drivers/infiniband/ulp/srp/ib_srp.c

   1 /*
   2  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #include <linux/module.h>
  34 #include <linux/init.h>
  35 #include <linux/slab.h>
  36 #include <linux/err.h>
  37 #include <linux/string.h>
  38 #include <linux/parser.h>
  39 #include <linux/random.h>
  40 #include <linux/jiffies.h>
  41
  42 #include <linux/atomic.h>
  43
  44 #include <scsi/scsi.h>
  45 #include <scsi/scsi_device.h>
  46 #include <scsi/scsi_dbg.h>
  47 #include <scsi/srp.h>
  48 #include <scsi/scsi_transport_srp.h>
  49
  50 #include "ib_srp.h"
  51
  52 #define DRV_NAME        "ib_srp"
  53 #define PFX             DRV_NAME ": "
  54 #define DRV_VERSION     "0.2"
  55 #define DRV_RELDATE     "November 1, 2005"
  56
  57 MODULE_AUTHOR("Roland Dreier");
  58 MODULE_DESCRIPTION("InfiniBand SCSI RDMA Protocol initiator "
  59                    "v" DRV_VERSION " (" DRV_RELDATE ")");
  60 MODULE_LICENSE("Dual BSD/GPL");
  61
  62 static unsigned int srp_sg_tablesize;
  63 static unsigned int cmd_sg_entries;
  64 static unsigned int indirect_sg_entries;
  65 static bool allow_ext_sg;
  66 static int topspin_workarounds = 1;
  67
  68 module_param(srp_sg_tablesize, uint, 0444);
  69 MODULE_PARM_DESC(srp_sg_tablesize, "Deprecated name for cmd_sg_entries");
  70
  71 module_param(cmd_sg_entries, uint, 0444);
  72 MODULE_PARM_DESC(cmd_sg_entries,
  73                  "Default number of gather/scatter entries in the SRP command (default is 12, max 255)");
  74
  75 module_param(indirect_sg_entries, uint, 0444);
  76 MODULE_PARM_DESC(indirect_sg_entries,
  77                  "Default max number of gather/scatter entries (default is 12, max is " __stringify(SCSI_MAX_SG_CHAIN_SEGMENTS) ")");
  78
  79 module_param(allow_ext_sg, bool, 0444);
  80 MODULE_PARM_DESC(allow_ext_sg,
  81                   "Default behavior when there are more than cmd_sg_entries S/G entries after mapping; fails the request when false (default false)");
  82
  83 module_param(topspin_workarounds, int, 0444);
  84 MODULE_PARM_DESC(topspin_workarounds,
  85                  "Enable workarounds for Topspin/Cisco SRP target bugs if != 0");
  86
  87 static void srp_add_one(struct ib_device *device);
  88 static void srp_remove_one(struct ib_device *device);
  89 static void srp_recv_completion(struct ib_cq *cq, void *target_ptr);
  90 static void srp_send_completion(struct ib_cq *cq, void *target_ptr);
  91 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
  92
  93 static struct scsi_transport_template *ib_srp_transport_template;
  94
  95 static struct ib_client srp_client = {
  96         .name   = "srp",
  97         .add    = srp_add_one,
  98         .remove = srp_remove_one
  99 };
 100
 101 static struct ib_sa_client srp_sa_client;
 102
 103 static inline struct srp_target_port *host_to_target(struct Scsi_Host *host)
 104 {
 105         return (struct srp_target_port *) host->hostdata;
 106 }
 107
 108 static const char *srp_target_info(struct Scsi_Host *host)
 109 {
 110         return host_to_target(host)->target_name;
 111 }
 112
 113 static int srp_target_is_topspin(struct srp_target_port *target)
 114 {
 115         static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 116         static const u8 cisco_oui[3]   = { 0x00, 0x1b, 0x0d };
 117
 118         return topspin_workarounds &&
 119                 (!memcmp(&target->ioc_guid, topspin_oui, sizeof topspin_oui) ||
 120                  !memcmp(&target->ioc_guid, cisco_oui, sizeof cisco_oui));
 121 }
 122
 123 static struct srp_iu *srp_alloc_iu(struct srp_host *host, size_t size,
 124                                    gfp_t gfp_mask,
 125                                    enum dma_data_direction direction)
 126 {
 127         struct srp_iu *iu;
 128
 129         iu = kmalloc(sizeof *iu, gfp_mask);
 130         if (!iu)
 131                 goto out;
 132
 133         iu->buf = kzalloc(size, gfp_mask);
 134         if (!iu->buf)
 135                 goto out_free_iu;
 136
 137         iu->dma = ib_dma_map_single(host->srp_dev->dev, iu->buf, size,
 138                                     direction);
 139         if (ib_dma_mapping_error(host->srp_dev->dev, iu->dma))
 140                 goto out_free_buf;
 141
 142         iu->size      = size;
 143         iu->direction = direction;
 144
 145         return iu;
 146
 147 out_free_buf:
 148         kfree(iu->buf);
 149 out_free_iu:
 150         kfree(iu);
 151 out:
 152         return NULL;
 153 }
 154
 155 static void srp_free_iu(struct srp_host *host, struct srp_iu *iu)
 156 {
 157         if (!iu)
 158                 return;
 159
 160         ib_dma_unmap_single(host->srp_dev->dev, iu->dma, iu->size,
 161                             iu->direction);
 162         kfree(iu->buf);
 163         kfree(iu);
 164 }
 165
 166 static void srp_qp_event(struct ib_event *event, void *context)
 167 {
 168         printk(KERN_ERR PFX "QP event %d\n", event->event);
 169 }
 170
 171 static int srp_init_qp(struct srp_target_port *target,
 172                        struct ib_qp *qp)
 173 {
 174         struct ib_qp_attr *attr;
 175         int ret;
 176
 177         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 178         if (!attr)
 179                 return -ENOMEM;
 180
 181         ret = ib_find_pkey(target->srp_host->srp_dev->dev,
 182                            target->srp_host->port,
 183                            be16_to_cpu(target->path.pkey),
 184                            &attr->pkey_index);
 185         if (ret)
 186                 goto out;
 187
 188         attr->qp_state        = IB_QPS_INIT;
 189         attr->qp_access_flags = (IB_ACCESS_REMOTE_READ |
 190                                     IB_ACCESS_REMOTE_WRITE);
 191         attr->port_num        = target->srp_host->port;
 192
 193         ret = ib_modify_qp(qp, attr,
 194                            IB_QP_STATE          |
 195                            IB_QP_PKEY_INDEX     |
 196                            IB_QP_ACCESS_FLAGS   |
 197                            IB_QP_PORT);
 198
 199 out:
 200         kfree(attr);
 201         return ret;
 202 }
 203
 204 static int srp_new_cm_id(struct srp_target_port *target)
 205 {
 206         struct ib_cm_id *new_cm_id;
 207
 208         new_cm_id = ib_create_cm_id(target->srp_host->srp_dev->dev,
 209                                     srp_cm_handler, target);
 210         if (IS_ERR(new_cm_id))
 211                 return PTR_ERR(new_cm_id);
 212
 213         if (target->cm_id)
 214                 ib_destroy_cm_id(target->cm_id);
 215         target->cm_id = new_cm_id;
 216
 217         return 0;
 218 }
 219
 220 static int srp_create_target_ib(struct srp_target_port *target)
 221 {
 222         struct ib_qp_init_attr *init_attr;
 223         int ret;
 224
 225         init_attr = kzalloc(sizeof *init_attr, GFP_KERNEL);
 226         if (!init_attr)
 227                 return -ENOMEM;
 228
 229         target->recv_cq = ib_create_cq(target->srp_host->srp_dev->dev,
 230                                        srp_recv_completion, NULL, target, SRP_RQ_SIZE, 0);
 231         if (IS_ERR(target->recv_cq)) {
 232                 ret = PTR_ERR(target->recv_cq);
 233                 goto err;
 234         }
 235
 236         target->send_cq = ib_create_cq(target->srp_host->srp_dev->dev,
 237                                        srp_send_completion, NULL, target, SRP_SQ_SIZE, 0);
 238         if (IS_ERR(target->send_cq)) {
 239                 ret = PTR_ERR(target->send_cq);
 240                 goto err_recv_cq;
 241         }
 242
 243         ib_req_notify_cq(target->recv_cq, IB_CQ_NEXT_COMP);
 244
 245         init_attr->event_handler       = srp_qp_event;
 246         init_attr->cap.max_send_wr     = SRP_SQ_SIZE;
 247         init_attr->cap.max_recv_wr     = SRP_RQ_SIZE;
 248         init_attr->cap.max_recv_sge    = 1;
 249         init_attr->cap.max_send_sge    = 1;
 250         init_attr->sq_sig_type         = IB_SIGNAL_ALL_WR;
 251         init_attr->qp_type             = IB_QPT_RC;
 252         init_attr->send_cq             = target->send_cq;
 253         init_attr->recv_cq             = target->recv_cq;
 254
 255         target->qp = ib_create_qp(target->srp_host->srp_dev->pd, init_attr);
 256         if (IS_ERR(target->qp)) {
 257                 ret = PTR_ERR(target->qp);
 258                 goto err_send_cq;
 259         }
 260
 261         ret = srp_init_qp(target, target->qp);
 262         if (ret)
 263                 goto err_qp;
 264
 265         kfree(init_attr);
 266         return 0;
 267
 268 err_qp:
 269         ib_destroy_qp(target->qp);
 270
 271 err_send_cq:
 272         ib_destroy_cq(target->send_cq);
 273
 274 err_recv_cq:
 275         ib_destroy_cq(target->recv_cq);
 276
 277 err:
 278         kfree(init_attr);
 279         return ret;
 280 }
 281
 282 static void srp_free_target_ib(struct srp_target_port *target)
 283 {
 284         int i;
 285
 286         ib_destroy_qp(target->qp);
 287         ib_destroy_cq(target->send_cq);
 288         ib_destroy_cq(target->recv_cq);
 289
 290         for (i = 0; i < SRP_RQ_SIZE; ++i)
 291                 srp_free_iu(target->srp_host, target->rx_ring[i]);
 292         for (i = 0; i < SRP_SQ_SIZE; ++i)
 293                 srp_free_iu(target->srp_host, target->tx_ring[i]);
 294 }
 295
 296 static void srp_path_rec_completion(int status,
 297                                     struct ib_sa_path_rec *pathrec,
 298                                     void *target_ptr)
 299 {
 300         struct srp_target_port *target = target_ptr;
 301
 302         target->status = status;
 303         if (status)
 304                 shost_printk(KERN_ERR, target->scsi_host,
 305                              PFX "Got failed path rec status %d\n", status);
 306         else
 307                 target->path = *pathrec;
 308         complete(&target->done);
 309 }
 310
 311 static int srp_lookup_path(struct srp_target_port *target)
 312 {
 313         target->path.numb_path = 1;
 314
 315         init_completion(&target->done);
 316
 317         target->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
 318                                                    target->srp_host->srp_dev->dev,
 319                                                    target->srp_host->port,
 320                                                    &target->path,
 321                                                    IB_SA_PATH_REC_SERVICE_ID    |
 322                                                    IB_SA_PATH_REC_DGID          |
 323                                                    IB_SA_PATH_REC_SGID          |
 324                                                    IB_SA_PATH_REC_NUMB_PATH     |
 325                                                    IB_SA_PATH_REC_PKEY,
 326                                                    SRP_PATH_REC_TIMEOUT_MS,
 327                                                    GFP_KERNEL,
 328                                                    srp_path_rec_completion,
 329                                                    target, &target->path_query);
 330         if (target->path_query_id < 0)
 331                 return target->path_query_id;
 332
 333         wait_for_completion(&target->done);
 334
 335         if (target->status < 0)
 336                 shost_printk(KERN_WARNING, target->scsi_host,
 337                              PFX "Path record query failed\n");
 338
 339         return target->status;
 340 }
 341
 342 static int srp_send_req(struct srp_target_port *target)
 343 {
 344         struct {
 345                 struct ib_cm_req_param param;
 346                 struct srp_login_req   priv;
 347         } *req = NULL;
 348         int status;
 349
 350         req = kzalloc(sizeof *req, GFP_KERNEL);
 351         if (!req)
 352                 return -ENOMEM;
 353
 354         req->param.primary_path               = &target->path;
 355         req->param.alternate_path             = NULL;
 356         req->param.service_id                 = target->service_id;
 357         req->param.qp_num                     = target->qp->qp_num;
 358         req->param.qp_type                    = target->qp->qp_type;
 359         req->param.private_data               = &req->priv;
 360         req->param.private_data_len           = sizeof req->priv;
 361         req->param.flow_control               = 1;
 362
 363         get_random_bytes(&req->param.starting_psn, 4);
 364         req->param.starting_psn              &= 0xffffff;
 365
 366         /*
 367          * Pick some arbitrary defaults here; we could make these
 368          * module parameters if anyone cared about setting them.
 369          */
 370         req->param.responder_resources        = 4;
 371         req->param.remote_cm_response_timeout = 20;
 372         req->param.local_cm_response_timeout  = 20;
 373         req->param.retry_count                = 7;
 374         req->param.rnr_retry_count            = 7;
 375         req->param.max_cm_retries             = 15;
 376
 377         req->priv.opcode        = SRP_LOGIN_REQ;
 378         req->priv.tag           = 0;
 379         req->priv.req_it_iu_len = cpu_to_be32(target->max_iu_len);
 380         req->priv.req_buf_fmt   = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
 381                                               SRP_BUF_FORMAT_INDIRECT);
 382         /*
 383          * In the published SRP specification (draft rev. 16a), the
 384          * port identifier format is 8 bytes of ID extension followed
 385          * by 8 bytes of GUID.  Older drafts put the two halves in the
 386          * opposite order, so that the GUID comes first.
 387          *
 388          * Targets conforming to these obsolete drafts can be
 389          * recognized by the I/O Class they report.
 390          */
 391         if (target->io_class == SRP_REV10_IB_IO_CLASS) {
 392                 memcpy(req->priv.initiator_port_id,
 393                        &target->path.sgid.global.interface_id, 8);
 394                 memcpy(req->priv.initiator_port_id + 8,
 395                        &target->initiator_ext, 8);
 396                 memcpy(req->priv.target_port_id,     &target->ioc_guid, 8);
 397                 memcpy(req->priv.target_port_id + 8, &target->id_ext, 8);
 398         } else {
 399                 memcpy(req->priv.initiator_port_id,
 400                        &target->initiator_ext, 8);
 401                 memcpy(req->priv.initiator_port_id + 8,
 402                        &target->path.sgid.global.interface_id, 8);
 403                 memcpy(req->priv.target_port_id,     &target->id_ext, 8);
 404                 memcpy(req->priv.target_port_id + 8, &target->ioc_guid, 8);
 405         }
 406
 407         /*
 408          * Topspin/Cisco SRP targets will reject our login unless we
 409          * zero out the first 8 bytes of our initiator port ID and set
 410          * the second 8 bytes to the local node GUID.
 411          */
 412         if (srp_target_is_topspin(target)) {
 413                 shost_printk(KERN_DEBUG, target->scsi_host,
 414                              PFX "Topspin/Cisco initiator port ID workaround "
 415                              "activated for target GUID %016llx\n",
 416                              (unsigned long long) be64_to_cpu(target->ioc_guid));
 417                 memset(req->priv.initiator_port_id, 0, 8);
 418                 memcpy(req->priv.initiator_port_id + 8,
 419                        &target->srp_host->srp_dev->dev->node_guid, 8);
 420         }
 421
 422         status = ib_send_cm_req(target->cm_id, &req->param);
 423
 424         kfree(req);
 425
 426         return status;
 427 }
 428
 429 static void srp_disconnect_target(struct srp_target_port *target)
 430 {
 431         /* XXX should send SRP_I_LOGOUT request */
 432
 433         init_completion(&target->done);
 434         if (ib_send_cm_dreq(target->cm_id, NULL, 0)) {
 435                 shost_printk(KERN_DEBUG, target->scsi_host,
 436                              PFX "Sending CM DREQ failed\n");
 437                 return;
 438         }
 439         wait_for_completion(&target->done);
 440 }
 441
 442 static bool srp_change_state(struct srp_target_port *target,
 443                             enum srp_target_state old,
 444                             enum srp_target_state new)
 445 {
 446         bool changed = false;
 447
 448         spin_lock_irq(&target->lock);
 449         if (target->state == old) {
 450                 target->state = new;
 451                 changed = true;
 452         }
 453         spin_unlock_irq(&target->lock);
 454         return changed;
 455 }
 456
 457 static void srp_free_req_data(struct srp_target_port *target)
 458 {
 459         struct ib_device *ibdev = target->srp_host->srp_dev->dev;
 460         struct srp_request *req;
 461         int i;
 462
 463         for (i = 0, req = target->req_ring; i < SRP_CMD_SQ_SIZE; ++i, ++req) {
 464                 kfree(req->fmr_list);
 465                 kfree(req->map_page);
 466                 if (req->indirect_dma_addr) {
 467                         ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
 468                                             target->indirect_size,
 469                                             DMA_TO_DEVICE);
 470                 }
 471                 kfree(req->indirect_desc);
 472         }
 473 }
 474
 475 static void srp_remove_work(struct work_struct *work)
 476 {
 477         struct srp_target_port *target =
 478                 container_of(work, struct srp_target_port, work);
 479
 480         if (!srp_change_state(target, SRP_TARGET_DEAD, SRP_TARGET_REMOVED))
 481                 return;
 482
 483         spin_lock(&target->srp_host->target_lock);
 484         list_del(&target->list);
 485         spin_unlock(&target->srp_host->target_lock);
 486
 487         srp_remove_host(target->scsi_host);
 488         scsi_remove_host(target->scsi_host);
 489         ib_destroy_cm_id(target->cm_id);
 490         srp_free_target_ib(target);
 491         srp_free_req_data(target);
 492         scsi_host_put(target->scsi_host);
 493 }
 494
 495 static int srp_connect_target(struct srp_target_port *target)
 496 {
 497         int retries = 3;
 498         int ret;
 499
 500         ret = srp_lookup_path(target);
 501         if (ret)
 502                 return ret;
 503
 504         while (1) {
 505                 init_completion(&target->done);
 506                 ret = srp_send_req(target);
 507                 if (ret)
 508                         return ret;
 509                 wait_for_completion(&target->done);
 510
 511                 /*
 512                  * The CM event handling code will set status to
 513                  * SRP_PORT_REDIRECT if we get a port redirect REJ
 514                  * back, or SRP_DLID_REDIRECT if we get a lid/qp
 515                  * redirect REJ back.
 516                  */
 517                 switch (target->status) {
 518                 case 0:
 519                         return 0;
 520
 521                 case SRP_PORT_REDIRECT:
 522                         ret = srp_lookup_path(target);
 523                         if (ret)
 524                                 return ret;
 525                         break;
 526
 527                 case SRP_DLID_REDIRECT:
 528                         break;
 529
 530                 case SRP_STALE_CONN:
 531                         /* Our current CM id was stale, and is now in timewait.
 532                          * Try to reconnect with a new one.
 533                          */
 534                         if (!retries-- || srp_new_cm_id(target)) {
 535                                 shost_printk(KERN_ERR, target->scsi_host, PFX
 536                                              "giving up on stale connection\n");
 537                                 target->status = -ECONNRESET;
 538                                 return target->status;
 539                         }
 540
 541                         shost_printk(KERN_ERR, target->scsi_host, PFX
 542                                      "retrying stale connection\n");
 543                         break;
 544
 545                 default:
 546                         return target->status;
 547                 }
 548         }
 549 }
 550
 551 static void srp_unmap_data(struct scsi_cmnd *scmnd,
 552                            struct srp_target_port *target,
 553                            struct srp_request *req)
 554 {
 555         struct ib_device *ibdev = target->srp_host->srp_dev->dev;
 556         struct ib_pool_fmr **pfmr;
 557
 558         if (!scsi_sglist(scmnd) ||
 559             (scmnd->sc_data_direction != DMA_TO_DEVICE &&
 560              scmnd->sc_data_direction != DMA_FROM_DEVICE))
 561                 return;
 562
 563         pfmr = req->fmr_list;
 564         while (req->nfmr--)
 565                 ib_fmr_pool_unmap(*pfmr++);
 566
 567         ib_dma_unmap_sg(ibdev, scsi_sglist(scmnd), scsi_sg_count(scmnd),
 568                         scmnd->sc_data_direction);
 569 }
 570
 571 /**
 572  * srp_claim_req - Take ownership of the scmnd associated with a request.
 573  * @target: SRP target port.
 574  * @req: SRP request.
 575  * @scmnd: If NULL, take ownership of @req->scmnd. If not NULL, only take
 576  *         ownership of @req->scmnd if it equals @scmnd.
 577  *
 578  * Return value:
 579  * Either NULL or a pointer to the SCSI command the caller became owner of.
 580  */
 581 static struct scsi_cmnd *srp_claim_req(struct srp_target_port *target,
 582                                        struct srp_request *req,
 583                                        struct scsi_cmnd *scmnd)
 584 {
 585         unsigned long flags;
 586
 587         spin_lock_irqsave(&target->lock, flags);
 588         if (!scmnd) {
 589                 scmnd = req->scmnd;
 590                 req->scmnd = NULL;
 591         } else if (req->scmnd == scmnd) {
 592                 req->scmnd = NULL;
 593         } else {
 594                 scmnd = NULL;
 595         }
 596         spin_unlock_irqrestore(&target->lock, flags);
 597
 598         return scmnd;
 599 }
 600
 601 /**
 602  * srp_free_req() - Unmap data and add request to the free request list.
 603  */
 604 static void srp_free_req(struct srp_target_port *target,
 605                          struct srp_request *req, struct scsi_cmnd *scmnd,
 606                          s32 req_lim_delta)
 607 {
 608         unsigned long flags;
 609
 610         srp_unmap_data(scmnd, target, req);
 611
 612         spin_lock_irqsave(&target->lock, flags);
 613         target->req_lim += req_lim_delta;
 614         list_add_tail(&req->list, &target->free_reqs);
 615         spin_unlock_irqrestore(&target->lock, flags);
 616 }
 617
 618 static void srp_reset_req(struct srp_target_port *target, struct srp_request *req)
 619 {
 620         struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
 621
 622         if (scmnd) {
 623                 srp_free_req(target, req, scmnd, 0);
 624                 scmnd->result = DID_RESET << 16;
 625                 scmnd->scsi_done(scmnd);
 626         }
 627 }
 628
 629 static int srp_reconnect_target(struct srp_target_port *target)
 630 {
 631         struct ib_qp_attr qp_attr;
 632         struct ib_wc wc;
 633         int i, ret;
 634
 635         if (!srp_change_state(target, SRP_TARGET_LIVE, SRP_TARGET_CONNECTING))
 636                 return -EAGAIN;
 637
 638         srp_disconnect_target(target);
 639         /*
 640          * Now get a new local CM ID so that we avoid confusing the
 641          * target in case things are really fouled up.
 642          */
 643         ret = srp_new_cm_id(target);
 644         if (ret)
 645                 goto err;
 646
 647         qp_attr.qp_state = IB_QPS_RESET;
 648         ret = ib_modify_qp(target->qp, &qp_attr, IB_QP_STATE);
 649         if (ret)
 650                 goto err;
 651
 652         ret = srp_init_qp(target, target->qp);
 653         if (ret)
 654                 goto err;
 655
 656         while (ib_poll_cq(target->recv_cq, 1, &wc) > 0)
 657                 ; /* nothing */
 658         while (ib_poll_cq(target->send_cq, 1, &wc) > 0)
 659                 ; /* nothing */
 660
 661         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
 662                 struct srp_request *req = &target->req_ring[i];
 663                 if (req->scmnd)
 664                         srp_reset_req(target, req);
 665         }
 666
 667         INIT_LIST_HEAD(&target->free_tx);
 668         for (i = 0; i < SRP_SQ_SIZE; ++i)
 669                 list_add(&target->tx_ring[i]->list, &target->free_tx);
 670
 671         target->qp_in_error = 0;
 672         ret = srp_connect_target(target);
 673         if (ret)
 674                 goto err;
 675
 676         if (!srp_change_state(target, SRP_TARGET_CONNECTING, SRP_TARGET_LIVE))
 677                 ret = -EAGAIN;
 678
 679         return ret;
 680
 681 err:
 682         shost_printk(KERN_ERR, target->scsi_host,
 683                      PFX "reconnect failed (%d), removing target port.\n", ret);
 684
 685         /*
 686          * We couldn't reconnect, so kill our target port off.
 687          * However, we have to defer the real removal because we
 688          * are in the context of the SCSI error handler now, which
 689          * will deadlock if we call scsi_remove_host().
 690          *
 691          * Schedule our work inside the lock to avoid a race with
 692          * the flush_scheduled_work() in srp_remove_one().
 693          */
 694         spin_lock_irq(&target->lock);
 695         if (target->state == SRP_TARGET_CONNECTING) {
 696                 target->state = SRP_TARGET_DEAD;
 697                 INIT_WORK(&target->work, srp_remove_work);
 698                 queue_work(ib_wq, &target->work);
 699         }
 700         spin_unlock_irq(&target->lock);
 701
 702         return ret;
 703 }
 704
 705 static void srp_map_desc(struct srp_map_state *state, dma_addr_t dma_addr,
 706                          unsigned int dma_len, u32 rkey)
 707 {
 708         struct srp_direct_buf *desc = state->desc;
 709
 710         desc->va = cpu_to_be64(dma_addr);
 711         desc->key = cpu_to_be32(rkey);
 712         desc->len = cpu_to_be32(dma_len);
 713
 714         state->total_len += dma_len;
 715         state->desc++;
 716         state->ndesc++;
 717 }
 718
 719 static int srp_map_finish_fmr(struct srp_map_state *state,
 720                               struct srp_target_port *target)
 721 {
 722         struct srp_device *dev = target->srp_host->srp_dev;
 723         struct ib_pool_fmr *fmr;
 724         u64 io_addr = 0;
 725
 726         if (!state->npages)
 727                 return 0;
 728
 729         if (state->npages == 1) {
 730                 srp_map_desc(state, state->base_dma_addr, state->fmr_len,
 731                              target->rkey);
 732                 state->npages = state->fmr_len = 0;
 733                 return 0;
 734         }
 735
 736         fmr = ib_fmr_pool_map_phys(dev->fmr_pool, state->pages,
 737                                    state->npages, io_addr);
 738         if (IS_ERR(fmr))
 739                 return PTR_ERR(fmr);
 740
 741         *state->next_fmr++ = fmr;
 742         state->nfmr++;
 743
 744         srp_map_desc(state, 0, state->fmr_len, fmr->fmr->rkey);
 745         state->npages = state->fmr_len = 0;
 746         return 0;
 747 }
 748
 749 static void srp_map_update_start(struct srp_map_state *state,
 750                                  struct scatterlist *sg, int sg_index,
 751                                  dma_addr_t dma_addr)
 752 {
 753         state->unmapped_sg = sg;
 754         state->unmapped_index = sg_index;
 755         state->unmapped_addr = dma_addr;
 756 }
 757
 758 static int srp_map_sg_entry(struct srp_map_state *state,
 759                             struct srp_target_port *target,
 760                             struct scatterlist *sg, int sg_index,
 761                             int use_fmr)
 762 {
 763         struct srp_device *dev = target->srp_host->srp_dev;
 764         struct ib_device *ibdev = dev->dev;
 765         dma_addr_t dma_addr = ib_sg_dma_address(ibdev, sg);
 766         unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
 767         unsigned int len;
 768         int ret;
 769
 770         if (!dma_len)
 771                 return 0;
 772
 773         if (use_fmr == SRP_MAP_NO_FMR) {
 774                 /* Once we're in direct map mode for a request, we don't
 775                  * go back to FMR mode, so no need to update anything
 776                  * other than the descriptor.
 777                  */
 778                 srp_map_desc(state, dma_addr, dma_len, target->rkey);
 779                 return 0;
 780         }
 781
 782         /* If we start at an offset into the FMR page, don't merge into
 783          * the current FMR. Finish it out, and use the kernel's MR for this
 784          * sg entry. This is to avoid potential bugs on some SRP targets
 785          * that were never quite defined, but went away when the initiator
 786          * avoided using FMR on such page fragments.
 787          */
 788         if (dma_addr & ~dev->fmr_page_mask || dma_len > dev->fmr_max_size) {
 789                 ret = srp_map_finish_fmr(state, target);
 790                 if (ret)
 791                         return ret;
 792
 793                 srp_map_desc(state, dma_addr, dma_len, target->rkey);
 794                 srp_map_update_start(state, NULL, 0, 0);
 795                 return 0;
 796         }
 797
 798         /* If this is the first sg to go into the FMR, save our position.
 799          * We need to know the first unmapped entry, its index, and the
 800          * first unmapped address within that entry to be able to restart
 801          * mapping after an error.
 802          */
 803         if (!state->unmapped_sg)
 804                 srp_map_update_start(state, sg, sg_index, dma_addr);
 805
 806         while (dma_len) {
 807                 if (state->npages == SRP_FMR_SIZE) {
 808                         ret = srp_map_finish_fmr(state, target);
 809                         if (ret)
 810                                 return ret;
 811
 812                         srp_map_update_start(state, sg, sg_index, dma_addr);
 813                 }
 814
 815                 len = min_t(unsigned int, dma_len, dev->fmr_page_size);
 816
 817                 if (!state->npages)
 818                         state->base_dma_addr = dma_addr;
 819                 state->pages[state->npages++] = dma_addr;
 820                 state->fmr_len += len;
 821                 dma_addr += len;
 822                 dma_len -= len;
 823         }
 824
 825         /* If the last entry of the FMR wasn't a full page, then we need to
 826          * close it out and start a new one -- we can only merge at page
 827          * boundries.
 828          */
 829         ret = 0;
 830         if (len != dev->fmr_page_size) {
 831                 ret = srp_map_finish_fmr(state, target);
 832                 if (!ret)
 833                         srp_map_update_start(state, NULL, 0, 0);
 834         }
 835         return ret;
 836 }
 837
 838 static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_target_port *target,
 839                         struct srp_request *req)
 840 {
 841         struct scatterlist *scat, *sg;
 842         struct srp_cmd *cmd = req->cmd->buf;
 843         int i, len, nents, count, use_fmr;
 844         struct srp_device *dev;
 845         struct ib_device *ibdev;
 846         struct srp_map_state state;
 847         struct srp_indirect_buf *indirect_hdr;
 848         u32 table_len;
 849         u8 fmt;
 850
 851         if (!scsi_sglist(scmnd) || scmnd->sc_data_direction == DMA_NONE)
 852                 return sizeof (struct srp_cmd);
 853
 854         if (scmnd->sc_data_direction != DMA_FROM_DEVICE &&
 855             scmnd->sc_data_direction != DMA_TO_DEVICE) {
 856                 shost_printk(KERN_WARNING, target->scsi_host,
 857                              PFX "Unhandled data direction %d\n",
 858                              scmnd->sc_data_direction);
 859                 return -EINVAL;
 860         }
 861
 862         nents = scsi_sg_count(scmnd);
 863         scat  = scsi_sglist(scmnd);
 864
 865         dev = target->srp_host->srp_dev;
 866         ibdev = dev->dev;
 867
 868         count = ib_dma_map_sg(ibdev, scat, nents, scmnd->sc_data_direction);
 869         if (unlikely(count == 0))
 870                 return -EIO;
 871
 872         fmt = SRP_DATA_DESC_DIRECT;
 873         len = sizeof (struct srp_cmd) + sizeof (struct srp_direct_buf);
 874
 875         if (count == 1) {
 876                 /*
 877                  * The midlayer only generated a single gather/scatter
 878                  * entry, or DMA mapping coalesced everything to a
 879                  * single entry.  So a direct descriptor along with
 880                  * the DMA MR suffices.
 881                  */
 882                 struct srp_direct_buf *buf = (void *) cmd->add_data;
 883
 884                 buf->va  = cpu_to_be64(ib_sg_dma_address(ibdev, scat));
 885                 buf->key = cpu_to_be32(target->rkey);
 886                 buf->len = cpu_to_be32(ib_sg_dma_len(ibdev, scat));
 887
 888                 req->nfmr = 0;
 889                 goto map_complete;
 890         }
 891
 892         /* We have more than one scatter/gather entry, so build our indirect
 893          * descriptor table, trying to merge as many entries with FMR as we
 894          * can.
 895          */
 896         indirect_hdr = (void *) cmd->add_data;
 897
 898         ib_dma_sync_single_for_cpu(ibdev, req->indirect_dma_addr,
 899                                    target->indirect_size, DMA_TO_DEVICE);
 900
 901         memset(&state, 0, sizeof(state));
 902         state.desc      = req->indirect_desc;
 903         state.pages     = req->map_page;
 904         state.next_fmr  = req->fmr_list;
 905
 906         use_fmr = dev->fmr_pool ? SRP_MAP_ALLOW_FMR : SRP_MAP_NO_FMR;
 907
 908         for_each_sg(scat, sg, count, i) {
 909                 if (srp_map_sg_entry(&state, target, sg, i, use_fmr)) {
 910                         /* FMR mapping failed, so backtrack to the first
 911                          * unmapped entry and continue on without using FMR.
 912                          */
 913                         dma_addr_t dma_addr;
 914                         unsigned int dma_len;
 915
 916 backtrack:
 917                         sg = state.unmapped_sg;
 918                         i = state.unmapped_index;
 919
 920                         dma_addr = ib_sg_dma_address(ibdev, sg);
 921                         dma_len = ib_sg_dma_len(ibdev, sg);
 922                         dma_len -= (state.unmapped_addr - dma_addr);
 923                         dma_addr = state.unmapped_addr;
 924                         use_fmr = SRP_MAP_NO_FMR;
 925                         srp_map_desc(&state, dma_addr, dma_len, target->rkey);
 926                 }
 927         }
 928
 929         if (use_fmr == SRP_MAP_ALLOW_FMR && srp_map_finish_fmr(&state, target))
 930                 goto backtrack;
 931
 932         /* We've mapped the request, now pull as much of the indirect
 933          * descriptor table as we can into the command buffer. If this
 934          * target is not using an external indirect table, we are
 935          * guaranteed to fit into the command, as the SCSI layer won't
 936          * give us more S/G entries than we allow.
 937          */
 938         req->nfmr = state.nfmr;
 939         if (state.ndesc == 1) {
 940                 /* FMR mapping was able to collapse this to one entry,
 941                  * so use a direct descriptor.
 942                  */
 943                 struct srp_direct_buf *buf = (void *) cmd->add_data;
 944
 945                 *buf = req->indirect_desc[0];
 946                 goto map_complete;
 947         }
 948
 949         if (unlikely(target->cmd_sg_cnt < state.ndesc &&
 950                                                 !target->allow_ext_sg)) {
 951                 shost_printk(KERN_ERR, target->scsi_host,
 952                              "Could not fit S/G list into SRP_CMD\n");
 953                 return -EIO;
 954         }
 955
 956         count = min(state.ndesc, target->cmd_sg_cnt);
 957         table_len = state.ndesc * sizeof (struct srp_direct_buf);
 958
 959         fmt = SRP_DATA_DESC_INDIRECT;
 960         len = sizeof(struct srp_cmd) + sizeof (struct srp_indirect_buf);
 961         len += count * sizeof (struct srp_direct_buf);
 962
 963         memcpy(indirect_hdr->desc_list, req->indirect_desc,
 964                count * sizeof (struct srp_direct_buf));
 965
 966         indirect_hdr->table_desc.va = cpu_to_be64(req->indirect_dma_addr);
 967         indirect_hdr->table_desc.key = cpu_to_be32(target->rkey);
 968         indirect_hdr->table_desc.len = cpu_to_be32(table_len);
 969         indirect_hdr->len = cpu_to_be32(state.total_len);
 970
 971         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
 972                 cmd->data_out_desc_cnt = count;
 973         else
 974                 cmd->data_in_desc_cnt = count;
 975
 976         ib_dma_sync_single_for_device(ibdev, req->indirect_dma_addr, table_len,
 977                                       DMA_TO_DEVICE);
 978
 979 map_complete:
 980         if (scmnd->sc_data_direction == DMA_TO_DEVICE)
 981                 cmd->buf_fmt = fmt << 4;
 982         else
 983                 cmd->buf_fmt = fmt;
 984
 985         return len;
 986 }
 987
 988 /*
 989  * Return an IU and possible credit to the free pool
 990  */
 991 static void srp_put_tx_iu(struct srp_target_port *target, struct srp_iu *iu,
 992                           enum srp_iu_type iu_type)
 993 {
 994         unsigned long flags;
 995
 996         spin_lock_irqsave(&target->lock, flags);
 997         list_add(&iu->list, &target->free_tx);
 998         if (iu_type != SRP_IU_RSP)
 999                 ++target->req_lim;
1000         spin_unlock_irqrestore(&target->lock, flags);
1001 }
1002
1003 /*
1004  * Must be called with target->lock held to protect req_lim and free_tx.
1005  * If IU is not sent, it must be returned using srp_put_tx_iu().
1006  *
1007  * Note:
1008  * An upper limit for the number of allocated information units for each
1009  * request type is:
1010  * - SRP_IU_CMD: SRP_CMD_SQ_SIZE, since the SCSI mid-layer never queues
1011  *   more than Scsi_Host.can_queue requests.
1012  * - SRP_IU_TSK_MGMT: SRP_TSK_MGMT_SQ_SIZE.
1013  * - SRP_IU_RSP: 1, since a conforming SRP target never sends more than
1014  *   one unanswered SRP request to an initiator.
1015  */
1016 static struct srp_iu *__srp_get_tx_iu(struct srp_target_port *target,
1017                                       enum srp_iu_type iu_type)
1018 {
1019         s32 rsv = (iu_type == SRP_IU_TSK_MGMT) ? 0 : SRP_TSK_MGMT_SQ_SIZE;
1020         struct srp_iu *iu;
1021
1022         srp_send_completion(target->send_cq, target);
1023
1024         if (list_empty(&target->free_tx))
1025                 return NULL;
1026
1027         /* Initiator responses to target requests do not consume credits */
1028         if (iu_type != SRP_IU_RSP) {
1029                 if (target->req_lim <= rsv) {
1030                         ++target->zero_req_lim;
1031                         return NULL;
1032                 }
1033
1034                 --target->req_lim;
1035         }
1036
1037         iu = list_first_entry(&target->free_tx, struct srp_iu, list);
1038         list_del(&iu->list);
1039         return iu;
1040 }
1041
1042 static int srp_post_send(struct srp_target_port *target,
1043                          struct srp_iu *iu, int len)
1044 {
1045         struct ib_sge list;
1046         struct ib_send_wr wr, *bad_wr;
1047
1048         list.addr   = iu->dma;
1049         list.length = len;
1050         list.lkey   = target->lkey;
1051
1052         wr.next       = NULL;
1053         wr.wr_id      = (uintptr_t) iu;
1054         wr.sg_list    = &list;
1055         wr.num_sge    = 1;
1056         wr.opcode     = IB_WR_SEND;
1057         wr.send_flags = IB_SEND_SIGNALED;
1058
1059         return ib_post_send(target->qp, &wr, &bad_wr);
1060 }
1061
1062 static int srp_post_recv(struct srp_target_port *target, struct srp_iu *iu)
1063 {
1064         struct ib_recv_wr wr, *bad_wr;
1065         struct ib_sge list;
1066
1067         list.addr   = iu->dma;
1068         list.length = iu->size;
1069         list.lkey   = target->lkey;
1070
1071         wr.next     = NULL;
1072         wr.wr_id    = (uintptr_t) iu;
1073         wr.sg_list  = &list;
1074         wr.num_sge  = 1;
1075
1076         return ib_post_recv(target->qp, &wr, &bad_wr);
1077 }
1078
1079 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
1080 {
1081         struct srp_request *req;
1082         struct scsi_cmnd *scmnd;
1083         unsigned long flags;
1084
1085         if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
1086                 spin_lock_irqsave(&target->lock, flags);
1087                 target->req_lim += be32_to_cpu(rsp->req_lim_delta);
1088                 spin_unlock_irqrestore(&target->lock, flags);
1089
1090                 target->tsk_mgmt_status = -1;
1091                 if (be32_to_cpu(rsp->resp_data_len) >= 4)
1092                         target->tsk_mgmt_status = rsp->data[3];
1093                 complete(&target->tsk_mgmt_done);
1094         } else {
1095                 req = &target->req_ring[rsp->tag];
1096                 scmnd = srp_claim_req(target, req, NULL);
1097                 if (!scmnd) {
1098                         shost_printk(KERN_ERR, target->scsi_host,
1099                                      "Null scmnd for RSP w/tag %016llx\n",
1100                                      (unsigned long long) rsp->tag);
1101
1102                         spin_lock_irqsave(&target->lock, flags);
1103                         target->req_lim += be32_to_cpu(rsp->req_lim_delta);
1104                         spin_unlock_irqrestore(&target->lock, flags);
1105
1106                         return;
1107                 }
1108                 scmnd->result = rsp->status;
1109
1110                 if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
1111                         memcpy(scmnd->sense_buffer, rsp->data +
1112                                be32_to_cpu(rsp->resp_data_len),
1113                                min_t(int, be32_to_cpu(rsp->sense_data_len),
1114                                      SCSI_SENSE_BUFFERSIZE));
1115                 }
1116
1117                 if (rsp->flags & (SRP_RSP_FLAG_DOOVER | SRP_RSP_FLAG_DOUNDER))
1118                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
1119                 else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
1120                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
1121
1122                 srp_free_req(target, req, scmnd,
1123                              be32_to_cpu(rsp->req_lim_delta));
1124
1125                 scmnd->host_scribble = NULL;
1126                 scmnd->scsi_done(scmnd);
1127         }
1128 }
1129
1130 static int srp_response_common(struct srp_target_port *target, s32 req_delta,
1131                                void *rsp, int len)
1132 {
1133         struct ib_device *dev = target->srp_host->srp_dev->dev;
1134         unsigned long flags;
1135         struct srp_iu *iu;
1136         int err;
1137
1138         spin_lock_irqsave(&target->lock, flags);
1139         target->req_lim += req_delta;
1140         iu = __srp_get_tx_iu(target, SRP_IU_RSP);
1141         spin_unlock_irqrestore(&target->lock, flags);
1142
1143         if (!iu) {
1144                 shost_printk(KERN_ERR, target->scsi_host, PFX
1145                              "no IU available to send response\n");
1146                 return 1;
1147         }
1148
1149         ib_dma_sync_single_for_cpu(dev, iu->dma, len, DMA_TO_DEVICE);
1150         memcpy(iu->buf, rsp, len);
1151         ib_dma_sync_single_for_device(dev, iu->dma, len, DMA_TO_DEVICE);
1152
1153         err = srp_post_send(target, iu, len);
1154         if (err) {
1155                 shost_printk(KERN_ERR, target->scsi_host, PFX
1156                              "unable to post response: %d\n", err);
1157                 srp_put_tx_iu(target, iu, SRP_IU_RSP);
1158         }
1159
1160         return err;
1161 }
1162
1163 static void srp_process_cred_req(struct srp_target_port *target,
1164                                  struct srp_cred_req *req)
1165 {
1166         struct srp_cred_rsp rsp = {
1167                 .opcode = SRP_CRED_RSP,
1168                 .tag = req->tag,
1169         };
1170         s32 delta = be32_to_cpu(req->req_lim_delta);
1171
1172         if (srp_response_common(target, delta, &rsp, sizeof rsp))
1173                 shost_printk(KERN_ERR, target->scsi_host, PFX
1174                              "problems processing SRP_CRED_REQ\n");
1175 }
1176
1177 static void srp_process_aer_req(struct srp_target_port *target,
1178                                 struct srp_aer_req *req)
1179 {
1180         struct srp_aer_rsp rsp = {
1181                 .opcode = SRP_AER_RSP,
1182                 .tag = req->tag,
1183         };
1184         s32 delta = be32_to_cpu(req->req_lim_delta);
1185
1186         shost_printk(KERN_ERR, target->scsi_host, PFX
1187                      "ignoring AER for LUN %llu\n", be64_to_cpu(req->lun));
1188
1189         if (srp_response_common(target, delta, &rsp, sizeof rsp))
1190                 shost_printk(KERN_ERR, target->scsi_host, PFX
1191                              "problems processing SRP_AER_REQ\n");
1192 }
1193
1194 static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
1195 {
1196         struct ib_device *dev = target->srp_host->srp_dev->dev;
1197         struct srp_iu *iu = (struct srp_iu *) (uintptr_t) wc->wr_id;
1198         int res;
1199         u8 opcode;
1200
1201         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_ti_iu_len,
1202                                    DMA_FROM_DEVICE);
1203
1204         opcode = *(u8 *) iu->buf;
1205
1206         if (0) {
1207                 shost_printk(KERN_ERR, target->scsi_host,
1208                              PFX "recv completion, opcode 0x%02x\n", opcode);
1209                 print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 8, 1,
1210                                iu->buf, wc->byte_len, true);
1211         }
1212
1213         switch (opcode) {
1214         case SRP_RSP:
1215                 srp_process_rsp(target, iu->buf);
1216                 break;
1217
1218         case SRP_CRED_REQ:
1219                 srp_process_cred_req(target, iu->buf);
1220                 break;
1221
1222         case SRP_AER_REQ:
1223                 srp_process_aer_req(target, iu->buf);
1224                 break;
1225
1226         case SRP_T_LOGOUT:
1227                 /* XXX Handle target logout */
1228                 shost_printk(KERN_WARNING, target->scsi_host,
1229                              PFX "Got target logout request\n");
1230                 break;
1231
1232         default:
1233                 shost_printk(KERN_WARNING, target->scsi_host,
1234                              PFX "Unhandled SRP opcode 0x%02x\n", opcode);
1235                 break;
1236         }
1237
1238         ib_dma_sync_single_for_device(dev, iu->dma, target->max_ti_iu_len,
1239                                       DMA_FROM_DEVICE);
1240
1241         res = srp_post_recv(target, iu);
1242         if (res != 0)
1243                 shost_printk(KERN_ERR, target->scsi_host,
1244                              PFX "Recv failed with error code %d\n", res);
1245 }
1246
1247 static void srp_recv_completion(struct ib_cq *cq, void *target_ptr)
1248 {
1249         struct srp_target_port *target = target_ptr;
1250         struct ib_wc wc;
1251
1252         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
1253         while (ib_poll_cq(cq, 1, &wc) > 0) {
1254                 if (wc.status) {
1255                         shost_printk(KERN_ERR, target->scsi_host,
1256                                      PFX "failed receive status %d\n",
1257                                      wc.status);
1258                         target->qp_in_error = 1;
1259                         break;
1260                 }
1261
1262                 srp_handle_recv(target, &wc);
1263         }
1264 }
1265
1266 static void srp_send_completion(struct ib_cq *cq, void *target_ptr)
1267 {
1268         struct srp_target_port *target = target_ptr;
1269         struct ib_wc wc;
1270         struct srp_iu *iu;
1271
1272         while (ib_poll_cq(cq, 1, &wc) > 0) {
1273                 if (wc.status) {
1274                         shost_printk(KERN_ERR, target->scsi_host,
1275                                      PFX "failed send status %d\n",
1276                                      wc.status);
1277                         target->qp_in_error = 1;
1278                         break;
1279                 }
1280
1281                 iu = (struct srp_iu *) (uintptr_t) wc.wr_id;
1282                 list_add(&iu->list, &target->free_tx);
1283         }
1284 }
1285
1286 static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
1287 {
1288         struct srp_target_port *target = host_to_target(shost);
1289         struct srp_request *req;
1290         struct srp_iu *iu;
1291         struct srp_cmd *cmd;
1292         struct ib_device *dev;
1293         unsigned long flags;
1294         int len;
1295
1296         if (target->state == SRP_TARGET_CONNECTING)
1297                 goto err;
1298
1299         if (target->state == SRP_TARGET_DEAD ||
1300             target->state == SRP_TARGET_REMOVED) {
1301                 scmnd->result = DID_BAD_TARGET << 16;
1302                 scmnd->scsi_done(scmnd);
1303                 return 0;
1304         }
1305
1306         spin_lock_irqsave(&target->lock, flags);
1307         iu = __srp_get_tx_iu(target, SRP_IU_CMD);
1308         if (!iu)
1309                 goto err_unlock;
1310
1311         req = list_first_entry(&target->free_reqs, struct srp_request, list);
1312         list_del(&req->list);
1313         spin_unlock_irqrestore(&target->lock, flags);
1314
1315         dev = target->srp_host->srp_dev->dev;
1316         ib_dma_sync_single_for_cpu(dev, iu->dma, target->max_iu_len,
1317                                    DMA_TO_DEVICE);
1318
1319         scmnd->result        = 0;
1320         scmnd->host_scribble = (void *) req;
1321
1322         cmd = iu->buf;
1323         memset(cmd, 0, sizeof *cmd);
1324
1325         cmd->opcode = SRP_CMD;
1326         cmd->lun    = cpu_to_be64((u64) scmnd->device->lun << 48);
1327         cmd->tag    = req->index;
1328         memcpy(cmd->cdb, scmnd->cmnd, scmnd->cmd_len);
1329
1330         req->scmnd    = scmnd;
1331         req->cmd      = iu;
1332
1333         len = srp_map_data(scmnd, target, req);
1334         if (len < 0) {
1335                 shost_printk(KERN_ERR, target->scsi_host,
1336                              PFX "Failed to map data\n");
1337                 goto err_iu;
1338         }
1339
1340         ib_dma_sync_single_for_device(dev, iu->dma, target->max_iu_len,
1341                                       DMA_TO_DEVICE);
1342
1343         if (srp_post_send(target, iu, len)) {
1344                 shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
1345                 goto err_unmap;
1346         }
1347
1348         return 0;
1349
1350 err_unmap:
1351         srp_unmap_data(scmnd, target, req);
1352
1353 err_iu:
1354         srp_put_tx_iu(target, iu, SRP_IU_CMD);
1355
1356         spin_lock_irqsave(&target->lock, flags);
1357         list_add(&req->list, &target->free_reqs);
1358
1359 err_unlock:
1360         spin_unlock_irqrestore(&target->lock, flags);
1361
1362 err:
1363         return SCSI_MLQUEUE_HOST_BUSY;
1364 }
1365
1366 static int srp_alloc_iu_bufs(struct srp_target_port *target)
1367 {
1368         int i;
1369
1370         for (i = 0; i < SRP_RQ_SIZE; ++i) {
1371                 target->rx_ring[i] = srp_alloc_iu(target->srp_host,
1372                                                   target->max_ti_iu_len,
1373                                                   GFP_KERNEL, DMA_FROM_DEVICE);
1374                 if (!target->rx_ring[i])
1375                         goto err;
1376         }
1377
1378         for (i = 0; i < SRP_SQ_SIZE; ++i) {
1379                 target->tx_ring[i] = srp_alloc_iu(target->srp_host,
1380                                                   target->max_iu_len,
1381                                                   GFP_KERNEL, DMA_TO_DEVICE);
1382                 if (!target->tx_ring[i])
1383                         goto err;
1384
1385                 list_add(&target->tx_ring[i]->list, &target->free_tx);
1386         }
1387
1388         return 0;
1389
1390 err:
1391         for (i = 0; i < SRP_RQ_SIZE; ++i) {
1392                 srp_free_iu(target->srp_host, target->rx_ring[i]);
1393                 target->rx_ring[i] = NULL;
1394         }
1395
1396         for (i = 0; i < SRP_SQ_SIZE; ++i) {
1397                 srp_free_iu(target->srp_host, target->tx_ring[i]);
1398                 target->tx_ring[i] = NULL;
1399         }
1400
1401         return -ENOMEM;
1402 }
1403
1404 static void srp_cm_rep_handler(struct ib_cm_id *cm_id,
1405                                struct srp_login_rsp *lrsp,
1406                                struct srp_target_port *target)
1407 {
1408         struct ib_qp_attr *qp_attr = NULL;
1409         int attr_mask = 0;
1410         int ret;
1411         int i;
1412
1413         if (lrsp->opcode == SRP_LOGIN_RSP) {
1414                 target->max_ti_iu_len = be32_to_cpu(lrsp->max_ti_iu_len);
1415                 target->req_lim       = be32_to_cpu(lrsp->req_lim_delta);
1416
1417                 /*
1418                  * Reserve credits for task management so we don't
1419                  * bounce requests back to the SCSI mid-layer.
1420                  */
1421                 target->scsi_host->can_queue
1422                         = min(target->req_lim - SRP_TSK_MGMT_SQ_SIZE,
1423                               target->scsi_host->can_queue);
1424         } else {
1425                 shost_printk(KERN_WARNING, target->scsi_host,
1426                              PFX "Unhandled RSP opcode %#x\n", lrsp->opcode);
1427                 ret = -ECONNRESET;
1428                 goto error;
1429         }
1430
1431         if (!target->rx_ring[0]) {
1432                 ret = srp_alloc_iu_bufs(target);
1433                 if (ret)
1434                         goto error;
1435         }
1436
1437         ret = -ENOMEM;
1438         qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
1439         if (!qp_attr)
1440                 goto error;
1441
1442         qp_attr->qp_state = IB_QPS_RTR;
1443         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
1444         if (ret)
1445                 goto error_free;
1446
1447         ret = ib_modify_qp(target->qp, qp_attr, attr_mask);
1448         if (ret)
1449                 goto error_free;
1450
1451         for (i = 0; i < SRP_RQ_SIZE; i++) {
1452                 struct srp_iu *iu = target->rx_ring[i];
1453                 ret = srp_post_recv(target, iu);
1454                 if (ret)
1455                         goto error_free;
1456         }
1457
1458         qp_attr->qp_state = IB_QPS_RTS;
1459         ret = ib_cm_init_qp_attr(cm_id, qp_attr, &attr_mask);
1460         if (ret)
1461                 goto error_free;
1462
1463         ret = ib_modify_qp(target->qp, qp_attr, attr_mask);
1464         if (ret)
1465                 goto error_free;
1466
1467         ret = ib_send_cm_rtu(cm_id, NULL, 0);
1468
1469 error_free:
1470         kfree(qp_attr);
1471
1472 error:
1473         target->status = ret;
1474 }
1475
1476 static void srp_cm_rej_handler(struct ib_cm_id *cm_id,
1477                                struct ib_cm_event *event,
1478                                struct srp_target_port *target)
1479 {
1480         struct Scsi_Host *shost = target->scsi_host;
1481         struct ib_class_port_info *cpi;
1482         int opcode;
1483
1484         switch (event->param.rej_rcvd.reason) {
1485         case IB_CM_REJ_PORT_CM_REDIRECT:
1486                 cpi = event->param.rej_rcvd.ari;
1487                 target->path.dlid = cpi->redirect_lid;
1488                 target->path.pkey = cpi->redirect_pkey;
1489                 cm_id->remote_cm_qpn = be32_to_cpu(cpi->redirect_qp) & 0x00ffffff;
1490                 memcpy(target->path.dgid.raw, cpi->redirect_gid, 16);
1491
1492                 target->status = target->path.dlid ?
1493                         SRP_DLID_REDIRECT : SRP_PORT_REDIRECT;
1494                 break;
1495
1496         case IB_CM_REJ_PORT_REDIRECT:
1497                 if (srp_target_is_topspin(target)) {
1498                         /*
1499                          * Topspin/Cisco SRP gateways incorrectly send
1500                          * reject reason code 25 when they mean 24
1501                          * (port redirect).
1502                          */
1503                         memcpy(target->path.dgid.raw,
1504                                event->param.rej_rcvd.ari, 16);
1505
1506                         shost_printk(KERN_DEBUG, shost,
1507                                      PFX "Topspin/Cisco redirect to target port GID %016llx%016llx\n",
1508                                      (unsigned long long) be64_to_cpu(target->path.dgid.global.subnet_prefix),
1509                                      (unsigned long long) be64_to_cpu(target->path.dgid.global.interface_id));
1510
1511                         target->status = SRP_PORT_REDIRECT;
1512                 } else {
1513                         shost_printk(KERN_WARNING, shost,
1514                                      "  REJ reason: IB_CM_REJ_PORT_REDIRECT\n");
1515                         target->status = -ECONNRESET;
1516                 }
1517                 break;
1518
1519         case IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID:
1520                 shost_printk(KERN_WARNING, shost,
1521                             "  REJ reason: IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID\n");
1522                 target->status = -ECONNRESET;
1523                 break;
1524
1525         case IB_CM_REJ_CONSUMER_DEFINED:
1526                 opcode = *(u8 *) event->private_data;
1527                 if (opcode == SRP_LOGIN_REJ) {
1528                         struct srp_login_rej *rej = event->private_data;
1529                         u32 reason = be32_to_cpu(rej->reason);
1530
1531                         if (reason == SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE)
1532                                 shost_printk(KERN_WARNING, shost,
1533                                              PFX "SRP_LOGIN_REJ: requested max_it_iu_len too large\n");
1534                         else
1535                                 shost_printk(KERN_WARNING, shost,
1536                                             PFX "SRP LOGIN REJECTED, reason 0x%08x\n", reason);
1537                 } else
1538                         shost_printk(KERN_WARNING, shost,
1539                                      "  REJ reason: IB_CM_REJ_CONSUMER_DEFINED,"
1540                                      " opcode 0x%02x\n", opcode);
1541                 target->status = -ECONNRESET;
1542                 break;
1543
1544         case IB_CM_REJ_STALE_CONN:
1545                 shost_printk(KERN_WARNING, shost, "  REJ reason: stale connection\n");
1546                 target->status = SRP_STALE_CONN;
1547                 break;
1548
1549         default:
1550                 shost_printk(KERN_WARNING, shost, "  REJ reason 0x%x\n",
1551                              event->param.rej_rcvd.reason);
1552                 target->status = -ECONNRESET;
1553         }
1554 }
1555
1556 static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
1557 {
1558         struct srp_target_port *target = cm_id->context;
1559         int comp = 0;
1560
1561         switch (event->event) {
1562         case IB_CM_REQ_ERROR:
1563                 shost_printk(KERN_DEBUG, target->scsi_host,
1564                              PFX "Sending CM REQ failed\n");
1565                 comp = 1;
1566                 target->status = -ECONNRESET;
1567                 break;
1568
1569         case IB_CM_REP_RECEIVED:
1570                 comp = 1;
1571                 srp_cm_rep_handler(cm_id, event->private_data, target);
1572                 break;
1573
1574         case IB_CM_REJ_RECEIVED:
1575                 shost_printk(KERN_DEBUG, target->scsi_host, PFX "REJ received\n");
1576                 comp = 1;
1577
1578                 srp_cm_rej_handler(cm_id, event, target);
1579                 break;
1580
1581         case IB_CM_DREQ_RECEIVED:
1582                 shost_printk(KERN_WARNING, target->scsi_host,
1583                              PFX "DREQ received - connection closed\n");
1584                 if (ib_send_cm_drep(cm_id, NULL, 0))
1585                         shost_printk(KERN_ERR, target->scsi_host,
1586                                      PFX "Sending CM DREP failed\n");
1587                 break;
1588
1589         case IB_CM_TIMEWAIT_EXIT:
1590                 shost_printk(KERN_ERR, target->scsi_host,
1591                              PFX "connection closed\n");
1592
1593                 comp = 1;
1594                 target->status = 0;
1595                 break;
1596
1597         case IB_CM_MRA_RECEIVED:
1598         case IB_CM_DREQ_ERROR:
1599         case IB_CM_DREP_RECEIVED:
1600                 break;
1601
1602         default:
1603                 shost_printk(KERN_WARNING, target->scsi_host,
1604                              PFX "Unhandled CM event %d\n", event->event);
1605                 break;
1606         }
1607
1608         if (comp)
1609                 complete(&target->done);
1610
1611         return 0;
1612 }
1613
1614 static int srp_send_tsk_mgmt(struct srp_target_port *target,
1615                              u64 req_tag, unsigned int lun, u8 func)
1616 {
1617         struct ib_device *dev = target->srp_host->srp_dev->dev;
1618         struct srp_iu *iu;
1619         struct srp_tsk_mgmt *tsk_mgmt;
1620
1621         if (target->state == SRP_TARGET_DEAD ||
1622             target->state == SRP_TARGET_REMOVED)
1623                 return -1;
1624
1625         init_completion(&target->tsk_mgmt_done);
1626
1627         spin_lock_irq(&target->lock);
1628         iu = __srp_get_tx_iu(target, SRP_IU_TSK_MGMT);
1629         spin_unlock_irq(&target->lock);
1630
1631         if (!iu)
1632                 return -1;
1633
1634         ib_dma_sync_single_for_cpu(dev, iu->dma, sizeof *tsk_mgmt,
1635                                    DMA_TO_DEVICE);
1636         tsk_mgmt = iu->buf;
1637         memset(tsk_mgmt, 0, sizeof *tsk_mgmt);
1638
1639         tsk_mgmt->opcode        = SRP_TSK_MGMT;
1640         tsk_mgmt->lun           = cpu_to_be64((u64) lun << 48);
1641         tsk_mgmt->tag           = req_tag | SRP_TAG_TSK_MGMT;
1642         tsk_mgmt->tsk_mgmt_func = func;
1643         tsk_mgmt->task_tag      = req_tag;
1644
1645         ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
1646                                       DMA_TO_DEVICE);
1647         if (srp_post_send(target, iu, sizeof *tsk_mgmt)) {
1648                 srp_put_tx_iu(target, iu, SRP_IU_TSK_MGMT);
1649                 return -1;
1650         }
1651
1652         if (!wait_for_completion_timeout(&target->tsk_mgmt_done,
1653                                          msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
1654                 return -1;
1655
1656         return 0;
1657 }
1658
1659 static int srp_abort(struct scsi_cmnd *scmnd)
1660 {
1661         struct srp_target_port *target = host_to_target(scmnd->device->host);
1662         struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
1663
1664         shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
1665
1666         if (!req || target->qp_in_error || !srp_claim_req(target, req, scmnd))
1667                 return FAILED;
1668         srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
1669                           SRP_TSK_ABORT_TASK);
1670         srp_free_req(target, req, scmnd, 0);
1671         scmnd->result = DID_ABORT << 16;
1672         scmnd->scsi_done(scmnd);
1673
1674         return SUCCESS;
1675 }
1676
1677 static int srp_reset_device(struct scsi_cmnd *scmnd)
1678 {
1679         struct srp_target_port *target = host_to_target(scmnd->device->host);
1680         int i;
1681
1682         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
1683
1684         if (target->qp_in_error)
1685                 return FAILED;
1686         if (srp_send_tsk_mgmt(target, SRP_TAG_NO_REQ, scmnd->device->lun,
1687                               SRP_TSK_LUN_RESET))
1688                 return FAILED;
1689         if (target->tsk_mgmt_status)
1690                 return FAILED;
1691
1692         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
1693                 struct srp_request *req = &target->req_ring[i];
1694                 if (req->scmnd && req->scmnd->device == scmnd->device)
1695                         srp_reset_req(target, req);
1696         }
1697
1698         return SUCCESS;
1699 }
1700
1701 static int srp_reset_host(struct scsi_cmnd *scmnd)
1702 {
1703         struct srp_target_port *target = host_to_target(scmnd->device->host);
1704         int ret = FAILED;
1705
1706         shost_printk(KERN_ERR, target->scsi_host, PFX "SRP reset_host called\n");
1707
1708         if (!srp_reconnect_target(target))
1709                 ret = SUCCESS;
1710
1711         return ret;
1712 }
1713
1714 static ssize_t show_id_ext(struct device *dev, struct device_attribute *attr,
1715                            char *buf)
1716 {
1717         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1718
1719         if (target->state == SRP_TARGET_DEAD ||
1720             target->state == SRP_TARGET_REMOVED)
1721                 return -ENODEV;
1722
1723         return sprintf(buf, "0x%016llx\n",
1724                        (unsigned long long) be64_to_cpu(target->id_ext));
1725 }
1726
1727 static ssize_t show_ioc_guid(struct device *dev, struct device_attribute *attr,
1728                              char *buf)
1729 {
1730         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1731
1732         if (target->state == SRP_TARGET_DEAD ||
1733             target->state == SRP_TARGET_REMOVED)
1734                 return -ENODEV;
1735
1736         return sprintf(buf, "0x%016llx\n",
1737                        (unsigned long long) be64_to_cpu(target->ioc_guid));
1738 }
1739
1740 static ssize_t show_service_id(struct device *dev,
1741                                struct device_attribute *attr, char *buf)
1742 {
1743         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1744
1745         if (target->state == SRP_TARGET_DEAD ||
1746             target->state == SRP_TARGET_REMOVED)
1747                 return -ENODEV;
1748
1749         return sprintf(buf, "0x%016llx\n",
1750                        (unsigned long long) be64_to_cpu(target->service_id));
1751 }
1752
1753 static ssize_t show_pkey(struct device *dev, struct device_attribute *attr,
1754                          char *buf)
1755 {
1756         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1757
1758         if (target->state == SRP_TARGET_DEAD ||
1759             target->state == SRP_TARGET_REMOVED)
1760                 return -ENODEV;
1761
1762         return sprintf(buf, "0x%04x\n", be16_to_cpu(target->path.pkey));
1763 }
1764
1765 static ssize_t show_dgid(struct device *dev, struct device_attribute *attr,
1766                          char *buf)
1767 {
1768         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1769
1770         if (target->state == SRP_TARGET_DEAD ||
1771             target->state == SRP_TARGET_REMOVED)
1772                 return -ENODEV;
1773
1774         return sprintf(buf, "%pI6\n", target->path.dgid.raw);
1775 }
1776
1777 static ssize_t show_orig_dgid(struct device *dev,
1778                               struct device_attribute *attr, char *buf)
1779 {
1780         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1781
1782         if (target->state == SRP_TARGET_DEAD ||
1783             target->state == SRP_TARGET_REMOVED)
1784                 return -ENODEV;
1785
1786         return sprintf(buf, "%pI6\n", target->orig_dgid);
1787 }
1788
1789 static ssize_t show_req_lim(struct device *dev,
1790                             struct device_attribute *attr, char *buf)
1791 {
1792         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1793
1794         if (target->state == SRP_TARGET_DEAD ||
1795             target->state == SRP_TARGET_REMOVED)
1796                 return -ENODEV;
1797
1798         return sprintf(buf, "%d\n", target->req_lim);
1799 }
1800
1801 static ssize_t show_zero_req_lim(struct device *dev,
1802                                  struct device_attribute *attr, char *buf)
1803 {
1804         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1805
1806         if (target->state == SRP_TARGET_DEAD ||
1807             target->state == SRP_TARGET_REMOVED)
1808                 return -ENODEV;
1809
1810         return sprintf(buf, "%d\n", target->zero_req_lim);
1811 }
1812
1813 static ssize_t show_local_ib_port(struct device *dev,
1814                                   struct device_attribute *attr, char *buf)
1815 {
1816         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1817
1818         return sprintf(buf, "%d\n", target->srp_host->port);
1819 }
1820
1821 static ssize_t show_local_ib_device(struct device *dev,
1822                                     struct device_attribute *attr, char *buf)
1823 {
1824         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1825
1826         return sprintf(buf, "%s\n", target->srp_host->srp_dev->dev->name);
1827 }
1828
1829 static ssize_t show_cmd_sg_entries(struct device *dev,
1830                                    struct device_attribute *attr, char *buf)
1831 {
1832         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1833
1834         return sprintf(buf, "%u\n", target->cmd_sg_cnt);
1835 }
1836
1837 static ssize_t show_allow_ext_sg(struct device *dev,
1838                                  struct device_attribute *attr, char *buf)
1839 {
1840         struct srp_target_port *target = host_to_target(class_to_shost(dev));
1841
1842         return sprintf(buf, "%s\n", target->allow_ext_sg ? "true" : "false");
1843 }
1844
1845 static DEVICE_ATTR(id_ext,          S_IRUGO, show_id_ext,          NULL);
1846 static DEVICE_ATTR(ioc_guid,        S_IRUGO, show_ioc_guid,        NULL);
1847 static DEVICE_ATTR(service_id,      S_IRUGO, show_service_id,      NULL);
1848 static DEVICE_ATTR(pkey,            S_IRUGO, show_pkey,            NULL);
1849 static DEVICE_ATTR(dgid,            S_IRUGO, show_dgid,            NULL);
1850 static DEVICE_ATTR(orig_dgid,       S_IRUGO, show_orig_dgid,       NULL);
1851 static DEVICE_ATTR(req_lim,         S_IRUGO, show_req_lim,         NULL);
1852 static DEVICE_ATTR(zero_req_lim,    S_IRUGO, show_zero_req_lim,    NULL);
1853 static DEVICE_ATTR(local_ib_port,   S_IRUGO, show_local_ib_port,   NULL);
1854 static DEVICE_ATTR(local_ib_device, S_IRUGO, show_local_ib_device, NULL);
1855 static DEVICE_ATTR(cmd_sg_entries,  S_IRUGO, show_cmd_sg_entries,  NULL);
1856 static DEVICE_ATTR(allow_ext_sg,    S_IRUGO, show_allow_ext_sg,    NULL);
1857
1858 static struct device_attribute *srp_host_attrs[] = {
1859         &dev_attr_id_ext,
1860         &dev_attr_ioc_guid,
1861         &dev_attr_service_id,
1862         &dev_attr_pkey,
1863         &dev_attr_dgid,
1864         &dev_attr_orig_dgid,
1865         &dev_attr_req_lim,
1866         &dev_attr_zero_req_lim,
1867         &dev_attr_local_ib_port,
1868         &dev_attr_local_ib_device,
1869         &dev_attr_cmd_sg_entries,
1870         &dev_attr_allow_ext_sg,
1871         NULL
1872 };
1873
1874 static struct scsi_host_template srp_template = {
1875         .module                         = THIS_MODULE,
1876         .name                           = "InfiniBand SRP initiator",
1877         .proc_name                      = DRV_NAME,
1878         .info                           = srp_target_info,
1879         .queuecommand                   = srp_queuecommand,
1880         .eh_abort_handler               = srp_abort,
1881         .eh_device_reset_handler        = srp_reset_device,
1882         .eh_host_reset_handler          = srp_reset_host,
1883         .sg_tablesize                   = SRP_DEF_SG_TABLESIZE,
1884         .can_queue                      = SRP_CMD_SQ_SIZE,
1885         .this_id                        = -1,
1886         .cmd_per_lun                    = SRP_CMD_SQ_SIZE,
1887         .use_clustering                 = ENABLE_CLUSTERING,
1888         .shost_attrs                    = srp_host_attrs
1889 };
1890
1891 static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
1892 {
1893         struct srp_rport_identifiers ids;
1894         struct srp_rport *rport;
1895
1896         sprintf(target->target_name, "SRP.T10:%016llX",
1897                  (unsigned long long) be64_to_cpu(target->id_ext));
1898
1899         if (scsi_add_host(target->scsi_host, host->srp_dev->dev->dma_device))
1900                 return -ENODEV;
1901
1902         memcpy(ids.port_id, &target->id_ext, 8);
1903         memcpy(ids.port_id + 8, &target->ioc_guid, 8);
1904         ids.roles = SRP_RPORT_ROLE_TARGET;
1905         rport = srp_rport_add(target->scsi_host, &ids);
1906         if (IS_ERR(rport)) {
1907                 scsi_remove_host(target->scsi_host);
1908                 return PTR_ERR(rport);
1909         }
1910
1911         spin_lock(&host->target_lock);
1912         list_add_tail(&target->list, &host->target_list);
1913         spin_unlock(&host->target_lock);
1914
1915         target->state = SRP_TARGET_LIVE;
1916
1917         scsi_scan_target(&target->scsi_host->shost_gendev,
1918                          0, target->scsi_id, SCAN_WILD_CARD, 0);
1919
1920         return 0;
1921 }
1922
1923 static void srp_release_dev(struct device *dev)
1924 {
1925         struct srp_host *host =
1926                 container_of(dev, struct srp_host, dev);
1927
1928         complete(&host->released);
1929 }
1930
1931 static struct class srp_class = {
1932         .name    = "infiniband_srp",
1933         .dev_release = srp_release_dev
1934 };
1935
1936 /*
1937  * Target ports are added by writing
1938  *
1939  *     id_ext=<SRP ID ext>,ioc_guid=<SRP IOC GUID>,dgid=<dest GID>,
1940  *     pkey=<P_Key>,service_id=<service ID>
1941  *
1942  * to the add_target sysfs attribute.
1943  */
1944 enum {
1945         SRP_OPT_ERR             = 0,
1946         SRP_OPT_ID_EXT          = 1 << 0,
1947         SRP_OPT_IOC_GUID        = 1 << 1,
1948         SRP_OPT_DGID            = 1 << 2,
1949         SRP_OPT_PKEY            = 1 << 3,
1950         SRP_OPT_SERVICE_ID      = 1 << 4,
1951         SRP_OPT_MAX_SECT        = 1 << 5,
1952         SRP_OPT_MAX_CMD_PER_LUN = 1 << 6,
1953         SRP_OPT_IO_CLASS        = 1 << 7,
1954         SRP_OPT_INITIATOR_EXT   = 1 << 8,
1955         SRP_OPT_CMD_SG_ENTRIES  = 1 << 9,
1956         SRP_OPT_ALLOW_EXT_SG    = 1 << 10,
1957         SRP_OPT_SG_TABLESIZE    = 1 << 11,
1958         SRP_OPT_ALL             = (SRP_OPT_ID_EXT       |
1959                                    SRP_OPT_IOC_GUID     |
1960                                    SRP_OPT_DGID         |
1961                                    SRP_OPT_PKEY         |
1962                                    SRP_OPT_SERVICE_ID),
1963 };
1964
1965 static const match_table_t srp_opt_tokens = {
1966         { SRP_OPT_ID_EXT,               "id_ext=%s"             },
1967         { SRP_OPT_IOC_GUID,             "ioc_guid=%s"           },
1968         { SRP_OPT_DGID,                 "dgid=%s"               },
1969         { SRP_OPT_PKEY,                 "pkey=%x"               },
1970         { SRP_OPT_SERVICE_ID,           "service_id=%s"         },
1971         { SRP_OPT_MAX_SECT,             "max_sect=%d"           },
1972         { SRP_OPT_MAX_CMD_PER_LUN,      "max_cmd_per_lun=%d"    },
1973         { SRP_OPT_IO_CLASS,             "io_class=%x"           },
1974         { SRP_OPT_INITIATOR_EXT,        "initiator_ext=%s"      },
1975         { SRP_OPT_CMD_SG_ENTRIES,       "cmd_sg_entries=%u"     },
1976         { SRP_OPT_ALLOW_EXT_SG,         "allow_ext_sg=%u"       },
1977         { SRP_OPT_SG_TABLESIZE,         "sg_tablesize=%u"       },
1978         { SRP_OPT_ERR,                  NULL                    }
1979 };
1980
1981 static int srp_parse_options(const char *buf, struct srp_target_port *target)
1982 {
1983         char *options, *sep_opt;
1984         char *p;
1985         char dgid[3];
1986         substring_t args[MAX_OPT_ARGS];
1987         int opt_mask = 0;
1988         int token;
1989         int ret = -EINVAL;
1990         int i;
1991
1992         options = kstrdup(buf, GFP_KERNEL);
1993         if (!options)
1994                 return -ENOMEM;
1995
1996         sep_opt = options;
1997         while ((p = strsep(&sep_opt, ",")) != NULL) {
1998                 if (!*p)
1999                         continue;
2000
2001                 token = match_token(p, srp_opt_tokens, args);
2002                 opt_mask |= token;
2003
2004                 switch (token) {
2005                 case SRP_OPT_ID_EXT:
2006                         p = match_strdup(args);
2007                         if (!p) {
2008                                 ret = -ENOMEM;
2009                                 goto out;
2010                         }
2011                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
2012                         kfree(p);
2013                         break;
2014
2015                 case SRP_OPT_IOC_GUID:
2016                         p = match_strdup(args);
2017                         if (!p) {
2018                                 ret = -ENOMEM;
2019                                 goto out;
2020                         }
2021                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
2022                         kfree(p);
2023                         break;
2024
2025                 case SRP_OPT_DGID:
2026                         p = match_strdup(args);
2027                         if (!p) {
2028                                 ret = -ENOMEM;
2029                                 goto out;
2030                         }
2031                         if (strlen(p) != 32) {
2032                                 printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
2033                                 kfree(p);
2034                                 goto out;
2035                         }
2036
2037                         for (i = 0; i < 16; ++i) {
2038                                 strlcpy(dgid, p + i * 2, 3);
2039                                 target->path.dgid.raw[i] = simple_strtoul(dgid, NULL, 16);
2040                         }
2041                         kfree(p);
2042                         memcpy(target->orig_dgid, target->path.dgid.raw, 16);
2043                         break;
2044
2045                 case SRP_OPT_PKEY:
2046                         if (match_hex(args, &token)) {
2047                                 printk(KERN_WARNING PFX "bad P_Key parameter '%s'\n", p);
2048                                 goto out;
2049                         }
2050                         target->path.pkey = cpu_to_be16(token);
2051                         break;
2052
2053                 case SRP_OPT_SERVICE_ID:
2054                         p = match_strdup(args);
2055                         if (!p) {
2056                                 ret = -ENOMEM;
2057                                 goto out;
2058                         }
2059                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
2060                         target->path.service_id = target->service_id;
2061                         kfree(p);
2062                         break;
2063
2064                 case SRP_OPT_MAX_SECT:
2065                         if (match_int(args, &token)) {
2066                                 printk(KERN_WARNING PFX "bad max sect parameter '%s'\n", p);
2067                                 goto out;
2068                         }
2069                         target->scsi_host->max_sectors = token;
2070                         break;
2071
2072                 case SRP_OPT_MAX_CMD_PER_LUN:
2073                         if (match_int(args, &token)) {
2074                                 printk(KERN_WARNING PFX "bad max cmd_per_lun parameter '%s'\n", p);
2075                                 goto out;
2076                         }
2077                         target->scsi_host->cmd_per_lun = min(token, SRP_CMD_SQ_SIZE);
2078                         break;
2079
2080                 case SRP_OPT_IO_CLASS:
2081                         if (match_hex(args, &token)) {
2082                                 printk(KERN_WARNING PFX "bad  IO class parameter '%s' \n", p);
2083                                 goto out;
2084                         }
2085                         if (token != SRP_REV10_IB_IO_CLASS &&
2086                             token != SRP_REV16A_IB_IO_CLASS) {
2087                                 printk(KERN_WARNING PFX "unknown IO class parameter value"
2088                                        " %x specified (use %x or %x).\n",
2089                                        token, SRP_REV10_IB_IO_CLASS, SRP_REV16A_IB_IO_CLASS);
2090                                 goto out;
2091                         }
2092                         target->io_class = token;
2093                         break;
2094
2095                 case SRP_OPT_INITIATOR_EXT:
2096                         p = match_strdup(args);
2097                         if (!p) {
2098                                 ret = -ENOMEM;
2099                                 goto out;
2100                         }
2101                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
2102                         kfree(p);
2103                         break;
2104
2105                 case SRP_OPT_CMD_SG_ENTRIES:
2106                         if (match_int(args, &token) || token < 1 || token > 255) {
2107                                 printk(KERN_WARNING PFX "bad max cmd_sg_entries parameter '%s'\n", p);
2108                                 goto out;
2109                         }
2110                         target->cmd_sg_cnt = token;
2111                         break;
2112
2113                 case SRP_OPT_ALLOW_EXT_SG:
2114                         if (match_int(args, &token)) {
2115                                 printk(KERN_WARNING PFX "bad allow_ext_sg parameter '%s'\n", p);
2116                                 goto out;
2117                         }
2118                         target->allow_ext_sg = !!token;
2119                         break;
2120
2121                 case SRP_OPT_SG_TABLESIZE:
2122                         if (match_int(args, &token) || token < 1 ||
2123                                         token > SCSI_MAX_SG_CHAIN_SEGMENTS) {
2124                                 printk(KERN_WARNING PFX "bad max sg_tablesize parameter '%s'\n", p);
2125                                 goto out;
2126                         }
2127                         target->sg_tablesize = token;
2128                         break;
2129
2130                 default:
2131                         printk(KERN_WARNING PFX "unknown parameter or missing value "
2132                                "'%s' in target creation request\n", p);
2133                         goto out;
2134                 }
2135         }
2136
2137         if ((opt_mask & SRP_OPT_ALL) == SRP_OPT_ALL)
2138                 ret = 0;
2139         else
2140                 for (i = 0; i < ARRAY_SIZE(srp_opt_tokens); ++i)
2141                         if ((srp_opt_tokens[i].token & SRP_OPT_ALL) &&
2142                             !(srp_opt_tokens[i].token & opt_mask))
2143                                 printk(KERN_WARNING PFX "target creation request is "
2144                                        "missing parameter '%s'\n",
2145                                        srp_opt_tokens[i].pattern);
2146
2147 out:
2148         kfree(options);
2149         return ret;
2150 }
2151
2152 static ssize_t srp_create_target(struct device *dev,
2153                                  struct device_attribute *attr,
2154                                  const char *buf, size_t count)
2155 {
2156         struct srp_host *host =
2157                 container_of(dev, struct srp_host, dev);
2158         struct Scsi_Host *target_host;
2159         struct srp_target_port *target;
2160         struct ib_device *ibdev = host->srp_dev->dev;
2161         dma_addr_t dma_addr;
2162         int i, ret;
2163
2164         target_host = scsi_host_alloc(&srp_template,
2165                                       sizeof (struct srp_target_port));
2166         if (!target_host)
2167                 return -ENOMEM;
2168
2169         target_host->transportt  = ib_srp_transport_template;
2170         target_host->max_channel = 0;
2171         target_host->max_id      = 1;
2172         target_host->max_lun     = SRP_MAX_LUN;
2173         target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
2174
2175         target = host_to_target(target_host);
2176
2177         target->io_class        = SRP_REV16A_IB_IO_CLASS;
2178         target->scsi_host       = target_host;
2179         target->srp_host        = host;
2180         target->lkey            = host->srp_dev->mr->lkey;
2181         target->rkey            = host->srp_dev->mr->rkey;
2182         target->cmd_sg_cnt      = cmd_sg_entries;
2183         target->sg_tablesize    = indirect_sg_entries ? : cmd_sg_entries;
2184         target->allow_ext_sg    = allow_ext_sg;
2185
2186         ret = srp_parse_options(buf, target);
2187         if (ret)
2188                 goto err;
2189
2190         if (!host->srp_dev->fmr_pool && !target->allow_ext_sg &&
2191                                 target->cmd_sg_cnt < target->sg_tablesize) {
2192                 printk(KERN_WARNING PFX "No FMR pool and no external indirect descriptors, limiting sg_tablesize to cmd_sg_cnt\n");
2193                 target->sg_tablesize = target->cmd_sg_cnt;
2194         }
2195
2196         target_host->sg_tablesize = target->sg_tablesize;
2197         target->indirect_size = target->sg_tablesize *
2198                                 sizeof (struct srp_direct_buf);
2199         target->max_iu_len = sizeof (struct srp_cmd) +
2200                              sizeof (struct srp_indirect_buf) +
2201                              target->cmd_sg_cnt * sizeof (struct srp_direct_buf);
2202
2203         spin_lock_init(&target->lock);
2204         INIT_LIST_HEAD(&target->free_tx);
2205         INIT_LIST_HEAD(&target->free_reqs);
2206         for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
2207                 struct srp_request *req = &target->req_ring[i];
2208
2209                 req->fmr_list = kmalloc(target->cmd_sg_cnt * sizeof (void *),
2210                                         GFP_KERNEL);
2211                 req->map_page = kmalloc(SRP_FMR_SIZE * sizeof (void *),
2212                                         GFP_KERNEL);
2213                 req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
2214                 if (!req->fmr_list || !req->map_page || !req->indirect_desc)
2215                         goto err_free_mem;
2216
2217                 dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
2218                                              target->indirect_size,
2219                                              DMA_TO_DEVICE);
2220                 if (ib_dma_mapping_error(ibdev, dma_addr))
2221                         goto err_free_mem;
2222
2223                 req->indirect_dma_addr = dma_addr;
2224                 req->index = i;
2225                 list_add_tail(&req->list, &target->free_reqs);
2226         }
2227
2228         ib_query_gid(ibdev, host->port, 0, &target->path.sgid);
2229
2230         shost_printk(KERN_DEBUG, target->scsi_host, PFX
2231                      "new target: id_ext %016llx ioc_guid %016llx pkey %04x "
2232                      "service_id %016llx dgid %pI6\n",
2233                (unsigned long long) be64_to_cpu(target->id_ext),
2234                (unsigned long long) be64_to_cpu(target->ioc_guid),
2235                be16_to_cpu(target->path.pkey),
2236                (unsigned long long) be64_to_cpu(target->service_id),
2237                target->path.dgid.raw);
2238
2239         ret = srp_create_target_ib(target);
2240         if (ret)
2241                 goto err_free_mem;
2242
2243         ret = srp_new_cm_id(target);
2244         if (ret)
2245                 goto err_free_ib;
2246
2247         target->qp_in_error = 0;
2248         ret = srp_connect_target(target);
2249         if (ret) {
2250                 shost_printk(KERN_ERR, target->scsi_host,
2251                              PFX "Connection failed\n");
2252                 goto err_cm_id;
2253         }
2254
2255         ret = srp_add_target(host, target);
2256         if (ret)
2257                 goto err_disconnect;
2258
2259         return count;
2260
2261 err_disconnect:
2262         srp_disconnect_target(target);
2263
2264 err_cm_id:
2265         ib_destroy_cm_id(target->cm_id);
2266
2267 err_free_ib:
2268         srp_free_target_ib(target);
2269
2270 err_free_mem:
2271         srp_free_req_data(target);
2272
2273 err:
2274         scsi_host_put(target_host);
2275
2276         return ret;
2277 }
2278
2279 static DEVICE_ATTR(add_target, S_IWUSR, NULL, srp_create_target);
2280
2281 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
2282                           char *buf)
2283 {
2284         struct srp_host *host = container_of(dev, struct srp_host, dev);
2285
2286         return sprintf(buf, "%s\n", host->srp_dev->dev->name);
2287 }
2288
2289 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
2290
2291 static ssize_t show_port(struct device *dev, struct device_attribute *attr,
2292                          char *buf)
2293 {
2294         struct srp_host *host = container_of(dev, struct srp_host, dev);
2295
2296         return sprintf(buf, "%d\n", host->port);
2297 }
2298
2299 static DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
2300
2301 static struct srp_host *srp_add_port(struct srp_device *device, u8 port)
2302 {
2303         struct srp_host *host;
2304
2305         host = kzalloc(sizeof *host, GFP_KERNEL);
2306         if (!host)
2307                 return NULL;
2308
2309         INIT_LIST_HEAD(&host->target_list);
2310         spin_lock_init(&host->target_lock);
2311         init_completion(&host->released);
2312         host->srp_dev = device;
2313         host->port = port;
2314
2315         host->dev.class = &srp_class;
2316         host->dev.parent = device->dev->dma_device;
2317         dev_set_name(&host->dev, "srp-%s-%d", device->dev->name, port);
2318
2319         if (device_register(&host->dev))
2320                 goto free_host;
2321         if (device_create_file(&host->dev, &dev_attr_add_target))
2322                 goto err_class;
2323         if (device_create_file(&host->dev, &dev_attr_ibdev))
2324                 goto err_class;
2325         if (device_create_file(&host->dev, &dev_attr_port))
2326                 goto err_class;
2327
2328         return host;
2329
2330 err_class:
2331         device_unregister(&host->dev);
2332
2333 free_host:
2334         kfree(host);
2335
2336         return NULL;
2337 }
2338
2339 static void srp_add_one(struct ib_device *device)
2340 {
2341         struct srp_device *srp_dev;
2342         struct ib_device_attr *dev_attr;
2343         struct ib_fmr_pool_param fmr_param;
2344         struct srp_host *host;
2345         int max_pages_per_fmr, fmr_page_shift, s, e, p;
2346
2347         dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
2348         if (!dev_attr)
2349                 return;
2350
2351         if (ib_query_device(device, dev_attr)) {
2352                 printk(KERN_WARNING PFX "Query device failed for %s\n",
2353                        device->name);
2354                 goto free_attr;
2355         }
2356
2357         srp_dev = kmalloc(sizeof *srp_dev, GFP_KERNEL);
2358         if (!srp_dev)
2359                 goto free_attr;
2360
2361         /*
2362          * Use the smallest page size supported by the HCA, down to a
2363          * minimum of 4096 bytes. We're unlikely to build large sglists
2364          * out of smaller entries.
2365          */
2366         fmr_page_shift          = max(12, ffs(dev_attr->page_size_cap) - 1);
2367         srp_dev->fmr_page_size  = 1 << fmr_page_shift;
2368         srp_dev->fmr_page_mask  = ~((u64) srp_dev->fmr_page_size - 1);
2369         srp_dev->fmr_max_size   = srp_dev->fmr_page_size * SRP_FMR_SIZE;
2370
2371         INIT_LIST_HEAD(&srp_dev->dev_list);
2372
2373         srp_dev->dev = device;
2374         srp_dev->pd  = ib_alloc_pd(device);
2375         if (IS_ERR(srp_dev->pd))
2376                 goto free_dev;
2377
2378         srp_dev->mr = ib_get_dma_mr(srp_dev->pd,
2379                                     IB_ACCESS_LOCAL_WRITE |
2380                                     IB_ACCESS_REMOTE_READ |
2381                                     IB_ACCESS_REMOTE_WRITE);
2382         if (IS_ERR(srp_dev->mr))
2383                 goto err_pd;
2384
2385         for (max_pages_per_fmr = SRP_FMR_SIZE;
2386                         max_pages_per_fmr >= SRP_FMR_MIN_SIZE;
2387                         max_pages_per_fmr /= 2, srp_dev->fmr_max_size /= 2) {
2388                 memset(&fmr_param, 0, sizeof fmr_param);
2389                 fmr_param.pool_size         = SRP_FMR_POOL_SIZE;
2390                 fmr_param.dirty_watermark   = SRP_FMR_DIRTY_SIZE;
2391                 fmr_param.cache             = 1;
2392                 fmr_param.max_pages_per_fmr = max_pages_per_fmr;
2393                 fmr_param.page_shift        = fmr_page_shift;
2394                 fmr_param.access            = (IB_ACCESS_LOCAL_WRITE |
2395                                                IB_ACCESS_REMOTE_WRITE |
2396                                                IB_ACCESS_REMOTE_READ);
2397
2398                 srp_dev->fmr_pool = ib_create_fmr_pool(srp_dev->pd, &fmr_param);
2399                 if (!IS_ERR(srp_dev->fmr_pool))
2400                         break;
2401         }
2402
2403         if (IS_ERR(srp_dev->fmr_pool))
2404                 srp_dev->fmr_pool = NULL;
2405
2406         if (device->node_type == RDMA_NODE_IB_SWITCH) {
2407                 s = 0;
2408                 e = 0;
2409         } else {
2410                 s = 1;
2411                 e = device->phys_port_cnt;
2412         }
2413
2414         for (p = s; p <= e; ++p) {
2415                 host = srp_add_port(srp_dev, p);
2416                 if (host)
2417                         list_add_tail(&host->list, &srp_dev->dev_list);
2418         }
2419
2420         ib_set_client_data(device, &srp_client, srp_dev);
2421
2422         goto free_attr;
2423
2424 err_pd:
2425         ib_dealloc_pd(srp_dev->pd);
2426
2427 free_dev:
2428         kfree(srp_dev);
2429
2430 free_attr:
2431         kfree(dev_attr);
2432 }
2433
2434 static void srp_remove_one(struct ib_device *device)
2435 {
2436         struct srp_device *srp_dev;
2437         struct srp_host *host, *tmp_host;
2438         LIST_HEAD(target_list);
2439         struct srp_target_port *target, *tmp_target;
2440
2441         srp_dev = ib_get_client_data(device, &srp_client);
2442
2443         list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
2444                 device_unregister(&host->dev);
2445                 /*
2446                  * Wait for the sysfs entry to go away, so that no new
2447                  * target ports can be created.
2448                  */
2449                 wait_for_completion(&host->released);
2450
2451                 /*
2452                  * Mark all target ports as removed, so we stop queueing
2453                  * commands and don't try to reconnect.
2454                  */
2455                 spin_lock(&host->target_lock);
2456                 list_for_each_entry(target, &host->target_list, list) {
2457                         spin_lock_irq(&target->lock);
2458                         target->state = SRP_TARGET_REMOVED;
2459                         spin_unlock_irq(&target->lock);
2460                 }
2461                 spin_unlock(&host->target_lock);
2462
2463                 /*
2464                  * Wait for any reconnection tasks that may have
2465                  * started before we marked our target ports as
2466                  * removed, and any target port removal tasks.
2467                  */
2468                 flush_workqueue(ib_wq);
2469
2470                 list_for_each_entry_safe(target, tmp_target,
2471                                          &host->target_list, list) {
2472                         srp_remove_host(target->scsi_host);
2473                         scsi_remove_host(target->scsi_host);
2474                         srp_disconnect_target(target);
2475                         ib_destroy_cm_id(target->cm_id);
2476                         srp_free_target_ib(target);
2477                         srp_free_req_data(target);
2478                         scsi_host_put(target->scsi_host);
2479                 }
2480
2481                 kfree(host);
2482         }
2483
2484         if (srp_dev->fmr_pool)
2485                 ib_destroy_fmr_pool(srp_dev->fmr_pool);
2486         ib_dereg_mr(srp_dev->mr);
2487         ib_dealloc_pd(srp_dev->pd);
2488
2489         kfree(srp_dev);
2490 }
2491
2492 static struct srp_function_template ib_srp_transport_functions = {
2493 };
2494
2495 static int __init srp_init_module(void)
2496 {
2497         int ret;
2498
2499         BUILD_BUG_ON(FIELD_SIZEOF(struct ib_wc, wr_id) < sizeof(void *));
2500
2501         if (srp_sg_tablesize) {
2502                 printk(KERN_WARNING PFX "srp_sg_tablesize is deprecated, please use cmd_sg_entries\n");
2503                 if (!cmd_sg_entries)
2504                         cmd_sg_entries = srp_sg_tablesize;
2505         }
2506
2507         if (!cmd_sg_entries)
2508                 cmd_sg_entries = SRP_DEF_SG_TABLESIZE;
2509
2510         if (cmd_sg_entries > 255) {
2511                 printk(KERN_WARNING PFX "Clamping cmd_sg_entries to 255\n");
2512                 cmd_sg_entries = 255;
2513         }
2514
2515         if (!indirect_sg_entries)
2516                 indirect_sg_entries = cmd_sg_entries;
2517         else if (indirect_sg_entries < cmd_sg_entries) {
2518                 printk(KERN_WARNING PFX "Bumping up indirect_sg_entries to match cmd_sg_entries (%u)\n", cmd_sg_entries);
2519                 indirect_sg_entries = cmd_sg_entries;
2520         }
2521
2522         ib_srp_transport_template =
2523                 srp_attach_transport(&ib_srp_transport_functions);
2524         if (!ib_srp_transport_template)
2525                 return -ENOMEM;
2526
2527         ret = class_register(&srp_class);
2528         if (ret) {
2529                 printk(KERN_ERR PFX "couldn't register class infiniband_srp\n");
2530                 srp_release_transport(ib_srp_transport_template);
2531                 return ret;
2532         }
2533
2534         ib_sa_register_client(&srp_sa_client);
2535
2536         ret = ib_register_client(&srp_client);
2537         if (ret) {
2538                 printk(KERN_ERR PFX "couldn't register IB client\n");
2539                 srp_release_transport(ib_srp_transport_template);
2540                 ib_sa_unregister_client(&srp_sa_client);
2541                 class_unregister(&srp_class);
2542                 return ret;
2543         }
2544
2545         return 0;
2546 }
2547
2548 static void __exit srp_cleanup_module(void)
2549 {
2550         ib_unregister_client(&srp_client);
2551         ib_sa_unregister_client(&srp_sa_client);
2552         class_unregister(&srp_class);
2553         srp_release_transport(ib_srp_transport_template);
2554 }
2555
2556 module_init(srp_init_module);
2557 module_exit(srp_cleanup_module);