1 /*******************************************************************************
2  * IBM Virtual SCSI Target Driver
3  * Copyright (C) 2003-2005 Dave Boutcher (boutcher@us.ibm.com) IBM Corp.
4  *			   Santiago Leon (santil@us.ibm.com) IBM Corp.
5  *			   Linda Xie (lxie@us.ibm.com) IBM Corp.
6  *
7  * Copyright (C) 2005-2011 FUJITA Tomonori <tomof@acm.org>
8  * Copyright (C) 2010 Nicholas A. Bellinger <nab@kernel.org>
9  *
10  * Authors: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
11  * Authors: Michael Cyr <mikecyr@linux.vnet.ibm.com>
12  *
13  * This program is free software; you can redistribute it and/or modify
14  * it under the terms of the GNU General Public License as published by
15  * the Free Software Foundation; either version 2 of the License, or
16  * (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
21  * GNU General Public License for more details.
22  *
23  ****************************************************************************/
24 
25 #define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
26 
27 #include <linux/module.h>
28 #include <linux/kernel.h>
29 #include <linux/slab.h>
30 #include <linux/types.h>
31 #include <linux/list.h>
32 #include <linux/string.h>
33 #include <linux/delay.h>
34 
35 #include <target/target_core_base.h>
36 #include <target/target_core_fabric.h>
37 
38 #include <asm/hvcall.h>
39 #include <asm/vio.h>
40 
41 #include <scsi/viosrp.h>
42 
43 #include "ibmvscsi_tgt.h"
44 
45 #define IBMVSCSIS_VERSION	"v0.2"
46 
47 #define	INITIAL_SRP_LIMIT	800
48 #define	DEFAULT_MAX_SECTORS	256
49 #define MAX_TXU			1024 * 1024
50 
51 static uint max_vdma_size = MAX_H_COPY_RDMA;
52 
53 static char system_id[SYS_ID_NAME_LEN] = "";
54 static char partition_name[PARTITION_NAMELEN] = "UNKNOWN";
55 static uint partition_number = -1;
56 
57 /* Adapter list and lock to control it */
58 static DEFINE_SPINLOCK(ibmvscsis_dev_lock);
59 static LIST_HEAD(ibmvscsis_dev_list);
60 
61 static long ibmvscsis_parse_command(struct scsi_info *vscsi,
62 				    struct viosrp_crq *crq);
63 
64 static void ibmvscsis_adapter_idle(struct scsi_info *vscsi);
65 
66 static void ibmvscsis_determine_resid(struct se_cmd *se_cmd,
67 				      struct srp_rsp *rsp)
68 {
69 	u32 residual_count = se_cmd->residual_count;
70 
71 	if (!residual_count)
72 		return;
73 
74 	if (se_cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
75 		if (se_cmd->data_direction == DMA_TO_DEVICE) {
76 			/* residual data from an underflow write */
77 			rsp->flags = SRP_RSP_FLAG_DOUNDER;
78 			rsp->data_out_res_cnt = cpu_to_be32(residual_count);
79 		} else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
80 			/* residual data from an underflow read */
81 			rsp->flags = SRP_RSP_FLAG_DIUNDER;
82 			rsp->data_in_res_cnt = cpu_to_be32(residual_count);
83 		}
84 	} else if (se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
85 		if (se_cmd->data_direction == DMA_TO_DEVICE) {
86 			/* residual data from an overflow write */
87 			rsp->flags = SRP_RSP_FLAG_DOOVER;
88 			rsp->data_out_res_cnt = cpu_to_be32(residual_count);
89 		} else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
90 			/* residual data from an overflow read */
91 			rsp->flags = SRP_RSP_FLAG_DIOVER;
92 			rsp->data_in_res_cnt = cpu_to_be32(residual_count);
93 		}
94 	}
95 }
96 
97 /**
98  * connection_broken() - Determine if the connection to the client is good
99  * @vscsi:	Pointer to our adapter structure
100  *
101  * This function attempts to send a ping MAD to the client. If the call to
102  * queue the request returns H_CLOSED then the connection has been broken
103  * and the function returns TRUE.
104  *
105  * EXECUTION ENVIRONMENT:
106  *	Interrupt or Process environment
107  */
108 static bool connection_broken(struct scsi_info *vscsi)
109 {
110 	struct viosrp_crq *crq;
111 	u64 buffer[2] = { 0, 0 };
112 	long h_return_code;
113 	bool rc = false;
114 
115 	/* create a PING crq */
116 	crq = (struct viosrp_crq *)&buffer;
117 	crq->valid = VALID_CMD_RESP_EL;
118 	crq->format = MESSAGE_IN_CRQ;
119 	crq->status = PING;
120 
121 	h_return_code = h_send_crq(vscsi->dds.unit_id,
122 				   cpu_to_be64(buffer[MSG_HI]),
123 				   cpu_to_be64(buffer[MSG_LOW]));
124 
125 	pr_debug("connection_broken: rc %ld\n", h_return_code);
126 
127 	if (h_return_code == H_CLOSED)
128 		rc = true;
129 
130 	return rc;
131 }
132 
133 /**
134  * ibmvscsis_unregister_command_q() - Helper Function-Unregister Command Queue
135  * @vscsi:	Pointer to our adapter structure
136  *
137  * This function calls h_free_q then frees the interrupt bit etc.
138  * It must release the lock before doing so because of the time it can take
139  * for h_free_crq in PHYP
140  * NOTE: the caller must make sure that state and or flags will prevent
141  *	 interrupt handler from scheduling work.
142  * NOTE: anyone calling this function may need to set the CRQ_CLOSED flag
143  *	 we can't do it here, because we don't have the lock
144  *
145  * EXECUTION ENVIRONMENT:
146  *	Process level
147  */
148 static long ibmvscsis_unregister_command_q(struct scsi_info *vscsi)
149 {
150 	long qrc;
151 	long rc = ADAPT_SUCCESS;
152 	int ticks = 0;
153 
154 	do {
155 		qrc = h_free_crq(vscsi->dds.unit_id);
156 		switch (qrc) {
157 		case H_SUCCESS:
158 			break;
159 
160 		case H_HARDWARE:
161 		case H_PARAMETER:
162 			dev_err(&vscsi->dev, "unregister_command_q: error from h_free_crq %ld\n",
163 				qrc);
164 			rc = ERROR;
165 			break;
166 
167 		case H_BUSY:
168 		case H_LONG_BUSY_ORDER_1_MSEC:
169 			/* msleep not good for small values */
170 			usleep_range(1000, 2000);
171 			ticks += 1;
172 			break;
173 		case H_LONG_BUSY_ORDER_10_MSEC:
174 			usleep_range(10000, 20000);
175 			ticks += 10;
176 			break;
177 		case H_LONG_BUSY_ORDER_100_MSEC:
178 			msleep(100);
179 			ticks += 100;
180 			break;
181 		case H_LONG_BUSY_ORDER_1_SEC:
182 			ssleep(1);
183 			ticks += 1000;
184 			break;
185 		case H_LONG_BUSY_ORDER_10_SEC:
186 			ssleep(10);
187 			ticks += 10000;
188 			break;
189 		case H_LONG_BUSY_ORDER_100_SEC:
190 			ssleep(100);
191 			ticks += 100000;
192 			break;
193 		default:
194 			dev_err(&vscsi->dev, "unregister_command_q: unknown error %ld from h_free_crq\n",
195 				qrc);
196 			rc = ERROR;
197 			break;
198 		}
199 
200 		/*
201 		 * dont wait more then 300 seconds
202 		 * ticks are in milliseconds more or less
203 		 */
204 		if (ticks > 300000 && qrc != H_SUCCESS) {
205 			rc = ERROR;
206 			dev_err(&vscsi->dev, "Excessive wait for h_free_crq\n");
207 		}
208 	} while (qrc != H_SUCCESS && rc == ADAPT_SUCCESS);
209 
210 	pr_debug("Freeing CRQ: phyp rc %ld, rc %ld\n", qrc, rc);
211 
212 	return rc;
213 }
214 
215 /**
216  * ibmvscsis_delete_client_info() - Helper function to Delete Client Info
217  * @vscsi:	Pointer to our adapter structure
218  * @client_closed:	True if client closed its queue
219  *
220  * Deletes information specific to the client when the client goes away
221  *
222  * EXECUTION ENVIRONMENT:
223  *	Interrupt or Process
224  */
225 static void ibmvscsis_delete_client_info(struct scsi_info *vscsi,
226 					 bool client_closed)
227 {
228 	vscsi->client_cap = 0;
229 
230 	/*
231 	 * Some things we don't want to clear if we're closing the queue,
232 	 * because some clients don't resend the host handshake when they
233 	 * get a transport event.
234 	 */
235 	if (client_closed)
236 		vscsi->client_data.os_type = 0;
237 }
238 
239 /**
240  * ibmvscsis_free_command_q() - Free Command Queue
241  * @vscsi:	Pointer to our adapter structure
242  *
243  * This function calls unregister_command_q, then clears interrupts and
244  * any pending interrupt acknowledgments associated with the command q.
245  * It also clears memory if there is no error.
246  *
247  * PHYP did not meet the PAPR architecture so that we must give up the
248  * lock. This causes a timing hole regarding state change.  To close the
249  * hole this routine does accounting on any change that occurred during
250  * the time the lock is not held.
251  * NOTE: must give up and then acquire the interrupt lock, the caller must
252  *	 make sure that state and or flags will prevent interrupt handler from
253  *	 scheduling work.
254  *
255  * EXECUTION ENVIRONMENT:
256  *	Process level, interrupt lock is held
257  */
258 static long ibmvscsis_free_command_q(struct scsi_info *vscsi)
259 {
260 	int bytes;
261 	u32 flags_under_lock;
262 	u16 state_under_lock;
263 	long rc = ADAPT_SUCCESS;
264 
265 	if (!(vscsi->flags & CRQ_CLOSED)) {
266 		vio_disable_interrupts(vscsi->dma_dev);
267 
268 		state_under_lock = vscsi->new_state;
269 		flags_under_lock = vscsi->flags;
270 		vscsi->phyp_acr_state = 0;
271 		vscsi->phyp_acr_flags = 0;
272 
273 		spin_unlock_bh(&vscsi->intr_lock);
274 		rc = ibmvscsis_unregister_command_q(vscsi);
275 		spin_lock_bh(&vscsi->intr_lock);
276 
277 		if (state_under_lock != vscsi->new_state)
278 			vscsi->phyp_acr_state = vscsi->new_state;
279 
280 		vscsi->phyp_acr_flags = ((~flags_under_lock) & vscsi->flags);
281 
282 		if (rc == ADAPT_SUCCESS) {
283 			bytes = vscsi->cmd_q.size * PAGE_SIZE;
284 			memset(vscsi->cmd_q.base_addr, 0, bytes);
285 			vscsi->cmd_q.index = 0;
286 			vscsi->flags |= CRQ_CLOSED;
287 
288 			ibmvscsis_delete_client_info(vscsi, false);
289 		}
290 
291 		pr_debug("free_command_q: flags 0x%x, state 0x%hx, acr_flags 0x%x, acr_state 0x%hx\n",
292 			 vscsi->flags, vscsi->state, vscsi->phyp_acr_flags,
293 			 vscsi->phyp_acr_state);
294 	}
295 	return rc;
296 }
297 
298 /**
299  * ibmvscsis_cmd_q_dequeue() - Get valid Command element
300  * @mask:	Mask to use in case index wraps
301  * @current_index:	Current index into command queue
302  * @base_addr:	Pointer to start of command queue
303  *
304  * Returns a pointer to a valid command element or NULL, if the command
305  * queue is empty
306  *
307  * EXECUTION ENVIRONMENT:
308  *	Interrupt environment, interrupt lock held
309  */
310 static struct viosrp_crq *ibmvscsis_cmd_q_dequeue(uint mask,
311 						  uint *current_index,
312 						  struct viosrp_crq *base_addr)
313 {
314 	struct viosrp_crq *ptr;
315 
316 	ptr = base_addr + *current_index;
317 
318 	if (ptr->valid) {
319 		*current_index = (*current_index + 1) & mask;
320 		dma_rmb();
321 	} else {
322 		ptr = NULL;
323 	}
324 
325 	return ptr;
326 }
327 
328 /**
329  * ibmvscsis_send_init_message() - send initialize message to the client
330  * @vscsi:	Pointer to our adapter structure
331  * @format:	Which Init Message format to send
332  *
333  * EXECUTION ENVIRONMENT:
334  *	Interrupt environment interrupt lock held
335  */
336 static long ibmvscsis_send_init_message(struct scsi_info *vscsi, u8 format)
337 {
338 	struct viosrp_crq *crq;
339 	u64 buffer[2] = { 0, 0 };
340 	long rc;
341 
342 	crq = (struct viosrp_crq *)&buffer;
343 	crq->valid = VALID_INIT_MSG;
344 	crq->format = format;
345 	rc = h_send_crq(vscsi->dds.unit_id, cpu_to_be64(buffer[MSG_HI]),
346 			cpu_to_be64(buffer[MSG_LOW]));
347 
348 	return rc;
349 }
350 
351 /**
352  * ibmvscsis_check_init_msg() - Check init message valid
353  * @vscsi:	Pointer to our adapter structure
354  * @format:	Pointer to return format of Init Message, if any.
355  *		Set to UNUSED_FORMAT if no Init Message in queue.
356  *
357  * Checks if an initialize message was queued by the initiatior
358  * after the queue was created and before the interrupt was enabled.
359  *
360  * EXECUTION ENVIRONMENT:
361  *	Process level only, interrupt lock held
362  */
363 static long ibmvscsis_check_init_msg(struct scsi_info *vscsi, uint *format)
364 {
365 	struct viosrp_crq *crq;
366 	long rc = ADAPT_SUCCESS;
367 
368 	crq = ibmvscsis_cmd_q_dequeue(vscsi->cmd_q.mask, &vscsi->cmd_q.index,
369 				      vscsi->cmd_q.base_addr);
370 	if (!crq) {
371 		*format = (uint)UNUSED_FORMAT;
372 	} else if (crq->valid == VALID_INIT_MSG && crq->format == INIT_MSG) {
373 		*format = (uint)INIT_MSG;
374 		crq->valid = INVALIDATE_CMD_RESP_EL;
375 		dma_rmb();
376 
377 		/*
378 		 * the caller has ensured no initialize message was
379 		 * sent after the queue was
380 		 * created so there should be no other message on the queue.
381 		 */
382 		crq = ibmvscsis_cmd_q_dequeue(vscsi->cmd_q.mask,
383 					      &vscsi->cmd_q.index,
384 					      vscsi->cmd_q.base_addr);
385 		if (crq) {
386 			*format = (uint)(crq->format);
387 			rc = ERROR;
388 			crq->valid = INVALIDATE_CMD_RESP_EL;
389 			dma_rmb();
390 		}
391 	} else {
392 		*format = (uint)(crq->format);
393 		rc = ERROR;
394 		crq->valid = INVALIDATE_CMD_RESP_EL;
395 		dma_rmb();
396 	}
397 
398 	return rc;
399 }
400 
401 /**
402  * ibmvscsis_disconnect() - Helper function to disconnect
403  * @work:	Pointer to work_struct, gives access to our adapter structure
404  *
405  * An error has occurred or the driver received a Transport event,
406  * and the driver is requesting that the command queue be de-registered
407  * in a safe manner. If there is no outstanding I/O then we can stop the
408  * queue. If we are restarting the queue it will be reflected in the
409  * the state of the adapter.
410  *
411  * EXECUTION ENVIRONMENT:
412  *	Process environment
413  */
414 static void ibmvscsis_disconnect(struct work_struct *work)
415 {
416 	struct scsi_info *vscsi = container_of(work, struct scsi_info,
417 					       proc_work);
418 	u16 new_state;
419 	bool wait_idle = false;
420 
421 	spin_lock_bh(&vscsi->intr_lock);
422 	new_state = vscsi->new_state;
423 	vscsi->new_state = 0;
424 
425 	pr_debug("disconnect: flags 0x%x, state 0x%hx\n", vscsi->flags,
426 		 vscsi->state);
427 
428 	/*
429 	 * check which state we are in and see if we
430 	 * should transitition to the new state
431 	 */
432 	switch (vscsi->state) {
433 	/* Should never be called while in this state. */
434 	case NO_QUEUE:
435 	/*
436 	 * Can never transition from this state;
437 	 * igonore errors and logout.
438 	 */
439 	case UNCONFIGURING:
440 		break;
441 
442 	/* can transition from this state to UNCONFIGURING */
443 	case ERR_DISCONNECT:
444 		if (new_state == UNCONFIGURING)
445 			vscsi->state = new_state;
446 		break;
447 
448 	/*
449 	 * Can transition from this state to to unconfiguring
450 	 * or err disconnect.
451 	 */
452 	case ERR_DISCONNECT_RECONNECT:
453 		switch (new_state) {
454 		case UNCONFIGURING:
455 		case ERR_DISCONNECT:
456 			vscsi->state = new_state;
457 			break;
458 
459 		case WAIT_IDLE:
460 			break;
461 		default:
462 			break;
463 		}
464 		break;
465 
466 	/* can transition from this state to UNCONFIGURING */
467 	case ERR_DISCONNECTED:
468 		if (new_state == UNCONFIGURING)
469 			vscsi->state = new_state;
470 		break;
471 
472 	case WAIT_ENABLED:
473 		switch (new_state) {
474 		case UNCONFIGURING:
475 			vscsi->state = new_state;
476 			vscsi->flags |= RESPONSE_Q_DOWN;
477 			vscsi->flags &= ~(SCHEDULE_DISCONNECT |
478 					  DISCONNECT_SCHEDULED);
479 			dma_rmb();
480 			if (vscsi->flags & CFG_SLEEPING) {
481 				vscsi->flags &= ~CFG_SLEEPING;
482 				complete(&vscsi->unconfig);
483 			}
484 			break;
485 
486 		/* should never happen */
487 		case ERR_DISCONNECT:
488 		case ERR_DISCONNECT_RECONNECT:
489 		case WAIT_IDLE:
490 			dev_err(&vscsi->dev, "disconnect: invalid state %d for WAIT_IDLE\n",
491 				vscsi->state);
492 			break;
493 		}
494 		break;
495 
496 	case WAIT_IDLE:
497 		switch (new_state) {
498 		case UNCONFIGURING:
499 			vscsi->flags |= RESPONSE_Q_DOWN;
500 			vscsi->state = new_state;
501 			vscsi->flags &= ~(SCHEDULE_DISCONNECT |
502 					  DISCONNECT_SCHEDULED);
503 			ibmvscsis_free_command_q(vscsi);
504 			break;
505 		case ERR_DISCONNECT:
506 		case ERR_DISCONNECT_RECONNECT:
507 			vscsi->state = new_state;
508 			break;
509 		}
510 		break;
511 
512 	/*
513 	 * Initiator has not done a successful srp login
514 	 * or has done a successful srp logout ( adapter was not
515 	 * busy). In the first case there can be responses queued
516 	 * waiting for space on the initiators response queue (MAD)
517 	 * The second case the adapter is idle. Assume the worse case,
518 	 * i.e. the second case.
519 	 */
520 	case WAIT_CONNECTION:
521 	case CONNECTED:
522 	case SRP_PROCESSING:
523 		wait_idle = true;
524 		vscsi->state = new_state;
525 		break;
526 
527 	/* can transition from this state to UNCONFIGURING */
528 	case UNDEFINED:
529 		if (new_state == UNCONFIGURING)
530 			vscsi->state = new_state;
531 		break;
532 	default:
533 		break;
534 	}
535 
536 	if (wait_idle) {
537 		pr_debug("disconnect start wait, active %d, sched %d\n",
538 			 (int)list_empty(&vscsi->active_q),
539 			 (int)list_empty(&vscsi->schedule_q));
540 		if (!list_empty(&vscsi->active_q) ||
541 		    !list_empty(&vscsi->schedule_q)) {
542 			vscsi->flags |= WAIT_FOR_IDLE;
543 			pr_debug("disconnect flags 0x%x\n", vscsi->flags);
544 			/*
545 			 * This routine is can not be called with the interrupt
546 			 * lock held.
547 			 */
548 			spin_unlock_bh(&vscsi->intr_lock);
549 			wait_for_completion(&vscsi->wait_idle);
550 			spin_lock_bh(&vscsi->intr_lock);
551 		}
552 		pr_debug("disconnect stop wait\n");
553 
554 		ibmvscsis_adapter_idle(vscsi);
555 	}
556 
557 	spin_unlock_bh(&vscsi->intr_lock);
558 }
559 
560 /**
561  * ibmvscsis_post_disconnect() - Schedule the disconnect
562  * @vscsi:	Pointer to our adapter structure
563  * @new_state:	State to move to after disconnecting
564  * @flag_bits:	Flags to turn on in adapter structure
565  *
566  * If it's already been scheduled, then see if we need to "upgrade"
567  * the new state (if the one passed in is more "severe" than the
568  * previous one).
569  *
570  * PRECONDITION:
571  *	interrupt lock is held
572  */
573 static void ibmvscsis_post_disconnect(struct scsi_info *vscsi, uint new_state,
574 				      uint flag_bits)
575 {
576 	uint state;
577 
578 	/* check the validity of the new state */
579 	switch (new_state) {
580 	case UNCONFIGURING:
581 	case ERR_DISCONNECT:
582 	case ERR_DISCONNECT_RECONNECT:
583 	case WAIT_IDLE:
584 		break;
585 
586 	default:
587 		dev_err(&vscsi->dev, "post_disconnect: Invalid new state %d\n",
588 			new_state);
589 		return;
590 	}
591 
592 	vscsi->flags |= flag_bits;
593 
594 	pr_debug("post_disconnect: new_state 0x%x, flag_bits 0x%x, vscsi->flags 0x%x, state %hx\n",
595 		 new_state, flag_bits, vscsi->flags, vscsi->state);
596 
597 	if (!(vscsi->flags & (DISCONNECT_SCHEDULED | SCHEDULE_DISCONNECT))) {
598 		vscsi->flags |= SCHEDULE_DISCONNECT;
599 		vscsi->new_state = new_state;
600 
601 		INIT_WORK(&vscsi->proc_work, ibmvscsis_disconnect);
602 		(void)queue_work(vscsi->work_q, &vscsi->proc_work);
603 	} else {
604 		if (vscsi->new_state)
605 			state = vscsi->new_state;
606 		else
607 			state = vscsi->state;
608 
609 		switch (state) {
610 		case NO_QUEUE:
611 		case UNCONFIGURING:
612 			break;
613 
614 		case ERR_DISCONNECTED:
615 		case ERR_DISCONNECT:
616 		case UNDEFINED:
617 			if (new_state == UNCONFIGURING)
618 				vscsi->new_state = new_state;
619 			break;
620 
621 		case ERR_DISCONNECT_RECONNECT:
622 			switch (new_state) {
623 			case UNCONFIGURING:
624 			case ERR_DISCONNECT:
625 				vscsi->new_state = new_state;
626 				break;
627 			default:
628 				break;
629 			}
630 			break;
631 
632 		case WAIT_ENABLED:
633 		case WAIT_IDLE:
634 		case WAIT_CONNECTION:
635 		case CONNECTED:
636 		case SRP_PROCESSING:
637 			vscsi->new_state = new_state;
638 			break;
639 
640 		default:
641 			break;
642 		}
643 	}
644 
645 	pr_debug("Leaving post_disconnect: flags 0x%x, new_state 0x%x\n",
646 		 vscsi->flags, vscsi->new_state);
647 }
648 
649 /**
650  * ibmvscsis_handle_init_compl_msg() - Respond to an Init Complete Message
651  * @vscsi:	Pointer to our adapter structure
652  *
653  * Must be called with interrupt lock held.
654  */
655 static long ibmvscsis_handle_init_compl_msg(struct scsi_info *vscsi)
656 {
657 	long rc = ADAPT_SUCCESS;
658 
659 	switch (vscsi->state) {
660 	case NO_QUEUE:
661 	case ERR_DISCONNECT:
662 	case ERR_DISCONNECT_RECONNECT:
663 	case ERR_DISCONNECTED:
664 	case UNCONFIGURING:
665 	case UNDEFINED:
666 		rc = ERROR;
667 		break;
668 
669 	case WAIT_CONNECTION:
670 		vscsi->state = CONNECTED;
671 		break;
672 
673 	case WAIT_IDLE:
674 	case SRP_PROCESSING:
675 	case CONNECTED:
676 	case WAIT_ENABLED:
677 	default:
678 		rc = ERROR;
679 		dev_err(&vscsi->dev, "init_msg: invalid state %d to get init compl msg\n",
680 			vscsi->state);
681 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
682 		break;
683 	}
684 
685 	return rc;
686 }
687 
688 /**
689  * ibmvscsis_handle_init_msg() - Respond to an Init Message
690  * @vscsi:	Pointer to our adapter structure
691  *
692  * Must be called with interrupt lock held.
693  */
694 static long ibmvscsis_handle_init_msg(struct scsi_info *vscsi)
695 {
696 	long rc = ADAPT_SUCCESS;
697 
698 	switch (vscsi->state) {
699 	case WAIT_CONNECTION:
700 		rc = ibmvscsis_send_init_message(vscsi, INIT_COMPLETE_MSG);
701 		switch (rc) {
702 		case H_SUCCESS:
703 			vscsi->state = CONNECTED;
704 			break;
705 
706 		case H_PARAMETER:
707 			dev_err(&vscsi->dev, "init_msg: failed to send, rc %ld\n",
708 				rc);
709 			ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT, 0);
710 			break;
711 
712 		case H_DROPPED:
713 			dev_err(&vscsi->dev, "init_msg: failed to send, rc %ld\n",
714 				rc);
715 			rc = ERROR;
716 			ibmvscsis_post_disconnect(vscsi,
717 						  ERR_DISCONNECT_RECONNECT, 0);
718 			break;
719 
720 		case H_CLOSED:
721 			pr_warn("init_msg: failed to send, rc %ld\n", rc);
722 			rc = 0;
723 			break;
724 		}
725 		break;
726 
727 	case UNDEFINED:
728 		rc = ERROR;
729 		break;
730 
731 	case UNCONFIGURING:
732 		break;
733 
734 	case WAIT_ENABLED:
735 	case CONNECTED:
736 	case SRP_PROCESSING:
737 	case WAIT_IDLE:
738 	case NO_QUEUE:
739 	case ERR_DISCONNECT:
740 	case ERR_DISCONNECT_RECONNECT:
741 	case ERR_DISCONNECTED:
742 	default:
743 		rc = ERROR;
744 		dev_err(&vscsi->dev, "init_msg: invalid state %d to get init msg\n",
745 			vscsi->state);
746 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
747 		break;
748 	}
749 
750 	return rc;
751 }
752 
753 /**
754  * ibmvscsis_init_msg() - Respond to an init message
755  * @vscsi:	Pointer to our adapter structure
756  * @crq:	Pointer to CRQ element containing the Init Message
757  *
758  * EXECUTION ENVIRONMENT:
759  *	Interrupt, interrupt lock held
760  */
761 static long ibmvscsis_init_msg(struct scsi_info *vscsi, struct viosrp_crq *crq)
762 {
763 	long rc = ADAPT_SUCCESS;
764 
765 	pr_debug("init_msg: state 0x%hx\n", vscsi->state);
766 
767 	rc = h_vioctl(vscsi->dds.unit_id, H_GET_PARTNER_INFO,
768 		      (u64)vscsi->map_ioba | ((u64)PAGE_SIZE << 32), 0, 0, 0,
769 		      0);
770 	if (rc == H_SUCCESS) {
771 		vscsi->client_data.partition_number =
772 			be64_to_cpu(*(u64 *)vscsi->map_buf);
773 		pr_debug("init_msg, part num %d\n",
774 			 vscsi->client_data.partition_number);
775 	} else {
776 		pr_debug("init_msg h_vioctl rc %ld\n", rc);
777 		rc = ADAPT_SUCCESS;
778 	}
779 
780 	if (crq->format == INIT_MSG) {
781 		rc = ibmvscsis_handle_init_msg(vscsi);
782 	} else if (crq->format == INIT_COMPLETE_MSG) {
783 		rc = ibmvscsis_handle_init_compl_msg(vscsi);
784 	} else {
785 		rc = ERROR;
786 		dev_err(&vscsi->dev, "init_msg: invalid format %d\n",
787 			(uint)crq->format);
788 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
789 	}
790 
791 	return rc;
792 }
793 
794 /**
795  * ibmvscsis_establish_new_q() - Establish new CRQ queue
796  * @vscsi:	Pointer to our adapter structure
797  *
798  * Must be called with interrupt lock held.
799  */
800 static long ibmvscsis_establish_new_q(struct scsi_info *vscsi)
801 {
802 	long rc = ADAPT_SUCCESS;
803 	uint format;
804 
805 	vscsi->flags &= PRESERVE_FLAG_FIELDS;
806 	vscsi->rsp_q_timer.timer_pops = 0;
807 	vscsi->debit = 0;
808 	vscsi->credit = 0;
809 
810 	rc = vio_enable_interrupts(vscsi->dma_dev);
811 	if (rc) {
812 		pr_warn("establish_new_q: failed to enable interrupts, rc %ld\n",
813 			rc);
814 		return rc;
815 	}
816 
817 	rc = ibmvscsis_check_init_msg(vscsi, &format);
818 	if (rc) {
819 		dev_err(&vscsi->dev, "establish_new_q: check_init_msg failed, rc %ld\n",
820 			rc);
821 		return rc;
822 	}
823 
824 	if (format == UNUSED_FORMAT) {
825 		rc = ibmvscsis_send_init_message(vscsi, INIT_MSG);
826 		switch (rc) {
827 		case H_SUCCESS:
828 		case H_DROPPED:
829 		case H_CLOSED:
830 			rc = ADAPT_SUCCESS;
831 			break;
832 
833 		case H_PARAMETER:
834 		case H_HARDWARE:
835 			break;
836 
837 		default:
838 			vscsi->state = UNDEFINED;
839 			rc = H_HARDWARE;
840 			break;
841 		}
842 	} else if (format == INIT_MSG) {
843 		rc = ibmvscsis_handle_init_msg(vscsi);
844 	}
845 
846 	return rc;
847 }
848 
849 /**
850  * ibmvscsis_reset_queue() - Reset CRQ Queue
851  * @vscsi:	Pointer to our adapter structure
852  *
853  * This function calls h_free_q and then calls h_reg_q and does all
854  * of the bookkeeping to get us back to where we can communicate.
855  *
856  * Actually, we don't always call h_free_crq.  A problem was discovered
857  * where one partition would close and reopen his queue, which would
858  * cause his partner to get a transport event, which would cause him to
859  * close and reopen his queue, which would cause the original partition
860  * to get a transport event, etc., etc.  To prevent this, we don't
861  * actually close our queue if the client initiated the reset, (i.e.
862  * either we got a transport event or we have detected that the client's
863  * queue is gone)
864  *
865  * EXECUTION ENVIRONMENT:
866  *	Process environment, called with interrupt lock held
867  */
868 static void ibmvscsis_reset_queue(struct scsi_info *vscsi)
869 {
870 	int bytes;
871 	long rc = ADAPT_SUCCESS;
872 
873 	pr_debug("reset_queue: flags 0x%x\n", vscsi->flags);
874 
875 	/* don't reset, the client did it for us */
876 	if (vscsi->flags & (CLIENT_FAILED | TRANS_EVENT)) {
877 		vscsi->flags &= PRESERVE_FLAG_FIELDS;
878 		vscsi->rsp_q_timer.timer_pops = 0;
879 		vscsi->debit = 0;
880 		vscsi->credit = 0;
881 		vscsi->state = WAIT_CONNECTION;
882 		vio_enable_interrupts(vscsi->dma_dev);
883 	} else {
884 		rc = ibmvscsis_free_command_q(vscsi);
885 		if (rc == ADAPT_SUCCESS) {
886 			vscsi->state = WAIT_CONNECTION;
887 
888 			bytes = vscsi->cmd_q.size * PAGE_SIZE;
889 			rc = h_reg_crq(vscsi->dds.unit_id,
890 				       vscsi->cmd_q.crq_token, bytes);
891 			if (rc == H_CLOSED || rc == H_SUCCESS) {
892 				rc = ibmvscsis_establish_new_q(vscsi);
893 			}
894 
895 			if (rc != ADAPT_SUCCESS) {
896 				pr_debug("reset_queue: reg_crq rc %ld\n", rc);
897 
898 				vscsi->state = ERR_DISCONNECTED;
899 				vscsi->flags |= RESPONSE_Q_DOWN;
900 				ibmvscsis_free_command_q(vscsi);
901 			}
902 		} else {
903 			vscsi->state = ERR_DISCONNECTED;
904 			vscsi->flags |= RESPONSE_Q_DOWN;
905 		}
906 	}
907 }
908 
909 /**
910  * ibmvscsis_free_cmd_resources() - Free command resources
911  * @vscsi:	Pointer to our adapter structure
912  * @cmd:	Command which is not longer in use
913  *
914  * Must be called with interrupt lock held.
915  */
916 static void ibmvscsis_free_cmd_resources(struct scsi_info *vscsi,
917 					 struct ibmvscsis_cmd *cmd)
918 {
919 	struct iu_entry *iue = cmd->iue;
920 
921 	switch (cmd->type) {
922 	case TASK_MANAGEMENT:
923 	case SCSI_CDB:
924 		/*
925 		 * When the queue goes down this value is cleared, so it
926 		 * cannot be cleared in this general purpose function.
927 		 */
928 		if (vscsi->debit)
929 			vscsi->debit -= 1;
930 		break;
931 	case ADAPTER_MAD:
932 		vscsi->flags &= ~PROCESSING_MAD;
933 		break;
934 	case UNSET_TYPE:
935 		break;
936 	default:
937 		dev_err(&vscsi->dev, "free_cmd_resources unknown type %d\n",
938 			cmd->type);
939 		break;
940 	}
941 
942 	cmd->iue = NULL;
943 	list_add_tail(&cmd->list, &vscsi->free_cmd);
944 	srp_iu_put(iue);
945 
946 	if (list_empty(&vscsi->active_q) && list_empty(&vscsi->schedule_q) &&
947 	    list_empty(&vscsi->waiting_rsp) && (vscsi->flags & WAIT_FOR_IDLE)) {
948 		vscsi->flags &= ~WAIT_FOR_IDLE;
949 		complete(&vscsi->wait_idle);
950 	}
951 }
952 
953 /**
954  * ibmvscsis_trans_event() - Handle a Transport Event
955  * @vscsi:	Pointer to our adapter structure
956  * @crq:	Pointer to CRQ entry containing the Transport Event
957  *
958  * Do the logic to close the I_T nexus.  This function may not
959  * behave to specification.
960  *
961  * EXECUTION ENVIRONMENT:
962  *	Interrupt, interrupt lock held
963  */
964 static long ibmvscsis_trans_event(struct scsi_info *vscsi,
965 				  struct viosrp_crq *crq)
966 {
967 	long rc = ADAPT_SUCCESS;
968 
969 	pr_debug("trans_event: format %d, flags 0x%x, state 0x%hx\n",
970 		 (int)crq->format, vscsi->flags, vscsi->state);
971 
972 	switch (crq->format) {
973 	case MIGRATED:
974 	case PARTNER_FAILED:
975 	case PARTNER_DEREGISTER:
976 		ibmvscsis_delete_client_info(vscsi, true);
977 		break;
978 
979 	default:
980 		rc = ERROR;
981 		dev_err(&vscsi->dev, "trans_event: invalid format %d\n",
982 			(uint)crq->format);
983 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT,
984 					  RESPONSE_Q_DOWN);
985 		break;
986 	}
987 
988 	if (rc == ADAPT_SUCCESS) {
989 		switch (vscsi->state) {
990 		case NO_QUEUE:
991 		case ERR_DISCONNECTED:
992 		case UNDEFINED:
993 			break;
994 
995 		case UNCONFIGURING:
996 			vscsi->flags |= (RESPONSE_Q_DOWN | TRANS_EVENT);
997 			break;
998 
999 		case WAIT_ENABLED:
1000 			break;
1001 
1002 		case WAIT_CONNECTION:
1003 			break;
1004 
1005 		case CONNECTED:
1006 			ibmvscsis_post_disconnect(vscsi, WAIT_IDLE,
1007 						  (RESPONSE_Q_DOWN |
1008 						   TRANS_EVENT));
1009 			break;
1010 
1011 		case SRP_PROCESSING:
1012 			if ((vscsi->debit > 0) ||
1013 			    !list_empty(&vscsi->schedule_q) ||
1014 			    !list_empty(&vscsi->waiting_rsp) ||
1015 			    !list_empty(&vscsi->active_q)) {
1016 				pr_debug("debit %d, sched %d, wait %d, active %d\n",
1017 					 vscsi->debit,
1018 					 (int)list_empty(&vscsi->schedule_q),
1019 					 (int)list_empty(&vscsi->waiting_rsp),
1020 					 (int)list_empty(&vscsi->active_q));
1021 				pr_warn("connection lost with outstanding work\n");
1022 			} else {
1023 				pr_debug("trans_event: SRP Processing, but no outstanding work\n");
1024 			}
1025 
1026 			ibmvscsis_post_disconnect(vscsi, WAIT_IDLE,
1027 						  (RESPONSE_Q_DOWN |
1028 						   TRANS_EVENT));
1029 			break;
1030 
1031 		case ERR_DISCONNECT:
1032 		case ERR_DISCONNECT_RECONNECT:
1033 		case WAIT_IDLE:
1034 			vscsi->flags |= (RESPONSE_Q_DOWN | TRANS_EVENT);
1035 			break;
1036 		}
1037 	}
1038 
1039 	rc = vscsi->flags & SCHEDULE_DISCONNECT;
1040 
1041 	pr_debug("Leaving trans_event: flags 0x%x, state 0x%hx, rc %ld\n",
1042 		 vscsi->flags, vscsi->state, rc);
1043 
1044 	return rc;
1045 }
1046 
1047 /**
1048  * ibmvscsis_poll_cmd_q() - Poll Command Queue
1049  * @vscsi:	Pointer to our adapter structure
1050  *
1051  * Called to handle command elements that may have arrived while
1052  * interrupts were disabled.
1053  *
1054  * EXECUTION ENVIRONMENT:
1055  *	intr_lock must be held
1056  */
1057 static void ibmvscsis_poll_cmd_q(struct scsi_info *vscsi)
1058 {
1059 	struct viosrp_crq *crq;
1060 	long rc;
1061 	bool ack = true;
1062 	volatile u8 valid;
1063 
1064 	pr_debug("poll_cmd_q: flags 0x%x, state 0x%hx, q index %ud\n",
1065 		 vscsi->flags, vscsi->state, vscsi->cmd_q.index);
1066 
1067 	rc = vscsi->flags & SCHEDULE_DISCONNECT;
1068 	crq = vscsi->cmd_q.base_addr + vscsi->cmd_q.index;
1069 	valid = crq->valid;
1070 	dma_rmb();
1071 
1072 	while (valid) {
1073 poll_work:
1074 		vscsi->cmd_q.index =
1075 			(vscsi->cmd_q.index + 1) & vscsi->cmd_q.mask;
1076 
1077 		if (!rc) {
1078 			rc = ibmvscsis_parse_command(vscsi, crq);
1079 		} else {
1080 			if ((uint)crq->valid == VALID_TRANS_EVENT) {
1081 				/*
1082 				 * must service the transport layer events even
1083 				 * in an error state, dont break out until all
1084 				 * the consecutive transport events have been
1085 				 * processed
1086 				 */
1087 				rc = ibmvscsis_trans_event(vscsi, crq);
1088 			} else if (vscsi->flags & TRANS_EVENT) {
1089 				/*
1090 				 * if a tranport event has occurred leave
1091 				 * everything but transport events on the queue
1092 				 */
1093 				pr_debug("poll_cmd_q, ignoring\n");
1094 
1095 				/*
1096 				 * need to decrement the queue index so we can
1097 				 * look at the elment again
1098 				 */
1099 				if (vscsi->cmd_q.index)
1100 					vscsi->cmd_q.index -= 1;
1101 				else
1102 					/*
1103 					 * index is at 0 it just wrapped.
1104 					 * have it index last element in q
1105 					 */
1106 					vscsi->cmd_q.index = vscsi->cmd_q.mask;
1107 				break;
1108 			}
1109 		}
1110 
1111 		crq->valid = INVALIDATE_CMD_RESP_EL;
1112 
1113 		crq = vscsi->cmd_q.base_addr + vscsi->cmd_q.index;
1114 		valid = crq->valid;
1115 		dma_rmb();
1116 	}
1117 
1118 	if (!rc) {
1119 		if (ack) {
1120 			vio_enable_interrupts(vscsi->dma_dev);
1121 			ack = false;
1122 			pr_debug("poll_cmd_q, reenabling interrupts\n");
1123 		}
1124 		valid = crq->valid;
1125 		dma_rmb();
1126 		if (valid)
1127 			goto poll_work;
1128 	}
1129 
1130 	pr_debug("Leaving poll_cmd_q: rc %ld\n", rc);
1131 }
1132 
1133 /**
1134  * ibmvscsis_free_cmd_qs() - Free elements in queue
1135  * @vscsi:	Pointer to our adapter structure
1136  *
1137  * Free all of the elements on all queues that are waiting for
1138  * whatever reason.
1139  *
1140  * PRECONDITION:
1141  *	Called with interrupt lock held
1142  */
1143 static void ibmvscsis_free_cmd_qs(struct scsi_info *vscsi)
1144 {
1145 	struct ibmvscsis_cmd *cmd, *nxt;
1146 
1147 	pr_debug("free_cmd_qs: waiting_rsp empty %d, timer starter %d\n",
1148 		 (int)list_empty(&vscsi->waiting_rsp),
1149 		 vscsi->rsp_q_timer.started);
1150 
1151 	list_for_each_entry_safe(cmd, nxt, &vscsi->waiting_rsp, list) {
1152 		list_del(&cmd->list);
1153 		ibmvscsis_free_cmd_resources(vscsi, cmd);
1154 	}
1155 }
1156 
1157 /**
1158  * ibmvscsis_get_free_cmd() - Get free command from list
1159  * @vscsi:	Pointer to our adapter structure
1160  *
1161  * Must be called with interrupt lock held.
1162  */
1163 static struct ibmvscsis_cmd *ibmvscsis_get_free_cmd(struct scsi_info *vscsi)
1164 {
1165 	struct ibmvscsis_cmd *cmd = NULL;
1166 	struct iu_entry *iue;
1167 
1168 	iue = srp_iu_get(&vscsi->target);
1169 	if (iue) {
1170 		cmd = list_first_entry_or_null(&vscsi->free_cmd,
1171 					       struct ibmvscsis_cmd, list);
1172 		if (cmd) {
1173 			if (cmd->abort_cmd)
1174 				cmd->abort_cmd = NULL;
1175 			cmd->flags &= ~(DELAY_SEND);
1176 			list_del(&cmd->list);
1177 			cmd->iue = iue;
1178 			cmd->type = UNSET_TYPE;
1179 			memset(&cmd->se_cmd, 0, sizeof(cmd->se_cmd));
1180 		} else {
1181 			srp_iu_put(iue);
1182 		}
1183 	}
1184 
1185 	return cmd;
1186 }
1187 
1188 /**
1189  * ibmvscsis_adapter_idle() - Helper function to handle idle adapter
1190  * @vscsi:	Pointer to our adapter structure
1191  *
1192  * This function is called when the adapter is idle when the driver
1193  * is attempting to clear an error condition.
1194  * The adapter is considered busy if any of its cmd queues
1195  * are non-empty. This function can be invoked
1196  * from the off level disconnect function.
1197  *
1198  * EXECUTION ENVIRONMENT:
1199  *	Process environment called with interrupt lock held
1200  */
1201 static void ibmvscsis_adapter_idle(struct scsi_info *vscsi)
1202 {
1203 	int free_qs = false;
1204 
1205 	pr_debug("adapter_idle: flags 0x%x, state 0x%hx\n", vscsi->flags,
1206 		 vscsi->state);
1207 
1208 	/* Only need to free qs if we're disconnecting from client */
1209 	if (vscsi->state != WAIT_CONNECTION || vscsi->flags & TRANS_EVENT)
1210 		free_qs = true;
1211 
1212 	switch (vscsi->state) {
1213 	case UNCONFIGURING:
1214 		ibmvscsis_free_command_q(vscsi);
1215 		dma_rmb();
1216 		isync();
1217 		if (vscsi->flags & CFG_SLEEPING) {
1218 			vscsi->flags &= ~CFG_SLEEPING;
1219 			complete(&vscsi->unconfig);
1220 		}
1221 		break;
1222 	case ERR_DISCONNECT_RECONNECT:
1223 		ibmvscsis_reset_queue(vscsi);
1224 		pr_debug("adapter_idle, disc_rec: flags 0x%x\n", vscsi->flags);
1225 		break;
1226 
1227 	case ERR_DISCONNECT:
1228 		ibmvscsis_free_command_q(vscsi);
1229 		vscsi->flags &= ~(SCHEDULE_DISCONNECT | DISCONNECT_SCHEDULED);
1230 		vscsi->flags |= RESPONSE_Q_DOWN;
1231 		if (vscsi->tport.enabled)
1232 			vscsi->state = ERR_DISCONNECTED;
1233 		else
1234 			vscsi->state = WAIT_ENABLED;
1235 		pr_debug("adapter_idle, disc: flags 0x%x, state 0x%hx\n",
1236 			 vscsi->flags, vscsi->state);
1237 		break;
1238 
1239 	case WAIT_IDLE:
1240 		vscsi->rsp_q_timer.timer_pops = 0;
1241 		vscsi->debit = 0;
1242 		vscsi->credit = 0;
1243 		if (vscsi->flags & TRANS_EVENT) {
1244 			vscsi->state = WAIT_CONNECTION;
1245 			vscsi->flags &= PRESERVE_FLAG_FIELDS;
1246 		} else {
1247 			vscsi->state = CONNECTED;
1248 			vscsi->flags &= ~DISCONNECT_SCHEDULED;
1249 		}
1250 
1251 		pr_debug("adapter_idle, wait: flags 0x%x, state 0x%hx\n",
1252 			 vscsi->flags, vscsi->state);
1253 		ibmvscsis_poll_cmd_q(vscsi);
1254 		break;
1255 
1256 	case ERR_DISCONNECTED:
1257 		vscsi->flags &= ~DISCONNECT_SCHEDULED;
1258 		pr_debug("adapter_idle, disconnected: flags 0x%x, state 0x%hx\n",
1259 			 vscsi->flags, vscsi->state);
1260 		break;
1261 
1262 	default:
1263 		dev_err(&vscsi->dev, "adapter_idle: in invalid state %d\n",
1264 			vscsi->state);
1265 		break;
1266 	}
1267 
1268 	if (free_qs)
1269 		ibmvscsis_free_cmd_qs(vscsi);
1270 
1271 	/*
1272 	 * There is a timing window where we could lose a disconnect request.
1273 	 * The known path to this window occurs during the DISCONNECT_RECONNECT
1274 	 * case above: reset_queue calls free_command_q, which will release the
1275 	 * interrupt lock.  During that time, a new post_disconnect call can be
1276 	 * made with a "more severe" state (DISCONNECT or UNCONFIGURING).
1277 	 * Because the DISCONNECT_SCHEDULED flag is already set, post_disconnect
1278 	 * will only set the new_state.  Now free_command_q reacquires the intr
1279 	 * lock and clears the DISCONNECT_SCHEDULED flag (using PRESERVE_FLAG_
1280 	 * FIELDS), and the disconnect is lost.  This is particularly bad when
1281 	 * the new disconnect was for UNCONFIGURING, since the unconfigure hangs
1282 	 * forever.
1283 	 * Fix is that free command queue sets acr state and acr flags if there
1284 	 * is a change under the lock
1285 	 * note free command queue writes to this state it clears it
1286 	 * before releasing the lock, different drivers call the free command
1287 	 * queue different times so dont initialize above
1288 	 */
1289 	if (vscsi->phyp_acr_state != 0)	{
1290 		/*
1291 		 * set any bits in flags that may have been cleared by
1292 		 * a call to free command queue in switch statement
1293 		 * or reset queue
1294 		 */
1295 		vscsi->flags |= vscsi->phyp_acr_flags;
1296 		ibmvscsis_post_disconnect(vscsi, vscsi->phyp_acr_state, 0);
1297 		vscsi->phyp_acr_state = 0;
1298 		vscsi->phyp_acr_flags = 0;
1299 
1300 		pr_debug("adapter_idle: flags 0x%x, state 0x%hx, acr_flags 0x%x, acr_state 0x%hx\n",
1301 			 vscsi->flags, vscsi->state, vscsi->phyp_acr_flags,
1302 			 vscsi->phyp_acr_state);
1303 	}
1304 
1305 	pr_debug("Leaving adapter_idle: flags 0x%x, state 0x%hx, new_state 0x%x\n",
1306 		 vscsi->flags, vscsi->state, vscsi->new_state);
1307 }
1308 
1309 /**
1310  * ibmvscsis_copy_crq_packet() - Copy CRQ Packet
1311  * @vscsi:	Pointer to our adapter structure
1312  * @cmd:	Pointer to command element to use to process the request
1313  * @crq:	Pointer to CRQ entry containing the request
1314  *
1315  * Copy the srp information unit from the hosted
1316  * partition using remote dma
1317  *
1318  * EXECUTION ENVIRONMENT:
1319  *	Interrupt, interrupt lock held
1320  */
1321 static long ibmvscsis_copy_crq_packet(struct scsi_info *vscsi,
1322 				      struct ibmvscsis_cmd *cmd,
1323 				      struct viosrp_crq *crq)
1324 {
1325 	struct iu_entry *iue = cmd->iue;
1326 	long rc = 0;
1327 	u16 len;
1328 
1329 	len = be16_to_cpu(crq->IU_length);
1330 	if ((len > SRP_MAX_IU_LEN) || (len == 0)) {
1331 		dev_err(&vscsi->dev, "copy_crq: Invalid len %d passed", len);
1332 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
1333 		return SRP_VIOLATION;
1334 	}
1335 
1336 	rc = h_copy_rdma(len, vscsi->dds.window[REMOTE].liobn,
1337 			 be64_to_cpu(crq->IU_data_ptr),
1338 			 vscsi->dds.window[LOCAL].liobn, iue->sbuf->dma);
1339 
1340 	switch (rc) {
1341 	case H_SUCCESS:
1342 		cmd->init_time = mftb();
1343 		iue->remote_token = crq->IU_data_ptr;
1344 		iue->iu_len = len;
1345 		pr_debug("copy_crq: ioba 0x%llx, init_time 0x%llx\n",
1346 			 be64_to_cpu(crq->IU_data_ptr), cmd->init_time);
1347 		break;
1348 	case H_PERMISSION:
1349 		if (connection_broken(vscsi))
1350 			ibmvscsis_post_disconnect(vscsi,
1351 						  ERR_DISCONNECT_RECONNECT,
1352 						  (RESPONSE_Q_DOWN |
1353 						   CLIENT_FAILED));
1354 		else
1355 			ibmvscsis_post_disconnect(vscsi,
1356 						  ERR_DISCONNECT_RECONNECT, 0);
1357 
1358 		dev_err(&vscsi->dev, "copy_crq: h_copy_rdma failed, rc %ld\n",
1359 			rc);
1360 		break;
1361 	case H_DEST_PARM:
1362 	case H_SOURCE_PARM:
1363 	default:
1364 		dev_err(&vscsi->dev, "copy_crq: h_copy_rdma failed, rc %ld\n",
1365 			rc);
1366 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
1367 		break;
1368 	}
1369 
1370 	return rc;
1371 }
1372 
1373 /**
1374  * ibmvscsis_adapter_info - Service an Adapter Info MAnagement Data gram
1375  * @vscsi:	Pointer to our adapter structure
1376  * @iue:	Information Unit containing the Adapter Info MAD request
1377  *
1378  * EXECUTION ENVIRONMENT:
1379  *	Interrupt adapter lock is held
1380  */
1381 static long ibmvscsis_adapter_info(struct scsi_info *vscsi,
1382 				   struct iu_entry *iue)
1383 {
1384 	struct viosrp_adapter_info *mad = &vio_iu(iue)->mad.adapter_info;
1385 	struct mad_adapter_info_data *info;
1386 	uint flag_bits = 0;
1387 	dma_addr_t token;
1388 	long rc;
1389 
1390 	mad->common.status = cpu_to_be16(VIOSRP_MAD_SUCCESS);
1391 
1392 	if (be16_to_cpu(mad->common.length) > sizeof(*info)) {
1393 		mad->common.status = cpu_to_be16(VIOSRP_MAD_FAILED);
1394 		return 0;
1395 	}
1396 
1397 	info = dma_alloc_coherent(&vscsi->dma_dev->dev, sizeof(*info), &token,
1398 				  GFP_ATOMIC);
1399 	if (!info) {
1400 		dev_err(&vscsi->dev, "bad dma_alloc_coherent %p\n",
1401 			iue->target);
1402 		mad->common.status = cpu_to_be16(VIOSRP_MAD_FAILED);
1403 		return 0;
1404 	}
1405 
1406 	/* Get remote info */
1407 	rc = h_copy_rdma(be16_to_cpu(mad->common.length),
1408 			 vscsi->dds.window[REMOTE].liobn,
1409 			 be64_to_cpu(mad->buffer),
1410 			 vscsi->dds.window[LOCAL].liobn, token);
1411 
1412 	if (rc != H_SUCCESS) {
1413 		if (rc == H_PERMISSION) {
1414 			if (connection_broken(vscsi))
1415 				flag_bits = (RESPONSE_Q_DOWN | CLIENT_FAILED);
1416 		}
1417 		pr_warn("adapter_info: h_copy_rdma from client failed, rc %ld\n",
1418 			rc);
1419 		pr_debug("adapter_info: ioba 0x%llx, flags 0x%x, flag_bits 0x%x\n",
1420 			 be64_to_cpu(mad->buffer), vscsi->flags, flag_bits);
1421 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT,
1422 					  flag_bits);
1423 		goto free_dma;
1424 	}
1425 
1426 	/*
1427 	 * Copy client info, but ignore partition number, which we
1428 	 * already got from phyp - unless we failed to get it from
1429 	 * phyp (e.g. if we're running on a p5 system).
1430 	 */
1431 	if (vscsi->client_data.partition_number == 0)
1432 		vscsi->client_data.partition_number =
1433 			be32_to_cpu(info->partition_number);
1434 	strncpy(vscsi->client_data.srp_version, info->srp_version,
1435 		sizeof(vscsi->client_data.srp_version));
1436 	strncpy(vscsi->client_data.partition_name, info->partition_name,
1437 		sizeof(vscsi->client_data.partition_name));
1438 	vscsi->client_data.mad_version = be32_to_cpu(info->mad_version);
1439 	vscsi->client_data.os_type = be32_to_cpu(info->os_type);
1440 
1441 	/* Copy our info */
1442 	strncpy(info->srp_version, SRP_VERSION,
1443 		sizeof(info->srp_version));
1444 	strncpy(info->partition_name, vscsi->dds.partition_name,
1445 		sizeof(info->partition_name));
1446 	info->partition_number = cpu_to_be32(vscsi->dds.partition_num);
1447 	info->mad_version = cpu_to_be32(MAD_VERSION_1);
1448 	info->os_type = cpu_to_be32(LINUX);
1449 	memset(&info->port_max_txu[0], 0, sizeof(info->port_max_txu));
1450 	info->port_max_txu[0] = cpu_to_be32(MAX_TXU);
1451 
1452 	dma_wmb();
1453 	rc = h_copy_rdma(sizeof(*info), vscsi->dds.window[LOCAL].liobn,
1454 			 token, vscsi->dds.window[REMOTE].liobn,
1455 			 be64_to_cpu(mad->buffer));
1456 	switch (rc) {
1457 	case H_SUCCESS:
1458 		break;
1459 
1460 	case H_SOURCE_PARM:
1461 	case H_DEST_PARM:
1462 	case H_PERMISSION:
1463 		if (connection_broken(vscsi))
1464 			flag_bits = (RESPONSE_Q_DOWN | CLIENT_FAILED);
1465 	default:
1466 		dev_err(&vscsi->dev, "adapter_info: h_copy_rdma to client failed, rc %ld\n",
1467 			rc);
1468 		ibmvscsis_post_disconnect(vscsi,
1469 					  ERR_DISCONNECT_RECONNECT,
1470 					  flag_bits);
1471 		break;
1472 	}
1473 
1474 free_dma:
1475 	dma_free_coherent(&vscsi->dma_dev->dev, sizeof(*info), info, token);
1476 	pr_debug("Leaving adapter_info, rc %ld\n", rc);
1477 
1478 	return rc;
1479 }
1480 
1481 /**
1482  * ibmvscsis_cap_mad() - Service a Capabilities MAnagement Data gram
1483  * @vscsi:	Pointer to our adapter structure
1484  * @iue:	Information Unit containing the Capabilities MAD request
1485  *
1486  * NOTE: if you return an error from this routine you must be
1487  * disconnecting or you will cause a hang
1488  *
1489  * EXECUTION ENVIRONMENT:
1490  *	Interrupt called with adapter lock held
1491  */
1492 static int ibmvscsis_cap_mad(struct scsi_info *vscsi, struct iu_entry *iue)
1493 {
1494 	struct viosrp_capabilities *mad = &vio_iu(iue)->mad.capabilities;
1495 	struct capabilities *cap;
1496 	struct mad_capability_common *common;
1497 	dma_addr_t token;
1498 	u16 olen, len, status, min_len, cap_len;
1499 	u32 flag;
1500 	uint flag_bits = 0;
1501 	long rc = 0;
1502 
1503 	olen = be16_to_cpu(mad->common.length);
1504 	/*
1505 	 * struct capabilities hardcodes a couple capabilities after the
1506 	 * header, but the capabilities can actually be in any order.
1507 	 */
1508 	min_len = offsetof(struct capabilities, migration);
1509 	if ((olen < min_len) || (olen > PAGE_SIZE)) {
1510 		pr_warn("cap_mad: invalid len %d\n", olen);
1511 		mad->common.status = cpu_to_be16(VIOSRP_MAD_FAILED);
1512 		return 0;
1513 	}
1514 
1515 	cap = dma_alloc_coherent(&vscsi->dma_dev->dev, olen, &token,
1516 				 GFP_ATOMIC);
1517 	if (!cap) {
1518 		dev_err(&vscsi->dev, "bad dma_alloc_coherent %p\n",
1519 			iue->target);
1520 		mad->common.status = cpu_to_be16(VIOSRP_MAD_FAILED);
1521 		return 0;
1522 	}
1523 	rc = h_copy_rdma(olen, vscsi->dds.window[REMOTE].liobn,
1524 			 be64_to_cpu(mad->buffer),
1525 			 vscsi->dds.window[LOCAL].liobn, token);
1526 	if (rc == H_SUCCESS) {
1527 		strncpy(cap->name, dev_name(&vscsi->dma_dev->dev),
1528 			SRP_MAX_LOC_LEN);
1529 
1530 		len = olen - min_len;
1531 		status = VIOSRP_MAD_SUCCESS;
1532 		common = (struct mad_capability_common *)&cap->migration;
1533 
1534 		while ((len > 0) && (status == VIOSRP_MAD_SUCCESS) && !rc) {
1535 			pr_debug("cap_mad: len left %hd, cap type %d, cap len %hd\n",
1536 				 len, be32_to_cpu(common->cap_type),
1537 				 be16_to_cpu(common->length));
1538 
1539 			cap_len = be16_to_cpu(common->length);
1540 			if (cap_len > len) {
1541 				dev_err(&vscsi->dev, "cap_mad: cap len mismatch with total len\n");
1542 				status = VIOSRP_MAD_FAILED;
1543 				break;
1544 			}
1545 
1546 			if (cap_len == 0) {
1547 				dev_err(&vscsi->dev, "cap_mad: cap len is 0\n");
1548 				status = VIOSRP_MAD_FAILED;
1549 				break;
1550 			}
1551 
1552 			switch (common->cap_type) {
1553 			default:
1554 				pr_debug("cap_mad: unsupported capability\n");
1555 				common->server_support = 0;
1556 				flag = cpu_to_be32((u32)CAP_LIST_SUPPORTED);
1557 				cap->flags &= ~flag;
1558 				break;
1559 			}
1560 
1561 			len = len - cap_len;
1562 			common = (struct mad_capability_common *)
1563 				((char *)common + cap_len);
1564 		}
1565 
1566 		mad->common.status = cpu_to_be16(status);
1567 
1568 		dma_wmb();
1569 		rc = h_copy_rdma(olen, vscsi->dds.window[LOCAL].liobn, token,
1570 				 vscsi->dds.window[REMOTE].liobn,
1571 				 be64_to_cpu(mad->buffer));
1572 
1573 		if (rc != H_SUCCESS) {
1574 			pr_debug("cap_mad: failed to copy to client, rc %ld\n",
1575 				 rc);
1576 
1577 			if (rc == H_PERMISSION) {
1578 				if (connection_broken(vscsi))
1579 					flag_bits = (RESPONSE_Q_DOWN |
1580 						     CLIENT_FAILED);
1581 			}
1582 
1583 			pr_warn("cap_mad: error copying data to client, rc %ld\n",
1584 				rc);
1585 			ibmvscsis_post_disconnect(vscsi,
1586 						  ERR_DISCONNECT_RECONNECT,
1587 						  flag_bits);
1588 		}
1589 	}
1590 
1591 	dma_free_coherent(&vscsi->dma_dev->dev, olen, cap, token);
1592 
1593 	pr_debug("Leaving cap_mad, rc %ld, client_cap 0x%x\n",
1594 		 rc, vscsi->client_cap);
1595 
1596 	return rc;
1597 }
1598 
1599 /**
1600  * ibmvscsis_process_mad() - Service a MAnagement Data gram
1601  * @vscsi:	Pointer to our adapter structure
1602  * @iue:	Information Unit containing the MAD request
1603  *
1604  * Must be called with interrupt lock held.
1605  */
1606 static long ibmvscsis_process_mad(struct scsi_info *vscsi, struct iu_entry *iue)
1607 {
1608 	struct mad_common *mad = (struct mad_common *)&vio_iu(iue)->mad;
1609 	struct viosrp_empty_iu *empty;
1610 	long rc = ADAPT_SUCCESS;
1611 
1612 	switch (be32_to_cpu(mad->type)) {
1613 	case VIOSRP_EMPTY_IU_TYPE:
1614 		empty = &vio_iu(iue)->mad.empty_iu;
1615 		vscsi->empty_iu_id = be64_to_cpu(empty->buffer);
1616 		vscsi->empty_iu_tag = be64_to_cpu(empty->common.tag);
1617 		mad->status = cpu_to_be16(VIOSRP_MAD_SUCCESS);
1618 		break;
1619 	case VIOSRP_ADAPTER_INFO_TYPE:
1620 		rc = ibmvscsis_adapter_info(vscsi, iue);
1621 		break;
1622 	case VIOSRP_CAPABILITIES_TYPE:
1623 		rc = ibmvscsis_cap_mad(vscsi, iue);
1624 		break;
1625 	case VIOSRP_ENABLE_FAST_FAIL:
1626 		if (vscsi->state == CONNECTED) {
1627 			vscsi->fast_fail = true;
1628 			mad->status = cpu_to_be16(VIOSRP_MAD_SUCCESS);
1629 		} else {
1630 			pr_warn("fast fail mad sent after login\n");
1631 			mad->status = cpu_to_be16(VIOSRP_MAD_FAILED);
1632 		}
1633 		break;
1634 	default:
1635 		mad->status = cpu_to_be16(VIOSRP_MAD_NOT_SUPPORTED);
1636 		break;
1637 	}
1638 
1639 	return rc;
1640 }
1641 
1642 /**
1643  * srp_snd_msg_failed() - Handle an error when sending a response
1644  * @vscsi:	Pointer to our adapter structure
1645  * @rc:		The return code from the h_send_crq command
1646  *
1647  * Must be called with interrupt lock held.
1648  */
1649 static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
1650 {
1651 	ktime_t kt;
1652 
1653 	if (rc != H_DROPPED) {
1654 		ibmvscsis_free_cmd_qs(vscsi);
1655 
1656 		if (rc == H_CLOSED)
1657 			vscsi->flags |= CLIENT_FAILED;
1658 
1659 		/* don't flag the same problem multiple times */
1660 		if (!(vscsi->flags & RESPONSE_Q_DOWN)) {
1661 			vscsi->flags |= RESPONSE_Q_DOWN;
1662 			if (!(vscsi->state & (ERR_DISCONNECT |
1663 					      ERR_DISCONNECT_RECONNECT |
1664 					      ERR_DISCONNECTED | UNDEFINED))) {
1665 				dev_err(&vscsi->dev, "snd_msg_failed: setting RESPONSE_Q_DOWN, state 0x%hx, flags 0x%x, rc %ld\n",
1666 					vscsi->state, vscsi->flags, rc);
1667 			}
1668 			ibmvscsis_post_disconnect(vscsi,
1669 						  ERR_DISCONNECT_RECONNECT, 0);
1670 		}
1671 		return;
1672 	}
1673 
1674 	/*
1675 	 * The response queue is full.
1676 	 * If the server is processing SRP requests, i.e.
1677 	 * the client has successfully done an
1678 	 * SRP_LOGIN, then it will wait forever for room in
1679 	 * the queue.  However if the system admin
1680 	 * is attempting to unconfigure the server then one
1681 	 * or more children will be in a state where
1682 	 * they are being removed. So if there is even one
1683 	 * child being removed then the driver assumes
1684 	 * the system admin is attempting to break the
1685 	 * connection with the client and MAX_TIMER_POPS
1686 	 * is honored.
1687 	 */
1688 	if ((vscsi->rsp_q_timer.timer_pops < MAX_TIMER_POPS) ||
1689 	    (vscsi->state == SRP_PROCESSING)) {
1690 		pr_debug("snd_msg_failed: response queue full, flags 0x%x, timer started %d, pops %d\n",
1691 			 vscsi->flags, (int)vscsi->rsp_q_timer.started,
1692 			 vscsi->rsp_q_timer.timer_pops);
1693 
1694 		/*
1695 		 * Check if the timer is running; if it
1696 		 * is not then start it up.
1697 		 */
1698 		if (!vscsi->rsp_q_timer.started) {
1699 			if (vscsi->rsp_q_timer.timer_pops <
1700 			    MAX_TIMER_POPS) {
1701 				kt = WAIT_NANO_SECONDS;
1702 			} else {
1703 				/*
1704 				 * slide the timeslice if the maximum
1705 				 * timer pops have already happened
1706 				 */
1707 				kt = ktime_set(WAIT_SECONDS, 0);
1708 			}
1709 
1710 			vscsi->rsp_q_timer.started = true;
1711 			hrtimer_start(&vscsi->rsp_q_timer.timer, kt,
1712 				      HRTIMER_MODE_REL);
1713 		}
1714 	} else {
1715 		/*
1716 		 * TBD: Do we need to worry about this? Need to get
1717 		 *      remove working.
1718 		 */
1719 		/*
1720 		 * waited a long time and it appears the system admin
1721 		 * is bring this driver down
1722 		 */
1723 		vscsi->flags |= RESPONSE_Q_DOWN;
1724 		ibmvscsis_free_cmd_qs(vscsi);
1725 		/*
1726 		 * if the driver is already attempting to disconnect
1727 		 * from the client and has already logged an error
1728 		 * trace this event but don't put it in the error log
1729 		 */
1730 		if (!(vscsi->state & (ERR_DISCONNECT |
1731 				      ERR_DISCONNECT_RECONNECT |
1732 				      ERR_DISCONNECTED | UNDEFINED))) {
1733 			dev_err(&vscsi->dev, "client crq full too long\n");
1734 			ibmvscsis_post_disconnect(vscsi,
1735 						  ERR_DISCONNECT_RECONNECT,
1736 						  0);
1737 		}
1738 	}
1739 }
1740 
1741 /**
1742  * ibmvscsis_send_messages() - Send a Response
1743  * @vscsi:	Pointer to our adapter structure
1744  *
1745  * Send a response, first checking the waiting queue. Responses are
1746  * sent in order they are received. If the response cannot be sent,
1747  * because the client queue is full, it stays on the waiting queue.
1748  *
1749  * PRECONDITION:
1750  *	Called with interrupt lock held
1751  */
1752 static void ibmvscsis_send_messages(struct scsi_info *vscsi)
1753 {
1754 	u64 msg_hi = 0;
1755 	/* note do not attempt to access the IU_data_ptr with this pointer
1756 	 * it is not valid
1757 	 */
1758 	struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
1759 	struct ibmvscsis_cmd *cmd, *nxt;
1760 	struct iu_entry *iue;
1761 	long rc = ADAPT_SUCCESS;
1762 	bool retry = false;
1763 
1764 	if (!(vscsi->flags & RESPONSE_Q_DOWN)) {
1765 		do {
1766 			retry = false;
1767 			list_for_each_entry_safe(cmd, nxt, &vscsi->waiting_rsp,
1768 						 list) {
1769 				/*
1770 				 * Check to make sure abort cmd gets processed
1771 				 * prior to the abort tmr cmd
1772 				 */
1773 				if (cmd->flags & DELAY_SEND)
1774 					continue;
1775 
1776 				if (cmd->abort_cmd) {
1777 					retry = true;
1778 					cmd->abort_cmd->flags &= ~(DELAY_SEND);
1779 					cmd->abort_cmd = NULL;
1780 				}
1781 
1782 				/*
1783 				 * If CMD_T_ABORTED w/o CMD_T_TAS scenarios and
1784 				 * the case where LIO issued a
1785 				 * ABORT_TASK: Sending TMR_TASK_DOES_NOT_EXIST
1786 				 * case then we dont send a response, since it
1787 				 * was already done.
1788 				 */
1789 				if (cmd->se_cmd.transport_state & CMD_T_ABORTED &&
1790 				    !(cmd->se_cmd.transport_state & CMD_T_TAS)) {
1791 					list_del(&cmd->list);
1792 					ibmvscsis_free_cmd_resources(vscsi,
1793 								     cmd);
1794 					/*
1795 					 * With a successfully aborted op
1796 					 * through LIO we want to increment the
1797 					 * the vscsi credit so that when we dont
1798 					 * send a rsp to the original scsi abort
1799 					 * op (h_send_crq), but the tm rsp to
1800 					 * the abort is sent, the credit is
1801 					 * correctly sent with the abort tm rsp.
1802 					 * We would need 1 for the abort tm rsp
1803 					 * and 1 credit for the aborted scsi op.
1804 					 * Thus we need to increment here.
1805 					 * Also we want to increment the credit
1806 					 * here because we want to make sure
1807 					 * cmd is actually released first
1808 					 * otherwise the client will think it
1809 					 * it can send a new cmd, and we could
1810 					 * find ourselves short of cmd elements.
1811 					 */
1812 					vscsi->credit += 1;
1813 				} else {
1814 					iue = cmd->iue;
1815 
1816 					crq->valid = VALID_CMD_RESP_EL;
1817 					crq->format = cmd->rsp.format;
1818 
1819 					if (cmd->flags & CMD_FAST_FAIL)
1820 						crq->status = VIOSRP_ADAPTER_FAIL;
1821 
1822 					crq->IU_length = cpu_to_be16(cmd->rsp.len);
1823 
1824 					rc = h_send_crq(vscsi->dma_dev->unit_address,
1825 							be64_to_cpu(msg_hi),
1826 							be64_to_cpu(cmd->rsp.tag));
1827 
1828 					pr_debug("send_messages: cmd %p, tag 0x%llx, rc %ld\n",
1829 						 cmd, be64_to_cpu(cmd->rsp.tag), rc);
1830 
1831 					/* if all ok free up the command
1832 					 * element resources
1833 					 */
1834 					if (rc == H_SUCCESS) {
1835 						/* some movement has occurred */
1836 						vscsi->rsp_q_timer.timer_pops = 0;
1837 						list_del(&cmd->list);
1838 
1839 						ibmvscsis_free_cmd_resources(vscsi,
1840 									     cmd);
1841 					} else {
1842 						srp_snd_msg_failed(vscsi, rc);
1843 						break;
1844 					}
1845 				}
1846 			}
1847 		} while (retry);
1848 
1849 		if (!rc) {
1850 			/*
1851 			 * The timer could pop with the queue empty.  If
1852 			 * this happens, rc will always indicate a
1853 			 * success; clear the pop count.
1854 			 */
1855 			vscsi->rsp_q_timer.timer_pops = 0;
1856 		}
1857 	} else {
1858 		ibmvscsis_free_cmd_qs(vscsi);
1859 	}
1860 }
1861 
1862 /* Called with intr lock held */
1863 static void ibmvscsis_send_mad_resp(struct scsi_info *vscsi,
1864 				    struct ibmvscsis_cmd *cmd,
1865 				    struct viosrp_crq *crq)
1866 {
1867 	struct iu_entry *iue = cmd->iue;
1868 	struct mad_common *mad = (struct mad_common *)&vio_iu(iue)->mad;
1869 	uint flag_bits = 0;
1870 	long rc;
1871 
1872 	dma_wmb();
1873 	rc = h_copy_rdma(sizeof(struct mad_common),
1874 			 vscsi->dds.window[LOCAL].liobn, iue->sbuf->dma,
1875 			 vscsi->dds.window[REMOTE].liobn,
1876 			 be64_to_cpu(crq->IU_data_ptr));
1877 	if (!rc) {
1878 		cmd->rsp.format = VIOSRP_MAD_FORMAT;
1879 		cmd->rsp.len = sizeof(struct mad_common);
1880 		cmd->rsp.tag = mad->tag;
1881 		list_add_tail(&cmd->list, &vscsi->waiting_rsp);
1882 		ibmvscsis_send_messages(vscsi);
1883 	} else {
1884 		pr_debug("Error sending mad response, rc %ld\n", rc);
1885 		if (rc == H_PERMISSION) {
1886 			if (connection_broken(vscsi))
1887 				flag_bits = (RESPONSE_Q_DOWN | CLIENT_FAILED);
1888 		}
1889 		dev_err(&vscsi->dev, "mad: failed to copy to client, rc %ld\n",
1890 			rc);
1891 
1892 		ibmvscsis_free_cmd_resources(vscsi, cmd);
1893 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT,
1894 					  flag_bits);
1895 	}
1896 }
1897 
1898 /**
1899  * ibmvscsis_mad() - Service a MAnagement Data gram.
1900  * @vscsi:	Pointer to our adapter structure
1901  * @crq:	Pointer to the CRQ entry containing the MAD request
1902  *
1903  * EXECUTION ENVIRONMENT:
1904  *	Interrupt, called with adapter lock held
1905  */
1906 static long ibmvscsis_mad(struct scsi_info *vscsi, struct viosrp_crq *crq)
1907 {
1908 	struct iu_entry *iue;
1909 	struct ibmvscsis_cmd *cmd;
1910 	struct mad_common *mad;
1911 	long rc = ADAPT_SUCCESS;
1912 
1913 	switch (vscsi->state) {
1914 		/*
1915 		 * We have not exchanged Init Msgs yet, so this MAD was sent
1916 		 * before the last Transport Event; client will not be
1917 		 * expecting a response.
1918 		 */
1919 	case WAIT_CONNECTION:
1920 		pr_debug("mad: in Wait Connection state, ignoring MAD, flags %d\n",
1921 			 vscsi->flags);
1922 		return ADAPT_SUCCESS;
1923 
1924 	case SRP_PROCESSING:
1925 	case CONNECTED:
1926 		break;
1927 
1928 		/*
1929 		 * We should never get here while we're in these states.
1930 		 * Just log an error and get out.
1931 		 */
1932 	case UNCONFIGURING:
1933 	case WAIT_IDLE:
1934 	case ERR_DISCONNECT:
1935 	case ERR_DISCONNECT_RECONNECT:
1936 	default:
1937 		dev_err(&vscsi->dev, "mad: invalid adapter state %d for mad\n",
1938 			vscsi->state);
1939 		return ADAPT_SUCCESS;
1940 	}
1941 
1942 	cmd = ibmvscsis_get_free_cmd(vscsi);
1943 	if (!cmd) {
1944 		dev_err(&vscsi->dev, "mad: failed to get cmd, debit %d\n",
1945 			vscsi->debit);
1946 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
1947 		return ERROR;
1948 	}
1949 	iue = cmd->iue;
1950 	cmd->type = ADAPTER_MAD;
1951 
1952 	rc = ibmvscsis_copy_crq_packet(vscsi, cmd, crq);
1953 	if (!rc) {
1954 		mad = (struct mad_common *)&vio_iu(iue)->mad;
1955 
1956 		pr_debug("mad: type %d\n", be32_to_cpu(mad->type));
1957 
1958 		rc = ibmvscsis_process_mad(vscsi, iue);
1959 
1960 		pr_debug("mad: status %hd, rc %ld\n", be16_to_cpu(mad->status),
1961 			 rc);
1962 
1963 		if (!rc)
1964 			ibmvscsis_send_mad_resp(vscsi, cmd, crq);
1965 	} else {
1966 		ibmvscsis_free_cmd_resources(vscsi, cmd);
1967 	}
1968 
1969 	pr_debug("Leaving mad, rc %ld\n", rc);
1970 	return rc;
1971 }
1972 
1973 /**
1974  * ibmvscsis_login_rsp() - Create/copy a login response notice to the client
1975  * @vscsi:	Pointer to our adapter structure
1976  * @cmd:	Pointer to the command for the SRP Login request
1977  *
1978  * EXECUTION ENVIRONMENT:
1979  *	Interrupt, interrupt lock held
1980  */
1981 static long ibmvscsis_login_rsp(struct scsi_info *vscsi,
1982 				struct ibmvscsis_cmd *cmd)
1983 {
1984 	struct iu_entry *iue = cmd->iue;
1985 	struct srp_login_rsp *rsp = &vio_iu(iue)->srp.login_rsp;
1986 	struct format_code *fmt;
1987 	uint flag_bits = 0;
1988 	long rc = ADAPT_SUCCESS;
1989 
1990 	memset(rsp, 0, sizeof(struct srp_login_rsp));
1991 
1992 	rsp->opcode = SRP_LOGIN_RSP;
1993 	rsp->req_lim_delta = cpu_to_be32(vscsi->request_limit);
1994 	rsp->tag = cmd->rsp.tag;
1995 	rsp->max_it_iu_len = cpu_to_be32(SRP_MAX_IU_LEN);
1996 	rsp->max_ti_iu_len = cpu_to_be32(SRP_MAX_IU_LEN);
1997 	fmt = (struct format_code *)&rsp->buf_fmt;
1998 	fmt->buffers = SUPPORTED_FORMATS;
1999 	vscsi->credit = 0;
2000 
2001 	cmd->rsp.len = sizeof(struct srp_login_rsp);
2002 
2003 	dma_wmb();
2004 	rc = h_copy_rdma(cmd->rsp.len, vscsi->dds.window[LOCAL].liobn,
2005 			 iue->sbuf->dma, vscsi->dds.window[REMOTE].liobn,
2006 			 be64_to_cpu(iue->remote_token));
2007 
2008 	switch (rc) {
2009 	case H_SUCCESS:
2010 		break;
2011 
2012 	case H_PERMISSION:
2013 		if (connection_broken(vscsi))
2014 			flag_bits = RESPONSE_Q_DOWN | CLIENT_FAILED;
2015 		dev_err(&vscsi->dev, "login_rsp: error copying to client, rc %ld\n",
2016 			rc);
2017 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT,
2018 					  flag_bits);
2019 		break;
2020 	case H_SOURCE_PARM:
2021 	case H_DEST_PARM:
2022 	default:
2023 		dev_err(&vscsi->dev, "login_rsp: error copying to client, rc %ld\n",
2024 			rc);
2025 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2026 		break;
2027 	}
2028 
2029 	return rc;
2030 }
2031 
2032 /**
2033  * ibmvscsis_srp_login_rej() - Create/copy a login rejection notice to client
2034  * @vscsi:	Pointer to our adapter structure
2035  * @cmd:	Pointer to the command for the SRP Login request
2036  * @reason:	The reason the SRP Login is being rejected, per SRP protocol
2037  *
2038  * EXECUTION ENVIRONMENT:
2039  *	Interrupt, interrupt lock held
2040  */
2041 static long ibmvscsis_srp_login_rej(struct scsi_info *vscsi,
2042 				    struct ibmvscsis_cmd *cmd, u32 reason)
2043 {
2044 	struct iu_entry *iue = cmd->iue;
2045 	struct srp_login_rej *rej = &vio_iu(iue)->srp.login_rej;
2046 	struct format_code *fmt;
2047 	uint flag_bits = 0;
2048 	long rc = ADAPT_SUCCESS;
2049 
2050 	memset(rej, 0, sizeof(*rej));
2051 
2052 	rej->opcode = SRP_LOGIN_REJ;
2053 	rej->reason = cpu_to_be32(reason);
2054 	rej->tag = cmd->rsp.tag;
2055 	fmt = (struct format_code *)&rej->buf_fmt;
2056 	fmt->buffers = SUPPORTED_FORMATS;
2057 
2058 	cmd->rsp.len = sizeof(*rej);
2059 
2060 	dma_wmb();
2061 	rc = h_copy_rdma(cmd->rsp.len, vscsi->dds.window[LOCAL].liobn,
2062 			 iue->sbuf->dma, vscsi->dds.window[REMOTE].liobn,
2063 			 be64_to_cpu(iue->remote_token));
2064 
2065 	switch (rc) {
2066 	case H_SUCCESS:
2067 		break;
2068 	case H_PERMISSION:
2069 		if (connection_broken(vscsi))
2070 			flag_bits = RESPONSE_Q_DOWN | CLIENT_FAILED;
2071 		dev_err(&vscsi->dev, "login_rej: error copying to client, rc %ld\n",
2072 			rc);
2073 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT,
2074 					  flag_bits);
2075 		break;
2076 	case H_SOURCE_PARM:
2077 	case H_DEST_PARM:
2078 	default:
2079 		dev_err(&vscsi->dev, "login_rej: error copying to client, rc %ld\n",
2080 			rc);
2081 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2082 		break;
2083 	}
2084 
2085 	return rc;
2086 }
2087 
2088 static int ibmvscsis_make_nexus(struct ibmvscsis_tport *tport)
2089 {
2090 	char *name = tport->tport_name;
2091 	struct ibmvscsis_nexus *nexus;
2092 	int rc;
2093 
2094 	if (tport->ibmv_nexus) {
2095 		pr_debug("tport->ibmv_nexus already exists\n");
2096 		return 0;
2097 	}
2098 
2099 	nexus = kzalloc(sizeof(*nexus), GFP_KERNEL);
2100 	if (!nexus) {
2101 		pr_err("Unable to allocate struct ibmvscsis_nexus\n");
2102 		return -ENOMEM;
2103 	}
2104 
2105 	nexus->se_sess = target_alloc_session(&tport->se_tpg, 0, 0,
2106 					      TARGET_PROT_NORMAL, name, nexus,
2107 					      NULL);
2108 	if (IS_ERR(nexus->se_sess)) {
2109 		rc = PTR_ERR(nexus->se_sess);
2110 		goto transport_init_fail;
2111 	}
2112 
2113 	tport->ibmv_nexus = nexus;
2114 
2115 	return 0;
2116 
2117 transport_init_fail:
2118 	kfree(nexus);
2119 	return rc;
2120 }
2121 
2122 static int ibmvscsis_drop_nexus(struct ibmvscsis_tport *tport)
2123 {
2124 	struct se_session *se_sess;
2125 	struct ibmvscsis_nexus *nexus;
2126 
2127 	nexus = tport->ibmv_nexus;
2128 	if (!nexus)
2129 		return -ENODEV;
2130 
2131 	se_sess = nexus->se_sess;
2132 	if (!se_sess)
2133 		return -ENODEV;
2134 
2135 	/*
2136 	 * Release the SCSI I_T Nexus to the emulated ibmvscsis Target Port
2137 	 */
2138 	target_wait_for_sess_cmds(se_sess);
2139 	transport_deregister_session_configfs(se_sess);
2140 	transport_deregister_session(se_sess);
2141 	tport->ibmv_nexus = NULL;
2142 	kfree(nexus);
2143 
2144 	return 0;
2145 }
2146 
2147 /**
2148  * ibmvscsis_srp_login() - Process an SRP Login Request
2149  * @vscsi:	Pointer to our adapter structure
2150  * @cmd:	Command element to use to process the SRP Login request
2151  * @crq:	Pointer to CRQ entry containing the SRP Login request
2152  *
2153  * EXECUTION ENVIRONMENT:
2154  *	Interrupt, called with interrupt lock held
2155  */
2156 static long ibmvscsis_srp_login(struct scsi_info *vscsi,
2157 				struct ibmvscsis_cmd *cmd,
2158 				struct viosrp_crq *crq)
2159 {
2160 	struct iu_entry *iue = cmd->iue;
2161 	struct srp_login_req *req = &vio_iu(iue)->srp.login_req;
2162 	struct port_id {
2163 		__be64 id_extension;
2164 		__be64 io_guid;
2165 	} *iport, *tport;
2166 	struct format_code *fmt;
2167 	u32 reason = 0x0;
2168 	long rc = ADAPT_SUCCESS;
2169 
2170 	iport = (struct port_id *)req->initiator_port_id;
2171 	tport = (struct port_id *)req->target_port_id;
2172 	fmt = (struct format_code *)&req->req_buf_fmt;
2173 	if (be32_to_cpu(req->req_it_iu_len) > SRP_MAX_IU_LEN)
2174 		reason = SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE;
2175 	else if (be32_to_cpu(req->req_it_iu_len) < 64)
2176 		reason = SRP_LOGIN_REJ_UNABLE_ESTABLISH_CHANNEL;
2177 	else if ((be64_to_cpu(iport->id_extension) > (MAX_NUM_PORTS - 1)) ||
2178 		 (be64_to_cpu(tport->id_extension) > (MAX_NUM_PORTS - 1)))
2179 		reason = SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL;
2180 	else if (req->req_flags & SRP_MULTICHAN_MULTI)
2181 		reason = SRP_LOGIN_REJ_MULTI_CHANNEL_UNSUPPORTED;
2182 	else if (fmt->buffers & (~SUPPORTED_FORMATS))
2183 		reason = SRP_LOGIN_REJ_UNSUPPORTED_DESCRIPTOR_FMT;
2184 	else if ((fmt->buffers & SUPPORTED_FORMATS) == 0)
2185 		reason = SRP_LOGIN_REJ_UNSUPPORTED_DESCRIPTOR_FMT;
2186 
2187 	if (vscsi->state == SRP_PROCESSING)
2188 		reason = SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED;
2189 
2190 	rc = ibmvscsis_make_nexus(&vscsi->tport);
2191 	if (rc)
2192 		reason = SRP_LOGIN_REJ_UNABLE_ESTABLISH_CHANNEL;
2193 
2194 	cmd->rsp.format = VIOSRP_SRP_FORMAT;
2195 	cmd->rsp.tag = req->tag;
2196 
2197 	pr_debug("srp_login: reason 0x%x\n", reason);
2198 
2199 	if (reason)
2200 		rc = ibmvscsis_srp_login_rej(vscsi, cmd, reason);
2201 	else
2202 		rc = ibmvscsis_login_rsp(vscsi, cmd);
2203 
2204 	if (!rc) {
2205 		if (!reason)
2206 			vscsi->state = SRP_PROCESSING;
2207 
2208 		list_add_tail(&cmd->list, &vscsi->waiting_rsp);
2209 		ibmvscsis_send_messages(vscsi);
2210 	} else {
2211 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2212 	}
2213 
2214 	pr_debug("Leaving srp_login, rc %ld\n", rc);
2215 	return rc;
2216 }
2217 
2218 /**
2219  * ibmvscsis_srp_i_logout() - Helper Function to close I_T Nexus
2220  * @vscsi:	Pointer to our adapter structure
2221  * @cmd:	Command element to use to process the Implicit Logout request
2222  * @crq:	Pointer to CRQ entry containing the Implicit Logout request
2223  *
2224  * Do the logic to close the I_T nexus.  This function may not
2225  * behave to specification.
2226  *
2227  * EXECUTION ENVIRONMENT:
2228  *	Interrupt, interrupt lock held
2229  */
2230 static long ibmvscsis_srp_i_logout(struct scsi_info *vscsi,
2231 				   struct ibmvscsis_cmd *cmd,
2232 				   struct viosrp_crq *crq)
2233 {
2234 	struct iu_entry *iue = cmd->iue;
2235 	struct srp_i_logout *log_out = &vio_iu(iue)->srp.i_logout;
2236 	long rc = ADAPT_SUCCESS;
2237 
2238 	if ((vscsi->debit > 0) || !list_empty(&vscsi->schedule_q) ||
2239 	    !list_empty(&vscsi->waiting_rsp)) {
2240 		dev_err(&vscsi->dev, "i_logout: outstanding work\n");
2241 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT, 0);
2242 	} else {
2243 		cmd->rsp.format = SRP_FORMAT;
2244 		cmd->rsp.tag = log_out->tag;
2245 		cmd->rsp.len = sizeof(struct mad_common);
2246 		list_add_tail(&cmd->list, &vscsi->waiting_rsp);
2247 		ibmvscsis_send_messages(vscsi);
2248 
2249 		ibmvscsis_post_disconnect(vscsi, WAIT_IDLE, 0);
2250 	}
2251 
2252 	return rc;
2253 }
2254 
2255 /* Called with intr lock held */
2256 static void ibmvscsis_srp_cmd(struct scsi_info *vscsi, struct viosrp_crq *crq)
2257 {
2258 	struct ibmvscsis_cmd *cmd;
2259 	struct iu_entry *iue;
2260 	struct srp_cmd *srp;
2261 	struct srp_tsk_mgmt *tsk;
2262 	long rc;
2263 
2264 	if (vscsi->request_limit - vscsi->debit <= 0) {
2265 		/* Client has exceeded request limit */
2266 		dev_err(&vscsi->dev, "Client exceeded the request limit (%d), debit %d\n",
2267 			vscsi->request_limit, vscsi->debit);
2268 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2269 		return;
2270 	}
2271 
2272 	cmd = ibmvscsis_get_free_cmd(vscsi);
2273 	if (!cmd) {
2274 		dev_err(&vscsi->dev, "srp_cmd failed to get cmd, debit %d\n",
2275 			vscsi->debit);
2276 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2277 		return;
2278 	}
2279 	iue = cmd->iue;
2280 	srp = &vio_iu(iue)->srp.cmd;
2281 
2282 	rc = ibmvscsis_copy_crq_packet(vscsi, cmd, crq);
2283 	if (rc) {
2284 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2285 		return;
2286 	}
2287 
2288 	if (vscsi->state == SRP_PROCESSING) {
2289 		switch (srp->opcode) {
2290 		case SRP_LOGIN_REQ:
2291 			rc = ibmvscsis_srp_login(vscsi, cmd, crq);
2292 			break;
2293 
2294 		case SRP_TSK_MGMT:
2295 			tsk = &vio_iu(iue)->srp.tsk_mgmt;
2296 			pr_debug("tsk_mgmt tag: %llu (0x%llx)\n", tsk->tag,
2297 				 tsk->tag);
2298 			cmd->rsp.tag = tsk->tag;
2299 			vscsi->debit += 1;
2300 			cmd->type = TASK_MANAGEMENT;
2301 			list_add_tail(&cmd->list, &vscsi->schedule_q);
2302 			queue_work(vscsi->work_q, &cmd->work);
2303 			break;
2304 
2305 		case SRP_CMD:
2306 			pr_debug("srp_cmd tag: %llu (0x%llx)\n", srp->tag,
2307 				 srp->tag);
2308 			cmd->rsp.tag = srp->tag;
2309 			vscsi->debit += 1;
2310 			cmd->type = SCSI_CDB;
2311 			/*
2312 			 * We want to keep track of work waiting for
2313 			 * the workqueue.
2314 			 */
2315 			list_add_tail(&cmd->list, &vscsi->schedule_q);
2316 			queue_work(vscsi->work_q, &cmd->work);
2317 			break;
2318 
2319 		case SRP_I_LOGOUT:
2320 			rc = ibmvscsis_srp_i_logout(vscsi, cmd, crq);
2321 			break;
2322 
2323 		case SRP_CRED_RSP:
2324 		case SRP_AER_RSP:
2325 		default:
2326 			ibmvscsis_free_cmd_resources(vscsi, cmd);
2327 			dev_err(&vscsi->dev, "invalid srp cmd, opcode %d\n",
2328 				(uint)srp->opcode);
2329 			ibmvscsis_post_disconnect(vscsi,
2330 						  ERR_DISCONNECT_RECONNECT, 0);
2331 			break;
2332 		}
2333 	} else if (srp->opcode == SRP_LOGIN_REQ && vscsi->state == CONNECTED) {
2334 		rc = ibmvscsis_srp_login(vscsi, cmd, crq);
2335 	} else {
2336 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2337 		dev_err(&vscsi->dev, "Invalid state %d to handle srp cmd\n",
2338 			vscsi->state);
2339 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2340 	}
2341 }
2342 
2343 /**
2344  * ibmvscsis_ping_response() - Respond to a ping request
2345  * @vscsi:	Pointer to our adapter structure
2346  *
2347  * Let the client know that the server is alive and waiting on
2348  * its native I/O stack.
2349  * If any type of error occurs from the call to queue a ping
2350  * response then the client is either not accepting or receiving
2351  * interrupts.  Disconnect with an error.
2352  *
2353  * EXECUTION ENVIRONMENT:
2354  *	Interrupt, interrupt lock held
2355  */
2356 static long ibmvscsis_ping_response(struct scsi_info *vscsi)
2357 {
2358 	struct viosrp_crq *crq;
2359 	u64 buffer[2] = { 0, 0 };
2360 	long rc;
2361 
2362 	crq = (struct viosrp_crq *)&buffer;
2363 	crq->valid = VALID_CMD_RESP_EL;
2364 	crq->format = (u8)MESSAGE_IN_CRQ;
2365 	crq->status = PING_RESPONSE;
2366 
2367 	rc = h_send_crq(vscsi->dds.unit_id, cpu_to_be64(buffer[MSG_HI]),
2368 			cpu_to_be64(buffer[MSG_LOW]));
2369 
2370 	switch (rc) {
2371 	case H_SUCCESS:
2372 		break;
2373 	case H_CLOSED:
2374 		vscsi->flags |= CLIENT_FAILED;
2375 	case H_DROPPED:
2376 		vscsi->flags |= RESPONSE_Q_DOWN;
2377 	case H_REMOTE_PARM:
2378 		dev_err(&vscsi->dev, "ping_response: h_send_crq failed, rc %ld\n",
2379 			rc);
2380 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2381 		break;
2382 	default:
2383 		dev_err(&vscsi->dev, "ping_response: h_send_crq returned unknown rc %ld\n",
2384 			rc);
2385 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT, 0);
2386 		break;
2387 	}
2388 
2389 	return rc;
2390 }
2391 
2392 /**
2393  * ibmvscsis_parse_command() - Parse an element taken from the cmd rsp queue.
2394  * @vscsi:	Pointer to our adapter structure
2395  * @crq:	Pointer to CRQ element containing the SRP request
2396  *
2397  * This function will return success if the command queue element is valid
2398  * and the srp iu or MAD request it pointed to was also valid.  That does
2399  * not mean that an error was not returned to the client.
2400  *
2401  * EXECUTION ENVIRONMENT:
2402  *	Interrupt, intr lock held
2403  */
2404 static long ibmvscsis_parse_command(struct scsi_info *vscsi,
2405 				    struct viosrp_crq *crq)
2406 {
2407 	long rc = ADAPT_SUCCESS;
2408 
2409 	switch (crq->valid) {
2410 	case VALID_CMD_RESP_EL:
2411 		switch (crq->format) {
2412 		case OS400_FORMAT:
2413 		case AIX_FORMAT:
2414 		case LINUX_FORMAT:
2415 		case MAD_FORMAT:
2416 			if (vscsi->flags & PROCESSING_MAD) {
2417 				rc = ERROR;
2418 				dev_err(&vscsi->dev, "parse_command: already processing mad\n");
2419 				ibmvscsis_post_disconnect(vscsi,
2420 						       ERR_DISCONNECT_RECONNECT,
2421 						       0);
2422 			} else {
2423 				vscsi->flags |= PROCESSING_MAD;
2424 				rc = ibmvscsis_mad(vscsi, crq);
2425 			}
2426 			break;
2427 
2428 		case SRP_FORMAT:
2429 			ibmvscsis_srp_cmd(vscsi, crq);
2430 			break;
2431 
2432 		case MESSAGE_IN_CRQ:
2433 			if (crq->status == PING)
2434 				ibmvscsis_ping_response(vscsi);
2435 			break;
2436 
2437 		default:
2438 			dev_err(&vscsi->dev, "parse_command: invalid format %d\n",
2439 				(uint)crq->format);
2440 			ibmvscsis_post_disconnect(vscsi,
2441 						  ERR_DISCONNECT_RECONNECT, 0);
2442 			break;
2443 		}
2444 		break;
2445 
2446 	case VALID_TRANS_EVENT:
2447 		rc = ibmvscsis_trans_event(vscsi, crq);
2448 		break;
2449 
2450 	case VALID_INIT_MSG:
2451 		rc = ibmvscsis_init_msg(vscsi, crq);
2452 		break;
2453 
2454 	default:
2455 		dev_err(&vscsi->dev, "parse_command: invalid valid field %d\n",
2456 			(uint)crq->valid);
2457 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2458 		break;
2459 	}
2460 
2461 	/*
2462 	 * Return only what the interrupt handler cares
2463 	 * about. Most errors we keep right on trucking.
2464 	 */
2465 	rc = vscsi->flags & SCHEDULE_DISCONNECT;
2466 
2467 	return rc;
2468 }
2469 
2470 static int read_dma_window(struct scsi_info *vscsi)
2471 {
2472 	struct vio_dev *vdev = vscsi->dma_dev;
2473 	const __be32 *dma_window;
2474 	const __be32 *prop;
2475 
2476 	/* TODO Using of_parse_dma_window would be better, but it doesn't give
2477 	 * a way to read multiple windows without already knowing the size of
2478 	 * a window or the number of windows.
2479 	 */
2480 	dma_window = (const __be32 *)vio_get_attribute(vdev,
2481 						       "ibm,my-dma-window",
2482 						       NULL);
2483 	if (!dma_window) {
2484 		pr_err("Couldn't find ibm,my-dma-window property\n");
2485 		return -1;
2486 	}
2487 
2488 	vscsi->dds.window[LOCAL].liobn = be32_to_cpu(*dma_window);
2489 	dma_window++;
2490 
2491 	prop = (const __be32 *)vio_get_attribute(vdev, "ibm,#dma-address-cells",
2492 						 NULL);
2493 	if (!prop) {
2494 		pr_warn("Couldn't find ibm,#dma-address-cells property\n");
2495 		dma_window++;
2496 	} else {
2497 		dma_window += be32_to_cpu(*prop);
2498 	}
2499 
2500 	prop = (const __be32 *)vio_get_attribute(vdev, "ibm,#dma-size-cells",
2501 						 NULL);
2502 	if (!prop) {
2503 		pr_warn("Couldn't find ibm,#dma-size-cells property\n");
2504 		dma_window++;
2505 	} else {
2506 		dma_window += be32_to_cpu(*prop);
2507 	}
2508 
2509 	/* dma_window should point to the second window now */
2510 	vscsi->dds.window[REMOTE].liobn = be32_to_cpu(*dma_window);
2511 
2512 	return 0;
2513 }
2514 
2515 static struct ibmvscsis_tport *ibmvscsis_lookup_port(const char *name)
2516 {
2517 	struct ibmvscsis_tport *tport = NULL;
2518 	struct vio_dev *vdev;
2519 	struct scsi_info *vscsi;
2520 
2521 	spin_lock_bh(&ibmvscsis_dev_lock);
2522 	list_for_each_entry(vscsi, &ibmvscsis_dev_list, list) {
2523 		vdev = vscsi->dma_dev;
2524 		if (!strcmp(dev_name(&vdev->dev), name)) {
2525 			tport = &vscsi->tport;
2526 			break;
2527 		}
2528 	}
2529 	spin_unlock_bh(&ibmvscsis_dev_lock);
2530 
2531 	return tport;
2532 }
2533 
2534 /**
2535  * ibmvscsis_parse_cmd() - Parse SRP Command
2536  * @vscsi:	Pointer to our adapter structure
2537  * @cmd:	Pointer to command element with SRP command
2538  *
2539  * Parse the srp command; if it is valid then submit it to tcm.
2540  * Note: The return code does not reflect the status of the SCSI CDB.
2541  *
2542  * EXECUTION ENVIRONMENT:
2543  *	Process level
2544  */
2545 static void ibmvscsis_parse_cmd(struct scsi_info *vscsi,
2546 				struct ibmvscsis_cmd *cmd)
2547 {
2548 	struct iu_entry *iue = cmd->iue;
2549 	struct srp_cmd *srp = (struct srp_cmd *)iue->sbuf->buf;
2550 	struct ibmvscsis_nexus *nexus;
2551 	u64 data_len = 0;
2552 	enum dma_data_direction dir;
2553 	int attr = 0;
2554 	int rc = 0;
2555 
2556 	nexus = vscsi->tport.ibmv_nexus;
2557 	/*
2558 	 * additional length in bytes.  Note that the SRP spec says that
2559 	 * additional length is in 4-byte words, but technically the
2560 	 * additional length field is only the upper 6 bits of the byte.
2561 	 * The lower 2 bits are reserved.  If the lower 2 bits are 0 (as
2562 	 * all reserved fields should be), then interpreting the byte as
2563 	 * an int will yield the length in bytes.
2564 	 */
2565 	if (srp->add_cdb_len & 0x03) {
2566 		dev_err(&vscsi->dev, "parse_cmd: reserved bits set in IU\n");
2567 		spin_lock_bh(&vscsi->intr_lock);
2568 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2569 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2570 		spin_unlock_bh(&vscsi->intr_lock);
2571 		return;
2572 	}
2573 
2574 	if (srp_get_desc_table(srp, &dir, &data_len)) {
2575 		dev_err(&vscsi->dev, "0x%llx: parsing SRP descriptor table failed.\n",
2576 			srp->tag);
2577 		goto fail;
2578 	}
2579 
2580 	cmd->rsp.sol_not = srp->sol_not;
2581 
2582 	switch (srp->task_attr) {
2583 	case SRP_SIMPLE_TASK:
2584 		attr = TCM_SIMPLE_TAG;
2585 		break;
2586 	case SRP_ORDERED_TASK:
2587 		attr = TCM_ORDERED_TAG;
2588 		break;
2589 	case SRP_HEAD_TASK:
2590 		attr = TCM_HEAD_TAG;
2591 		break;
2592 	case SRP_ACA_TASK:
2593 		attr = TCM_ACA_TAG;
2594 		break;
2595 	default:
2596 		dev_err(&vscsi->dev, "Invalid task attribute %d\n",
2597 			srp->task_attr);
2598 		goto fail;
2599 	}
2600 
2601 	cmd->se_cmd.tag = be64_to_cpu(srp->tag);
2602 
2603 	spin_lock_bh(&vscsi->intr_lock);
2604 	list_add_tail(&cmd->list, &vscsi->active_q);
2605 	spin_unlock_bh(&vscsi->intr_lock);
2606 
2607 	srp->lun.scsi_lun[0] &= 0x3f;
2608 
2609 	rc = target_submit_cmd(&cmd->se_cmd, nexus->se_sess, srp->cdb,
2610 			       cmd->sense_buf, scsilun_to_int(&srp->lun),
2611 			       data_len, attr, dir, 0);
2612 	if (rc) {
2613 		dev_err(&vscsi->dev, "target_submit_cmd failed, rc %d\n", rc);
2614 		spin_lock_bh(&vscsi->intr_lock);
2615 		list_del(&cmd->list);
2616 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2617 		spin_unlock_bh(&vscsi->intr_lock);
2618 		goto fail;
2619 	}
2620 	return;
2621 
2622 fail:
2623 	spin_lock_bh(&vscsi->intr_lock);
2624 	ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT_RECONNECT, 0);
2625 	spin_unlock_bh(&vscsi->intr_lock);
2626 }
2627 
2628 /**
2629  * ibmvscsis_parse_task() - Parse SRP Task Management Request
2630  * @vscsi:	Pointer to our adapter structure
2631  * @cmd:	Pointer to command element with SRP task management request
2632  *
2633  * Parse the srp task management request; if it is valid then submit it to tcm.
2634  * Note: The return code does not reflect the status of the task management
2635  * request.
2636  *
2637  * EXECUTION ENVIRONMENT:
2638  *	Processor level
2639  */
2640 static void ibmvscsis_parse_task(struct scsi_info *vscsi,
2641 				 struct ibmvscsis_cmd *cmd)
2642 {
2643 	struct iu_entry *iue = cmd->iue;
2644 	struct srp_tsk_mgmt *srp_tsk = &vio_iu(iue)->srp.tsk_mgmt;
2645 	int tcm_type;
2646 	u64 tag_to_abort = 0;
2647 	int rc = 0;
2648 	struct ibmvscsis_nexus *nexus;
2649 
2650 	nexus = vscsi->tport.ibmv_nexus;
2651 
2652 	cmd->rsp.sol_not = srp_tsk->sol_not;
2653 
2654 	switch (srp_tsk->tsk_mgmt_func) {
2655 	case SRP_TSK_ABORT_TASK:
2656 		tcm_type = TMR_ABORT_TASK;
2657 		tag_to_abort = be64_to_cpu(srp_tsk->task_tag);
2658 		break;
2659 	case SRP_TSK_ABORT_TASK_SET:
2660 		tcm_type = TMR_ABORT_TASK_SET;
2661 		break;
2662 	case SRP_TSK_CLEAR_TASK_SET:
2663 		tcm_type = TMR_CLEAR_TASK_SET;
2664 		break;
2665 	case SRP_TSK_LUN_RESET:
2666 		tcm_type = TMR_LUN_RESET;
2667 		break;
2668 	case SRP_TSK_CLEAR_ACA:
2669 		tcm_type = TMR_CLEAR_ACA;
2670 		break;
2671 	default:
2672 		dev_err(&vscsi->dev, "unknown task mgmt func %d\n",
2673 			srp_tsk->tsk_mgmt_func);
2674 		cmd->se_cmd.se_tmr_req->response =
2675 			TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
2676 		rc = -1;
2677 		break;
2678 	}
2679 
2680 	if (!rc) {
2681 		cmd->se_cmd.tag = be64_to_cpu(srp_tsk->tag);
2682 
2683 		spin_lock_bh(&vscsi->intr_lock);
2684 		list_add_tail(&cmd->list, &vscsi->active_q);
2685 		spin_unlock_bh(&vscsi->intr_lock);
2686 
2687 		srp_tsk->lun.scsi_lun[0] &= 0x3f;
2688 
2689 		pr_debug("calling submit_tmr, func %d\n",
2690 			 srp_tsk->tsk_mgmt_func);
2691 		rc = target_submit_tmr(&cmd->se_cmd, nexus->se_sess, NULL,
2692 				       scsilun_to_int(&srp_tsk->lun), srp_tsk,
2693 				       tcm_type, GFP_KERNEL, tag_to_abort, 0);
2694 		if (rc) {
2695 			dev_err(&vscsi->dev, "target_submit_tmr failed, rc %d\n",
2696 				rc);
2697 			spin_lock_bh(&vscsi->intr_lock);
2698 			list_del(&cmd->list);
2699 			spin_unlock_bh(&vscsi->intr_lock);
2700 			cmd->se_cmd.se_tmr_req->response =
2701 				TMR_FUNCTION_REJECTED;
2702 		}
2703 	}
2704 
2705 	if (rc)
2706 		transport_send_check_condition_and_sense(&cmd->se_cmd, 0, 0);
2707 }
2708 
2709 static void ibmvscsis_scheduler(struct work_struct *work)
2710 {
2711 	struct ibmvscsis_cmd *cmd = container_of(work, struct ibmvscsis_cmd,
2712 						 work);
2713 	struct scsi_info *vscsi = cmd->adapter;
2714 
2715 	spin_lock_bh(&vscsi->intr_lock);
2716 
2717 	/* Remove from schedule_q */
2718 	list_del(&cmd->list);
2719 
2720 	/* Don't submit cmd if we're disconnecting */
2721 	if (vscsi->flags & (SCHEDULE_DISCONNECT | DISCONNECT_SCHEDULED)) {
2722 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2723 
2724 		/* ibmvscsis_disconnect might be waiting for us */
2725 		if (list_empty(&vscsi->active_q) &&
2726 		    list_empty(&vscsi->schedule_q) &&
2727 		    (vscsi->flags & WAIT_FOR_IDLE)) {
2728 			vscsi->flags &= ~WAIT_FOR_IDLE;
2729 			complete(&vscsi->wait_idle);
2730 		}
2731 
2732 		spin_unlock_bh(&vscsi->intr_lock);
2733 		return;
2734 	}
2735 
2736 	spin_unlock_bh(&vscsi->intr_lock);
2737 
2738 	switch (cmd->type) {
2739 	case SCSI_CDB:
2740 		ibmvscsis_parse_cmd(vscsi, cmd);
2741 		break;
2742 	case TASK_MANAGEMENT:
2743 		ibmvscsis_parse_task(vscsi, cmd);
2744 		break;
2745 	default:
2746 		dev_err(&vscsi->dev, "scheduler, invalid cmd type %d\n",
2747 			cmd->type);
2748 		spin_lock_bh(&vscsi->intr_lock);
2749 		ibmvscsis_free_cmd_resources(vscsi, cmd);
2750 		spin_unlock_bh(&vscsi->intr_lock);
2751 		break;
2752 	}
2753 }
2754 
2755 static int ibmvscsis_alloc_cmds(struct scsi_info *vscsi, int num)
2756 {
2757 	struct ibmvscsis_cmd *cmd;
2758 	int i;
2759 
2760 	INIT_LIST_HEAD(&vscsi->free_cmd);
2761 	vscsi->cmd_pool = kcalloc(num, sizeof(struct ibmvscsis_cmd),
2762 				  GFP_KERNEL);
2763 	if (!vscsi->cmd_pool)
2764 		return -ENOMEM;
2765 
2766 	for (i = 0, cmd = (struct ibmvscsis_cmd *)vscsi->cmd_pool; i < num;
2767 	     i++, cmd++) {
2768 		cmd->abort_cmd = NULL;
2769 		cmd->adapter = vscsi;
2770 		INIT_WORK(&cmd->work, ibmvscsis_scheduler);
2771 		list_add_tail(&cmd->list, &vscsi->free_cmd);
2772 	}
2773 
2774 	return 0;
2775 }
2776 
2777 static void ibmvscsis_free_cmds(struct scsi_info *vscsi)
2778 {
2779 	kfree(vscsi->cmd_pool);
2780 	vscsi->cmd_pool = NULL;
2781 	INIT_LIST_HEAD(&vscsi->free_cmd);
2782 }
2783 
2784 /**
2785  * ibmvscsis_service_wait_q() - Service Waiting Queue
2786  * @timer:	Pointer to timer which has expired
2787  *
2788  * This routine is called when the timer pops to service the waiting
2789  * queue. Elements on the queue have completed, their responses have been
2790  * copied to the client, but the client's response queue was full so
2791  * the queue message could not be sent. The routine grabs the proper locks
2792  * and calls send messages.
2793  *
2794  * EXECUTION ENVIRONMENT:
2795  *	called at interrupt level
2796  */
2797 static enum hrtimer_restart ibmvscsis_service_wait_q(struct hrtimer *timer)
2798 {
2799 	struct timer_cb *p_timer = container_of(timer, struct timer_cb, timer);
2800 	struct scsi_info *vscsi = container_of(p_timer, struct scsi_info,
2801 					       rsp_q_timer);
2802 
2803 	spin_lock_bh(&vscsi->intr_lock);
2804 	p_timer->timer_pops += 1;
2805 	p_timer->started = false;
2806 	ibmvscsis_send_messages(vscsi);
2807 	spin_unlock_bh(&vscsi->intr_lock);
2808 
2809 	return HRTIMER_NORESTART;
2810 }
2811 
2812 static long ibmvscsis_alloctimer(struct scsi_info *vscsi)
2813 {
2814 	struct timer_cb *p_timer;
2815 
2816 	p_timer = &vscsi->rsp_q_timer;
2817 	hrtimer_init(&p_timer->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
2818 
2819 	p_timer->timer.function = ibmvscsis_service_wait_q;
2820 	p_timer->started = false;
2821 	p_timer->timer_pops = 0;
2822 
2823 	return ADAPT_SUCCESS;
2824 }
2825 
2826 static void ibmvscsis_freetimer(struct scsi_info *vscsi)
2827 {
2828 	struct timer_cb *p_timer;
2829 
2830 	p_timer = &vscsi->rsp_q_timer;
2831 
2832 	(void)hrtimer_cancel(&p_timer->timer);
2833 
2834 	p_timer->started = false;
2835 	p_timer->timer_pops = 0;
2836 }
2837 
2838 static irqreturn_t ibmvscsis_interrupt(int dummy, void *data)
2839 {
2840 	struct scsi_info *vscsi = data;
2841 
2842 	vio_disable_interrupts(vscsi->dma_dev);
2843 	tasklet_schedule(&vscsi->work_task);
2844 
2845 	return IRQ_HANDLED;
2846 }
2847 
2848 /**
2849  * ibmvscsis_enable_change_state() - Set new state based on enabled status
2850  * @vscsi:	Pointer to our adapter structure
2851  *
2852  * This function determines our new state now that we are enabled.  This
2853  * may involve sending an Init Complete message to the client.
2854  *
2855  * Must be called with interrupt lock held.
2856  */
2857 static long ibmvscsis_enable_change_state(struct scsi_info *vscsi)
2858 {
2859 	int bytes;
2860 	long rc = ADAPT_SUCCESS;
2861 
2862 	bytes = vscsi->cmd_q.size * PAGE_SIZE;
2863 	rc = h_reg_crq(vscsi->dds.unit_id, vscsi->cmd_q.crq_token, bytes);
2864 	if (rc == H_CLOSED || rc == H_SUCCESS) {
2865 		vscsi->state = WAIT_CONNECTION;
2866 		rc = ibmvscsis_establish_new_q(vscsi);
2867 	}
2868 
2869 	if (rc != ADAPT_SUCCESS) {
2870 		vscsi->state = ERR_DISCONNECTED;
2871 		vscsi->flags |= RESPONSE_Q_DOWN;
2872 	}
2873 
2874 	return rc;
2875 }
2876 
2877 /**
2878  * ibmvscsis_create_command_q() - Create Command Queue
2879  * @vscsi:	Pointer to our adapter structure
2880  * @num_cmds:	Currently unused.  In the future, may be used to determine
2881  *		the size of the CRQ.
2882  *
2883  * Allocates memory for command queue maps remote memory into an ioba
2884  * initializes the command response queue
2885  *
2886  * EXECUTION ENVIRONMENT:
2887  *	Process level only
2888  */
2889 static long ibmvscsis_create_command_q(struct scsi_info *vscsi, int num_cmds)
2890 {
2891 	int pages;
2892 	struct vio_dev *vdev = vscsi->dma_dev;
2893 
2894 	/* We might support multiple pages in the future, but just 1 for now */
2895 	pages = 1;
2896 
2897 	vscsi->cmd_q.size = pages;
2898 
2899 	vscsi->cmd_q.base_addr =
2900 		(struct viosrp_crq *)get_zeroed_page(GFP_KERNEL);
2901 	if (!vscsi->cmd_q.base_addr)
2902 		return -ENOMEM;
2903 
2904 	vscsi->cmd_q.mask = ((uint)pages * CRQ_PER_PAGE) - 1;
2905 
2906 	vscsi->cmd_q.crq_token = dma_map_single(&vdev->dev,
2907 						vscsi->cmd_q.base_addr,
2908 						PAGE_SIZE, DMA_BIDIRECTIONAL);
2909 	if (dma_mapping_error(&vdev->dev, vscsi->cmd_q.crq_token)) {
2910 		free_page((unsigned long)vscsi->cmd_q.base_addr);
2911 		return -ENOMEM;
2912 	}
2913 
2914 	return 0;
2915 }
2916 
2917 /**
2918  * ibmvscsis_destroy_command_q - Destroy Command Queue
2919  * @vscsi:	Pointer to our adapter structure
2920  *
2921  * Releases memory for command queue and unmaps mapped remote memory.
2922  *
2923  * EXECUTION ENVIRONMENT:
2924  *	Process level only
2925  */
2926 static void ibmvscsis_destroy_command_q(struct scsi_info *vscsi)
2927 {
2928 	dma_unmap_single(&vscsi->dma_dev->dev, vscsi->cmd_q.crq_token,
2929 			 PAGE_SIZE, DMA_BIDIRECTIONAL);
2930 	free_page((unsigned long)vscsi->cmd_q.base_addr);
2931 	vscsi->cmd_q.base_addr = NULL;
2932 	vscsi->state = NO_QUEUE;
2933 }
2934 
2935 static u8 ibmvscsis_fast_fail(struct scsi_info *vscsi,
2936 			      struct ibmvscsis_cmd *cmd)
2937 {
2938 	struct iu_entry *iue = cmd->iue;
2939 	struct se_cmd *se_cmd = &cmd->se_cmd;
2940 	struct srp_cmd *srp = (struct srp_cmd *)iue->sbuf->buf;
2941 	struct scsi_sense_hdr sshdr;
2942 	u8 rc = se_cmd->scsi_status;
2943 
2944 	if (vscsi->fast_fail && (READ_CMD(srp->cdb) || WRITE_CMD(srp->cdb)))
2945 		if (scsi_normalize_sense(se_cmd->sense_buffer,
2946 					 se_cmd->scsi_sense_length, &sshdr))
2947 			if (sshdr.sense_key == HARDWARE_ERROR &&
2948 			    (se_cmd->residual_count == 0 ||
2949 			     se_cmd->residual_count == se_cmd->data_length)) {
2950 				rc = NO_SENSE;
2951 				cmd->flags |= CMD_FAST_FAIL;
2952 			}
2953 
2954 	return rc;
2955 }
2956 
2957 /**
2958  * srp_build_response() - Build an SRP response buffer
2959  * @vscsi:	Pointer to our adapter structure
2960  * @cmd:	Pointer to command for which to send the response
2961  * @len_p:	Where to return the length of the IU response sent.  This
2962  *		is needed to construct the CRQ response.
2963  *
2964  * Build the SRP response buffer and copy it to the client's memory space.
2965  */
2966 static long srp_build_response(struct scsi_info *vscsi,
2967 			       struct ibmvscsis_cmd *cmd, uint *len_p)
2968 {
2969 	struct iu_entry *iue = cmd->iue;
2970 	struct se_cmd *se_cmd = &cmd->se_cmd;
2971 	struct srp_rsp *rsp;
2972 	uint len;
2973 	u32 rsp_code;
2974 	char *data;
2975 	u32 *tsk_status;
2976 	long rc = ADAPT_SUCCESS;
2977 
2978 	spin_lock_bh(&vscsi->intr_lock);
2979 
2980 	rsp = &vio_iu(iue)->srp.rsp;
2981 	len = sizeof(*rsp);
2982 	memset(rsp, 0, len);
2983 	data = rsp->data;
2984 
2985 	rsp->opcode = SRP_RSP;
2986 
2987 	rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
2988 	rsp->tag = cmd->rsp.tag;
2989 	rsp->flags = 0;
2990 
2991 	if (cmd->type == SCSI_CDB) {
2992 		rsp->status = ibmvscsis_fast_fail(vscsi, cmd);
2993 		if (rsp->status) {
2994 			pr_debug("build_resp: cmd %p, scsi status %d\n", cmd,
2995 				 (int)rsp->status);
2996 			ibmvscsis_determine_resid(se_cmd, rsp);
2997 			if (se_cmd->scsi_sense_length && se_cmd->sense_buffer) {
2998 				rsp->sense_data_len =
2999 					cpu_to_be32(se_cmd->scsi_sense_length);
3000 				rsp->flags |= SRP_RSP_FLAG_SNSVALID;
3001 				len += se_cmd->scsi_sense_length;
3002 				memcpy(data, se_cmd->sense_buffer,
3003 				       se_cmd->scsi_sense_length);
3004 			}
3005 			rsp->sol_not = (cmd->rsp.sol_not & UCSOLNT) >>
3006 				UCSOLNT_RESP_SHIFT;
3007 		} else if (cmd->flags & CMD_FAST_FAIL) {
3008 			pr_debug("build_resp: cmd %p, fast fail\n", cmd);
3009 			rsp->sol_not = (cmd->rsp.sol_not & UCSOLNT) >>
3010 				UCSOLNT_RESP_SHIFT;
3011 		} else {
3012 			rsp->sol_not = (cmd->rsp.sol_not & SCSOLNT) >>
3013 				SCSOLNT_RESP_SHIFT;
3014 		}
3015 	} else {
3016 		/* this is task management */
3017 		rsp->status = 0;
3018 		rsp->resp_data_len = cpu_to_be32(4);
3019 		rsp->flags |= SRP_RSP_FLAG_RSPVALID;
3020 
3021 		switch (se_cmd->se_tmr_req->response) {
3022 		case TMR_FUNCTION_COMPLETE:
3023 		case TMR_TASK_DOES_NOT_EXIST:
3024 			rsp_code = SRP_TASK_MANAGEMENT_FUNCTION_COMPLETE;
3025 			rsp->sol_not = (cmd->rsp.sol_not & SCSOLNT) >>
3026 				SCSOLNT_RESP_SHIFT;
3027 			break;
3028 		case TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED:
3029 		case TMR_LUN_DOES_NOT_EXIST:
3030 			rsp_code = SRP_TASK_MANAGEMENT_FUNCTION_NOT_SUPPORTED;
3031 			rsp->sol_not = (cmd->rsp.sol_not & UCSOLNT) >>
3032 				UCSOLNT_RESP_SHIFT;
3033 			break;
3034 		case TMR_FUNCTION_FAILED:
3035 		case TMR_FUNCTION_REJECTED:
3036 		default:
3037 			rsp_code = SRP_TASK_MANAGEMENT_FUNCTION_FAILED;
3038 			rsp->sol_not = (cmd->rsp.sol_not & UCSOLNT) >>
3039 				UCSOLNT_RESP_SHIFT;
3040 			break;
3041 		}
3042 
3043 		tsk_status = (u32 *)data;
3044 		*tsk_status = cpu_to_be32(rsp_code);
3045 		data = (char *)(tsk_status + 1);
3046 		len += 4;
3047 	}
3048 
3049 	dma_wmb();
3050 	rc = h_copy_rdma(len, vscsi->dds.window[LOCAL].liobn, iue->sbuf->dma,
3051 			 vscsi->dds.window[REMOTE].liobn,
3052 			 be64_to_cpu(iue->remote_token));
3053 
3054 	switch (rc) {
3055 	case H_SUCCESS:
3056 		vscsi->credit = 0;
3057 		*len_p = len;
3058 		break;
3059 	case H_PERMISSION:
3060 		if (connection_broken(vscsi))
3061 			vscsi->flags |= RESPONSE_Q_DOWN | CLIENT_FAILED;
3062 
3063 		dev_err(&vscsi->dev, "build_response: error copying to client, rc %ld, flags 0x%x, state 0x%hx\n",
3064 			rc, vscsi->flags, vscsi->state);
3065 		break;
3066 	case H_SOURCE_PARM:
3067 	case H_DEST_PARM:
3068 	default:
3069 		dev_err(&vscsi->dev, "build_response: error copying to client, rc %ld\n",
3070 			rc);
3071 		break;
3072 	}
3073 
3074 	spin_unlock_bh(&vscsi->intr_lock);
3075 
3076 	return rc;
3077 }
3078 
3079 static int ibmvscsis_rdma(struct ibmvscsis_cmd *cmd, struct scatterlist *sg,
3080 			  int nsg, struct srp_direct_buf *md, int nmd,
3081 			  enum dma_data_direction dir, unsigned int bytes)
3082 {
3083 	struct iu_entry *iue = cmd->iue;
3084 	struct srp_target *target = iue->target;
3085 	struct scsi_info *vscsi = target->ldata;
3086 	struct scatterlist *sgp;
3087 	dma_addr_t client_ioba, server_ioba;
3088 	ulong buf_len;
3089 	ulong client_len, server_len;
3090 	int md_idx;
3091 	long tx_len;
3092 	long rc = 0;
3093 
3094 	if (bytes == 0)
3095 		return 0;
3096 
3097 	sgp = sg;
3098 	client_len = 0;
3099 	server_len = 0;
3100 	md_idx = 0;
3101 	tx_len = bytes;
3102 
3103 	do {
3104 		if (client_len == 0) {
3105 			if (md_idx >= nmd) {
3106 				dev_err(&vscsi->dev, "rdma: ran out of client memory descriptors\n");
3107 				rc = -EIO;
3108 				break;
3109 			}
3110 			client_ioba = be64_to_cpu(md[md_idx].va);
3111 			client_len = be32_to_cpu(md[md_idx].len);
3112 		}
3113 		if (server_len == 0) {
3114 			if (!sgp) {
3115 				dev_err(&vscsi->dev, "rdma: ran out of scatter/gather list\n");
3116 				rc = -EIO;
3117 				break;
3118 			}
3119 			server_ioba = sg_dma_address(sgp);
3120 			server_len = sg_dma_len(sgp);
3121 		}
3122 
3123 		buf_len = tx_len;
3124 
3125 		if (buf_len > client_len)
3126 			buf_len = client_len;
3127 
3128 		if (buf_len > server_len)
3129 			buf_len = server_len;
3130 
3131 		if (buf_len > max_vdma_size)
3132 			buf_len = max_vdma_size;
3133 
3134 		if (dir == DMA_TO_DEVICE) {
3135 			/* read from client */
3136 			rc = h_copy_rdma(buf_len,
3137 					 vscsi->dds.window[REMOTE].liobn,
3138 					 client_ioba,
3139 					 vscsi->dds.window[LOCAL].liobn,
3140 					 server_ioba);
3141 		} else {
3142 			/* The h_copy_rdma will cause phyp, running in another
3143 			 * partition, to read memory, so we need to make sure
3144 			 * the data has been written out, hence these syncs.
3145 			 */
3146 			/* ensure that everything is in memory */
3147 			isync();
3148 			/* ensure that memory has been made visible */
3149 			dma_wmb();
3150 			rc = h_copy_rdma(buf_len,
3151 					 vscsi->dds.window[LOCAL].liobn,
3152 					 server_ioba,
3153 					 vscsi->dds.window[REMOTE].liobn,
3154 					 client_ioba);
3155 		}
3156 		switch (rc) {
3157 		case H_SUCCESS:
3158 			break;
3159 		case H_PERMISSION:
3160 		case H_SOURCE_PARM:
3161 		case H_DEST_PARM:
3162 			if (connection_broken(vscsi)) {
3163 				spin_lock_bh(&vscsi->intr_lock);
3164 				vscsi->flags |=
3165 					(RESPONSE_Q_DOWN | CLIENT_FAILED);
3166 				spin_unlock_bh(&vscsi->intr_lock);
3167 			}
3168 			dev_err(&vscsi->dev, "rdma: h_copy_rdma failed, rc %ld\n",
3169 				rc);
3170 			break;
3171 
3172 		default:
3173 			dev_err(&vscsi->dev, "rdma: unknown error %ld from h_copy_rdma\n",
3174 				rc);
3175 			break;
3176 		}
3177 
3178 		if (!rc) {
3179 			tx_len -= buf_len;
3180 			if (tx_len) {
3181 				client_len -= buf_len;
3182 				if (client_len == 0)
3183 					md_idx++;
3184 				else
3185 					client_ioba += buf_len;
3186 
3187 				server_len -= buf_len;
3188 				if (server_len == 0)
3189 					sgp = sg_next(sgp);
3190 				else
3191 					server_ioba += buf_len;
3192 			} else {
3193 				break;
3194 			}
3195 		}
3196 	} while (!rc);
3197 
3198 	return rc;
3199 }
3200 
3201 /**
3202  * ibmvscsis_handle_crq() - Handle CRQ
3203  * @data:	Pointer to our adapter structure
3204  *
3205  * Read the command elements from the command queue and copy the payloads
3206  * associated with the command elements to local memory and execute the
3207  * SRP requests.
3208  *
3209  * Note: this is an edge triggered interrupt. It can not be shared.
3210  */
3211 static void ibmvscsis_handle_crq(unsigned long data)
3212 {
3213 	struct scsi_info *vscsi = (struct scsi_info *)data;
3214 	struct viosrp_crq *crq;
3215 	long rc;
3216 	bool ack = true;
3217 	volatile u8 valid;
3218 
3219 	spin_lock_bh(&vscsi->intr_lock);
3220 
3221 	pr_debug("got interrupt\n");
3222 
3223 	/*
3224 	 * if we are in a path where we are waiting for all pending commands
3225 	 * to complete because we received a transport event and anything in
3226 	 * the command queue is for a new connection, do nothing
3227 	 */
3228 	if (TARGET_STOP(vscsi)) {
3229 		vio_enable_interrupts(vscsi->dma_dev);
3230 
3231 		pr_debug("handle_crq, don't process: flags 0x%x, state 0x%hx\n",
3232 			 vscsi->flags, vscsi->state);
3233 		spin_unlock_bh(&vscsi->intr_lock);
3234 		return;
3235 	}
3236 
3237 	rc = vscsi->flags & SCHEDULE_DISCONNECT;
3238 	crq = vscsi->cmd_q.base_addr + vscsi->cmd_q.index;
3239 	valid = crq->valid;
3240 	dma_rmb();
3241 
3242 	while (valid) {
3243 		/*
3244 		 * These are edege triggered interrupts. After dropping out of
3245 		 * the while loop, the code must check for work since an
3246 		 * interrupt could be lost, and an elment be left on the queue,
3247 		 * hence the label.
3248 		 */
3249 cmd_work:
3250 		vscsi->cmd_q.index =
3251 			(vscsi->cmd_q.index + 1) & vscsi->cmd_q.mask;
3252 
3253 		if (!rc) {
3254 			rc = ibmvscsis_parse_command(vscsi, crq);
3255 		} else {
3256 			if ((uint)crq->valid == VALID_TRANS_EVENT) {
3257 				/*
3258 				 * must service the transport layer events even
3259 				 * in an error state, dont break out until all
3260 				 * the consecutive transport events have been
3261 				 * processed
3262 				 */
3263 				rc = ibmvscsis_trans_event(vscsi, crq);
3264 			} else if (vscsi->flags & TRANS_EVENT) {
3265 				/*
3266 				 * if a transport event has occurred leave
3267 				 * everything but transport events on the queue
3268 				 *
3269 				 * need to decrement the queue index so we can
3270 				 * look at the element again
3271 				 */
3272 				if (vscsi->cmd_q.index)
3273 					vscsi->cmd_q.index -= 1;
3274 				else
3275 					/*
3276 					 * index is at 0 it just wrapped.
3277 					 * have it index last element in q
3278 					 */
3279 					vscsi->cmd_q.index = vscsi->cmd_q.mask;
3280 				break;
3281 			}
3282 		}
3283 
3284 		crq->valid = INVALIDATE_CMD_RESP_EL;
3285 
3286 		crq = vscsi->cmd_q.base_addr + vscsi->cmd_q.index;
3287 		valid = crq->valid;
3288 		dma_rmb();
3289 	}
3290 
3291 	if (!rc) {
3292 		if (ack) {
3293 			vio_enable_interrupts(vscsi->dma_dev);
3294 			ack = false;
3295 			pr_debug("handle_crq, reenabling interrupts\n");
3296 		}
3297 		valid = crq->valid;
3298 		dma_rmb();
3299 		if (valid)
3300 			goto cmd_work;
3301 	} else {
3302 		pr_debug("handle_crq, error: flags 0x%x, state 0x%hx, crq index 0x%x\n",
3303 			 vscsi->flags, vscsi->state, vscsi->cmd_q.index);
3304 	}
3305 
3306 	pr_debug("Leaving handle_crq: schedule_q empty %d, flags 0x%x, state 0x%hx\n",
3307 		 (int)list_empty(&vscsi->schedule_q), vscsi->flags,
3308 		 vscsi->state);
3309 
3310 	spin_unlock_bh(&vscsi->intr_lock);
3311 }
3312 
3313 static int ibmvscsis_probe(struct vio_dev *vdev,
3314 			   const struct vio_device_id *id)
3315 {
3316 	struct scsi_info *vscsi;
3317 	int rc = 0;
3318 	long hrc = 0;
3319 	char wq_name[24];
3320 
3321 	vscsi = kzalloc(sizeof(*vscsi), GFP_KERNEL);
3322 	if (!vscsi) {
3323 		rc = -ENOMEM;
3324 		pr_err("probe: allocation of adapter failed\n");
3325 		return rc;
3326 	}
3327 
3328 	vscsi->dma_dev = vdev;
3329 	vscsi->dev = vdev->dev;
3330 	INIT_LIST_HEAD(&vscsi->schedule_q);
3331 	INIT_LIST_HEAD(&vscsi->waiting_rsp);
3332 	INIT_LIST_HEAD(&vscsi->active_q);
3333 
3334 	snprintf(vscsi->tport.tport_name, IBMVSCSIS_NAMELEN, "%s",
3335 		 dev_name(&vdev->dev));
3336 
3337 	pr_debug("probe tport_name: %s\n", vscsi->tport.tport_name);
3338 
3339 	rc = read_dma_window(vscsi);
3340 	if (rc)
3341 		goto free_adapter;
3342 	pr_debug("Probe: liobn 0x%x, riobn 0x%x\n",
3343 		 vscsi->dds.window[LOCAL].liobn,
3344 		 vscsi->dds.window[REMOTE].liobn);
3345 
3346 	strcpy(vscsi->eye, "VSCSI ");
3347 	strncat(vscsi->eye, vdev->name, MAX_EYE);
3348 
3349 	vscsi->dds.unit_id = vdev->unit_address;
3350 	strncpy(vscsi->dds.partition_name, partition_name,
3351 		sizeof(vscsi->dds.partition_name));
3352 	vscsi->dds.partition_num = partition_number;
3353 
3354 	spin_lock_bh(&ibmvscsis_dev_lock);
3355 	list_add_tail(&vscsi->list, &ibmvscsis_dev_list);
3356 	spin_unlock_bh(&ibmvscsis_dev_lock);
3357 
3358 	/*
3359 	 * TBD: How do we determine # of cmds to request?  Do we know how
3360 	 * many "children" we have?
3361 	 */
3362 	vscsi->request_limit = INITIAL_SRP_LIMIT;
3363 	rc = srp_target_alloc(&vscsi->target, &vdev->dev, vscsi->request_limit,
3364 			      SRP_MAX_IU_LEN);
3365 	if (rc)
3366 		goto rem_list;
3367 
3368 	vscsi->target.ldata = vscsi;
3369 
3370 	rc = ibmvscsis_alloc_cmds(vscsi, vscsi->request_limit);
3371 	if (rc) {
3372 		dev_err(&vscsi->dev, "alloc_cmds failed, rc %d, num %d\n",
3373 			rc, vscsi->request_limit);
3374 		goto free_target;
3375 	}
3376 
3377 	/*
3378 	 * Note: the lock is used in freeing timers, so must initialize
3379 	 * first so that ordering in case of error is correct.
3380 	 */
3381 	spin_lock_init(&vscsi->intr_lock);
3382 
3383 	rc = ibmvscsis_alloctimer(vscsi);
3384 	if (rc) {
3385 		dev_err(&vscsi->dev, "probe: alloctimer failed, rc %d\n", rc);
3386 		goto free_cmds;
3387 	}
3388 
3389 	rc = ibmvscsis_create_command_q(vscsi, 256);
3390 	if (rc) {
3391 		dev_err(&vscsi->dev, "probe: create_command_q failed, rc %d\n",
3392 			rc);
3393 		goto free_timer;
3394 	}
3395 
3396 	vscsi->map_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
3397 	if (!vscsi->map_buf) {
3398 		rc = -ENOMEM;
3399 		dev_err(&vscsi->dev, "probe: allocating cmd buffer failed\n");
3400 		goto destroy_queue;
3401 	}
3402 
3403 	vscsi->map_ioba = dma_map_single(&vdev->dev, vscsi->map_buf, PAGE_SIZE,
3404 					 DMA_BIDIRECTIONAL);
3405 	if (dma_mapping_error(&vdev->dev, vscsi->map_ioba)) {
3406 		rc = -ENOMEM;
3407 		dev_err(&vscsi->dev, "probe: error mapping command buffer\n");
3408 		goto free_buf;
3409 	}
3410 
3411 	hrc = h_vioctl(vscsi->dds.unit_id, H_GET_PARTNER_INFO,
3412 		       (u64)vscsi->map_ioba | ((u64)PAGE_SIZE << 32), 0, 0, 0,
3413 		       0);
3414 	if (hrc == H_SUCCESS)
3415 		vscsi->client_data.partition_number =
3416 			be64_to_cpu(*(u64 *)vscsi->map_buf);
3417 	/*
3418 	 * We expect the VIOCTL to fail if we're configured as "any
3419 	 * client can connect" and the client isn't activated yet.
3420 	 * We'll make the call again when he sends an init msg.
3421 	 */
3422 	pr_debug("probe hrc %ld, client partition num %d\n",
3423 		 hrc, vscsi->client_data.partition_number);
3424 
3425 	tasklet_init(&vscsi->work_task, ibmvscsis_handle_crq,
3426 		     (unsigned long)vscsi);
3427 
3428 	init_completion(&vscsi->wait_idle);
3429 	init_completion(&vscsi->unconfig);
3430 
3431 	snprintf(wq_name, 24, "ibmvscsis%s", dev_name(&vdev->dev));
3432 	vscsi->work_q = create_workqueue(wq_name);
3433 	if (!vscsi->work_q) {
3434 		rc = -ENOMEM;
3435 		dev_err(&vscsi->dev, "create_workqueue failed\n");
3436 		goto unmap_buf;
3437 	}
3438 
3439 	rc = request_irq(vdev->irq, ibmvscsis_interrupt, 0, "ibmvscsis", vscsi);
3440 	if (rc) {
3441 		rc = -EPERM;
3442 		dev_err(&vscsi->dev, "probe: request_irq failed, rc %d\n", rc);
3443 		goto destroy_WQ;
3444 	}
3445 
3446 	vscsi->state = WAIT_ENABLED;
3447 
3448 	dev_set_drvdata(&vdev->dev, vscsi);
3449 
3450 	return 0;
3451 
3452 destroy_WQ:
3453 	destroy_workqueue(vscsi->work_q);
3454 unmap_buf:
3455 	dma_unmap_single(&vdev->dev, vscsi->map_ioba, PAGE_SIZE,
3456 			 DMA_BIDIRECTIONAL);
3457 free_buf:
3458 	kfree(vscsi->map_buf);
3459 destroy_queue:
3460 	tasklet_kill(&vscsi->work_task);
3461 	ibmvscsis_unregister_command_q(vscsi);
3462 	ibmvscsis_destroy_command_q(vscsi);
3463 free_timer:
3464 	ibmvscsis_freetimer(vscsi);
3465 free_cmds:
3466 	ibmvscsis_free_cmds(vscsi);
3467 free_target:
3468 	srp_target_free(&vscsi->target);
3469 rem_list:
3470 	spin_lock_bh(&ibmvscsis_dev_lock);
3471 	list_del(&vscsi->list);
3472 	spin_unlock_bh(&ibmvscsis_dev_lock);
3473 free_adapter:
3474 	kfree(vscsi);
3475 
3476 	return rc;
3477 }
3478 
3479 static int ibmvscsis_remove(struct vio_dev *vdev)
3480 {
3481 	struct scsi_info *vscsi = dev_get_drvdata(&vdev->dev);
3482 
3483 	pr_debug("remove (%s)\n", dev_name(&vscsi->dma_dev->dev));
3484 
3485 	spin_lock_bh(&vscsi->intr_lock);
3486 	ibmvscsis_post_disconnect(vscsi, UNCONFIGURING, 0);
3487 	vscsi->flags |= CFG_SLEEPING;
3488 	spin_unlock_bh(&vscsi->intr_lock);
3489 	wait_for_completion(&vscsi->unconfig);
3490 
3491 	vio_disable_interrupts(vdev);
3492 	free_irq(vdev->irq, vscsi);
3493 	destroy_workqueue(vscsi->work_q);
3494 	dma_unmap_single(&vdev->dev, vscsi->map_ioba, PAGE_SIZE,
3495 			 DMA_BIDIRECTIONAL);
3496 	kfree(vscsi->map_buf);
3497 	tasklet_kill(&vscsi->work_task);
3498 	ibmvscsis_destroy_command_q(vscsi);
3499 	ibmvscsis_freetimer(vscsi);
3500 	ibmvscsis_free_cmds(vscsi);
3501 	srp_target_free(&vscsi->target);
3502 	spin_lock_bh(&ibmvscsis_dev_lock);
3503 	list_del(&vscsi->list);
3504 	spin_unlock_bh(&ibmvscsis_dev_lock);
3505 	kfree(vscsi);
3506 
3507 	return 0;
3508 }
3509 
3510 static ssize_t system_id_show(struct device *dev,
3511 			      struct device_attribute *attr, char *buf)
3512 {
3513 	return snprintf(buf, PAGE_SIZE, "%s\n", system_id);
3514 }
3515 
3516 static ssize_t partition_number_show(struct device *dev,
3517 				     struct device_attribute *attr, char *buf)
3518 {
3519 	return snprintf(buf, PAGE_SIZE, "%x\n", partition_number);
3520 }
3521 
3522 static ssize_t unit_address_show(struct device *dev,
3523 				 struct device_attribute *attr, char *buf)
3524 {
3525 	struct scsi_info *vscsi = container_of(dev, struct scsi_info, dev);
3526 
3527 	return snprintf(buf, PAGE_SIZE, "%x\n", vscsi->dma_dev->unit_address);
3528 }
3529 
3530 static int ibmvscsis_get_system_info(void)
3531 {
3532 	struct device_node *rootdn, *vdevdn;
3533 	const char *id, *model, *name;
3534 	const uint *num;
3535 
3536 	rootdn = of_find_node_by_path("/");
3537 	if (!rootdn)
3538 		return -ENOENT;
3539 
3540 	model = of_get_property(rootdn, "model", NULL);
3541 	id = of_get_property(rootdn, "system-id", NULL);
3542 	if (model && id)
3543 		snprintf(system_id, sizeof(system_id), "%s-%s", model, id);
3544 
3545 	name = of_get_property(rootdn, "ibm,partition-name", NULL);
3546 	if (name)
3547 		strncpy(partition_name, name, sizeof(partition_name));
3548 
3549 	num = of_get_property(rootdn, "ibm,partition-no", NULL);
3550 	if (num)
3551 		partition_number = of_read_number(num, 1);
3552 
3553 	of_node_put(rootdn);
3554 
3555 	vdevdn = of_find_node_by_path("/vdevice");
3556 	if (vdevdn) {
3557 		const uint *mvds;
3558 
3559 		mvds = of_get_property(vdevdn, "ibm,max-virtual-dma-size",
3560 				       NULL);
3561 		if (mvds)
3562 			max_vdma_size = *mvds;
3563 		of_node_put(vdevdn);
3564 	}
3565 
3566 	return 0;
3567 }
3568 
3569 static char *ibmvscsis_get_fabric_name(void)
3570 {
3571 	return "ibmvscsis";
3572 }
3573 
3574 static char *ibmvscsis_get_fabric_wwn(struct se_portal_group *se_tpg)
3575 {
3576 	struct ibmvscsis_tport *tport =
3577 		container_of(se_tpg, struct ibmvscsis_tport, se_tpg);
3578 
3579 	return tport->tport_name;
3580 }
3581 
3582 static u16 ibmvscsis_get_tag(struct se_portal_group *se_tpg)
3583 {
3584 	struct ibmvscsis_tport *tport =
3585 		container_of(se_tpg, struct ibmvscsis_tport, se_tpg);
3586 
3587 	return tport->tport_tpgt;
3588 }
3589 
3590 static u32 ibmvscsis_get_default_depth(struct se_portal_group *se_tpg)
3591 {
3592 	return 1;
3593 }
3594 
3595 static int ibmvscsis_check_true(struct se_portal_group *se_tpg)
3596 {
3597 	return 1;
3598 }
3599 
3600 static int ibmvscsis_check_false(struct se_portal_group *se_tpg)
3601 {
3602 	return 0;
3603 }
3604 
3605 static u32 ibmvscsis_tpg_get_inst_index(struct se_portal_group *se_tpg)
3606 {
3607 	return 1;
3608 }
3609 
3610 static int ibmvscsis_check_stop_free(struct se_cmd *se_cmd)
3611 {
3612 	return target_put_sess_cmd(se_cmd);
3613 }
3614 
3615 static void ibmvscsis_release_cmd(struct se_cmd *se_cmd)
3616 {
3617 	struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd,
3618 						 se_cmd);
3619 	struct scsi_info *vscsi = cmd->adapter;
3620 
3621 	spin_lock_bh(&vscsi->intr_lock);
3622 	/* Remove from active_q */
3623 	list_move_tail(&cmd->list, &vscsi->waiting_rsp);
3624 	ibmvscsis_send_messages(vscsi);
3625 	spin_unlock_bh(&vscsi->intr_lock);
3626 }
3627 
3628 static u32 ibmvscsis_sess_get_index(struct se_session *se_sess)
3629 {
3630 	return 0;
3631 }
3632 
3633 static int ibmvscsis_write_pending(struct se_cmd *se_cmd)
3634 {
3635 	struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd,
3636 						 se_cmd);
3637 	struct scsi_info *vscsi = cmd->adapter;
3638 	struct iu_entry *iue = cmd->iue;
3639 	int rc;
3640 
3641 	/*
3642 	 * If CLIENT_FAILED OR RESPONSE_Q_DOWN, then just return success
3643 	 * since LIO can't do anything about it, and we dont want to
3644 	 * attempt an srp_transfer_data.
3645 	 */
3646 	if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) {
3647 		pr_err("write_pending failed since: %d\n", vscsi->flags);
3648 		return 0;
3649 	}
3650 
3651 	rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
3652 			       1, 1);
3653 	if (rc) {
3654 		pr_err("srp_transfer_data() failed: %d\n", rc);
3655 		return -EIO;
3656 	}
3657 	/*
3658 	 * We now tell TCM to add this WRITE CDB directly into the TCM storage
3659 	 * object execution queue.
3660 	 */
3661 	target_execute_cmd(se_cmd);
3662 	return 0;
3663 }
3664 
3665 static int ibmvscsis_write_pending_status(struct se_cmd *se_cmd)
3666 {
3667 	return 0;
3668 }
3669 
3670 static void ibmvscsis_set_default_node_attrs(struct se_node_acl *nacl)
3671 {
3672 }
3673 
3674 static int ibmvscsis_get_cmd_state(struct se_cmd *se_cmd)
3675 {
3676 	return 0;
3677 }
3678 
3679 static int ibmvscsis_queue_data_in(struct se_cmd *se_cmd)
3680 {
3681 	struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd,
3682 						 se_cmd);
3683 	struct iu_entry *iue = cmd->iue;
3684 	struct scsi_info *vscsi = cmd->adapter;
3685 	char *sd;
3686 	uint len = 0;
3687 	int rc;
3688 
3689 	rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma, 1,
3690 			       1);
3691 	if (rc) {
3692 		pr_err("srp_transfer_data failed: %d\n", rc);
3693 		sd = se_cmd->sense_buffer;
3694 		se_cmd->scsi_sense_length = 18;
3695 		memset(se_cmd->sense_buffer, 0, se_cmd->scsi_sense_length);
3696 		/* Logical Unit Communication Time-out asc/ascq = 0x0801 */
3697 		scsi_build_sense_buffer(0, se_cmd->sense_buffer, MEDIUM_ERROR,
3698 					0x08, 0x01);
3699 	}
3700 
3701 	srp_build_response(vscsi, cmd, &len);
3702 	cmd->rsp.format = SRP_FORMAT;
3703 	cmd->rsp.len = len;
3704 
3705 	return 0;
3706 }
3707 
3708 static int ibmvscsis_queue_status(struct se_cmd *se_cmd)
3709 {
3710 	struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd,
3711 						 se_cmd);
3712 	struct scsi_info *vscsi = cmd->adapter;
3713 	uint len;
3714 
3715 	pr_debug("queue_status %p\n", se_cmd);
3716 
3717 	srp_build_response(vscsi, cmd, &len);
3718 	cmd->rsp.format = SRP_FORMAT;
3719 	cmd->rsp.len = len;
3720 
3721 	return 0;
3722 }
3723 
3724 static void ibmvscsis_queue_tm_rsp(struct se_cmd *se_cmd)
3725 {
3726 	struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd,
3727 						 se_cmd);
3728 	struct scsi_info *vscsi = cmd->adapter;
3729 	struct ibmvscsis_cmd *cmd_itr;
3730 	struct iu_entry *iue = iue = cmd->iue;
3731 	struct srp_tsk_mgmt *srp_tsk = &vio_iu(iue)->srp.tsk_mgmt;
3732 	u64 tag_to_abort = be64_to_cpu(srp_tsk->task_tag);
3733 	uint len;
3734 
3735 	pr_debug("queue_tm_rsp %p, status %d\n",
3736 		 se_cmd, (int)se_cmd->se_tmr_req->response);
3737 
3738 	if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK &&
3739 	    cmd->se_cmd.se_tmr_req->response == TMR_TASK_DOES_NOT_EXIST) {
3740 		spin_lock_bh(&vscsi->intr_lock);
3741 		list_for_each_entry(cmd_itr, &vscsi->active_q, list) {
3742 			if (tag_to_abort == cmd_itr->se_cmd.tag) {
3743 				cmd_itr->abort_cmd = cmd;
3744 				cmd->flags |= DELAY_SEND;
3745 				break;
3746 			}
3747 		}
3748 		spin_unlock_bh(&vscsi->intr_lock);
3749 	}
3750 
3751 	srp_build_response(vscsi, cmd, &len);
3752 	cmd->rsp.format = SRP_FORMAT;
3753 	cmd->rsp.len = len;
3754 }
3755 
3756 static void ibmvscsis_aborted_task(struct se_cmd *se_cmd)
3757 {
3758 	pr_debug("ibmvscsis_aborted_task %p task_tag: %llu\n",
3759 		 se_cmd, se_cmd->tag);
3760 }
3761 
3762 static struct se_wwn *ibmvscsis_make_tport(struct target_fabric_configfs *tf,
3763 					   struct config_group *group,
3764 					   const char *name)
3765 {
3766 	struct ibmvscsis_tport *tport;
3767 
3768 	tport = ibmvscsis_lookup_port(name);
3769 	if (tport) {
3770 		tport->tport_proto_id = SCSI_PROTOCOL_SRP;
3771 		pr_debug("make_tport(%s), pointer:%p, tport_id:%x\n",
3772 			 name, tport, tport->tport_proto_id);
3773 		return &tport->tport_wwn;
3774 	}
3775 
3776 	return ERR_PTR(-EINVAL);
3777 }
3778 
3779 static void ibmvscsis_drop_tport(struct se_wwn *wwn)
3780 {
3781 	struct ibmvscsis_tport *tport = container_of(wwn,
3782 						     struct ibmvscsis_tport,
3783 						     tport_wwn);
3784 
3785 	pr_debug("drop_tport(%s)\n",
3786 		 config_item_name(&tport->tport_wwn.wwn_group.cg_item));
3787 }
3788 
3789 static struct se_portal_group *ibmvscsis_make_tpg(struct se_wwn *wwn,
3790 						  struct config_group *group,
3791 						  const char *name)
3792 {
3793 	struct ibmvscsis_tport *tport =
3794 		container_of(wwn, struct ibmvscsis_tport, tport_wwn);
3795 	int rc;
3796 
3797 	tport->releasing = false;
3798 
3799 	rc = core_tpg_register(&tport->tport_wwn, &tport->se_tpg,
3800 			       tport->tport_proto_id);
3801 	if (rc)
3802 		return ERR_PTR(rc);
3803 
3804 	return &tport->se_tpg;
3805 }
3806 
3807 static void ibmvscsis_drop_tpg(struct se_portal_group *se_tpg)
3808 {
3809 	struct ibmvscsis_tport *tport = container_of(se_tpg,
3810 						     struct ibmvscsis_tport,
3811 						     se_tpg);
3812 
3813 	tport->releasing = true;
3814 	tport->enabled = false;
3815 
3816 	/*
3817 	 * Release the virtual I_T Nexus for this ibmvscsis TPG
3818 	 */
3819 	ibmvscsis_drop_nexus(tport);
3820 	/*
3821 	 * Deregister the se_tpg from TCM..
3822 	 */
3823 	core_tpg_deregister(se_tpg);
3824 }
3825 
3826 static ssize_t ibmvscsis_wwn_version_show(struct config_item *item,
3827 					  char *page)
3828 {
3829 	return scnprintf(page, PAGE_SIZE, "%s\n", IBMVSCSIS_VERSION);
3830 }
3831 CONFIGFS_ATTR_RO(ibmvscsis_wwn_, version);
3832 
3833 static struct configfs_attribute *ibmvscsis_wwn_attrs[] = {
3834 	&ibmvscsis_wwn_attr_version,
3835 	NULL,
3836 };
3837 
3838 static ssize_t ibmvscsis_tpg_enable_show(struct config_item *item,
3839 					 char *page)
3840 {
3841 	struct se_portal_group *se_tpg = to_tpg(item);
3842 	struct ibmvscsis_tport *tport = container_of(se_tpg,
3843 						     struct ibmvscsis_tport,
3844 						     se_tpg);
3845 
3846 	return snprintf(page, PAGE_SIZE, "%d\n", (tport->enabled) ? 1 : 0);
3847 }
3848 
3849 static ssize_t ibmvscsis_tpg_enable_store(struct config_item *item,
3850 					  const char *page, size_t count)
3851 {
3852 	struct se_portal_group *se_tpg = to_tpg(item);
3853 	struct ibmvscsis_tport *tport = container_of(se_tpg,
3854 						     struct ibmvscsis_tport,
3855 						     se_tpg);
3856 	struct scsi_info *vscsi = container_of(tport, struct scsi_info, tport);
3857 	unsigned long tmp;
3858 	int rc;
3859 	long lrc;
3860 
3861 	rc = kstrtoul(page, 0, &tmp);
3862 	if (rc < 0) {
3863 		pr_err("Unable to extract srpt_tpg_store_enable\n");
3864 		return -EINVAL;
3865 	}
3866 
3867 	if ((tmp != 0) && (tmp != 1)) {
3868 		pr_err("Illegal value for srpt_tpg_store_enable\n");
3869 		return -EINVAL;
3870 	}
3871 
3872 	if (tmp) {
3873 		spin_lock_bh(&vscsi->intr_lock);
3874 		tport->enabled = true;
3875 		lrc = ibmvscsis_enable_change_state(vscsi);
3876 		if (lrc)
3877 			pr_err("enable_change_state failed, rc %ld state %d\n",
3878 			       lrc, vscsi->state);
3879 		spin_unlock_bh(&vscsi->intr_lock);
3880 	} else {
3881 		spin_lock_bh(&vscsi->intr_lock);
3882 		tport->enabled = false;
3883 		/* This simulates the server going down */
3884 		ibmvscsis_post_disconnect(vscsi, ERR_DISCONNECT, 0);
3885 		spin_unlock_bh(&vscsi->intr_lock);
3886 	}
3887 
3888 	pr_debug("tpg_enable_store, tmp %ld, state %d\n", tmp, vscsi->state);
3889 
3890 	return count;
3891 }
3892 CONFIGFS_ATTR(ibmvscsis_tpg_, enable);
3893 
3894 static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
3895 	&ibmvscsis_tpg_attr_enable,
3896 	NULL,
3897 };
3898 
3899 static const struct target_core_fabric_ops ibmvscsis_ops = {
3900 	.module				= THIS_MODULE,
3901 	.name				= "ibmvscsis",
3902 	.max_data_sg_nents		= MAX_TXU / PAGE_SIZE,
3903 	.get_fabric_name		= ibmvscsis_get_fabric_name,
3904 	.tpg_get_wwn			= ibmvscsis_get_fabric_wwn,
3905 	.tpg_get_tag			= ibmvscsis_get_tag,
3906 	.tpg_get_default_depth		= ibmvscsis_get_default_depth,
3907 	.tpg_check_demo_mode		= ibmvscsis_check_true,
3908 	.tpg_check_demo_mode_cache	= ibmvscsis_check_true,
3909 	.tpg_check_demo_mode_write_protect = ibmvscsis_check_false,
3910 	.tpg_check_prod_mode_write_protect = ibmvscsis_check_false,
3911 	.tpg_get_inst_index		= ibmvscsis_tpg_get_inst_index,
3912 	.check_stop_free		= ibmvscsis_check_stop_free,
3913 	.release_cmd			= ibmvscsis_release_cmd,
3914 	.sess_get_index			= ibmvscsis_sess_get_index,
3915 	.write_pending			= ibmvscsis_write_pending,
3916 	.write_pending_status		= ibmvscsis_write_pending_status,
3917 	.set_default_node_attributes	= ibmvscsis_set_default_node_attrs,
3918 	.get_cmd_state			= ibmvscsis_get_cmd_state,
3919 	.queue_data_in			= ibmvscsis_queue_data_in,
3920 	.queue_status			= ibmvscsis_queue_status,
3921 	.queue_tm_rsp			= ibmvscsis_queue_tm_rsp,
3922 	.aborted_task			= ibmvscsis_aborted_task,
3923 	/*
3924 	 * Setup function pointers for logic in target_core_fabric_configfs.c
3925 	 */
3926 	.fabric_make_wwn		= ibmvscsis_make_tport,
3927 	.fabric_drop_wwn		= ibmvscsis_drop_tport,
3928 	.fabric_make_tpg		= ibmvscsis_make_tpg,
3929 	.fabric_drop_tpg		= ibmvscsis_drop_tpg,
3930 
3931 	.tfc_wwn_attrs			= ibmvscsis_wwn_attrs,
3932 	.tfc_tpg_base_attrs		= ibmvscsis_tpg_attrs,
3933 };
3934 
3935 static void ibmvscsis_dev_release(struct device *dev) {};
3936 
3937 static struct class_attribute ibmvscsis_class_attrs[] = {
3938 	__ATTR_NULL,
3939 };
3940 
3941 static struct device_attribute dev_attr_system_id =
3942 	__ATTR(system_id, S_IRUGO, system_id_show, NULL);
3943 
3944 static struct device_attribute dev_attr_partition_number =
3945 	__ATTR(partition_number, S_IRUGO, partition_number_show, NULL);
3946 
3947 static struct device_attribute dev_attr_unit_address =
3948 	__ATTR(unit_address, S_IRUGO, unit_address_show, NULL);
3949 
3950 static struct attribute *ibmvscsis_dev_attrs[] = {
3951 	&dev_attr_system_id.attr,
3952 	&dev_attr_partition_number.attr,
3953 	&dev_attr_unit_address.attr,
3954 };
3955 ATTRIBUTE_GROUPS(ibmvscsis_dev);
3956 
3957 static struct class ibmvscsis_class = {
3958 	.name		= "ibmvscsis",
3959 	.dev_release	= ibmvscsis_dev_release,
3960 	.class_attrs	= ibmvscsis_class_attrs,
3961 	.dev_groups	= ibmvscsis_dev_groups,
3962 };
3963 
3964 static struct vio_device_id ibmvscsis_device_table[] = {
3965 	{ "v-scsi-host", "IBM,v-scsi-host" },
3966 	{ "", "" }
3967 };
3968 MODULE_DEVICE_TABLE(vio, ibmvscsis_device_table);
3969 
3970 static struct vio_driver ibmvscsis_driver = {
3971 	.name = "ibmvscsis",
3972 	.id_table = ibmvscsis_device_table,
3973 	.probe = ibmvscsis_probe,
3974 	.remove = ibmvscsis_remove,
3975 };
3976 
3977 /*
3978  * ibmvscsis_init() - Kernel Module initialization
3979  *
3980  * Note: vio_register_driver() registers callback functions, and at least one
3981  * of those callback functions calls TCM - Linux IO Target Subsystem, thus
3982  * the SCSI Target template must be registered before vio_register_driver()
3983  * is called.
3984  */
3985 static int __init ibmvscsis_init(void)
3986 {
3987 	int rc = 0;
3988 
3989 	rc = ibmvscsis_get_system_info();
3990 	if (rc) {
3991 		pr_err("rc %d from get_system_info\n", rc);
3992 		goto out;
3993 	}
3994 
3995 	rc = class_register(&ibmvscsis_class);
3996 	if (rc) {
3997 		pr_err("failed class register\n");
3998 		goto out;
3999 	}
4000 
4001 	rc = target_register_template(&ibmvscsis_ops);
4002 	if (rc) {
4003 		pr_err("rc %d from target_register_template\n", rc);
4004 		goto unregister_class;
4005 	}
4006 
4007 	rc = vio_register_driver(&ibmvscsis_driver);
4008 	if (rc) {
4009 		pr_err("rc %d from vio_register_driver\n", rc);
4010 		goto unregister_target;
4011 	}
4012 
4013 	return 0;
4014 
4015 unregister_target:
4016 	target_unregister_template(&ibmvscsis_ops);
4017 unregister_class:
4018 	class_unregister(&ibmvscsis_class);
4019 out:
4020 	return rc;
4021 }
4022 
4023 static void __exit ibmvscsis_exit(void)
4024 {
4025 	pr_info("Unregister IBM virtual SCSI host driver\n");
4026 	vio_unregister_driver(&ibmvscsis_driver);
4027 	target_unregister_template(&ibmvscsis_ops);
4028 	class_unregister(&ibmvscsis_class);
4029 }
4030 
4031 MODULE_DESCRIPTION("IBMVSCSIS fabric driver");
4032 MODULE_AUTHOR("Bryant G. Ly and Michael Cyr");
4033 MODULE_LICENSE("GPL");
4034 MODULE_VERSION(IBMVSCSIS_VERSION);
4035 module_init(ibmvscsis_init);
4036 module_exit(ibmvscsis_exit);
4037