1 /*
2  * Copyright (c) 2004, 2005, 2006 Voltaire, Inc. All rights reserved.
3  * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
4  *
5  * This software is available to you under a choice of one of two
6  * licenses.  You may choose to be licensed under the terms of the GNU
7  * General Public License (GPL) Version 2, available from the file
8  * COPYING in the main directory of this source tree, or the
9  * OpenIB.org BSD license below:
10  *
11  *     Redistribution and use in source and binary forms, with or
12  *     without modification, are permitted provided that the following
13  *     conditions are met:
14  *
15  *	- Redistributions of source code must retain the above
16  *	  copyright notice, this list of conditions and the following
17  *	  disclaimer.
18  *
19  *	- Redistributions in binary form must reproduce the above
20  *	  copyright notice, this list of conditions and the following
21  *	  disclaimer in the documentation and/or other materials
22  *	  provided with the distribution.
23  *
24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
25  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
26  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
27  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
28  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
29  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
30  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
31  * SOFTWARE.
32  */
33 #include <linux/kernel.h>
34 #include <linux/module.h>
35 #include <linux/delay.h>
36 #include <linux/version.h>
37 
38 #include "iscsi_iser.h"
39 
40 #define ISCSI_ISER_MAX_CONN	8
41 #define ISER_MAX_CQ_LEN		((ISER_QP_MAX_RECV_DTOS + \
42 				ISER_QP_MAX_REQ_DTOS) *   \
43 				 ISCSI_ISER_MAX_CONN)
44 
45 static void iser_cq_tasklet_fn(unsigned long data);
46 static void iser_cq_callback(struct ib_cq *cq, void *cq_context);
47 
48 static void iser_cq_event_callback(struct ib_event *cause, void *context)
49 {
50 	iser_err("got cq event %d \n", cause->event);
51 }
52 
53 static void iser_qp_event_callback(struct ib_event *cause, void *context)
54 {
55 	iser_err("got qp event %d\n",cause->event);
56 }
57 
58 /**
59  * iser_create_device_ib_res - creates Protection Domain (PD), Completion
60  * Queue (CQ), DMA Memory Region (DMA MR) with the device associated with
61  * the adapator.
62  *
63  * returns 0 on success, -1 on failure
64  */
65 static int iser_create_device_ib_res(struct iser_device *device)
66 {
67 	device->pd = ib_alloc_pd(device->ib_device);
68 	if (IS_ERR(device->pd))
69 		goto pd_err;
70 
71 	device->cq = ib_create_cq(device->ib_device,
72 				  iser_cq_callback,
73 				  iser_cq_event_callback,
74 				  (void *)device,
75 				  ISER_MAX_CQ_LEN, 0);
76 	if (IS_ERR(device->cq))
77 		goto cq_err;
78 
79 	if (ib_req_notify_cq(device->cq, IB_CQ_NEXT_COMP))
80 		goto cq_arm_err;
81 
82 	tasklet_init(&device->cq_tasklet,
83 		     iser_cq_tasklet_fn,
84 		     (unsigned long)device);
85 
86 	device->mr = ib_get_dma_mr(device->pd, IB_ACCESS_LOCAL_WRITE |
87 				   IB_ACCESS_REMOTE_WRITE |
88 				   IB_ACCESS_REMOTE_READ);
89 	if (IS_ERR(device->mr))
90 		goto dma_mr_err;
91 
92 	return 0;
93 
94 dma_mr_err:
95 	tasklet_kill(&device->cq_tasklet);
96 cq_arm_err:
97 	ib_destroy_cq(device->cq);
98 cq_err:
99 	ib_dealloc_pd(device->pd);
100 pd_err:
101 	iser_err("failed to allocate an IB resource\n");
102 	return -1;
103 }
104 
105 /**
106  * iser_free_device_ib_res - destroy/dealloc/dereg the DMA MR,
107  * CQ and PD created with the device associated with the adapator.
108  */
109 static void iser_free_device_ib_res(struct iser_device *device)
110 {
111 	BUG_ON(device->mr == NULL);
112 
113 	tasklet_kill(&device->cq_tasklet);
114 
115 	(void)ib_dereg_mr(device->mr);
116 	(void)ib_destroy_cq(device->cq);
117 	(void)ib_dealloc_pd(device->pd);
118 
119 	device->mr = NULL;
120 	device->cq = NULL;
121 	device->pd = NULL;
122 }
123 
124 /**
125  * iser_create_ib_conn_res - Creates FMR pool and Queue-Pair (QP)
126  *
127  * returns 0 on success, -1 on failure
128  */
129 static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
130 {
131 	struct iser_device	*device;
132 	struct ib_qp_init_attr	init_attr;
133 	int			ret;
134 	struct ib_fmr_pool_param params;
135 
136 	BUG_ON(ib_conn->device == NULL);
137 
138 	device = ib_conn->device;
139 
140 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
141 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
142 				    GFP_KERNEL);
143 	if (!ib_conn->page_vec) {
144 		ret = -ENOMEM;
145 		goto alloc_err;
146 	}
147 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
148 
149 	params.page_shift        = SHIFT_4K;
150 	/* when the first/last SG element are not start/end *
151 	 * page aligned, the map whould be of N+1 pages     */
152 	params.max_pages_per_fmr = ISCSI_ISER_SG_TABLESIZE + 1;
153 	/* make the pool size twice the max number of SCSI commands *
154 	 * the ML is expected to queue, watermark for unmap at 50%  */
155 	params.pool_size	 = ISCSI_DEF_XMIT_CMDS_MAX * 2;
156 	params.dirty_watermark	 = ISCSI_DEF_XMIT_CMDS_MAX;
157 	params.cache		 = 0;
158 	params.flush_function	 = NULL;
159 	params.access		 = (IB_ACCESS_LOCAL_WRITE  |
160 				    IB_ACCESS_REMOTE_WRITE |
161 				    IB_ACCESS_REMOTE_READ);
162 
163 	ib_conn->fmr_pool = ib_create_fmr_pool(device->pd, &params);
164 	if (IS_ERR(ib_conn->fmr_pool)) {
165 		ret = PTR_ERR(ib_conn->fmr_pool);
166 		goto fmr_pool_err;
167 	}
168 
169 	memset(&init_attr, 0, sizeof init_attr);
170 
171 	init_attr.event_handler = iser_qp_event_callback;
172 	init_attr.qp_context	= (void *)ib_conn;
173 	init_attr.send_cq	= device->cq;
174 	init_attr.recv_cq	= device->cq;
175 	init_attr.cap.max_send_wr  = ISER_QP_MAX_REQ_DTOS;
176 	init_attr.cap.max_recv_wr  = ISER_QP_MAX_RECV_DTOS;
177 	init_attr.cap.max_send_sge = MAX_REGD_BUF_VECTOR_LEN;
178 	init_attr.cap.max_recv_sge = 2;
179 	init_attr.sq_sig_type	= IB_SIGNAL_REQ_WR;
180 	init_attr.qp_type	= IB_QPT_RC;
181 
182 	ret = rdma_create_qp(ib_conn->cma_id, device->pd, &init_attr);
183 	if (ret)
184 		goto qp_err;
185 
186 	ib_conn->qp = ib_conn->cma_id->qp;
187 	iser_err("setting conn %p cma_id %p: fmr_pool %p qp %p\n",
188 		 ib_conn, ib_conn->cma_id,
189 		 ib_conn->fmr_pool, ib_conn->cma_id->qp);
190 	return ret;
191 
192 qp_err:
193 	(void)ib_destroy_fmr_pool(ib_conn->fmr_pool);
194 fmr_pool_err:
195 	kfree(ib_conn->page_vec);
196 alloc_err:
197 	iser_err("unable to alloc mem or create resource, err %d\n", ret);
198 	return ret;
199 }
200 
201 /**
202  * releases the FMR pool, QP and CMA ID objects, returns 0 on success,
203  * -1 on failure
204  */
205 static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
206 {
207 	BUG_ON(ib_conn == NULL);
208 
209 	iser_err("freeing conn %p cma_id %p fmr pool %p qp %p\n",
210 		 ib_conn, ib_conn->cma_id,
211 		 ib_conn->fmr_pool, ib_conn->qp);
212 
213 	/* qp is created only once both addr & route are resolved */
214 	if (ib_conn->fmr_pool != NULL)
215 		ib_destroy_fmr_pool(ib_conn->fmr_pool);
216 
217 	if (ib_conn->qp != NULL)
218 		rdma_destroy_qp(ib_conn->cma_id);
219 
220 	if (ib_conn->cma_id != NULL)
221 		rdma_destroy_id(ib_conn->cma_id);
222 
223 	ib_conn->fmr_pool = NULL;
224 	ib_conn->qp	  = NULL;
225 	ib_conn->cma_id   = NULL;
226 	kfree(ib_conn->page_vec);
227 
228 	return 0;
229 }
230 
231 /**
232  * based on the resolved device node GUID see if there already allocated
233  * device for this device. If there's no such, create one.
234  */
235 static
236 struct iser_device *iser_device_find_by_ib_device(struct rdma_cm_id *cma_id)
237 {
238 	struct iser_device *device;
239 
240 	mutex_lock(&ig.device_list_mutex);
241 
242 	list_for_each_entry(device, &ig.device_list, ig_list)
243 		/* find if there's a match using the node GUID */
244 		if (device->ib_device->node_guid == cma_id->device->node_guid)
245 			goto inc_refcnt;
246 
247 	device = kzalloc(sizeof *device, GFP_KERNEL);
248 	if (device == NULL)
249 		goto out;
250 
251 	/* assign this device to the device */
252 	device->ib_device = cma_id->device;
253 	/* init the device and link it into ig device list */
254 	if (iser_create_device_ib_res(device)) {
255 		kfree(device);
256 		device = NULL;
257 		goto out;
258 	}
259 	list_add(&device->ig_list, &ig.device_list);
260 
261 inc_refcnt:
262 	device->refcount++;
263 out:
264 	mutex_unlock(&ig.device_list_mutex);
265 	return device;
266 }
267 
268 /* if there's no demand for this device, release it */
269 static void iser_device_try_release(struct iser_device *device)
270 {
271 	mutex_lock(&ig.device_list_mutex);
272 	device->refcount--;
273 	iser_err("device %p refcount %d\n",device,device->refcount);
274 	if (!device->refcount) {
275 		iser_free_device_ib_res(device);
276 		list_del(&device->ig_list);
277 		kfree(device);
278 	}
279 	mutex_unlock(&ig.device_list_mutex);
280 }
281 
282 int iser_conn_state_comp(struct iser_conn *ib_conn,
283 			enum iser_ib_conn_state comp)
284 {
285 	int ret;
286 
287 	spin_lock_bh(&ib_conn->lock);
288 	ret = (ib_conn->state == comp);
289 	spin_unlock_bh(&ib_conn->lock);
290 	return ret;
291 }
292 
293 static int iser_conn_state_comp_exch(struct iser_conn *ib_conn,
294 				     enum iser_ib_conn_state comp,
295 				     enum iser_ib_conn_state exch)
296 {
297 	int ret;
298 
299 	spin_lock_bh(&ib_conn->lock);
300 	if ((ret = (ib_conn->state == comp)))
301 		ib_conn->state = exch;
302 	spin_unlock_bh(&ib_conn->lock);
303 	return ret;
304 }
305 
306 /**
307  * Frees all conn objects and deallocs conn descriptor
308  */
309 static void iser_conn_release(struct iser_conn *ib_conn)
310 {
311 	struct iser_device  *device = ib_conn->device;
312 
313 	BUG_ON(ib_conn->state != ISER_CONN_DOWN);
314 
315 	mutex_lock(&ig.connlist_mutex);
316 	list_del(&ib_conn->conn_list);
317 	mutex_unlock(&ig.connlist_mutex);
318 
319 	iser_free_ib_conn_res(ib_conn);
320 	ib_conn->device = NULL;
321 	/* on EVENT_ADDR_ERROR there's no device yet for this conn */
322 	if (device != NULL)
323 		iser_device_try_release(device);
324 	if (ib_conn->iser_conn)
325 		ib_conn->iser_conn->ib_conn = NULL;
326 	iscsi_destroy_endpoint(ib_conn->ep);
327 }
328 
329 void iser_conn_get(struct iser_conn *ib_conn)
330 {
331 	atomic_inc(&ib_conn->refcount);
332 }
333 
334 void iser_conn_put(struct iser_conn *ib_conn)
335 {
336 	if (atomic_dec_and_test(&ib_conn->refcount))
337 		iser_conn_release(ib_conn);
338 }
339 
340 /**
341  * triggers start of the disconnect procedures and wait for them to be done
342  */
343 void iser_conn_terminate(struct iser_conn *ib_conn)
344 {
345 	int err = 0;
346 
347 	/* change the ib conn state only if the conn is UP, however always call
348 	 * rdma_disconnect since this is the only way to cause the CMA to change
349 	 * the QP state to ERROR
350 	 */
351 
352 	iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP, ISER_CONN_TERMINATING);
353 	err = rdma_disconnect(ib_conn->cma_id);
354 	if (err)
355 		iser_err("Failed to disconnect, conn: 0x%p err %d\n",
356 			 ib_conn,err);
357 
358 	wait_event_interruptible(ib_conn->wait,
359 				 ib_conn->state == ISER_CONN_DOWN);
360 
361 	iser_conn_put(ib_conn);
362 }
363 
364 static void iser_connect_error(struct rdma_cm_id *cma_id)
365 {
366 	struct iser_conn *ib_conn;
367 	ib_conn = (struct iser_conn *)cma_id->context;
368 
369 	ib_conn->state = ISER_CONN_DOWN;
370 	wake_up_interruptible(&ib_conn->wait);
371 }
372 
373 static void iser_addr_handler(struct rdma_cm_id *cma_id)
374 {
375 	struct iser_device *device;
376 	struct iser_conn   *ib_conn;
377 	int    ret;
378 
379 	device = iser_device_find_by_ib_device(cma_id);
380 	if (!device) {
381 		iser_err("device lookup/creation failed\n");
382 		iser_connect_error(cma_id);
383 		return;
384 	}
385 
386 	ib_conn = (struct iser_conn *)cma_id->context;
387 	ib_conn->device = device;
388 
389 	ret = rdma_resolve_route(cma_id, 1000);
390 	if (ret) {
391 		iser_err("resolve route failed: %d\n", ret);
392 		iser_connect_error(cma_id);
393 	}
394 }
395 
396 static void iser_route_handler(struct rdma_cm_id *cma_id)
397 {
398 	struct rdma_conn_param conn_param;
399 	int    ret;
400 
401 	ret = iser_create_ib_conn_res((struct iser_conn *)cma_id->context);
402 	if (ret)
403 		goto failure;
404 
405 	iser_dbg("path.mtu is %d setting it to %d\n",
406 		 cma_id->route.path_rec->mtu, IB_MTU_1024);
407 
408 	/* we must set the MTU to 1024 as this is what the target is assuming */
409 	if (cma_id->route.path_rec->mtu > IB_MTU_1024)
410 		cma_id->route.path_rec->mtu = IB_MTU_1024;
411 
412 	memset(&conn_param, 0, sizeof conn_param);
413 	conn_param.responder_resources = 4;
414 	conn_param.initiator_depth     = 1;
415 	conn_param.retry_count	       = 7;
416 	conn_param.rnr_retry_count     = 6;
417 
418 	ret = rdma_connect(cma_id, &conn_param);
419 	if (ret) {
420 		iser_err("failure connecting: %d\n", ret);
421 		goto failure;
422 	}
423 
424 	return;
425 failure:
426 	iser_connect_error(cma_id);
427 }
428 
429 static void iser_connected_handler(struct rdma_cm_id *cma_id)
430 {
431 	struct iser_conn *ib_conn;
432 
433 	ib_conn = (struct iser_conn *)cma_id->context;
434 	ib_conn->state = ISER_CONN_UP;
435 	wake_up_interruptible(&ib_conn->wait);
436 }
437 
438 static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
439 {
440 	struct iser_conn *ib_conn;
441 
442 	ib_conn = (struct iser_conn *)cma_id->context;
443 	ib_conn->disc_evt_flag = 1;
444 
445 	/* getting here when the state is UP means that the conn is being *
446 	 * terminated asynchronously from the iSCSI layer's perspective.  */
447 	if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
448 				      ISER_CONN_TERMINATING))
449 		iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
450 				   ISCSI_ERR_CONN_FAILED);
451 
452 	/* Complete the termination process if no posts are pending */
453 	if ((atomic_read(&ib_conn->post_recv_buf_count) == 0) &&
454 	    (atomic_read(&ib_conn->post_send_buf_count) == 0)) {
455 		ib_conn->state = ISER_CONN_DOWN;
456 		wake_up_interruptible(&ib_conn->wait);
457 	}
458 }
459 
460 static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
461 {
462 	int ret = 0;
463 
464 	iser_err("event %d conn %p id %p\n",event->event,cma_id->context,cma_id);
465 
466 	switch (event->event) {
467 	case RDMA_CM_EVENT_ADDR_RESOLVED:
468 		iser_addr_handler(cma_id);
469 		break;
470 	case RDMA_CM_EVENT_ROUTE_RESOLVED:
471 		iser_route_handler(cma_id);
472 		break;
473 	case RDMA_CM_EVENT_ESTABLISHED:
474 		iser_connected_handler(cma_id);
475 		break;
476 	case RDMA_CM_EVENT_ADDR_ERROR:
477 	case RDMA_CM_EVENT_ROUTE_ERROR:
478 	case RDMA_CM_EVENT_CONNECT_ERROR:
479 	case RDMA_CM_EVENT_UNREACHABLE:
480 	case RDMA_CM_EVENT_REJECTED:
481 		iser_err("event: %d, error: %d\n", event->event, event->status);
482 		iser_connect_error(cma_id);
483 		break;
484 	case RDMA_CM_EVENT_DISCONNECTED:
485 	case RDMA_CM_EVENT_DEVICE_REMOVAL:
486 	case RDMA_CM_EVENT_ADDR_CHANGE:
487 		iser_disconnected_handler(cma_id);
488 		break;
489 	default:
490 		iser_err("Unexpected RDMA CM event (%d)\n", event->event);
491 		break;
492 	}
493 	return ret;
494 }
495 
496 void iser_conn_init(struct iser_conn *ib_conn)
497 {
498 	ib_conn->state = ISER_CONN_INIT;
499 	init_waitqueue_head(&ib_conn->wait);
500 	atomic_set(&ib_conn->post_recv_buf_count, 0);
501 	atomic_set(&ib_conn->post_send_buf_count, 0);
502 	atomic_set(&ib_conn->refcount, 1);
503 	INIT_LIST_HEAD(&ib_conn->conn_list);
504 	spin_lock_init(&ib_conn->lock);
505 }
506 
507  /**
508  * starts the process of connecting to the target
509  * sleeps untill the connection is established or rejected
510  */
511 int iser_connect(struct iser_conn   *ib_conn,
512 		 struct sockaddr_in *src_addr,
513 		 struct sockaddr_in *dst_addr,
514 		 int                 non_blocking)
515 {
516 	struct sockaddr *src, *dst;
517 	int err = 0;
518 
519 	sprintf(ib_conn->name,"%d.%d.%d.%d:%d",
520 		NIPQUAD(dst_addr->sin_addr.s_addr), dst_addr->sin_port);
521 
522 	/* the device is known only --after-- address resolution */
523 	ib_conn->device = NULL;
524 
525 	iser_err("connecting to: %d.%d.%d.%d, port 0x%x\n",
526 		 NIPQUAD(dst_addr->sin_addr), dst_addr->sin_port);
527 
528 	ib_conn->state = ISER_CONN_PENDING;
529 
530 	ib_conn->cma_id = rdma_create_id(iser_cma_handler,
531 					     (void *)ib_conn,
532 					     RDMA_PS_TCP);
533 	if (IS_ERR(ib_conn->cma_id)) {
534 		err = PTR_ERR(ib_conn->cma_id);
535 		iser_err("rdma_create_id failed: %d\n", err);
536 		goto id_failure;
537 	}
538 
539 	src = (struct sockaddr *)src_addr;
540 	dst = (struct sockaddr *)dst_addr;
541 	err = rdma_resolve_addr(ib_conn->cma_id, src, dst, 1000);
542 	if (err) {
543 		iser_err("rdma_resolve_addr failed: %d\n", err);
544 		goto addr_failure;
545 	}
546 
547 	if (!non_blocking) {
548 		wait_event_interruptible(ib_conn->wait,
549 					 (ib_conn->state != ISER_CONN_PENDING));
550 
551 		if (ib_conn->state != ISER_CONN_UP) {
552 			err =  -EIO;
553 			goto connect_failure;
554 		}
555 	}
556 
557 	mutex_lock(&ig.connlist_mutex);
558 	list_add(&ib_conn->conn_list, &ig.connlist);
559 	mutex_unlock(&ig.connlist_mutex);
560 	return 0;
561 
562 id_failure:
563 	ib_conn->cma_id = NULL;
564 addr_failure:
565 	ib_conn->state = ISER_CONN_DOWN;
566 connect_failure:
567 	iser_conn_release(ib_conn);
568 	return err;
569 }
570 
571 /**
572  * iser_reg_page_vec - Register physical memory
573  *
574  * returns: 0 on success, errno code on failure
575  */
576 int iser_reg_page_vec(struct iser_conn     *ib_conn,
577 		      struct iser_page_vec *page_vec,
578 		      struct iser_mem_reg  *mem_reg)
579 {
580 	struct ib_pool_fmr *mem;
581 	u64		   io_addr;
582 	u64		   *page_list;
583 	int		   status;
584 
585 	page_list = page_vec->pages;
586 	io_addr	  = page_list[0];
587 
588 	mem  = ib_fmr_pool_map_phys(ib_conn->fmr_pool,
589 				    page_list,
590 				    page_vec->length,
591 				    io_addr);
592 
593 	if (IS_ERR(mem)) {
594 		status = (int)PTR_ERR(mem);
595 		iser_err("ib_fmr_pool_map_phys failed: %d\n", status);
596 		return status;
597 	}
598 
599 	mem_reg->lkey  = mem->fmr->lkey;
600 	mem_reg->rkey  = mem->fmr->rkey;
601 	mem_reg->len   = page_vec->length * SIZE_4K;
602 	mem_reg->va    = io_addr;
603 	mem_reg->is_fmr = 1;
604 	mem_reg->mem_h = (void *)mem;
605 
606 	mem_reg->va   += page_vec->offset;
607 	mem_reg->len   = page_vec->data_size;
608 
609 	iser_dbg("PHYSICAL Mem.register, [PHYS p_array: 0x%p, sz: %d, "
610 		 "entry[0]: (0x%08lx,%ld)] -> "
611 		 "[lkey: 0x%08X mem_h: 0x%p va: 0x%08lX sz: %ld]\n",
612 		 page_vec, page_vec->length,
613 		 (unsigned long)page_vec->pages[0],
614 		 (unsigned long)page_vec->data_size,
615 		 (unsigned int)mem_reg->lkey, mem_reg->mem_h,
616 		 (unsigned long)mem_reg->va, (unsigned long)mem_reg->len);
617 	return 0;
618 }
619 
620 /**
621  * Unregister (previosuly registered) memory.
622  */
623 void iser_unreg_mem(struct iser_mem_reg *reg)
624 {
625 	int ret;
626 
627 	iser_dbg("PHYSICAL Mem.Unregister mem_h %p\n",reg->mem_h);
628 
629 	ret = ib_fmr_pool_unmap((struct ib_pool_fmr *)reg->mem_h);
630 	if (ret)
631 		iser_err("ib_fmr_pool_unmap failed %d\n", ret);
632 
633 	reg->mem_h = NULL;
634 }
635 
636 /**
637  * iser_dto_to_iov - builds IOV from a dto descriptor
638  */
639 static void iser_dto_to_iov(struct iser_dto *dto, struct ib_sge *iov, int iov_len)
640 {
641 	int		     i;
642 	struct ib_sge	     *sge;
643 	struct iser_regd_buf *regd_buf;
644 
645 	if (dto->regd_vector_len > iov_len) {
646 		iser_err("iov size %d too small for posting dto of len %d\n",
647 			 iov_len, dto->regd_vector_len);
648 		BUG();
649 	}
650 
651 	for (i = 0; i < dto->regd_vector_len; i++) {
652 		sge	    = &iov[i];
653 		regd_buf  = dto->regd[i];
654 
655 		sge->addr   = regd_buf->reg.va;
656 		sge->length = regd_buf->reg.len;
657 		sge->lkey   = regd_buf->reg.lkey;
658 
659 		if (dto->used_sz[i] > 0)  /* Adjust size */
660 			sge->length = dto->used_sz[i];
661 
662 		/* offset and length should not exceed the regd buf length */
663 		if (sge->length + dto->offset[i] > regd_buf->reg.len) {
664 			iser_err("Used len:%ld + offset:%d, exceed reg.buf.len:"
665 				 "%ld in dto:0x%p [%d], va:0x%08lX\n",
666 				 (unsigned long)sge->length, dto->offset[i],
667 				 (unsigned long)regd_buf->reg.len, dto, i,
668 				 (unsigned long)sge->addr);
669 			BUG();
670 		}
671 
672 		sge->addr += dto->offset[i]; /* Adjust offset */
673 	}
674 }
675 
676 /**
677  * iser_post_recv - Posts a receive buffer.
678  *
679  * returns 0 on success, -1 on failure
680  */
681 int iser_post_recv(struct iser_desc *rx_desc)
682 {
683 	int		  ib_ret, ret_val = 0;
684 	struct ib_recv_wr recv_wr, *recv_wr_failed;
685 	struct ib_sge	  iov[2];
686 	struct iser_conn  *ib_conn;
687 	struct iser_dto   *recv_dto = &rx_desc->dto;
688 
689 	/* Retrieve conn */
690 	ib_conn = recv_dto->ib_conn;
691 
692 	iser_dto_to_iov(recv_dto, iov, 2);
693 
694 	recv_wr.next	= NULL;
695 	recv_wr.sg_list = iov;
696 	recv_wr.num_sge = recv_dto->regd_vector_len;
697 	recv_wr.wr_id	= (unsigned long)rx_desc;
698 
699 	atomic_inc(&ib_conn->post_recv_buf_count);
700 	ib_ret	= ib_post_recv(ib_conn->qp, &recv_wr, &recv_wr_failed);
701 	if (ib_ret) {
702 		iser_err("ib_post_recv failed ret=%d\n", ib_ret);
703 		atomic_dec(&ib_conn->post_recv_buf_count);
704 		ret_val = -1;
705 	}
706 
707 	return ret_val;
708 }
709 
710 /**
711  * iser_start_send - Initiate a Send DTO operation
712  *
713  * returns 0 on success, -1 on failure
714  */
715 int iser_post_send(struct iser_desc *tx_desc)
716 {
717 	int		  ib_ret, ret_val = 0;
718 	struct ib_send_wr send_wr, *send_wr_failed;
719 	struct ib_sge	  iov[MAX_REGD_BUF_VECTOR_LEN];
720 	struct iser_conn  *ib_conn;
721 	struct iser_dto   *dto = &tx_desc->dto;
722 
723 	ib_conn = dto->ib_conn;
724 
725 	iser_dto_to_iov(dto, iov, MAX_REGD_BUF_VECTOR_LEN);
726 
727 	send_wr.next	   = NULL;
728 	send_wr.wr_id	   = (unsigned long)tx_desc;
729 	send_wr.sg_list	   = iov;
730 	send_wr.num_sge	   = dto->regd_vector_len;
731 	send_wr.opcode	   = IB_WR_SEND;
732 	send_wr.send_flags = dto->notify_enable ? IB_SEND_SIGNALED : 0;
733 
734 	atomic_inc(&ib_conn->post_send_buf_count);
735 
736 	ib_ret = ib_post_send(ib_conn->qp, &send_wr, &send_wr_failed);
737 	if (ib_ret) {
738 		iser_err("Failed to start SEND DTO, dto: 0x%p, IOV len: %d\n",
739 			 dto, dto->regd_vector_len);
740 		iser_err("ib_post_send failed, ret:%d\n", ib_ret);
741 		atomic_dec(&ib_conn->post_send_buf_count);
742 		ret_val = -1;
743 	}
744 
745 	return ret_val;
746 }
747 
748 static void iser_handle_comp_error(struct iser_desc *desc)
749 {
750 	struct iser_dto  *dto     = &desc->dto;
751 	struct iser_conn *ib_conn = dto->ib_conn;
752 
753 	iser_dto_buffs_release(dto);
754 
755 	if (desc->type == ISCSI_RX) {
756 		kfree(desc->data);
757 		kmem_cache_free(ig.desc_cache, desc);
758 		atomic_dec(&ib_conn->post_recv_buf_count);
759 	} else { /* type is TX control/command/dataout */
760 		if (desc->type == ISCSI_TX_DATAOUT)
761 			kmem_cache_free(ig.desc_cache, desc);
762 		atomic_dec(&ib_conn->post_send_buf_count);
763 	}
764 
765 	if (atomic_read(&ib_conn->post_recv_buf_count) == 0 &&
766 	    atomic_read(&ib_conn->post_send_buf_count) == 0) {
767 		/* getting here when the state is UP means that the conn is *
768 		 * being terminated asynchronously from the iSCSI layer's   *
769 		 * perspective.                                             */
770 		if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
771 		    ISER_CONN_TERMINATING))
772 			iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
773 					   ISCSI_ERR_CONN_FAILED);
774 
775 		/* complete the termination process if disconnect event was delivered *
776 		 * note there are no more non completed posts to the QP               */
777 		if (ib_conn->disc_evt_flag) {
778 			ib_conn->state = ISER_CONN_DOWN;
779 			wake_up_interruptible(&ib_conn->wait);
780 		}
781 	}
782 }
783 
784 static void iser_cq_tasklet_fn(unsigned long data)
785 {
786 	 struct iser_device  *device = (struct iser_device *)data;
787 	 struct ib_cq	     *cq = device->cq;
788 	 struct ib_wc	     wc;
789 	 struct iser_desc    *desc;
790 	 unsigned long	     xfer_len;
791 
792 	while (ib_poll_cq(cq, 1, &wc) == 1) {
793 		desc	 = (struct iser_desc *) (unsigned long) wc.wr_id;
794 		BUG_ON(desc == NULL);
795 
796 		if (wc.status == IB_WC_SUCCESS) {
797 			if (desc->type == ISCSI_RX) {
798 				xfer_len = (unsigned long)wc.byte_len;
799 				iser_rcv_completion(desc, xfer_len);
800 			} else /* type == ISCSI_TX_CONTROL/SCSI_CMD/DOUT */
801 				iser_snd_completion(desc);
802 		} else {
803 			iser_err("comp w. error op %d status %d\n",desc->type,wc.status);
804 			iser_handle_comp_error(desc);
805 		}
806 	}
807 	/* #warning "it is assumed here that arming CQ only once its empty" *
808 	 * " would not cause interrupts to be missed"                       */
809 	ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
810 }
811 
812 static void iser_cq_callback(struct ib_cq *cq, void *cq_context)
813 {
814 	struct iser_device  *device = (struct iser_device *)cq_context;
815 
816 	tasklet_schedule(&device->cq_tasklet);
817 }
818