1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* NVMe over Fabrics RDMA target.
4	* Copyright (c) 2015-2016 HGST, a Western Digital Company.
5	*/
6	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7	#include <linux/atomic.h>
8	#include <linux/blk-integrity.h>
9	#include <linux/ctype.h>
10	#include <linux/delay.h>
11	#include <linux/err.h>
12	#include <linux/init.h>
13	#include <linux/module.h>
14	#include <linux/nvme.h>
15	#include <linux/slab.h>
16	#include <linux/string.h>
17	#include <linux/wait.h>
18	#include <linux/inet.h>
19	#include <asm/unaligned.h>
20
21	#include <rdma/ib_verbs.h>
22	#include <rdma/rdma_cm.h>
23	#include <rdma/rw.h>
24	#include <rdma/ib_cm.h>
25
26	#include <linux/nvme-rdma.h>
27	#include "nvmet.h"
28
29	/*
30	* We allow at least 1 page, up to 4 SGEs, and up to 16KB of inline data
31	*/
32	#define NVMET_RDMA_DEFAULT_INLINE_DATA_SIZE PAGE_SIZE
33	#define NVMET_RDMA_MAX_INLINE_SGE 4
34	#define NVMET_RDMA_MAX_INLINE_DATA_SIZE max_t(int, SZ_16K, PAGE_SIZE)
35
36	/* Assume mpsmin == device_page_size == 4KB */
37	#define NVMET_RDMA_MAX_MDTS 8
38	#define NVMET_RDMA_MAX_METADATA_MDTS 5
39
40	#define NVMET_RDMA_BACKLOG 128
41
42	struct nvmet_rdma_srq;
43
44	struct nvmet_rdma_cmd {
45	struct ib_sge sge[NVMET_RDMA_MAX_INLINE_SGE + 1];
46	struct ib_cqe cqe;
47	struct ib_recv_wr wr;
48	struct scatterlist inline_sg[NVMET_RDMA_MAX_INLINE_SGE];
49	struct nvme_command *nvme_cmd;
50	struct nvmet_rdma_queue *queue;
51	struct nvmet_rdma_srq *nsrq;
52	};
53
54	enum {
55	NVMET_RDMA_REQ_INLINE_DATA = (1 << 0),
56	};
57
58	struct nvmet_rdma_rsp {
59	struct ib_sge send_sge;
60	struct ib_cqe send_cqe;
61	struct ib_send_wr send_wr;
62
63	struct nvmet_rdma_cmd *cmd;
64	struct nvmet_rdma_queue *queue;
65
66	struct ib_cqe read_cqe;
67	struct ib_cqe write_cqe;
68	struct rdma_rw_ctx rw;
69
70	struct nvmet_req req;
71
72	bool allocated;
73	u8 n_rdma;
74	u32 flags;
75	u32 invalidate_rkey;
76
77	struct list_head wait_list;
78	struct list_head free_list;
79	};
80
81	enum nvmet_rdma_queue_state {
82	NVMET_RDMA_Q_CONNECTING,
83	NVMET_RDMA_Q_LIVE,
84	NVMET_RDMA_Q_DISCONNECTING,
85	};
86
87	struct nvmet_rdma_queue {
88	struct rdma_cm_id *cm_id;
89	struct ib_qp *qp;
90	struct nvmet_port *port;
91	struct ib_cq *cq;
92	atomic_t sq_wr_avail;
93	struct nvmet_rdma_device *dev;
94	struct nvmet_rdma_srq *nsrq;
95	spinlock_t state_lock;
96	enum nvmet_rdma_queue_state state;
97	struct nvmet_cq nvme_cq;
98	struct nvmet_sq nvme_sq;
99
100	struct nvmet_rdma_rsp *rsps;
101	struct list_head free_rsps;
102	spinlock_t rsps_lock;
103	struct nvmet_rdma_cmd *cmds;
104
105	struct work_struct release_work;
106	struct list_head rsp_wait_list;
107	struct list_head rsp_wr_wait_list;
108	spinlock_t rsp_wr_wait_lock;
109
110	int idx;
111	int host_qid;
112	int comp_vector;
113	int recv_queue_size;
114	int send_queue_size;
115
116	struct list_head queue_list;
117	};
118
119	struct nvmet_rdma_port {
120	struct nvmet_port *nport;
121	struct sockaddr_storage addr;
122	struct rdma_cm_id *cm_id;
123	struct delayed_work repair_work;
124	};
125
126	struct nvmet_rdma_srq {
127	struct ib_srq *srq;
128	struct nvmet_rdma_cmd *cmds;
129	struct nvmet_rdma_device *ndev;
130	};
131
132	struct nvmet_rdma_device {
133	struct ib_device *device;
134	struct ib_pd *pd;
135	struct nvmet_rdma_srq **srqs;
136	int srq_count;
137	size_t srq_size;
138	struct kref ref;
139	struct list_head entry;
140	int inline_data_size;
141	int inline_page_count;
142	};
143
144	static bool nvmet_rdma_use_srq;
145	module_param_named(use_srq, nvmet_rdma_use_srq, bool, 0444);
146	MODULE_PARM_DESC(use_srq, "Use shared receive queue.");
147
148	static int srq_size_set(const char *val, const struct kernel_param *kp);
149	static const struct kernel_param_ops srq_size_ops = {
150	.set = srq_size_set,
151	.get = param_get_int,
152	};
153
154	static int nvmet_rdma_srq_size = 1024;
155	module_param_cb(srq_size, &srq_size_ops, &nvmet_rdma_srq_size, 0644);
156	MODULE_PARM_DESC(srq_size, "set Shared Receive Queue (SRQ) size, should >= 256 (default: 1024)");
157
158	static DEFINE_IDA(nvmet_rdma_queue_ida);
159	static LIST_HEAD(nvmet_rdma_queue_list);
160	static DEFINE_MUTEX(nvmet_rdma_queue_mutex);
161
162	static LIST_HEAD(device_list);
163	static DEFINE_MUTEX(device_list_mutex);
164
165	static bool nvmet_rdma_execute_command(struct nvmet_rdma_rsp *rsp);
166	static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc);
167	static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
168	static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
169	static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc);
170	static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
171	static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
172	static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
173	struct nvmet_rdma_rsp *r);
174	static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
175	struct nvmet_rdma_rsp *r);
176
177	static const struct nvmet_fabrics_ops nvmet_rdma_ops;
178
179	static int srq_size_set(const char *val, const struct kernel_param *kp)
180	{
181	int n = 0, ret;
182
183	ret = kstrtoint(s: val, base: 10, res: &n);
184	if (ret != 0 || n < 256)
185	return -EINVAL;
186
187	return param_set_int(val, kp);
188	}
189
190	static int num_pages(int len)
191	{
192	return 1 + (((len - 1) & PAGE_MASK) >> PAGE_SHIFT);
193	}
194
195	static inline bool nvmet_rdma_need_data_in(struct nvmet_rdma_rsp *rsp)
196	{
197	return nvme_is_write(cmd: rsp->req.cmd) &&
198	rsp->req.transfer_len &&
199	!(rsp->flags & NVMET_RDMA_REQ_INLINE_DATA);
200	}
201
202	static inline bool nvmet_rdma_need_data_out(struct nvmet_rdma_rsp *rsp)
203	{
204	return !nvme_is_write(cmd: rsp->req.cmd) &&
205	rsp->req.transfer_len &&
206	!rsp->req.cqe->status &&
207	!(rsp->flags & NVMET_RDMA_REQ_INLINE_DATA);
208	}
209
210	static inline struct nvmet_rdma_rsp *
211	nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
212	{
213	struct nvmet_rdma_rsp *rsp;
214	unsigned long flags;
215
216	spin_lock_irqsave(&queue->rsps_lock, flags);
217	rsp = list_first_entry_or_null(&queue->free_rsps,
218	struct nvmet_rdma_rsp, free_list);
219	if (likely(rsp))
220	list_del(entry: &rsp->free_list);
221	spin_unlock_irqrestore(lock: &queue->rsps_lock, flags);
222
223	if (unlikely(!rsp)) {
224	int ret;
225
226	rsp = kzalloc(size: sizeof(*rsp), GFP_KERNEL);
227	if (unlikely(!rsp))
228	return NULL;
229	ret = nvmet_rdma_alloc_rsp(ndev: queue->dev, r: rsp);
230	if (unlikely(ret)) {
231	kfree(objp: rsp);
232	return NULL;
233	}
234
235	rsp->allocated = true;
236	}
237
238	return rsp;
239	}
240
241	static inline void
242	nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
243	{
244	unsigned long flags;
245
246	if (unlikely(rsp->allocated)) {
247	nvmet_rdma_free_rsp(ndev: rsp->queue->dev, r: rsp);
248	kfree(objp: rsp);
249	return;
250	}
251
252	spin_lock_irqsave(&rsp->queue->rsps_lock, flags);
253	list_add_tail(new: &rsp->free_list, head: &rsp->queue->free_rsps);
254	spin_unlock_irqrestore(lock: &rsp->queue->rsps_lock, flags);
255	}
256
257	static void nvmet_rdma_free_inline_pages(struct nvmet_rdma_device *ndev,
258	struct nvmet_rdma_cmd *c)
259	{
260	struct scatterlist *sg;
261	struct ib_sge *sge;
262	int i;
263
264	if (!ndev->inline_data_size)
265	return;
266
267	sg = c->inline_sg;
268	sge = &c->sge[1];
269
270	for (i = 0; i < ndev->inline_page_count; i++, sg++, sge++) {
271	if (sge->length)
272	ib_dma_unmap_page(dev: ndev->device, addr: sge->addr,
273	size: sge->length, direction: DMA_FROM_DEVICE);
274	if (sg_page(sg))
275	__free_page(sg_page(sg));
276	}
277	}
278
279	static int nvmet_rdma_alloc_inline_pages(struct nvmet_rdma_device *ndev,
280	struct nvmet_rdma_cmd *c)
281	{
282	struct scatterlist *sg;
283	struct ib_sge *sge;
284	struct page *pg;
285	int len;
286	int i;
287
288	if (!ndev->inline_data_size)
289	return 0;
290
291	sg = c->inline_sg;
292	sg_init_table(sg, ndev->inline_page_count);
293	sge = &c->sge[1];
294	len = ndev->inline_data_size;
295
296	for (i = 0; i < ndev->inline_page_count; i++, sg++, sge++) {
297	pg = alloc_page(GFP_KERNEL);
298	if (!pg)
299	goto out_err;
300	sg_assign_page(sg, page: pg);
301	sge->addr = ib_dma_map_page(dev: ndev->device,
302	page: pg, offset: 0, PAGE_SIZE, direction: DMA_FROM_DEVICE);
303	if (ib_dma_mapping_error(dev: ndev->device, dma_addr: sge->addr))
304	goto out_err;
305	sge->length = min_t(int, len, PAGE_SIZE);
306	sge->lkey = ndev->pd->local_dma_lkey;
307	len -= sge->length;
308	}
309
310	return 0;
311	out_err:
312	for (; i >= 0; i--, sg--, sge--) {
313	if (sge->length)
314	ib_dma_unmap_page(dev: ndev->device, addr: sge->addr,
315	size: sge->length, direction: DMA_FROM_DEVICE);
316	if (sg_page(sg))
317	__free_page(sg_page(sg));
318	}
319	return -ENOMEM;
320	}
321
322	static int nvmet_rdma_alloc_cmd(struct nvmet_rdma_device *ndev,
323	struct nvmet_rdma_cmd *c, bool admin)
324	{
325	/* NVMe command / RDMA RECV */
326	c->nvme_cmd = kmalloc(size: sizeof(*c->nvme_cmd), GFP_KERNEL);
327	if (!c->nvme_cmd)
328	goto out;
329
330	c->sge[0].addr = ib_dma_map_single(dev: ndev->device, cpu_addr: c->nvme_cmd,
331	size: sizeof(*c->nvme_cmd), direction: DMA_FROM_DEVICE);
332	if (ib_dma_mapping_error(dev: ndev->device, dma_addr: c->sge[0].addr))
333	goto out_free_cmd;
334
335	c->sge[0].length = sizeof(*c->nvme_cmd);
336	c->sge[0].lkey = ndev->pd->local_dma_lkey;
337
338	if (!admin && nvmet_rdma_alloc_inline_pages(ndev, c))
339	goto out_unmap_cmd;
340
341	c->cqe.done = nvmet_rdma_recv_done;
342
343	c->wr.wr_cqe = &c->cqe;
344	c->wr.sg_list = c->sge;
345	c->wr.num_sge = admin ? 1 : ndev->inline_page_count + 1;
346
347	return 0;
348
349	out_unmap_cmd:
350	ib_dma_unmap_single(dev: ndev->device, addr: c->sge[0].addr,
351	size: sizeof(*c->nvme_cmd), direction: DMA_FROM_DEVICE);
352	out_free_cmd:
353	kfree(objp: c->nvme_cmd);
354
355	out:
356	return -ENOMEM;
357	}
358
359	static void nvmet_rdma_free_cmd(struct nvmet_rdma_device *ndev,
360	struct nvmet_rdma_cmd *c, bool admin)
361	{
362	if (!admin)
363	nvmet_rdma_free_inline_pages(ndev, c);
364	ib_dma_unmap_single(dev: ndev->device, addr: c->sge[0].addr,
365	size: sizeof(*c->nvme_cmd), direction: DMA_FROM_DEVICE);
366	kfree(objp: c->nvme_cmd);
367	}
368
369	static struct nvmet_rdma_cmd *
370	nvmet_rdma_alloc_cmds(struct nvmet_rdma_device *ndev,
371	int nr_cmds, bool admin)
372	{
373	struct nvmet_rdma_cmd *cmds;
374	int ret = -EINVAL, i;
375
376	cmds = kcalloc(n: nr_cmds, size: sizeof(struct nvmet_rdma_cmd), GFP_KERNEL);
377	if (!cmds)
378	goto out;
379
380	for (i = 0; i < nr_cmds; i++) {
381	ret = nvmet_rdma_alloc_cmd(ndev, c: cmds + i, admin);
382	if (ret)
383	goto out_free;
384	}
385
386	return cmds;
387
388	out_free:
389	while (--i >= 0)
390	nvmet_rdma_free_cmd(ndev, c: cmds + i, admin);
391	kfree(objp: cmds);
392	out:
393	return ERR_PTR(error: ret);
394	}
395
396	static void nvmet_rdma_free_cmds(struct nvmet_rdma_device *ndev,
397	struct nvmet_rdma_cmd *cmds, int nr_cmds, bool admin)
398	{
399	int i;
400
401	for (i = 0; i < nr_cmds; i++)
402	nvmet_rdma_free_cmd(ndev, c: cmds + i, admin);
403	kfree(objp: cmds);
404	}
405
406	static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
407	struct nvmet_rdma_rsp *r)
408	{
409	/* NVMe CQE / RDMA SEND */
410	r->req.cqe = kmalloc(size: sizeof(*r->req.cqe), GFP_KERNEL);
411	if (!r->req.cqe)
412	goto out;
413
414	r->send_sge.addr = ib_dma_map_single(dev: ndev->device, cpu_addr: r->req.cqe,
415	size: sizeof(*r->req.cqe), direction: DMA_TO_DEVICE);
416	if (ib_dma_mapping_error(dev: ndev->device, dma_addr: r->send_sge.addr))
417	goto out_free_rsp;
418
419	if (ib_dma_pci_p2p_dma_supported(dev: ndev->device))
420	r->req.p2p_client = &ndev->device->dev;
421	r->send_sge.length = sizeof(*r->req.cqe);
422	r->send_sge.lkey = ndev->pd->local_dma_lkey;
423
424	r->send_cqe.done = nvmet_rdma_send_done;
425
426	r->send_wr.wr_cqe = &r->send_cqe;
427	r->send_wr.sg_list = &r->send_sge;
428	r->send_wr.num_sge = 1;
429	r->send_wr.send_flags = IB_SEND_SIGNALED;
430
431	/* Data In / RDMA READ */
432	r->read_cqe.done = nvmet_rdma_read_data_done;
433	/* Data Out / RDMA WRITE */
434	r->write_cqe.done = nvmet_rdma_write_data_done;
435
436	return 0;
437
438	out_free_rsp:
439	kfree(objp: r->req.cqe);
440	out:
441	return -ENOMEM;
442	}
443
444	static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
445	struct nvmet_rdma_rsp *r)
446	{
447	ib_dma_unmap_single(dev: ndev->device, addr: r->send_sge.addr,
448	size: sizeof(*r->req.cqe), direction: DMA_TO_DEVICE);
449	kfree(objp: r->req.cqe);
450	}
451
452	static int
453	nvmet_rdma_alloc_rsps(struct nvmet_rdma_queue *queue)
454	{
455	struct nvmet_rdma_device *ndev = queue->dev;
456	int nr_rsps = queue->recv_queue_size * 2;
457	int ret = -EINVAL, i;
458
459	queue->rsps = kcalloc(n: nr_rsps, size: sizeof(struct nvmet_rdma_rsp),
460	GFP_KERNEL);
461	if (!queue->rsps)
462	goto out;
463
464	for (i = 0; i < nr_rsps; i++) {
465	struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
466
467	ret = nvmet_rdma_alloc_rsp(ndev, r: rsp);
468	if (ret)
469	goto out_free;
470
471	list_add_tail(new: &rsp->free_list, head: &queue->free_rsps);
472	}
473
474	return 0;
475
476	out_free:
477	while (--i >= 0) {
478	struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
479
480	list_del(entry: &rsp->free_list);
481	nvmet_rdma_free_rsp(ndev, r: rsp);
482	}
483	kfree(objp: queue->rsps);
484	out:
485	return ret;
486	}
487
488	static void nvmet_rdma_free_rsps(struct nvmet_rdma_queue *queue)
489	{
490	struct nvmet_rdma_device *ndev = queue->dev;
491	int i, nr_rsps = queue->recv_queue_size * 2;
492
493	for (i = 0; i < nr_rsps; i++) {
494	struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
495
496	list_del(entry: &rsp->free_list);
497	nvmet_rdma_free_rsp(ndev, r: rsp);
498	}
499	kfree(objp: queue->rsps);
500	}
501
502	static int nvmet_rdma_post_recv(struct nvmet_rdma_device *ndev,
503	struct nvmet_rdma_cmd *cmd)
504	{
505	int ret;
506
507	ib_dma_sync_single_for_device(dev: ndev->device,
508	addr: cmd->sge[0].addr, size: cmd->sge[0].length,
509	dir: DMA_FROM_DEVICE);
510
511	if (cmd->nsrq)
512	ret = ib_post_srq_recv(srq: cmd->nsrq->srq, recv_wr: &cmd->wr, NULL);
513	else
514	ret = ib_post_recv(qp: cmd->queue->qp, recv_wr: &cmd->wr, NULL);
515
516	if (unlikely(ret))
517	pr_err("post_recv cmd failed\n");
518
519	return ret;
520	}
521
522	static void nvmet_rdma_process_wr_wait_list(struct nvmet_rdma_queue *queue)
523	{
524	spin_lock(lock: &queue->rsp_wr_wait_lock);
525	while (!list_empty(head: &queue->rsp_wr_wait_list)) {
526	struct nvmet_rdma_rsp *rsp;
527	bool ret;
528
529	rsp = list_entry(queue->rsp_wr_wait_list.next,
530	struct nvmet_rdma_rsp, wait_list);
531	list_del(entry: &rsp->wait_list);
532
533	spin_unlock(lock: &queue->rsp_wr_wait_lock);
534	ret = nvmet_rdma_execute_command(rsp);
535	spin_lock(lock: &queue->rsp_wr_wait_lock);
536
537	if (!ret) {
538	list_add(new: &rsp->wait_list, head: &queue->rsp_wr_wait_list);
539	break;
540	}
541	}
542	spin_unlock(lock: &queue->rsp_wr_wait_lock);
543	}
544
545	static u16 nvmet_rdma_check_pi_status(struct ib_mr *sig_mr)
546	{
547	struct ib_mr_status mr_status;
548	int ret;
549	u16 status = 0;
550
551	ret = ib_check_mr_status(mr: sig_mr, check_mask: IB_MR_CHECK_SIG_STATUS, mr_status: &mr_status);
552	if (ret) {
553	pr_err("ib_check_mr_status failed, ret %d\n", ret);
554	return NVME_SC_INVALID_PI;
555	}
556
557	if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
558	switch (mr_status.sig_err.err_type) {
559	case IB_SIG_BAD_GUARD:
560	status = NVME_SC_GUARD_CHECK;
561	break;
562	case IB_SIG_BAD_REFTAG:
563	status = NVME_SC_REFTAG_CHECK;
564	break;
565	case IB_SIG_BAD_APPTAG:
566	status = NVME_SC_APPTAG_CHECK;
567	break;
568	}
569	pr_err("PI error found type %d expected 0x%x vs actual 0x%x\n",
570	mr_status.sig_err.err_type,
571	mr_status.sig_err.expected,
572	mr_status.sig_err.actual);
573	}
574
575	return status;
576	}
577
578	static void nvmet_rdma_set_sig_domain(struct blk_integrity *bi,
579	struct nvme_command *cmd, struct ib_sig_domain *domain,
580	u16 control, u8 pi_type)
581	{
582	domain->sig_type = IB_SIG_TYPE_T10_DIF;
583	domain->sig.dif.bg_type = IB_T10DIF_CRC;
584	domain->sig.dif.pi_interval = 1 << bi->interval_exp;
585	domain->sig.dif.ref_tag = le32_to_cpu(cmd->rw.reftag);
586	if (control & NVME_RW_PRINFO_PRCHK_REF)
587	domain->sig.dif.ref_remap = true;
588
589	domain->sig.dif.app_tag = le16_to_cpu(cmd->rw.apptag);
590	domain->sig.dif.apptag_check_mask = le16_to_cpu(cmd->rw.appmask);
591	domain->sig.dif.app_escape = true;
592	if (pi_type == NVME_NS_DPS_PI_TYPE3)
593	domain->sig.dif.ref_escape = true;
594	}
595
596	static void nvmet_rdma_set_sig_attrs(struct nvmet_req *req,
597	struct ib_sig_attrs *sig_attrs)
598	{
599	struct nvme_command *cmd = req->cmd;
600	u16 control = le16_to_cpu(cmd->rw.control);
601	u8 pi_type = req->ns->pi_type;
602	struct blk_integrity *bi;
603
604	bi = bdev_get_integrity(bdev: req->ns->bdev);
605
606	memset(sig_attrs, 0, sizeof(*sig_attrs));
607
608	if (control & NVME_RW_PRINFO_PRACT) {
609	/* for WRITE_INSERT/READ_STRIP no wire domain */
610	sig_attrs->wire.sig_type = IB_SIG_TYPE_NONE;
611	nvmet_rdma_set_sig_domain(bi, cmd, domain: &sig_attrs->mem, control,
612	pi_type);
613	/* Clear the PRACT bit since HCA will generate/verify the PI */
614	control &= ~NVME_RW_PRINFO_PRACT;
615	cmd->rw.control = cpu_to_le16(control);
616	/* PI is added by the HW */
617	req->transfer_len += req->metadata_len;
618	} else {
619	/* for WRITE_PASS/READ_PASS both wire/memory domains exist */
620	nvmet_rdma_set_sig_domain(bi, cmd, domain: &sig_attrs->wire, control,
621	pi_type);
622	nvmet_rdma_set_sig_domain(bi, cmd, domain: &sig_attrs->mem, control,
623	pi_type);
624	}
625
626	if (control & NVME_RW_PRINFO_PRCHK_REF)
627	sig_attrs->check_mask |= IB_SIG_CHECK_REFTAG;
628	if (control & NVME_RW_PRINFO_PRCHK_GUARD)
629	sig_attrs->check_mask |= IB_SIG_CHECK_GUARD;
630	if (control & NVME_RW_PRINFO_PRCHK_APP)
631	sig_attrs->check_mask |= IB_SIG_CHECK_APPTAG;
632	}
633
634	static int nvmet_rdma_rw_ctx_init(struct nvmet_rdma_rsp *rsp, u64 addr, u32 key,
635	struct ib_sig_attrs *sig_attrs)
636	{
637	struct rdma_cm_id *cm_id = rsp->queue->cm_id;
638	struct nvmet_req *req = &rsp->req;
639	int ret;
640
641	if (req->metadata_len)
642	ret = rdma_rw_ctx_signature_init(ctx: &rsp->rw, qp: cm_id->qp,
643	port_num: cm_id->port_num, sg: req->sg, sg_cnt: req->sg_cnt,
644	prot_sg: req->metadata_sg, prot_sg_cnt: req->metadata_sg_cnt, sig_attrs,
645	remote_addr: addr, rkey: key, dir: nvmet_data_dir(req));
646	else
647	ret = rdma_rw_ctx_init(ctx: &rsp->rw, qp: cm_id->qp, port_num: cm_id->port_num,
648	sg: req->sg, sg_cnt: req->sg_cnt, sg_offset: 0, remote_addr: addr, rkey: key,
649	dir: nvmet_data_dir(req));
650
651	return ret;
652	}
653
654	static void nvmet_rdma_rw_ctx_destroy(struct nvmet_rdma_rsp *rsp)
655	{
656	struct rdma_cm_id *cm_id = rsp->queue->cm_id;
657	struct nvmet_req *req = &rsp->req;
658
659	if (req->metadata_len)
660	rdma_rw_ctx_destroy_signature(ctx: &rsp->rw, qp: cm_id->qp,
661	port_num: cm_id->port_num, sg: req->sg, sg_cnt: req->sg_cnt,
662	prot_sg: req->metadata_sg, prot_sg_cnt: req->metadata_sg_cnt,
663	dir: nvmet_data_dir(req));
664	else
665	rdma_rw_ctx_destroy(ctx: &rsp->rw, qp: cm_id->qp, port_num: cm_id->port_num,
666	sg: req->sg, sg_cnt: req->sg_cnt, dir: nvmet_data_dir(req));
667	}
668
669	static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
670	{
671	struct nvmet_rdma_queue *queue = rsp->queue;
672
673	atomic_add(i: 1 + rsp->n_rdma, v: &queue->sq_wr_avail);
674
675	if (rsp->n_rdma)
676	nvmet_rdma_rw_ctx_destroy(rsp);
677
678	if (rsp->req.sg != rsp->cmd->inline_sg)
679	nvmet_req_free_sgls(req: &rsp->req);
680
681	if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
682	nvmet_rdma_process_wr_wait_list(queue);
683
684	nvmet_rdma_put_rsp(rsp);
685	}
686
687	static void nvmet_rdma_error_comp(struct nvmet_rdma_queue *queue)
688	{
689	if (queue->nvme_sq.ctrl) {
690	nvmet_ctrl_fatal_error(ctrl: queue->nvme_sq.ctrl);
691	} else {
692	/*
693	* we didn't setup the controller yet in case
694	* of admin connect error, just disconnect and
695	* cleanup the queue
696	*/
697	nvmet_rdma_queue_disconnect(queue);
698	}
699	}
700
701	static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
702	{
703	struct nvmet_rdma_rsp *rsp =
704	container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
705	struct nvmet_rdma_queue *queue = wc->qp->qp_context;
706
707	nvmet_rdma_release_rsp(rsp);
708
709	if (unlikely(wc->status != IB_WC_SUCCESS &&
710	wc->status != IB_WC_WR_FLUSH_ERR)) {
711	pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
712	wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
713	nvmet_rdma_error_comp(queue);
714	}
715	}
716
717	static void nvmet_rdma_queue_response(struct nvmet_req *req)
718	{
719	struct nvmet_rdma_rsp *rsp =
720	container_of(req, struct nvmet_rdma_rsp, req);
721	struct rdma_cm_id *cm_id = rsp->queue->cm_id;
722	struct ib_send_wr *first_wr;
723
724	if (rsp->invalidate_rkey) {
725	rsp->send_wr.opcode = IB_WR_SEND_WITH_INV;
726	rsp->send_wr.ex.invalidate_rkey = rsp->invalidate_rkey;
727	} else {
728	rsp->send_wr.opcode = IB_WR_SEND;
729	}
730
731	if (nvmet_rdma_need_data_out(rsp)) {
732	if (rsp->req.metadata_len)
733	first_wr = rdma_rw_ctx_wrs(ctx: &rsp->rw, qp: cm_id->qp,
734	port_num: cm_id->port_num, cqe: &rsp->write_cqe, NULL);
735	else
736	first_wr = rdma_rw_ctx_wrs(ctx: &rsp->rw, qp: cm_id->qp,
737	port_num: cm_id->port_num, NULL, chain_wr: &rsp->send_wr);
738	} else {
739	first_wr = &rsp->send_wr;
740	}
741
742	nvmet_rdma_post_recv(ndev: rsp->queue->dev, cmd: rsp->cmd);
743
744	ib_dma_sync_single_for_device(dev: rsp->queue->dev->device,
745	addr: rsp->send_sge.addr, size: rsp->send_sge.length,
746	dir: DMA_TO_DEVICE);
747
748	if (unlikely(ib_post_send(cm_id->qp, first_wr, NULL))) {
749	pr_err("sending cmd response failed\n");
750	nvmet_rdma_release_rsp(rsp);
751	}
752	}
753
754	static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc)
755	{
756	struct nvmet_rdma_rsp *rsp =
757	container_of(wc->wr_cqe, struct nvmet_rdma_rsp, read_cqe);
758	struct nvmet_rdma_queue *queue = wc->qp->qp_context;
759	u16 status = 0;
760
761	WARN_ON(rsp->n_rdma <= 0);
762	atomic_add(i: rsp->n_rdma, v: &queue->sq_wr_avail);
763	rsp->n_rdma = 0;
764
765	if (unlikely(wc->status != IB_WC_SUCCESS)) {
766	nvmet_rdma_rw_ctx_destroy(rsp);
767	nvmet_req_uninit(req: &rsp->req);
768	nvmet_rdma_release_rsp(rsp);
769	if (wc->status != IB_WC_WR_FLUSH_ERR) {
770	pr_info("RDMA READ for CQE 0x%p failed with status %s (%d).\n",
771	wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
772	nvmet_rdma_error_comp(queue);
773	}
774	return;
775	}
776
777	if (rsp->req.metadata_len)
778	status = nvmet_rdma_check_pi_status(sig_mr: rsp->rw.reg->mr);
779	nvmet_rdma_rw_ctx_destroy(rsp);
780
781	if (unlikely(status))
782	nvmet_req_complete(req: &rsp->req, status);
783	else
784	rsp->req.execute(&rsp->req);
785	}
786
787	static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc)
788	{
789	struct nvmet_rdma_rsp *rsp =
790	container_of(wc->wr_cqe, struct nvmet_rdma_rsp, write_cqe);
791	struct nvmet_rdma_queue *queue = wc->qp->qp_context;
792	struct rdma_cm_id *cm_id = rsp->queue->cm_id;
793	u16 status;
794
795	if (!IS_ENABLED(CONFIG_BLK_DEV_INTEGRITY))
796	return;
797
798	WARN_ON(rsp->n_rdma <= 0);
799	atomic_add(i: rsp->n_rdma, v: &queue->sq_wr_avail);
800	rsp->n_rdma = 0;
801
802	if (unlikely(wc->status != IB_WC_SUCCESS)) {
803	nvmet_rdma_rw_ctx_destroy(rsp);
804	nvmet_req_uninit(req: &rsp->req);
805	nvmet_rdma_release_rsp(rsp);
806	if (wc->status != IB_WC_WR_FLUSH_ERR) {
807	pr_info("RDMA WRITE for CQE failed with status %s (%d).\n",
808	ib_wc_status_msg(wc->status), wc->status);
809	nvmet_rdma_error_comp(queue);
810	}
811	return;
812	}
813
814	/*
815	* Upon RDMA completion check the signature status
816	* - if succeeded send good NVMe response
817	* - if failed send bad NVMe response with appropriate error
818	*/
819	status = nvmet_rdma_check_pi_status(sig_mr: rsp->rw.reg->mr);
820	if (unlikely(status))
821	rsp->req.cqe->status = cpu_to_le16(status << 1);
822	nvmet_rdma_rw_ctx_destroy(rsp);
823
824	if (unlikely(ib_post_send(cm_id->qp, &rsp->send_wr, NULL))) {
825	pr_err("sending cmd response failed\n");
826	nvmet_rdma_release_rsp(rsp);
827	}
828	}
829
830	static void nvmet_rdma_use_inline_sg(struct nvmet_rdma_rsp *rsp, u32 len,
831	u64 off)
832	{
833	int sg_count = num_pages(len);
834	struct scatterlist *sg;
835	int i;
836
837	sg = rsp->cmd->inline_sg;
838	for (i = 0; i < sg_count; i++, sg++) {
839	if (i < sg_count - 1)
840	sg_unmark_end(sg);
841	else
842	sg_mark_end(sg);
843	sg->offset = off;
844	sg->length = min_t(int, len, PAGE_SIZE - off);
845	len -= sg->length;
846	if (!i)
847	off = 0;
848	}
849
850	rsp->req.sg = rsp->cmd->inline_sg;
851	rsp->req.sg_cnt = sg_count;
852	}
853
854	static u16 nvmet_rdma_map_sgl_inline(struct nvmet_rdma_rsp *rsp)
855	{
856	struct nvme_sgl_desc *sgl = &rsp->req.cmd->common.dptr.sgl;
857	u64 off = le64_to_cpu(sgl->addr);
858	u32 len = le32_to_cpu(sgl->length);
859
860	if (!nvme_is_write(cmd: rsp->req.cmd)) {
861	rsp->req.error_loc =
862	offsetof(struct nvme_common_command, opcode);
863	return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
864	}
865
866	if (off + len > rsp->queue->dev->inline_data_size) {
867	pr_err("invalid inline data offset!\n");
868	return NVME_SC_SGL_INVALID_OFFSET | NVME_SC_DNR;
869	}
870
871	/* no data command? */
872	if (!len)
873	return 0;
874
875	nvmet_rdma_use_inline_sg(rsp, len, off);
876	rsp->flags |= NVMET_RDMA_REQ_INLINE_DATA;
877	rsp->req.transfer_len += len;
878	return 0;
879	}
880
881	static u16 nvmet_rdma_map_sgl_keyed(struct nvmet_rdma_rsp *rsp,
882	struct nvme_keyed_sgl_desc *sgl, bool invalidate)
883	{
884	u64 addr = le64_to_cpu(sgl->addr);
885	u32 key = get_unaligned_le32(p: sgl->key);
886	struct ib_sig_attrs sig_attrs;
887	int ret;
888
889	rsp->req.transfer_len = get_unaligned_le24(p: sgl->length);
890
891	/* no data command? */
892	if (!rsp->req.transfer_len)
893	return 0;
894
895	if (rsp->req.metadata_len)
896	nvmet_rdma_set_sig_attrs(req: &rsp->req, sig_attrs: &sig_attrs);
897
898	ret = nvmet_req_alloc_sgls(req: &rsp->req);
899	if (unlikely(ret < 0))
900	goto error_out;
901
902	ret = nvmet_rdma_rw_ctx_init(rsp, addr, key, sig_attrs: &sig_attrs);
903	if (unlikely(ret < 0))
904	goto error_out;
905	rsp->n_rdma += ret;
906
907	if (invalidate)
908	rsp->invalidate_rkey = key;
909
910	return 0;
911
912	error_out:
913	rsp->req.transfer_len = 0;
914	return NVME_SC_INTERNAL;
915	}
916
917	static u16 nvmet_rdma_map_sgl(struct nvmet_rdma_rsp *rsp)
918	{
919	struct nvme_keyed_sgl_desc *sgl = &rsp->req.cmd->common.dptr.ksgl;
920
921	switch (sgl->type >> 4) {
922	case NVME_SGL_FMT_DATA_DESC:
923	switch (sgl->type & 0xf) {
924	case NVME_SGL_FMT_OFFSET:
925	return nvmet_rdma_map_sgl_inline(rsp);
926	default:
927	pr_err("invalid SGL subtype: %#x\n", sgl->type);
928	rsp->req.error_loc =
929	offsetof(struct nvme_common_command, dptr);
930	return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
931	}
932	case NVME_KEY_SGL_FMT_DATA_DESC:
933	switch (sgl->type & 0xf) {
934	case NVME_SGL_FMT_ADDRESS | NVME_SGL_FMT_INVALIDATE:
935	return nvmet_rdma_map_sgl_keyed(rsp, sgl, invalidate: true);
936	case NVME_SGL_FMT_ADDRESS:
937	return nvmet_rdma_map_sgl_keyed(rsp, sgl, invalidate: false);
938	default:
939	pr_err("invalid SGL subtype: %#x\n", sgl->type);
940	rsp->req.error_loc =
941	offsetof(struct nvme_common_command, dptr);
942	return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
943	}
944	default:
945	pr_err("invalid SGL type: %#x\n", sgl->type);
946	rsp->req.error_loc = offsetof(struct nvme_common_command, dptr);
947	return NVME_SC_SGL_INVALID_TYPE | NVME_SC_DNR;
948	}
949	}
950
951	static bool nvmet_rdma_execute_command(struct nvmet_rdma_rsp *rsp)
952	{
953	struct nvmet_rdma_queue *queue = rsp->queue;
954
955	if (unlikely(atomic_sub_return(1 + rsp->n_rdma,
956	&queue->sq_wr_avail) < 0)) {
957	pr_debug("IB send queue full (needed %d): queue %u cntlid %u\n",
958	1 + rsp->n_rdma, queue->idx,
959	queue->nvme_sq.ctrl->cntlid);
960	atomic_add(i: 1 + rsp->n_rdma, v: &queue->sq_wr_avail);
961	return false;
962	}
963
964	if (nvmet_rdma_need_data_in(rsp)) {
965	if (rdma_rw_ctx_post(ctx: &rsp->rw, qp: queue->qp,
966	port_num: queue->cm_id->port_num, cqe: &rsp->read_cqe, NULL))
967	nvmet_req_complete(req: &rsp->req, status: NVME_SC_DATA_XFER_ERROR);
968	} else {
969	rsp->req.execute(&rsp->req);
970	}
971
972	return true;
973	}
974
975	static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
976	struct nvmet_rdma_rsp *cmd)
977	{
978	u16 status;
979
980	ib_dma_sync_single_for_cpu(dev: queue->dev->device,
981	addr: cmd->cmd->sge[0].addr, size: cmd->cmd->sge[0].length,
982	dir: DMA_FROM_DEVICE);
983	ib_dma_sync_single_for_cpu(dev: queue->dev->device,
984	addr: cmd->send_sge.addr, size: cmd->send_sge.length,
985	dir: DMA_TO_DEVICE);
986
987	if (!nvmet_req_init(req: &cmd->req, cq: &queue->nvme_cq,
988	sq: &queue->nvme_sq, ops: &nvmet_rdma_ops))
989	return;
990
991	status = nvmet_rdma_map_sgl(rsp: cmd);
992	if (status)
993	goto out_err;
994
995	if (unlikely(!nvmet_rdma_execute_command(cmd))) {
996	spin_lock(lock: &queue->rsp_wr_wait_lock);
997	list_add_tail(new: &cmd->wait_list, head: &queue->rsp_wr_wait_list);
998	spin_unlock(lock: &queue->rsp_wr_wait_lock);
999	}
1000
1001	return;
1002
1003	out_err:
1004	nvmet_req_complete(req: &cmd->req, status);
1005	}
1006
1007	static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
1008	{
1009	struct nvmet_rdma_cmd *cmd =
1010	container_of(wc->wr_cqe, struct nvmet_rdma_cmd, cqe);
1011	struct nvmet_rdma_queue *queue = wc->qp->qp_context;
1012	struct nvmet_rdma_rsp *rsp;
1013
1014	if (unlikely(wc->status != IB_WC_SUCCESS)) {
1015	if (wc->status != IB_WC_WR_FLUSH_ERR) {
1016	pr_err("RECV for CQE 0x%p failed with status %s (%d)\n",
1017	wc->wr_cqe, ib_wc_status_msg(wc->status),
1018	wc->status);
1019	nvmet_rdma_error_comp(queue);
1020	}
1021	return;
1022	}
1023
1024	if (unlikely(wc->byte_len < sizeof(struct nvme_command))) {
1025	pr_err("Ctrl Fatal Error: capsule size less than 64 bytes\n");
1026	nvmet_rdma_error_comp(queue);
1027	return;
1028	}
1029
1030	cmd->queue = queue;
1031	rsp = nvmet_rdma_get_rsp(queue);
1032	if (unlikely(!rsp)) {
1033	/*
1034	* we get here only under memory pressure,
1035	* silently drop and have the host retry
1036	* as we can't even fail it.
1037	*/
1038	nvmet_rdma_post_recv(ndev: queue->dev, cmd);
1039	return;
1040	}
1041	rsp->queue = queue;
1042	rsp->cmd = cmd;
1043	rsp->flags = 0;
1044	rsp->req.cmd = cmd->nvme_cmd;
1045	rsp->req.port = queue->port;
1046	rsp->n_rdma = 0;
1047	rsp->invalidate_rkey = 0;
1048
1049	if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) {
1050	unsigned long flags;
1051
1052	spin_lock_irqsave(&queue->state_lock, flags);
1053	if (queue->state == NVMET_RDMA_Q_CONNECTING)
1054	list_add_tail(new: &rsp->wait_list, head: &queue->rsp_wait_list);
1055	else
1056	nvmet_rdma_put_rsp(rsp);
1057	spin_unlock_irqrestore(lock: &queue->state_lock, flags);
1058	return;
1059	}
1060
1061	nvmet_rdma_handle_command(queue, cmd: rsp);
1062	}
1063
1064	static void nvmet_rdma_destroy_srq(struct nvmet_rdma_srq *nsrq)
1065	{
1066	nvmet_rdma_free_cmds(ndev: nsrq->ndev, cmds: nsrq->cmds, nr_cmds: nsrq->ndev->srq_size,
1067	admin: false);
1068	ib_destroy_srq(srq: nsrq->srq);
1069
1070	kfree(objp: nsrq);
1071	}
1072
1073	static void nvmet_rdma_destroy_srqs(struct nvmet_rdma_device *ndev)
1074	{
1075	int i;
1076
1077	if (!ndev->srqs)
1078	return;
1079
1080	for (i = 0; i < ndev->srq_count; i++)
1081	nvmet_rdma_destroy_srq(nsrq: ndev->srqs[i]);
1082
1083	kfree(objp: ndev->srqs);
1084	}
1085
1086	static struct nvmet_rdma_srq *
1087	nvmet_rdma_init_srq(struct nvmet_rdma_device *ndev)
1088	{
1089	struct ib_srq_init_attr srq_attr = { NULL, };
1090	size_t srq_size = ndev->srq_size;
1091	struct nvmet_rdma_srq *nsrq;
1092	struct ib_srq *srq;
1093	int ret, i;
1094
1095	nsrq = kzalloc(size: sizeof(*nsrq), GFP_KERNEL);
1096	if (!nsrq)
1097	return ERR_PTR(error: -ENOMEM);
1098
1099	srq_attr.attr.max_wr = srq_size;
1100	srq_attr.attr.max_sge = 1 + ndev->inline_page_count;
1101	srq_attr.attr.srq_limit = 0;
1102	srq_attr.srq_type = IB_SRQT_BASIC;
1103	srq = ib_create_srq(pd: ndev->pd, srq_init_attr: &srq_attr);
1104	if (IS_ERR(ptr: srq)) {
1105	ret = PTR_ERR(ptr: srq);
1106	goto out_free;
1107	}
1108
1109	nsrq->cmds = nvmet_rdma_alloc_cmds(ndev, nr_cmds: srq_size, admin: false);
1110	if (IS_ERR(ptr: nsrq->cmds)) {
1111	ret = PTR_ERR(ptr: nsrq->cmds);
1112	goto out_destroy_srq;
1113	}
1114
1115	nsrq->srq = srq;
1116	nsrq->ndev = ndev;
1117
1118	for (i = 0; i < srq_size; i++) {
1119	nsrq->cmds[i].nsrq = nsrq;
1120	ret = nvmet_rdma_post_recv(ndev, cmd: &nsrq->cmds[i]);
1121	if (ret)
1122	goto out_free_cmds;
1123	}
1124
1125	return nsrq;
1126
1127	out_free_cmds:
1128	nvmet_rdma_free_cmds(ndev, cmds: nsrq->cmds, nr_cmds: srq_size, admin: false);
1129	out_destroy_srq:
1130	ib_destroy_srq(srq);
1131	out_free:
1132	kfree(objp: nsrq);
1133	return ERR_PTR(error: ret);
1134	}
1135
1136	static int nvmet_rdma_init_srqs(struct nvmet_rdma_device *ndev)
1137	{
1138	int i, ret;
1139
1140	if (!ndev->device->attrs.max_srq_wr || !ndev->device->attrs.max_srq) {
1141	/*
1142	* If SRQs aren't supported we just go ahead and use normal
1143	* non-shared receive queues.
1144	*/
1145	pr_info("SRQ requested but not supported.\n");
1146	return 0;
1147	}
1148
1149	ndev->srq_size = min(ndev->device->attrs.max_srq_wr,
1150	nvmet_rdma_srq_size);
1151	ndev->srq_count = min(ndev->device->num_comp_vectors,
1152	ndev->device->attrs.max_srq);
1153
1154	ndev->srqs = kcalloc(n: ndev->srq_count, size: sizeof(*ndev->srqs), GFP_KERNEL);
1155	if (!ndev->srqs)
1156	return -ENOMEM;
1157
1158	for (i = 0; i < ndev->srq_count; i++) {
1159	ndev->srqs[i] = nvmet_rdma_init_srq(ndev);
1160	if (IS_ERR(ptr: ndev->srqs[i])) {
1161	ret = PTR_ERR(ptr: ndev->srqs[i]);
1162	goto err_srq;
1163	}
1164	}
1165
1166	return 0;
1167
1168	err_srq:
1169	while (--i >= 0)
1170	nvmet_rdma_destroy_srq(nsrq: ndev->srqs[i]);
1171	kfree(objp: ndev->srqs);
1172	return ret;
1173	}
1174
1175	static void nvmet_rdma_free_dev(struct kref *ref)
1176	{
1177	struct nvmet_rdma_device *ndev =
1178	container_of(ref, struct nvmet_rdma_device, ref);
1179
1180	mutex_lock(&device_list_mutex);
1181	list_del(entry: &ndev->entry);
1182	mutex_unlock(lock: &device_list_mutex);
1183
1184	nvmet_rdma_destroy_srqs(ndev);
1185	ib_dealloc_pd(pd: ndev->pd);
1186
1187	kfree(objp: ndev);
1188	}
1189
1190	static struct nvmet_rdma_device *
1191	nvmet_rdma_find_get_device(struct rdma_cm_id *cm_id)
1192	{
1193	struct nvmet_rdma_port *port = cm_id->context;
1194	struct nvmet_port *nport = port->nport;
1195	struct nvmet_rdma_device *ndev;
1196	int inline_page_count;
1197	int inline_sge_count;
1198	int ret;
1199
1200	mutex_lock(&device_list_mutex);
1201	list_for_each_entry(ndev, &device_list, entry) {
1202	if (ndev->device->node_guid == cm_id->device->node_guid &&
1203	kref_get_unless_zero(kref: &ndev->ref))
1204	goto out_unlock;
1205	}
1206
1207	ndev = kzalloc(size: sizeof(*ndev), GFP_KERNEL);
1208	if (!ndev)
1209	goto out_err;
1210
1211	inline_page_count = num_pages(len: nport->inline_data_size);
1212	inline_sge_count = max(cm_id->device->attrs.max_sge_rd,
1213	cm_id->device->attrs.max_recv_sge) - 1;
1214	if (inline_page_count > inline_sge_count) {
1215	pr_warn("inline_data_size %d cannot be supported by device %s. Reducing to %lu.\n",
1216	nport->inline_data_size, cm_id->device->name,
1217	inline_sge_count * PAGE_SIZE);
1218	nport->inline_data_size = inline_sge_count * PAGE_SIZE;
1219	inline_page_count = inline_sge_count;
1220	}
1221	ndev->inline_data_size = nport->inline_data_size;
1222	ndev->inline_page_count = inline_page_count;
1223
1224	if (nport->pi_enable && !(cm_id->device->attrs.kernel_cap_flags &
1225	IBK_INTEGRITY_HANDOVER)) {
1226	pr_warn("T10-PI is not supported by device %s. Disabling it\n",
1227	cm_id->device->name);
1228	nport->pi_enable = false;
1229	}
1230
1231	ndev->device = cm_id->device;
1232	kref_init(kref: &ndev->ref);
1233
1234	ndev->pd = ib_alloc_pd(ndev->device, 0);
1235	if (IS_ERR(ptr: ndev->pd))
1236	goto out_free_dev;
1237
1238	if (nvmet_rdma_use_srq) {
1239	ret = nvmet_rdma_init_srqs(ndev);
1240	if (ret)
1241	goto out_free_pd;
1242	}
1243
1244	list_add(new: &ndev->entry, head: &device_list);
1245	out_unlock:
1246	mutex_unlock(lock: &device_list_mutex);
1247	pr_debug("added %s.\n", ndev->device->name);
1248	return ndev;
1249
1250	out_free_pd:
1251	ib_dealloc_pd(pd: ndev->pd);
1252	out_free_dev:
1253	kfree(objp: ndev);
1254	out_err:
1255	mutex_unlock(lock: &device_list_mutex);
1256	return NULL;
1257	}
1258
1259	static int nvmet_rdma_create_queue_ib(struct nvmet_rdma_queue *queue)
1260	{
1261	struct ib_qp_init_attr qp_attr = { };
1262	struct nvmet_rdma_device *ndev = queue->dev;
1263	int nr_cqe, ret, i, factor;
1264
1265	/*
1266	* Reserve CQ slots for RECV + RDMA_READ/RDMA_WRITE + RDMA_SEND.
1267	*/
1268	nr_cqe = queue->recv_queue_size + 2 * queue->send_queue_size;
1269
1270	queue->cq = ib_cq_pool_get(dev: ndev->device, nr_cqe: nr_cqe + 1,
1271	comp_vector_hint: queue->comp_vector, poll_ctx: IB_POLL_WORKQUEUE);
1272	if (IS_ERR(ptr: queue->cq)) {
1273	ret = PTR_ERR(ptr: queue->cq);
1274	pr_err("failed to create CQ cqe= %d ret= %d\n",
1275	nr_cqe + 1, ret);
1276	goto out;
1277	}
1278
1279	qp_attr.qp_context = queue;
1280	qp_attr.event_handler = nvmet_rdma_qp_event;
1281	qp_attr.send_cq = queue->cq;
1282	qp_attr.recv_cq = queue->cq;
1283	qp_attr.sq_sig_type = IB_SIGNAL_REQ_WR;
1284	qp_attr.qp_type = IB_QPT_RC;
1285	/* +1 for drain */
1286	qp_attr.cap.max_send_wr = queue->send_queue_size + 1;
1287	factor = rdma_rw_mr_factor(device: ndev->device, port_num: queue->cm_id->port_num,
1288	maxpages: 1 << NVMET_RDMA_MAX_MDTS);
1289	qp_attr.cap.max_rdma_ctxs = queue->send_queue_size * factor;
1290	qp_attr.cap.max_send_sge = max(ndev->device->attrs.max_sge_rd,
1291	ndev->device->attrs.max_send_sge);
1292
1293	if (queue->nsrq) {
1294	qp_attr.srq = queue->nsrq->srq;
1295	} else {
1296	/* +1 for drain */
1297	qp_attr.cap.max_recv_wr = 1 + queue->recv_queue_size;
1298	qp_attr.cap.max_recv_sge = 1 + ndev->inline_page_count;
1299	}
1300
1301	if (queue->port->pi_enable && queue->host_qid)
1302	qp_attr.create_flags |= IB_QP_CREATE_INTEGRITY_EN;
1303
1304	ret = rdma_create_qp(id: queue->cm_id, pd: ndev->pd, qp_init_attr: &qp_attr);
1305	if (ret) {
1306	pr_err("failed to create_qp ret= %d\n", ret);
1307	goto err_destroy_cq;
1308	}
1309	queue->qp = queue->cm_id->qp;
1310
1311	atomic_set(v: &queue->sq_wr_avail, i: qp_attr.cap.max_send_wr);
1312
1313	pr_debug("%s: max_cqe= %d max_sge= %d sq_size = %d cm_id= %p\n",
1314	__func__, queue->cq->cqe, qp_attr.cap.max_send_sge,
1315	qp_attr.cap.max_send_wr, queue->cm_id);
1316
1317	if (!queue->nsrq) {
1318	for (i = 0; i < queue->recv_queue_size; i++) {
1319	queue->cmds[i].queue = queue;
1320	ret = nvmet_rdma_post_recv(ndev, cmd: &queue->cmds[i]);
1321	if (ret)
1322	goto err_destroy_qp;
1323	}
1324	}
1325
1326	out:
1327	return ret;
1328
1329	err_destroy_qp:
1330	rdma_destroy_qp(id: queue->cm_id);
1331	err_destroy_cq:
1332	ib_cq_pool_put(cq: queue->cq, nr_cqe: nr_cqe + 1);
1333	goto out;
1334	}
1335
1336	static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
1337	{
1338	ib_drain_qp(qp: queue->qp);
1339	if (queue->cm_id)
1340	rdma_destroy_id(id: queue->cm_id);
1341	ib_destroy_qp(qp: queue->qp);
1342	ib_cq_pool_put(cq: queue->cq, nr_cqe: queue->recv_queue_size + 2 *
1343	queue->send_queue_size + 1);
1344	}
1345
1346	static void nvmet_rdma_free_queue(struct nvmet_rdma_queue *queue)
1347	{
1348	pr_debug("freeing queue %d\n", queue->idx);
1349
1350	nvmet_sq_destroy(sq: &queue->nvme_sq);
1351
1352	nvmet_rdma_destroy_queue_ib(queue);
1353	if (!queue->nsrq) {
1354	nvmet_rdma_free_cmds(ndev: queue->dev, cmds: queue->cmds,
1355	nr_cmds: queue->recv_queue_size,
1356	admin: !queue->host_qid);
1357	}
1358	nvmet_rdma_free_rsps(queue);
1359	ida_free(&nvmet_rdma_queue_ida, id: queue->idx);
1360	kfree(objp: queue);
1361	}
1362
1363	static void nvmet_rdma_release_queue_work(struct work_struct *w)
1364	{
1365	struct nvmet_rdma_queue *queue =
1366	container_of(w, struct nvmet_rdma_queue, release_work);
1367	struct nvmet_rdma_device *dev = queue->dev;
1368
1369	nvmet_rdma_free_queue(queue);
1370
1371	kref_put(kref: &dev->ref, release: nvmet_rdma_free_dev);
1372	}
1373
1374	static int
1375	nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
1376	struct nvmet_rdma_queue *queue)
1377	{
1378	struct nvme_rdma_cm_req *req;
1379
1380	req = (struct nvme_rdma_cm_req *)conn->private_data;
1381	if (!req || conn->private_data_len == 0)
1382	return NVME_RDMA_CM_INVALID_LEN;
1383
1384	if (le16_to_cpu(req->recfmt) != NVME_RDMA_CM_FMT_1_0)
1385	return NVME_RDMA_CM_INVALID_RECFMT;
1386
1387	queue->host_qid = le16_to_cpu(req->qid);
1388
1389	/*
1390	* req->hsqsize corresponds to our recv queue size plus 1
1391	* req->hrqsize corresponds to our send queue size
1392	*/
1393	queue->recv_queue_size = le16_to_cpu(req->hsqsize) + 1;
1394	queue->send_queue_size = le16_to_cpu(req->hrqsize);
1395
1396	if (!queue->host_qid && queue->recv_queue_size > NVME_AQ_DEPTH)
1397	return NVME_RDMA_CM_INVALID_HSQSIZE;
1398
1399	/* XXX: Should we enforce some kind of max for IO queues? */
1400
1401	return 0;
1402	}
1403
1404	static int nvmet_rdma_cm_reject(struct rdma_cm_id *cm_id,
1405	enum nvme_rdma_cm_status status)
1406	{
1407	struct nvme_rdma_cm_rej rej;
1408
1409	pr_debug("rejecting connect request: status %d (%s)\n",
1410	status, nvme_rdma_cm_msg(status));
1411
1412	rej.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
1413	rej.sts = cpu_to_le16(status);
1414
1415	return rdma_reject(id: cm_id, private_data: (void *)&rej, private_data_len: sizeof(rej),
1416	reason: IB_CM_REJ_CONSUMER_DEFINED);
1417	}
1418
1419	static struct nvmet_rdma_queue *
1420	nvmet_rdma_alloc_queue(struct nvmet_rdma_device *ndev,
1421	struct rdma_cm_id *cm_id,
1422	struct rdma_cm_event *event)
1423	{
1424	struct nvmet_rdma_port *port = cm_id->context;
1425	struct nvmet_rdma_queue *queue;
1426	int ret;
1427
1428	queue = kzalloc(size: sizeof(*queue), GFP_KERNEL);
1429	if (!queue) {
1430	ret = NVME_RDMA_CM_NO_RSC;
1431	goto out_reject;
1432	}
1433
1434	ret = nvmet_sq_init(sq: &queue->nvme_sq);
1435	if (ret) {
1436	ret = NVME_RDMA_CM_NO_RSC;
1437	goto out_free_queue;
1438	}
1439
1440	ret = nvmet_rdma_parse_cm_connect_req(conn: &event->param.conn, queue);
1441	if (ret)
1442	goto out_destroy_sq;
1443
1444	/*
1445	* Schedules the actual release because calling rdma_destroy_id from
1446	* inside a CM callback would trigger a deadlock. (great API design..)
1447	*/
1448	INIT_WORK(&queue->release_work, nvmet_rdma_release_queue_work);
1449	queue->dev = ndev;
1450	queue->cm_id = cm_id;
1451	queue->port = port->nport;
1452
1453	spin_lock_init(&queue->state_lock);
1454	queue->state = NVMET_RDMA_Q_CONNECTING;
1455	INIT_LIST_HEAD(list: &queue->rsp_wait_list);
1456	INIT_LIST_HEAD(list: &queue->rsp_wr_wait_list);
1457	spin_lock_init(&queue->rsp_wr_wait_lock);
1458	INIT_LIST_HEAD(list: &queue->free_rsps);
1459	spin_lock_init(&queue->rsps_lock);
1460	INIT_LIST_HEAD(list: &queue->queue_list);
1461
1462	queue->idx = ida_alloc(ida: &nvmet_rdma_queue_ida, GFP_KERNEL);
1463	if (queue->idx < 0) {
1464	ret = NVME_RDMA_CM_NO_RSC;
1465	goto out_destroy_sq;
1466	}
1467
1468	/*
1469	* Spread the io queues across completion vectors,
1470	* but still keep all admin queues on vector 0.
1471	*/
1472	queue->comp_vector = !queue->host_qid ? 0 :
1473	queue->idx % ndev->device->num_comp_vectors;
1474
1475
1476	ret = nvmet_rdma_alloc_rsps(queue);
1477	if (ret) {
1478	ret = NVME_RDMA_CM_NO_RSC;
1479	goto out_ida_remove;
1480	}
1481
1482	if (ndev->srqs) {
1483	queue->nsrq = ndev->srqs[queue->comp_vector % ndev->srq_count];
1484	} else {
1485	queue->cmds = nvmet_rdma_alloc_cmds(ndev,
1486	nr_cmds: queue->recv_queue_size,
1487	admin: !queue->host_qid);
1488	if (IS_ERR(ptr: queue->cmds)) {
1489	ret = NVME_RDMA_CM_NO_RSC;
1490	goto out_free_responses;
1491	}
1492	}
1493
1494	ret = nvmet_rdma_create_queue_ib(queue);
1495	if (ret) {
1496	pr_err("%s: creating RDMA queue failed (%d).\n",
1497	__func__, ret);
1498	ret = NVME_RDMA_CM_NO_RSC;
1499	goto out_free_cmds;
1500	}
1501
1502	return queue;
1503
1504	out_free_cmds:
1505	if (!queue->nsrq) {
1506	nvmet_rdma_free_cmds(ndev: queue->dev, cmds: queue->cmds,
1507	nr_cmds: queue->recv_queue_size,
1508	admin: !queue->host_qid);
1509	}
1510	out_free_responses:
1511	nvmet_rdma_free_rsps(queue);
1512	out_ida_remove:
1513	ida_free(&nvmet_rdma_queue_ida, id: queue->idx);
1514	out_destroy_sq:
1515	nvmet_sq_destroy(sq: &queue->nvme_sq);
1516	out_free_queue:
1517	kfree(objp: queue);
1518	out_reject:
1519	nvmet_rdma_cm_reject(cm_id, status: ret);
1520	return NULL;
1521	}
1522
1523	static void nvmet_rdma_qp_event(struct ib_event *event, void *priv)
1524	{
1525	struct nvmet_rdma_queue *queue = priv;
1526
1527	switch (event->event) {
1528	case IB_EVENT_COMM_EST:
1529	rdma_notify(id: queue->cm_id, event: event->event);
1530	break;
1531	case IB_EVENT_QP_LAST_WQE_REACHED:
1532	pr_debug("received last WQE reached event for queue=0x%p\n",
1533	queue);
1534	break;
1535	default:
1536	pr_err("received IB QP event: %s (%d)\n",
1537	ib_event_msg(event->event), event->event);
1538	break;
1539	}
1540	}
1541
1542	static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id,
1543	struct nvmet_rdma_queue *queue,
1544	struct rdma_conn_param *p)
1545	{
1546	struct rdma_conn_param param = { };
1547	struct nvme_rdma_cm_rep priv = { };
1548	int ret = -ENOMEM;
1549
1550	param.rnr_retry_count = 7;
1551	param.flow_control = 1;
1552	param.initiator_depth = min_t(u8, p->initiator_depth,
1553	queue->dev->device->attrs.max_qp_init_rd_atom);
1554	param.private_data = &priv;
1555	param.private_data_len = sizeof(priv);
1556	priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
1557	priv.crqsize = cpu_to_le16(queue->recv_queue_size);
1558
1559	ret = rdma_accept(id: cm_id, conn_param: &param);
1560	if (ret)
1561	pr_err("rdma_accept failed (error code = %d)\n", ret);
1562
1563	return ret;
1564	}
1565
1566	static int nvmet_rdma_queue_connect(struct rdma_cm_id *cm_id,
1567	struct rdma_cm_event *event)
1568	{
1569	struct nvmet_rdma_device *ndev;
1570	struct nvmet_rdma_queue *queue;
1571	int ret = -EINVAL;
1572
1573	ndev = nvmet_rdma_find_get_device(cm_id);
1574	if (!ndev) {
1575	nvmet_rdma_cm_reject(cm_id, status: NVME_RDMA_CM_NO_RSC);
1576	return -ECONNREFUSED;
1577	}
1578
1579	queue = nvmet_rdma_alloc_queue(ndev, cm_id, event);
1580	if (!queue) {
1581	ret = -ENOMEM;
1582	goto put_device;
1583	}
1584
1585	if (queue->host_qid == 0) {
1586	struct nvmet_rdma_queue *q;
1587	int pending = 0;
1588
1589	/* Check for pending controller teardown */
1590	mutex_lock(&nvmet_rdma_queue_mutex);
1591	list_for_each_entry(q, &nvmet_rdma_queue_list, queue_list) {
1592	if (q->nvme_sq.ctrl == queue->nvme_sq.ctrl &&
1593	q->state == NVMET_RDMA_Q_DISCONNECTING)
1594	pending++;
1595	}
1596	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1597	if (pending > NVMET_RDMA_BACKLOG)
1598	return NVME_SC_CONNECT_CTRL_BUSY;
1599	}
1600
1601	ret = nvmet_rdma_cm_accept(cm_id, queue, p: &event->param.conn);
1602	if (ret) {
1603	/*
1604	* Don't destroy the cm_id in free path, as we implicitly
1605	* destroy the cm_id here with non-zero ret code.
1606	*/
1607	queue->cm_id = NULL;
1608	goto free_queue;
1609	}
1610
1611	mutex_lock(&nvmet_rdma_queue_mutex);
1612	list_add_tail(new: &queue->queue_list, head: &nvmet_rdma_queue_list);
1613	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1614
1615	return 0;
1616
1617	free_queue:
1618	nvmet_rdma_free_queue(queue);
1619	put_device:
1620	kref_put(kref: &ndev->ref, release: nvmet_rdma_free_dev);
1621
1622	return ret;
1623	}
1624
1625	static void nvmet_rdma_queue_established(struct nvmet_rdma_queue *queue)
1626	{
1627	unsigned long flags;
1628
1629	spin_lock_irqsave(&queue->state_lock, flags);
1630	if (queue->state != NVMET_RDMA_Q_CONNECTING) {
1631	pr_warn("trying to establish a connected queue\n");
1632	goto out_unlock;
1633	}
1634	queue->state = NVMET_RDMA_Q_LIVE;
1635
1636	while (!list_empty(head: &queue->rsp_wait_list)) {
1637	struct nvmet_rdma_rsp *cmd;
1638
1639	cmd = list_first_entry(&queue->rsp_wait_list,
1640	struct nvmet_rdma_rsp, wait_list);
1641	list_del(entry: &cmd->wait_list);
1642
1643	spin_unlock_irqrestore(lock: &queue->state_lock, flags);
1644	nvmet_rdma_handle_command(queue, cmd);
1645	spin_lock_irqsave(&queue->state_lock, flags);
1646	}
1647
1648	out_unlock:
1649	spin_unlock_irqrestore(lock: &queue->state_lock, flags);
1650	}
1651
1652	static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
1653	{
1654	bool disconnect = false;
1655	unsigned long flags;
1656
1657	pr_debug("cm_id= %p queue->state= %d\n", queue->cm_id, queue->state);
1658
1659	spin_lock_irqsave(&queue->state_lock, flags);
1660	switch (queue->state) {
1661	case NVMET_RDMA_Q_CONNECTING:
1662	while (!list_empty(head: &queue->rsp_wait_list)) {
1663	struct nvmet_rdma_rsp *rsp;
1664
1665	rsp = list_first_entry(&queue->rsp_wait_list,
1666	struct nvmet_rdma_rsp,
1667	wait_list);
1668	list_del(entry: &rsp->wait_list);
1669	nvmet_rdma_put_rsp(rsp);
1670	}
1671	fallthrough;
1672	case NVMET_RDMA_Q_LIVE:
1673	queue->state = NVMET_RDMA_Q_DISCONNECTING;
1674	disconnect = true;
1675	break;
1676	case NVMET_RDMA_Q_DISCONNECTING:
1677	break;
1678	}
1679	spin_unlock_irqrestore(lock: &queue->state_lock, flags);
1680
1681	if (disconnect) {
1682	rdma_disconnect(id: queue->cm_id);
1683	queue_work(wq: nvmet_wq, work: &queue->release_work);
1684	}
1685	}
1686
1687	static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
1688	{
1689	bool disconnect = false;
1690
1691	mutex_lock(&nvmet_rdma_queue_mutex);
1692	if (!list_empty(head: &queue->queue_list)) {
1693	list_del_init(entry: &queue->queue_list);
1694	disconnect = true;
1695	}
1696	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1697
1698	if (disconnect)
1699	__nvmet_rdma_queue_disconnect(queue);
1700	}
1701
1702	static void nvmet_rdma_queue_connect_fail(struct rdma_cm_id *cm_id,
1703	struct nvmet_rdma_queue *queue)
1704	{
1705	WARN_ON_ONCE(queue->state != NVMET_RDMA_Q_CONNECTING);
1706
1707	mutex_lock(&nvmet_rdma_queue_mutex);
1708	if (!list_empty(head: &queue->queue_list))
1709	list_del_init(entry: &queue->queue_list);
1710	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1711
1712	pr_err("failed to connect queue %d\n", queue->idx);
1713	queue_work(wq: nvmet_wq, work: &queue->release_work);
1714	}
1715
1716	/**
1717	* nvmet_rdma_device_removal() - Handle RDMA device removal
1718	* @cm_id: rdma_cm id, used for nvmet port
1719	* @queue: nvmet rdma queue (cm id qp_context)
1720	*
1721	* DEVICE_REMOVAL event notifies us that the RDMA device is about
1722	* to unplug. Note that this event can be generated on a normal
1723	* queue cm_id and/or a device bound listener cm_id (where in this
1724	* case queue will be null).
1725	*
1726	* We registered an ib_client to handle device removal for queues,
1727	* so we only need to handle the listening port cm_ids. In this case
1728	* we nullify the priv to prevent double cm_id destruction and destroying
1729	* the cm_id implicitely by returning a non-zero rc to the callout.
1730	*/
1731	static int nvmet_rdma_device_removal(struct rdma_cm_id *cm_id,
1732	struct nvmet_rdma_queue *queue)
1733	{
1734	struct nvmet_rdma_port *port;
1735
1736	if (queue) {
1737	/*
1738	* This is a queue cm_id. we have registered
1739	* an ib_client to handle queues removal
1740	* so don't interfear and just return.
1741	*/
1742	return 0;
1743	}
1744
1745	port = cm_id->context;
1746
1747	/*
1748	* This is a listener cm_id. Make sure that
1749	* future remove_port won't invoke a double
1750	* cm_id destroy. use atomic xchg to make sure
1751	* we don't compete with remove_port.
1752	*/
1753	if (xchg(&port->cm_id, NULL) != cm_id)
1754	return 0;
1755
1756	/*
1757	* We need to return 1 so that the core will destroy
1758	* it's own ID. What a great API design..
1759	*/
1760	return 1;
1761	}
1762
1763	static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id,
1764	struct rdma_cm_event *event)
1765	{
1766	struct nvmet_rdma_queue *queue = NULL;
1767	int ret = 0;
1768
1769	if (cm_id->qp)
1770	queue = cm_id->qp->qp_context;
1771
1772	pr_debug("%s (%d): status %d id %p\n",
1773	rdma_event_msg(event->event), event->event,
1774	event->status, cm_id);
1775
1776	switch (event->event) {
1777	case RDMA_CM_EVENT_CONNECT_REQUEST:
1778	ret = nvmet_rdma_queue_connect(cm_id, event);
1779	break;
1780	case RDMA_CM_EVENT_ESTABLISHED:
1781	nvmet_rdma_queue_established(queue);
1782	break;
1783	case RDMA_CM_EVENT_ADDR_CHANGE:
1784	if (!queue) {
1785	struct nvmet_rdma_port *port = cm_id->context;
1786
1787	queue_delayed_work(wq: nvmet_wq, dwork: &port->repair_work, delay: 0);
1788	break;
1789	}
1790	fallthrough;
1791	case RDMA_CM_EVENT_DISCONNECTED:
1792	case RDMA_CM_EVENT_TIMEWAIT_EXIT:
1793	nvmet_rdma_queue_disconnect(queue);
1794	break;
1795	case RDMA_CM_EVENT_DEVICE_REMOVAL:
1796	ret = nvmet_rdma_device_removal(cm_id, queue);
1797	break;
1798	case RDMA_CM_EVENT_REJECTED:
1799	pr_debug("Connection rejected: %s\n",
1800	rdma_reject_msg(cm_id, event->status));
1801	fallthrough;
1802	case RDMA_CM_EVENT_UNREACHABLE:
1803	case RDMA_CM_EVENT_CONNECT_ERROR:
1804	nvmet_rdma_queue_connect_fail(cm_id, queue);
1805	break;
1806	default:
1807	pr_err("received unrecognized RDMA CM event %d\n",
1808	event->event);
1809	break;
1810	}
1811
1812	return ret;
1813	}
1814
1815	static void nvmet_rdma_delete_ctrl(struct nvmet_ctrl *ctrl)
1816	{
1817	struct nvmet_rdma_queue *queue;
1818
1819	restart:
1820	mutex_lock(&nvmet_rdma_queue_mutex);
1821	list_for_each_entry(queue, &nvmet_rdma_queue_list, queue_list) {
1822	if (queue->nvme_sq.ctrl == ctrl) {
1823	list_del_init(entry: &queue->queue_list);
1824	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1825
1826	__nvmet_rdma_queue_disconnect(queue);
1827	goto restart;
1828	}
1829	}
1830	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1831	}
1832
1833	static void nvmet_rdma_destroy_port_queues(struct nvmet_rdma_port *port)
1834	{
1835	struct nvmet_rdma_queue *queue, *tmp;
1836	struct nvmet_port *nport = port->nport;
1837
1838	mutex_lock(&nvmet_rdma_queue_mutex);
1839	list_for_each_entry_safe(queue, tmp, &nvmet_rdma_queue_list,
1840	queue_list) {
1841	if (queue->port != nport)
1842	continue;
1843
1844	list_del_init(entry: &queue->queue_list);
1845	__nvmet_rdma_queue_disconnect(queue);
1846	}
1847	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
1848	}
1849
1850	static void nvmet_rdma_disable_port(struct nvmet_rdma_port *port)
1851	{
1852	struct rdma_cm_id *cm_id = xchg(&port->cm_id, NULL);
1853
1854	if (cm_id)
1855	rdma_destroy_id(id: cm_id);
1856
1857	/*
1858	* Destroy the remaining queues, which are not belong to any
1859	* controller yet. Do it here after the RDMA-CM was destroyed
1860	* guarantees that no new queue will be created.
1861	*/
1862	nvmet_rdma_destroy_port_queues(port);
1863	}
1864
1865	static int nvmet_rdma_enable_port(struct nvmet_rdma_port *port)
1866	{
1867	struct sockaddr *addr = (struct sockaddr *)&port->addr;
1868	struct rdma_cm_id *cm_id;
1869	int ret;
1870
1871	cm_id = rdma_create_id(&init_net, nvmet_rdma_cm_handler, port,
1872	RDMA_PS_TCP, IB_QPT_RC);
1873	if (IS_ERR(ptr: cm_id)) {
1874	pr_err("CM ID creation failed\n");
1875	return PTR_ERR(ptr: cm_id);
1876	}
1877
1878	/*
1879	* Allow both IPv4 and IPv6 sockets to bind a single port
1880	* at the same time.
1881	*/
1882	ret = rdma_set_afonly(id: cm_id, afonly: 1);
1883	if (ret) {
1884	pr_err("rdma_set_afonly failed (%d)\n", ret);
1885	goto out_destroy_id;
1886	}
1887
1888	ret = rdma_bind_addr(id: cm_id, addr);
1889	if (ret) {
1890	pr_err("binding CM ID to %pISpcs failed (%d)\n", addr, ret);
1891	goto out_destroy_id;
1892	}
1893
1894	ret = rdma_listen(id: cm_id, NVMET_RDMA_BACKLOG);
1895	if (ret) {
1896	pr_err("listening to %pISpcs failed (%d)\n", addr, ret);
1897	goto out_destroy_id;
1898	}
1899
1900	port->cm_id = cm_id;
1901	return 0;
1902
1903	out_destroy_id:
1904	rdma_destroy_id(id: cm_id);
1905	return ret;
1906	}
1907
1908	static void nvmet_rdma_repair_port_work(struct work_struct *w)
1909	{
1910	struct nvmet_rdma_port *port = container_of(to_delayed_work(w),
1911	struct nvmet_rdma_port, repair_work);
1912	int ret;
1913
1914	nvmet_rdma_disable_port(port);
1915	ret = nvmet_rdma_enable_port(port);
1916	if (ret)
1917	queue_delayed_work(wq: nvmet_wq, dwork: &port->repair_work, delay: 5 * HZ);
1918	}
1919
1920	static int nvmet_rdma_add_port(struct nvmet_port *nport)
1921	{
1922	struct nvmet_rdma_port *port;
1923	__kernel_sa_family_t af;
1924	int ret;
1925
1926	port = kzalloc(size: sizeof(*port), GFP_KERNEL);
1927	if (!port)
1928	return -ENOMEM;
1929
1930	nport->priv = port;
1931	port->nport = nport;
1932	INIT_DELAYED_WORK(&port->repair_work, nvmet_rdma_repair_port_work);
1933
1934	switch (nport->disc_addr.adrfam) {
1935	case NVMF_ADDR_FAMILY_IP4:
1936	af = AF_INET;
1937	break;
1938	case NVMF_ADDR_FAMILY_IP6:
1939	af = AF_INET6;
1940	break;
1941	default:
1942	pr_err("address family %d not supported\n",
1943	nport->disc_addr.adrfam);
1944	ret = -EINVAL;
1945	goto out_free_port;
1946	}
1947
1948	if (nport->inline_data_size < 0) {
1949	nport->inline_data_size = NVMET_RDMA_DEFAULT_INLINE_DATA_SIZE;
1950	} else if (nport->inline_data_size > NVMET_RDMA_MAX_INLINE_DATA_SIZE) {
1951	pr_warn("inline_data_size %u is too large, reducing to %u\n",
1952	nport->inline_data_size,
1953	NVMET_RDMA_MAX_INLINE_DATA_SIZE);
1954	nport->inline_data_size = NVMET_RDMA_MAX_INLINE_DATA_SIZE;
1955	}
1956
1957	if (nport->max_queue_size < 0) {
1958	nport->max_queue_size = NVME_RDMA_DEFAULT_QUEUE_SIZE;
1959	} else if (nport->max_queue_size > NVME_RDMA_MAX_QUEUE_SIZE) {
1960	pr_warn("max_queue_size %u is too large, reducing to %u\n",
1961	nport->max_queue_size, NVME_RDMA_MAX_QUEUE_SIZE);
1962	nport->max_queue_size = NVME_RDMA_MAX_QUEUE_SIZE;
1963	}
1964
1965	ret = inet_pton_with_scope(net: &init_net, af, src: nport->disc_addr.traddr,
1966	port: nport->disc_addr.trsvcid, addr: &port->addr);
1967	if (ret) {
1968	pr_err("malformed ip/port passed: %s:%s\n",
1969	nport->disc_addr.traddr, nport->disc_addr.trsvcid);
1970	goto out_free_port;
1971	}
1972
1973	ret = nvmet_rdma_enable_port(port);
1974	if (ret)
1975	goto out_free_port;
1976
1977	pr_info("enabling port %d (%pISpcs)\n",
1978	le16_to_cpu(nport->disc_addr.portid),
1979	(struct sockaddr *)&port->addr);
1980
1981	return 0;
1982
1983	out_free_port:
1984	kfree(objp: port);
1985	return ret;
1986	}
1987
1988	static void nvmet_rdma_remove_port(struct nvmet_port *nport)
1989	{
1990	struct nvmet_rdma_port *port = nport->priv;
1991
1992	cancel_delayed_work_sync(dwork: &port->repair_work);
1993	nvmet_rdma_disable_port(port);
1994	kfree(objp: port);
1995	}
1996
1997	static void nvmet_rdma_disc_port_addr(struct nvmet_req *req,
1998	struct nvmet_port *nport, char *traddr)
1999	{
2000	struct nvmet_rdma_port *port = nport->priv;
2001	struct rdma_cm_id *cm_id = port->cm_id;
2002
2003	if (inet_addr_is_any(addr: (struct sockaddr *)&cm_id->route.addr.src_addr)) {
2004	struct nvmet_rdma_rsp *rsp =
2005	container_of(req, struct nvmet_rdma_rsp, req);
2006	struct rdma_cm_id *req_cm_id = rsp->queue->cm_id;
2007	struct sockaddr *addr = (void *)&req_cm_id->route.addr.src_addr;
2008
2009	sprintf(buf: traddr, fmt: "%pISc", addr);
2010	} else {
2011	memcpy(traddr, nport->disc_addr.traddr, NVMF_TRADDR_SIZE);
2012	}
2013	}
2014
2015	static u8 nvmet_rdma_get_mdts(const struct nvmet_ctrl *ctrl)
2016	{
2017	if (ctrl->pi_support)
2018	return NVMET_RDMA_MAX_METADATA_MDTS;
2019	return NVMET_RDMA_MAX_MDTS;
2020	}
2021
2022	static u16 nvmet_rdma_get_max_queue_size(const struct nvmet_ctrl *ctrl)
2023	{
2024	if (ctrl->pi_support)
2025	return NVME_RDMA_MAX_METADATA_QUEUE_SIZE;
2026	return NVME_RDMA_MAX_QUEUE_SIZE;
2027	}
2028
2029	static const struct nvmet_fabrics_ops nvmet_rdma_ops = {
2030	.owner = THIS_MODULE,
2031	.type = NVMF_TRTYPE_RDMA,
2032	.msdbd = 1,
2033	.flags = NVMF_KEYED_SGLS | NVMF_METADATA_SUPPORTED,
2034	.add_port = nvmet_rdma_add_port,
2035	.remove_port = nvmet_rdma_remove_port,
2036	.queue_response = nvmet_rdma_queue_response,
2037	.delete_ctrl = nvmet_rdma_delete_ctrl,
2038	.disc_traddr = nvmet_rdma_disc_port_addr,
2039	.get_mdts = nvmet_rdma_get_mdts,
2040	.get_max_queue_size = nvmet_rdma_get_max_queue_size,
2041	};
2042
2043	static void nvmet_rdma_remove_one(struct ib_device *ib_device, void *client_data)
2044	{
2045	struct nvmet_rdma_queue *queue, *tmp;
2046	struct nvmet_rdma_device *ndev;
2047	bool found = false;
2048
2049	mutex_lock(&device_list_mutex);
2050	list_for_each_entry(ndev, &device_list, entry) {
2051	if (ndev->device == ib_device) {
2052	found = true;
2053	break;
2054	}
2055	}
2056	mutex_unlock(lock: &device_list_mutex);
2057
2058	if (!found)
2059	return;
2060
2061	/*
2062	* IB Device that is used by nvmet controllers is being removed,
2063	* delete all queues using this device.
2064	*/
2065	mutex_lock(&nvmet_rdma_queue_mutex);
2066	list_for_each_entry_safe(queue, tmp, &nvmet_rdma_queue_list,
2067	queue_list) {
2068	if (queue->dev->device != ib_device)
2069	continue;
2070
2071	pr_info("Removing queue %d\n", queue->idx);
2072	list_del_init(entry: &queue->queue_list);
2073	__nvmet_rdma_queue_disconnect(queue);
2074	}
2075	mutex_unlock(lock: &nvmet_rdma_queue_mutex);
2076
2077	flush_workqueue(nvmet_wq);
2078	}
2079
2080	static struct ib_client nvmet_rdma_ib_client = {
2081	.name = "nvmet_rdma",
2082	.remove = nvmet_rdma_remove_one
2083	};
2084
2085	static int __init nvmet_rdma_init(void)
2086	{
2087	int ret;
2088
2089	ret = ib_register_client(client: &nvmet_rdma_ib_client);
2090	if (ret)
2091	return ret;
2092
2093	ret = nvmet_register_transport(ops: &nvmet_rdma_ops);
2094	if (ret)
2095	goto err_ib_client;
2096
2097	return 0;
2098
2099	err_ib_client:
2100	ib_unregister_client(client: &nvmet_rdma_ib_client);
2101	return ret;
2102	}
2103
2104	static void __exit nvmet_rdma_exit(void)
2105	{
2106	nvmet_unregister_transport(ops: &nvmet_rdma_ops);
2107	ib_unregister_client(client: &nvmet_rdma_ib_client);
2108	WARN_ON_ONCE(!list_empty(&nvmet_rdma_queue_list));
2109	ida_destroy(ida: &nvmet_rdma_queue_ida);
2110	}
2111
2112	module_init(nvmet_rdma_init);
2113	module_exit(nvmet_rdma_exit);
2114
2115	MODULE_DESCRIPTION("NVMe target RDMA transport driver");
2116	MODULE_LICENSE("GPL v2");
2117	MODULE_ALIAS("nvmet-transport-1"); /* 1 == NVMF_TRTYPE_RDMA */
2118