
1247                 if (ret)
1248                         goto error;
1249         }
1250
1251         ret = -ENOMEM;
1252         qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
1253         if (!qp_attr)
1254                 goto error;
1255
1256         qp_attr->qp_state = IB_QPS_RTR;
1257         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
1258         if (ret)
1259                 goto error_free;
1260
1261         ret = ib_modify_qp(target->qp, qp_attr, attr_mask);
1262         if (ret)
1263                 goto error_free;
1264
1265         for (i = 0; i < SRP_RQ_SIZE; i++) {
1266                 struct srp_iu *iu = target->rx_ring[i];
1267                 ret = srp_post_recv(target, iu);
1268                 if (ret)
1269                         goto error_free;
1270         }
1271
1272         qp_attr->qp_state = IB_QPS_RTS;
1273         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
1274         if (ret)
1275                 goto error_free;
1276
1277         ret = ib_modify_qp(target->qp, qp_attr, attr_mask);
1278         if (ret)
1279                 goto error_free;
1280
1281         ret = ib_send_cm_rtu(cm_id, NULL, 0);
1282
1283 error_free:
1284         kfree(qp_attr);
1285
1286 error:
1287         target->status = ret;
1288 }
1289
1290 static void srp_cm_rej_handler(struct ib_cm_id *cm_id,
1291                                struct ib_cm_event *event,
1292                                struct srp_target_port *target)
1293 {
1294         struct Scsi_Host *shost = target->scsi_host;
1295         struct ib_class_port_info *cpi;
1296         int opcode;
1297
1298         switch (event->param.rej_rcvd.reason) {
1299         case IB_CM_REJ_PORT_CM_REDIRECT:
1300                 cpi = event->param.rej_rcvd.ari;
1301                 target->path.dlid = cpi->redirect_lid;
1302                 target->path.pkey = cpi->redirect_pkey;
1303                 cm_id->remote_cm_qpn = be32_to_cpu(cpi->redirect_qp) & 0x00ffffff;
1304                 memcpy(target->path.dgid.raw, cpi->redirect_gid, 16);
1305
1306                 target->status = target->path.dlid ?
1307                         SRP_DLID_REDIRECT : SRP_PORT_REDIRECT;
1308                 break;
1309
1310         case IB_CM_REJ_PORT_REDIRECT:
1311                 if (srp_target_is_topspin(target)) {
1312                         /*
1313                          * Topspin/Cisco SRP gateways incorrectly send
1314                          * reject reason code 25 when they mean 24
1315                          * (port redirect).
1316                          */
1317                         memcpy(target->path.dgid.raw,
1318                                event->param.rej_rcvd.ari, 16);
1319
1320                         shost_printk(KERN_DEBUG, shost,
1321                                      PFX "Topspin/Cisco redirect to target port GID %016llx%016llx\n",
1322                                      (unsigned long long) be64_to_cpu(target->path.dgid.global.subnet_prefix),
1323                                      (unsigned long long) be64_to_cpu(target->path.dgid.global.interface_id));
1324
1325                         target->status = SRP_PORT_REDIRECT;
1326                 } else {
1327                         shost_printk(KERN_WARNING, shost,
1328                                      "  REJ reason: IB_CM_REJ_PORT_REDIRECT\n");
1329                         target->status = -ECONNRESET;
1330                 }
1331                 break;
1332
1333         case IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID:
1334                 shost_printk(KERN_WARNING, shost,
1335                             "  REJ reason: IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID\n");
1336                 target->status = -ECONNRESET;
1337                 break;
1338
1339         case IB_CM_REJ_CONSUMER_DEFINED:
1340                 opcode = *(u8 *) event->private_data;
1341                 if (opcode == SRP_LOGIN_REJ) {
1342                         struct srp_login_rej *rej = event->private_data;
1343                         u32 reason = be32_to_cpu(rej->reason);
1344
1345                         if (reason == SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE)
1346                                 shost_printk(KERN_WARNING, shost,
1347                                              PFX "SRP_LOGIN_REJ: requested max_it_iu_len too large\n");
1348                         else
1349                                 shost_printk(KERN_WARNING, shost,
1350                                             PFX "SRP LOGIN REJECTED, reason 0x%08x\n", reason);
1351                 } else
1352                         shost_printk(KERN_WARNING, shost,
1353                                      "  REJ reason: IB_CM_REJ_CONSUMER_DEFINED,"
1354                                      " opcode 0x%02x\n", opcode);
1355                 target->status = -ECONNRESET;
1356                 break;
1357
1358         case IB_CM_REJ_STALE_CONN:
1359                 shost_printk(KERN_WARNING, shost, "  REJ reason: stale connection\n");
1360                 target->status = SRP_STALE_CONN;
1361                 break;
1362
1363         default:
1364                 shost_printk(KERN_WARNING, shost, "  REJ reason 0x%x\n",
1365                              event->param.rej_rcvd.reason);
1366                 target->status = -ECONNRESET;
1367         }
1368 }
1369
1370 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
1371 {
1372         struct srp_target_port *target = cm_id->context;
1373         int comp = 0;
1374
1375         switch (event->event) {
1376         case IB_CM_REQ_ERROR:
1377                 shost_printk(KERN_DEBUG, target->scsi_host,
1378                              PFX "Sending CM REQ failed\n");
1379                 comp = 1;
1380                 target->status = -ECONNRESET;
1381                 break;
1382
1383         case IB_CM_REP_RECEIVED:
1384                 comp = 1;
1385                 srp_cm_rep_handler(cm_id, event->private_data, target);
1386                 break;
1387
1388         case IB_CM_REJ_RECEIVED:
1389                 shost_printk(KERN_DEBUG, target->scsi_host, PFX "REJ received\n");
1390                 comp = 1;
1391
1392                 srp_cm_rej_handler(cm_id, event, target);
1393                 break;
1394
1395         case IB_CM_DREQ_RECEIVED:
1396                 shost_printk(KERN_WARNING, target->scsi_host,
1397                              PFX "DREQ received - connection closed\n");
1398                 if (ib_send_cm_drep(cm_id, NULL, 0))
1399                         shost_printk(KERN_ERR, target->scsi_host,
1400                                      PFX "Sending CM DREP failed\n");
1401                 break;
1402
1403         case IB_CM_TIMEWAIT_EXIT:
1404                 shost_printk(KERN_ERR, target->scsi_host,
1405                              PFX "connection closed\n");
1406
1407                 comp = 1;
1408                 target->status = 0;
1409                 break;
1410
1411         case IB_CM_MRA_RECEIVED:
1412         case IB_CM_DREQ_ERROR:
1413         case IB_CM_DREP_RECEIVED:
1414                 break;
1415
1416         default:
1417                 shost_printk(KERN_WARNING, target->scsi_host,
1418                              PFX "Unhandled CM event %d\n", event->event);
1419                 break;
1420         }
1421
1422         if (comp)
1423                 complete(&target->done);
1424
1425         return 0;
1426 }
1427
1428 static int srp_send_tsk_mgmt(struct srp_target_port *target,
1429                              u64 req_tag, unsigned int lun, u8 func)
1430 {
1431         struct ib_device *dev = target->srp_host->srp_dev->dev;
1432         struct srp_iu *iu;
1433         struct srp_tsk_mgmt *tsk_mgmt;
1434
1435         if (target->state == SRP_TARGET_DEAD ||
1436             target->state == SRP_TARGET_REMOVED)
1437                 return -1;
1438
1439         init_completion(&target->tsk_mgmt_done);
1440
1441         spin_lock_irq(&target->lock);
1442         iu = __srp_get_tx_iu(target, SRP_IU_TSK_MGMT);
1443         spin_unlock_irq(&target->lock);
1444
1445         if (!iu)
1446                 return -1;
1447
1448         ib_dma_sync_single_for_cpu(dev, iu->dma, sizeof *tsk_mgmt,
1449                                    DMA_TO_DEVICE);
1450         tsk_mgmt = iu->buf;
1451         memset(tsk_mgmt, 0, sizeof *tsk_mgmt);
1452
1453         tsk_mgmt->opcode        = SRP_TSK_MGMT;
1454         tsk_mgmt->lun           = cpu_to_be64((u64) lun << 48);
1455         tsk_mgmt->tag           = req_tag | SRP_TAG_TSK_MGMT;
1456         tsk_mgmt->tsk_mgmt_func = func;
1457         tsk_mgmt->task_tag      = req_tag;
1458
1459         ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
1460                                       DMA_TO_DEVICE);
1461         if (srp_post_send(target, iu, sizeof *tsk_mgmt)) {
1462                 srp_put_tx_iu(target, iu, SRP_IU_TSK_MGMT);
1463                 return -1;
1464         }
1465
1466         if (!wait_for_completion_timeout(&target->tsk_mgmt_done,
1467                                          msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
1468                 return -1;
1469
1470         return 0;
1471 }
1472
1473 static int srp_abort(struct scsi_cmnd *scmnd)
1474 {
1475         struct srp_target_port *target = host_to_target(scmnd->device->host);
1476         struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
1477         int ret = SUCCESS;
1478
1479         shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
1480
1481         if (!req || target->qp_in_error)
1482                 return FAILED;
1483         if (srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
1484                               SRP_TSK_ABORT_TASK))
1485                 return FAILED;
1486
1487         if (req->scmnd) {
1488                 if (!target->tsk_mgmt_status) {
1489                         srp_remove_req(target, req, 0);
1490                         scmnd->result = DID_ABORT << 16;
1491                 } else
1492                         ret = FAILED;
1493         }
1494
1495         return ret;
1496 }
1497
1498 static int srp_reset_device(struct scsi_cmnd *scmnd)
1499 {
1500         struct srp_target_port *target = host_to_target(scmnd->device->host);
1501         int i;
1502
1503         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
1504
1505         if (target->qp_in_error)
1506                 return FAILED;
1507         if (srp_send_tsk_mgmt(target, SRP_TAG_NO_REQ, scmnd->device->lun,
1508                               SRP_TSK_LUN_RESET))
1509                 return FAILED;
1510         if (target->tsk_mgmt_status)
1511                 return FAILED;
1512
1513         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
1514                 struct srp_request *req = &target->req_ring[i];
1515                 if (req->scmnd && req->scmnd->device == scmnd->device)
1516                         srp_reset_req(target, req);
1517         }
1518
1519         return SUCCESS;
1520 }
1521
1522 static int srp_reset_host(struct scsi_cmnd *scmnd)
1523 {
1524         struct srp_target_port *target = host_to_target(scmnd->device->host);
1525         int ret = FAILED;
1526
1527         shost_printk(KERN_ERR, target->scsi_host, PFX "SRP reset_host called\n");
1528
1529         if (!srp_reconnect_target(target))
1530                 ret = SUCCESS;
1531
1532         return ret;
1533 }
1534
1535 static ssize_t show_id_ext(struct device *dev, struct device_attribute *attr,
1536                            char *buf)
1537 {
1538         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1539
1540         if (target->state == SRP_TARGET_DEAD ||
1541             target->state == SRP_TARGET_REMOVED)
1542                 return -ENODEV;
1543
1544         return sprintf(buf, "0x%016llx\n",
1545                        (unsigned long long) be64_to_cpu(target->id_ext));
1546 }
1547
1548 static ssize_t show_ioc_guid(struct device *dev, struct device_attribute *attr,
1549                              char *buf)
1550 {
1551         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1552
1553         if (target->state == SRP_TARGET_DEAD ||
1554             target->state == SRP_TARGET_REMOVED)
1555                 return -ENODEV;
1556
1557         return sprintf(buf, "0x%016llx\n",
1558                        (unsigned long long) be64_to_cpu(target->ioc_guid));
1559 }
1560
1561 static ssize_t show_service_id(struct device *dev,
1562                                struct device_attribute *attr, char *buf)
1563 {
1564         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1565
1566         if (target->state == SRP_TARGET_DEAD ||
1567             target->state == SRP_TARGET_REMOVED)
1568                 return -ENODEV;
1569
1570         return sprintf(buf, "0x%016llx\n",
1571                        (unsigned long long) be64_to_cpu(target->service_id));
1572 }
1573
1574 static ssize_t show_pkey(struct device *dev, struct device_attribute *attr,
1575                          char *buf)
1576 {
1577         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1578
1579         if (target->state == SRP_TARGET_DEAD ||
1580             target->state == SRP_TARGET_REMOVED)
1581                 return -ENODEV;
1582
1583         return sprintf(buf, "0x%04x\n", be16_to_cpu(target->path.pkey));
1584 }
1585
1586 static ssize_t show_dgid(struct device *dev, struct device_attribute *attr,
1587                          char *buf)
1588 {
1589         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1590
1591         if (target->state == SRP_TARGET_DEAD ||
1592             target->state == SRP_TARGET_REMOVED)
1593                 return -ENODEV;
1594
1595         return sprintf(buf, "%pI6\n", target->path.dgid.raw);
1596 }
1597
1598 static ssize_t show_orig_dgid(struct device *dev,
1599                               struct device_attribute *attr, char *buf)
1600 {
1601         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1602
1603         if (target->state == SRP_TARGET_DEAD ||
1604             target->state == SRP_TARGET_REMOVED)
1605                 return -ENODEV;
1606
1607         return sprintf(buf, "%pI6\n", target->orig_dgid);
1608 }
1609
1610 static ssize_t show_req_lim(struct device *dev,
1611                             struct device_attribute *attr, char *buf)
1612 {
1613         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1614
1615         if (target->state == SRP_TARGET_DEAD ||
1616             target->state == SRP_TARGET_REMOVED)
1617                 return -ENODEV;
1618
1619         return sprintf(buf, "%d\n", target->req_lim);
1620 }
1621
1622 static ssize_t show_zero_req_lim(struct device *dev,
1623                                  struct device_attribute *attr, char *buf)
1624 {
1625         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1626
1627         if (target->state == SRP_TARGET_DEAD ||
1628             target->state == SRP_TARGET_REMOVED)
1629                 return -ENODEV;
1630
1631         return sprintf(buf, "%d\n", target->zero_req_lim);
1632 }
1633
1634 static ssize_t show_local_ib_port(struct device *dev,
1635                                   struct device_attribute *attr, char *buf)
1636 {
1637         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1638
1639         return sprintf(buf, "%d\n", target->srp_host->port);
1640 }
1641
1642 static ssize_t show_local_ib_device(struct device *dev,
1643                                     struct device_attribute *attr, char *buf)
1644 {
1645         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1646
1647         return sprintf(buf, "%s\n", target->srp_host->srp_dev->dev->name);
1648 }
1649
1650 static ssize_t show_cmd_sg_entries(struct device *dev,
1651                                    struct device_attribute *attr, char *buf)
1652 {
1653         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1654
1655         return sprintf(buf, "%u\n", target->cmd_sg_cnt);
1656 }
1657
1658 static DEVICE_ATTR(id_ext,          S_IRUGO, show_id_ext,          NULL);
1659 static DEVICE_ATTR(ioc_guid,        S_IRUGO, show_ioc_guid,        NULL);
1660 static DEVICE_ATTR(service_id,      S_IRUGO, show_service_id,      NULL);
1661 static DEVICE_ATTR(pkey,            S_IRUGO, show_pkey,            NULL);
1662 static DEVICE_ATTR(dgid,            S_IRUGO, show_dgid,            NULL);
1663 static DEVICE_ATTR(orig_dgid,       S_IRUGO, show_orig_dgid,       NULL);
1664 static DEVICE_ATTR(req_lim,         S_IRUGO, show_req_lim,         NULL);
1665 static DEVICE_ATTR(zero_req_lim,    S_IRUGO, show_zero_req_lim,    NULL);
1666 static DEVICE_ATTR(local_ib_port,   S_IRUGO, show_local_ib_port,   NULL);
1667 static DEVICE_ATTR(local_ib_device, S_IRUGO, show_local_ib_device, NULL);
1668 static DEVICE_ATTR(cmd_sg_entries,  S_IRUGO, show_cmd_sg_entries,  NULL);
1669
1670 static struct device_attribute *srp_host_attrs[] = {
1671         &dev_attr_id_ext,
1672         &dev_attr_ioc_guid,
1673         &dev_attr_service_id,
1674         &dev_attr_pkey,
1675         &dev_attr_dgid,
1676         &dev_attr_orig_dgid,
1677         &dev_attr_req_lim,
1678         &dev_attr_zero_req_lim,
1679         &dev_attr_local_ib_port,
1680         &dev_attr_local_ib_device,
1681         &dev_attr_cmd_sg_entries,
1682         NULL
1683 };
1684
1685 static struct scsi_host_template srp_template = {
1686         .module                         = THIS_MODULE,
1687         .name                           = "InfiniBand SRP initiator",
1688         .proc_name                      = DRV_NAME,
1689         .info                           = srp_target_info,
1690         .queuecommand                   = srp_queuecommand,
1691         .eh_abort_handler               = srp_abort,
1692         .eh_device_reset_handler        = srp_reset_device,
1693         .eh_host_reset_handler          = srp_reset_host,
1694         .sg_tablesize                   = SRP_DEF_SG_TABLESIZE,
1695         .can_queue                      = SRP_CMD_SQ_SIZE,
1696         .this_id                        = -1,
1697         .cmd_per_lun                    = SRP_CMD_SQ_SIZE,
1698         .use_clustering                 = ENABLE_CLUSTERING,
1699         .shost_attrs                    = srp_host_attrs
1700 };
1701
1702 static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
1703 {
1704         struct srp_rport_identifiers ids;
1705         struct srp_rport *rport;
1706
1707         sprintf(target->target_name, "SRP.T10:%016llX",
1708                  (unsigned long long) be64_to_cpu(target->id_ext));
1709
1710         if (scsi_add_host(target->scsi_host, host->srp_dev->dev->dma_device))
1711                 return -ENODEV;
1712
1713         memcpy(ids.port_id, &target->id_ext, 8);
1714         memcpy(ids.port_id + 8, &target->ioc_guid, 8);
1715         ids.roles = SRP_RPORT_ROLE_TARGET;
1716         rport = srp_rport_add(target->scsi_host, &ids);
1717         if (IS_ERR(rport)) {
1718                 scsi_remove_host(target->scsi_host);
1719                 return PTR_ERR(rport);
1720         }
1721
1722         spin_lock(&host->target_lock);
1723         list_add_tail(&target->list, &host->target_list);
1724         spin_unlock(&host->target_lock);
1725
1726         target->state = SRP_TARGET_LIVE;
1727
1728         scsi_scan_target(&target->scsi_host->shost_gendev,
1729                          0, target->scsi_id, SCAN_WILD_CARD, 0);
1730
1731         return 0;
1732 }
1733
1734 static void srp_release_dev(struct device *dev)
1735 {
1736         struct srp_host *host =
1737                 container_of(dev, struct srp_host, dev);
1738
1739         complete(&host->released);
1740 }
1741
1742 static struct class srp_class = {
1743         .name    = "infiniband_srp",
1744         .dev_release = srp_release_dev
1745 };
1746
1747 /*
1748  * Target ports are added by writing
1749  *
1750  *     id_ext=<SRP ID ext>,ioc_guid=<SRP IOC GUID>,dgid=<dest GID>,
1751  *     pkey=<P_Key>,service_id=<service ID>
1752  *
1753  * to the add_target sysfs attribute.
1754  */
1755 enum {
1756         SRP_OPT_ERR             = 0,
1757         SRP_OPT_ID_EXT          = 1 << 0,
1758         SRP_OPT_IOC_GUID        = 1 << 1,
1759         SRP_OPT_DGID            = 1 << 2,
1760         SRP_OPT_PKEY            = 1 << 3,
1761         SRP_OPT_SERVICE_ID      = 1 << 4,
1762         SRP_OPT_MAX_SECT        = 1 << 5,
1763         SRP_OPT_MAX_CMD_PER_LUN = 1 << 6,
1764         SRP_OPT_IO_CLASS        = 1 << 7,
1765         SRP_OPT_INITIATOR_EXT   = 1 << 8,
1766         SRP_OPT_CMD_SG_ENTRIES  = 1 << 9,
1767         SRP_OPT_ALL             = (SRP_OPT_ID_EXT       |
1768                                    SRP_OPT_IOC_GUID     |
1769                                    SRP_OPT_DGID         |
1770                                    SRP_OPT_PKEY         |
1771                                    SRP_OPT_SERVICE_ID),
1772 };
1773
1774 static const match_table_t srp_opt_tokens = {
1775         { SRP_OPT_ID_EXT,               "id_ext=%s"             },
1776         { SRP_OPT_IOC_GUID,             "ioc_guid=%s"           },
1777         { SRP_OPT_DGID,                 "dgid=%s"               },
1778         { SRP_OPT_PKEY,                 "pkey=%x"               },
1779         { SRP_OPT_SERVICE_ID,           "service_id=%s"         },
1780         { SRP_OPT_MAX_SECT,             "max_sect=%d"           },
1781         { SRP_OPT_MAX_CMD_PER_LUN,      "max_cmd_per_lun=%d"    },
1782         { SRP_OPT_IO_CLASS,             "io_class=%x"           },
1783         { SRP_OPT_INITIATOR_EXT,        "initiator_ext=%s"      },
1784         { SRP_OPT_CMD_SG_ENTRIES,       "cmd_sg_entries=%u"     },
1785         { SRP_OPT_ERR,                  NULL                    }
1786 };
1787
1788 static int srp_parse_options(const char *buf, struct srp_target_port *target)
1789 {
1790         char *options, *sep_opt;
1791         char *p;
1792         char dgid[3];
1793         substring_t args[MAX_OPT_ARGS];
1794         int opt_mask = 0;
1795         int token;
1796         int ret = -EINVAL;
1797         int i;
1798
1799         options = kstrdup(buf, GFP_KERNEL);
1800         if (!options)
1801                 return -ENOMEM;
1802
1803         sep_opt = options;
1804         while ((p = strsep(&sep_opt, ",")) != NULL) {
1805                 if (!*p)
1806                         continue;
1807
1808                 token = match_token(p, srp_opt_tokens, args);
1809                 opt_mask |= token;
1810
1811                 switch (token) {
1812                 case SRP_OPT_ID_EXT:
1813                         p = match_strdup(args);
1814                         if (!p) {
1815                                 ret = -ENOMEM;
1816                                 goto out;
1817                         }
1818                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
1819                         kfree(p);
1820                         break;
1821
1822                 case SRP_OPT_IOC_GUID:
1823                         p = match_strdup(args);
1824                         if (!p) {
1825                                 ret = -ENOMEM;
1826                                 goto out;
1827                         }
1828                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
1829                         kfree(p);
1830                         break;
1831
1832                 case SRP_OPT_DGID:
1833                         p = match_strdup(args);
1834                         if (!p) {
1835                                 ret = -ENOMEM;
1836                                 goto out;
1837                         }
1838                         if (strlen(p) != 32) {
1839                                 printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
1840                                 kfree(p);
1841                                 goto out;
1842                         }
1843
1844                         for (i = 0; i < 16; ++i) {
1845                                 strlcpy(dgid, p + i * 2, 3);
1846                                 target->path.dgid.raw[i] = simple_strtoul(dgid, NULL, 16);
1847                         }
1848                         kfree(p);
1849                         memcpy(target->orig_dgid, target->path.dgid.raw, 16);
1850                         break;
1851
1852                 case SRP_OPT_PKEY:
1853                         if (match_hex(args, &token)) {
1854                                 printk(KERN_WARNING PFX "bad P_Key parameter '%s'\n", p);
1855                                 goto out;
1856                         }
1857                         target->path.pkey = cpu_to_be16(token);
1858                         break;
1859
1860                 case SRP_OPT_SERVICE_ID:
1861                         p = match_strdup(args);
1862                         if (!p) {
1863                                 ret = -ENOMEM;
1864                                 goto out;
1865                         }
1866                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
1867                         target->path.service_id = target->service_id;
1868                         kfree(p);
1869                         break;
1870
1871                 case SRP_OPT_MAX_SECT:
1872                         if (match_int(args, &token)) {
1873                                 printk(KERN_WARNING PFX "bad max sect parameter '%s'\n", p);
1874                                 goto out;
1875                         }
1876                         target->scsi_host->max_sectors = token;
1877                         break;
1878
1879                 case SRP_OPT_MAX_CMD_PER_LUN:
1880                         if (match_int(args, &token)) {
1881                                 printk(KERN_WARNING PFX "bad max cmd_per_lun parameter '%s'\n", p);
1882                                 goto out;
1883                         }
1884                         target->scsi_host->cmd_per_lun = min(token, SRP_CMD_SQ_SIZE);
1885                         break;
1886
1887                 case SRP_OPT_IO_CLASS:
1888                         if (match_hex(args, &token)) {
1889                                 printk(KERN_WARNING PFX "bad  IO class parameter '%s' \n", p);
1890                                 goto out;
1891                         }
1892                         if (token != SRP_REV10_IB_IO_CLASS &&
1893                             token != SRP_REV16A_IB_IO_CLASS) {
1894                                 printk(KERN_WARNING PFX "unknown IO class parameter value"
1895                                        " %x specified (use %x or %x).\n",
1896                                        token, SRP_REV10_IB_IO_CLASS, SRP_REV16A_IB_IO_CLASS);
1897                                 goto out;
1898                         }
1899                         target->io_class = token;
1900                         break;
1901
1902                 case SRP_OPT_INITIATOR_EXT:
1903                         p = match_strdup(args);
1904                         if (!p) {
1905                                 ret = -ENOMEM;
1906                                 goto out;
1907                         }
1908                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
1909                         kfree(p);
1910                         break;
1911
1912                 case SRP_OPT_CMD_SG_ENTRIES:
1913                         if (match_int(args, &token) || token < 1 || token > 255) {
1914                                 printk(KERN_WARNING PFX "bad max cmd_sg_entries parameter '%s'\n", p);
1915                                 goto out;
1916                         }
1917                         target->cmd_sg_cnt = token;
1918                         break;
1919
1920                 default:
1921                         printk(KERN_WARNING PFX "unknown parameter or missing value "
1922                                "'%s' in target creation request\n", p);
1923                         goto out;
1924                 }
1925         }
1926
1927         if ((opt_mask & SRP_OPT_ALL) == SRP_OPT_ALL)
1928                 ret = 0;
1929         else
1930                 for (i = 0; i < ARRAY_SIZE(srp_opt_tokens); ++i)
1931                         if ((srp_opt_tokens[i].token & SRP_OPT_ALL) &&
1932                             !(srp_opt_tokens[i].token & opt_mask))
1933                                 printk(KERN_WARNING PFX "target creation request is "
1934                                        "missing parameter '%s'\n",
1935                                        srp_opt_tokens[i].pattern);
1936
1937 out:
1938         kfree(options);
1939         return ret;
1940 }
1941
1942 static ssize_t srp_create_target(struct device *dev,
1943                                  struct device_attribute *attr,
1944                                  const char *buf, size_t count)
1945 {
1946         struct srp_host *host =
1947                 container_of(dev, struct srp_host, dev);
1948         struct Scsi_Host *target_host;
1949         struct srp_target_port *target;
1950         int ret;
1951         int i;
1952
1953         target_host = scsi_host_alloc(&srp_template,
1954                                       sizeof (struct srp_target_port));
1955         if (!target_host)
1956                 return -ENOMEM;
1957
1958         target_host->transportt  = ib_srp_transport_template;
1959         target_host->max_lun     = SRP_MAX_LUN;
1960         target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
1961
1962         target = host_to_target(target_host);
1963
1964         target->io_class        = SRP_REV16A_IB_IO_CLASS;
1965         target->scsi_host       = target_host;
1966         target->srp_host        = host;
1967         target->lkey            = host->srp_dev->mr->lkey;
1968         target->rkey            = host->srp_dev->mr->rkey;
1969         target->cmd_sg_cnt      = cmd_sg_entries;
1970
1971         spin_lock_init(&target->lock);
1972         INIT_LIST_HEAD(&target->free_tx);
1973         INIT_LIST_HEAD(&target->free_reqs);
1974         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
1975                 target->req_ring[i].index = i;
1976                 list_add_tail(&target->req_ring[i].list, &target->free_reqs);
1977         }
1978
1979         ret = srp_parse_options(buf, target);
1980         if (ret)
1981                 goto err;
1982
1983         target_host->sg_tablesize = target->cmd_sg_cnt;
1984         target->max_iu_len = sizeof (struct srp_cmd) +
1985                              sizeof (struct srp_indirect_buf) +
1986                              target->cmd_sg_cnt * sizeof (struct srp_direct_buf);
1987
1988         ib_query_gid(host->srp_dev->dev, host->port, 0, &target->path.sgid);
1989
1990         shost_printk(KERN_DEBUG, target->scsi_host, PFX
1991                      "new target: id_ext %016llx ioc_guid %016llx pkey %04x "
1992                      "service_id %016llx dgid %pI6\n",
1993                (unsigned long long) be64_to_cpu(target->id_ext),
1994                (unsigned long long) be64_to_cpu(target->ioc_guid),
1995                be16_to_cpu(target->path.pkey),
1996                (unsigned long long) be64_to_cpu(target->service_id),
1997                target->path.dgid.raw);
1998
1999         ret = srp_create_target_ib(target);
2000         if (ret)
2001                 goto err;
2002
2003         ret = srp_new_cm_id(target);
2004         if (ret)
2005                 goto err_free;
2006
2007         target->qp_in_error = 0;
2008         ret = srp_connect_target(target);
2009         if (ret) {
2010                 shost_printk(KERN_ERR, target->scsi_host,
2011                              PFX "Connection failed\n");
2012                 goto err_cm_id;
2013         }
2014
2015         ret = srp_add_target(host, target);
2016         if (ret)
2017                 goto err_disconnect;
2018
2019         return count;
2020
2021 err_disconnect:
2022         srp_disconnect_target(target);
2023
2024 err_cm_id:
2025         ib_destroy_cm_id(target->cm_id);
2026
2027 err_free:
2028         srp_free_target_ib(target);
2029
2030 err:
2031         scsi_host_put(target_host);
2032
2033         return ret;
2034 }
2035
2036 static DEVICE_ATTR(add_target, S_IWUSR, NULL, srp_create_target);
2037
2038 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
2039                           char *buf)
2040 {
2041         struct srp_host *host = container_of(dev, struct srp_host, dev);
2042
2043         return sprintf(buf, "%s\n", host->srp_dev->dev->name);
2044 }
2045
2046 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
2047
2048 static ssize_t show_port(struct device *dev, struct device_attribute *attr,
2049                          char *buf)
2050 {
2051         struct srp_host *host = container_of(dev, struct srp_host, dev);
2052
2053         return sprintf(buf, "%d\n", host->port);
2054 }
2055
2056 static DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
2057
2058 static struct srp_host *srp_add_port(struct srp_device *device, u8 port)
2059 {
2060         struct srp_host *host;
2061
2062         host = kzalloc(sizeof *host, GFP_KERNEL);
2063         if (!host)
2064                 return NULL;
2065
2066         INIT_LIST_HEAD(&host->target_list);
2067         spin_lock_init(&host->target_lock);
2068         init_completion(&host->released);
2069         host->srp_dev = device;
2070         host->port = port;
2071
2072         host->dev.class = &srp_class;
2073         host->dev.parent = device->dev->dma_device;
2074         dev_set_name(&host->dev, "srp-%s-%d", device->dev->name, port);
2075
2076         if (device_register(&host->dev))
2077                 goto free_host;
2078         if (device_create_file(&host->dev, &dev_attr_add_target))
2079                 goto err_class;
2080         if (device_create_file(&host->dev, &dev_attr_ibdev))
2081                 goto err_class;
2082         if (device_create_file(&host->dev, &dev_attr_port))
2083                 goto err_class;
2084
2085         return host;
2086
2087 err_class:
2088         device_unregister(&host->dev);
2089
2090 free_host:
2091         kfree(host);
2092
2093         return NULL;
2094 }
2095
2096 static void srp_add_one(struct ib_device *device)
2097 {
2098         struct srp_device *srp_dev;
2099         struct ib_device_attr *dev_attr;
2100         struct ib_fmr_pool_param fmr_param;
2101         struct srp_host *host;
2102         int s, e, p;
2103
2104         dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
2105         if (!dev_attr)
2106                 return;
2107
2108         if (ib_query_device(device, dev_attr)) {
2109                 printk(KERN_WARNING PFX "Query device failed for %s\n",
2110                        device->name);
2111                 goto free_attr;
2112         }
2113
2114         srp_dev = kmalloc(sizeof *srp_dev, GFP_KERNEL);
2115         if (!srp_dev)
2116                 goto free_attr;
2117
2118         /*
2119          * Use the smallest page size supported by the HCA, down to a
2120          * minimum of 512 bytes (which is the smallest sector that a
2121          * SCSI command will ever carry).
2122          */
2123         srp_dev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1);
2124         srp_dev->fmr_page_size  = 1 << srp_dev->fmr_page_shift;
2125         srp_dev->fmr_page_mask  = ~((u64) srp_dev->fmr_page_size - 1);
2126
2127         INIT_LIST_HEAD(&srp_dev->dev_list);
2128
2129         srp_dev->dev = device;
2130         srp_dev->pd  = ib_alloc_pd(device);
2131         if (IS_ERR(srp_dev->pd))
2132                 goto free_dev;
2133
2134         srp_dev->mr = ib_get_dma_mr(srp_dev->pd,
2135                                     IB_ACCESS_LOCAL_WRITE |
2136                                     IB_ACCESS_REMOTE_READ |
2137                                     IB_ACCESS_REMOTE_WRITE);
2138         if (IS_ERR(srp_dev->mr))
2139                 goto err_pd;
2140
2141         memset(&fmr_param, 0, sizeof fmr_param);
2142         fmr_param.pool_size         = SRP_FMR_POOL_SIZE;
2143         fmr_param.dirty_watermark   = SRP_FMR_DIRTY_SIZE;
2144         fmr_param.cache             = 1;
2145         fmr_param.max_pages_per_fmr = SRP_FMR_SIZE;
2146         fmr_param.page_shift        = srp_dev->fmr_page_shift;
2147         fmr_param.access            = (IB_ACCESS_LOCAL_WRITE |
2148                                        IB_ACCESS_REMOTE_WRITE |
2149                                        IB_ACCESS_REMOTE_READ);
2150
2151         srp_dev->fmr_pool = ib_create_fmr_pool(srp_dev->pd, &fmr_param);
2152         if (IS_ERR(srp_dev->fmr_pool))
2153                 srp_dev->fmr_pool = NULL;
2154
2155         if (device->node_type == RDMA_NODE_IB_SWITCH) {
2156                 s = 0;
2157                 e = 0;
2158         } else {
2159                 s = 1;
2160                 e = device->phys_port_cnt;
2161         }
2162
2163         for (p = s; p <= e; ++p) {
2164                 host = srp_add_port(srp_dev, p);
2165                 if (host)
2166                         list_add_tail(&host->list, &srp_dev->dev_list);
2167         }
2168
2169         ib_set_client_data(device, &srp_client, srp_dev);
2170
2171         goto free_attr;
2172
2173 err_pd:
2174         ib_dealloc_pd(srp_dev->pd);
2175
2176 free_dev:
2177         kfree(srp_dev);
2178
2179 free_attr:
2180         kfree(dev_attr);
2181 }
2182
2183 static void srp_remove_one(struct ib_device *device)
2184 {
2185         struct srp_device *srp_dev;
2186         struct srp_host *host, *tmp_host;
2187         LIST_HEAD(target_list);
2188         struct srp_target_port *target, *tmp_target;
2189
2190         srp_dev = ib_get_client_data(device, &srp_client);
2191
2192         list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
2193                 device_unregister(&host->dev);
2194                 /*
2195                  * Wait for the sysfs entry to go away, so that no new
2196                  * target ports can be created.
2197                  */
2198                 wait_for_completion(&host->released);
2199
2200                 /*
2201                  * Mark all target ports as removed, so we stop queueing
2202                  * commands and don't try to reconnect.
2203                  */
2204                 spin_lock(&host->target_lock);
2205                 list_for_each_entry(target, &host->target_list, list) {
2206                         spin_lock_irq(&target->lock);
2207                         target->state = SRP_TARGET_REMOVED;
2208                         spin_unlock_irq(&target->lock);
2209                 }
2210                 spin_unlock(&host->target_lock);
2211
2212                 /*
2213                  * Wait for any reconnection tasks that may have
2214                  * started before we marked our target ports as
2215                  * removed, and any target port removal tasks.
2216                  */
2217                 flush_workqueue(ib_wq);
2218
2219                 list_for_each_entry_safe(target, tmp_target,
2220                                          &host->target_list, list) {
2221                         srp_remove_host(target->scsi_host);
2222                         scsi_remove_host(target->scsi_host);
2223                         srp_disconnect_target(target);
2224                         ib_destroy_cm_id(target->cm_id);
2225                         srp_free_target_ib(target);
2226                         scsi_host_put(target->scsi_host);
2227                 }
2228
2229                 kfree(host);
2230         }
2231
2232         if (srp_dev->fmr_pool)
2233                 ib_destroy_fmr_pool(srp_dev->fmr_pool);
2234         ib_dereg_mr(srp_dev->mr);
2235         ib_dealloc_pd(srp_dev->pd);
2236
2237         kfree(srp_dev);
2238 }
2239
2240 static struct srp_function_template ib_srp_transport_functions = {
2241 };
2242
2243 static int __init srp_init_module(void)
2244 {
2245         int ret;
2246
2247         BUILD_BUG_ON(FIELD_SIZEOF(struct ib_wc, wr_id) < sizeof(void *));
2248
2249         if (srp_sg_tablesize) {
2250                 printk(KERN_WARNING PFX "srp_sg_tablesize is deprecated, please use cmd_sg_entries\n");
2251                 if (!cmd_sg_entries)
2252                         cmd_sg_entries = srp_sg_tablesize;
2253         }
2254
2255         if (!cmd_sg_entries)
2256                 cmd_sg_entries = SRP_DEF_SG_TABLESIZE;
2257
2258         if (cmd_sg_entries > 255) {
2259                 printk(KERN_WARNING PFX "Clamping cmd_sg_entries to 255\n");
2260                 cmd_sg_entries = 255;
2261         }
2262
2263         ib_srp_transport_template =
2264                 srp_attach_transport(&ib_srp_transport_functions);
2265         if (!ib_srp_transport_template)
2266                 return -ENOMEM;
2267
2268         ret = class_register(&srp_class);
2269         if (ret) {
2270                 printk(KERN_ERR PFX "couldn't register class infiniband_srp\n");
2271                 srp_release_transport(ib_srp_transport_template);
2272                 return ret;
2273         }
2274
2275         ib_sa_register_client(&srp_sa_client);
2276
2277         ret = ib_register_client(&srp_client);
2278         if (ret) {
2279                 printk(KERN_ERR PFX "couldn't register IB client\n");
2280                 srp_release_transport(ib_srp_transport_template);
2281                 ib_sa_unregister_client(&srp_sa_client);
2282                 class_unregister(&srp_class);
2283                 return ret;
2284         }
2285
2286         return 0;
2287 }
2288
2289 static void __exit srp_cleanup_module(void)
2290 {
2291         ib_unregister_client(&srp_client);
2292         ib_sa_unregister_client(&srp_sa_client);
2293         class_unregister(&srp_class);
2294         srp_release_transport(ib_srp_transport_template);
2295 }
2296
2297 module_init(srp_init_module);
2298 module_exit(srp_cleanup_module);