drivers/infiniband/core/uverbs_cmd.c

   1 /*
   2  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
   3  * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
   4  * Copyright (c) 2005 PathScale, Inc.  All rights reserved.
   5  *
   6  * This software is available to you under a choice of one of two
   7  * licenses.  You may choose to be licensed under the terms of the GNU
   8  * General Public License (GPL) Version 2, available from the file
   9  * COPYING in the main directory of this source tree, or the
  10  * OpenIB.org BSD license below:
  11  *
  12  *     Redistribution and use in source and binary forms, with or
  13  *     without modification, are permitted provided that the following
  14  *     conditions are met:
  15  *
  16  *      - Redistributions of source code must retain the above
  17  *        copyright notice, this list of conditions and the following
  18  *        disclaimer.
  19  *
  20  *      - Redistributions in binary form must reproduce the above
  21  *        copyright notice, this list of conditions and the following
  22  *        disclaimer in the documentation and/or other materials
  23  *        provided with the distribution.
  24  *
  25  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  26  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  27  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  28  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  29  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  30  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  31  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  32  * SOFTWARE.
  33  *
  34  * $Id: uverbs_cmd.c 2708 2005-06-24 17:27:21Z roland $
  35  */
  36
  37 #include <linux/file.h>
  38 #include <linux/fs.h>
  39
  40 #include <asm/uaccess.h>
  41
  42 #include "uverbs.h"
  43
  44 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
  45         do {                                                            \
  46                 (udata)->inbuf  = (void __user *) (ibuf);               \
  47                 (udata)->outbuf = (void __user *) (obuf);               \
  48                 (udata)->inlen  = (ilen);                               \
  49                 (udata)->outlen = (olen);                               \
  50         } while (0)
  51
  52 ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
  53                               const char __user *buf,
  54                               int in_len, int out_len)
  55 {
  56         struct ib_uverbs_get_context      cmd;
  57         struct ib_uverbs_get_context_resp resp;
  58         struct ib_udata                   udata;
  59         struct ib_device                 *ibdev = file->device->ib_dev;
  60         struct ib_ucontext               *ucontext;
  61         struct file                      *filp;
  62         int ret;
  63
  64         if (out_len < sizeof resp)
  65                 return -ENOSPC;
  66
  67         if (copy_from_user(&cmd, buf, sizeof cmd))
  68                 return -EFAULT;
  69
  70         mutex_lock(&file->mutex);
  71
  72         if (file->ucontext) {
  73                 ret = -EINVAL;
  74                 goto err;
  75         }
  76
  77         INIT_UDATA(&udata, buf + sizeof cmd,
  78                    (unsigned long) cmd.response + sizeof resp,
  79                    in_len - sizeof cmd, out_len - sizeof resp);
  80
  81         ucontext = ibdev->alloc_ucontext(ibdev, &udata);
  82         if (IS_ERR(ucontext))
  83                 return PTR_ERR(file->ucontext);
  84
  85         ucontext->device = ibdev;
  86         INIT_LIST_HEAD(&ucontext->pd_list);
  87         INIT_LIST_HEAD(&ucontext->mr_list);
  88         INIT_LIST_HEAD(&ucontext->mw_list);
  89         INIT_LIST_HEAD(&ucontext->cq_list);
  90         INIT_LIST_HEAD(&ucontext->qp_list);
  91         INIT_LIST_HEAD(&ucontext->srq_list);
  92         INIT_LIST_HEAD(&ucontext->ah_list);
  93
  94         resp.num_comp_vectors = file->device->num_comp_vectors;
  95
  96         filp = ib_uverbs_alloc_event_file(file, 1, &resp.async_fd);
  97         if (IS_ERR(filp)) {
  98                 ret = PTR_ERR(filp);
  99                 goto err_free;
 100         }
 101
 102         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 103                          &resp, sizeof resp)) {
 104                 ret = -EFAULT;
 105                 goto err_file;
 106         }
 107
 108         file->async_file = filp->private_data;
 109
 110         INIT_IB_EVENT_HANDLER(&file->event_handler, file->device->ib_dev,
 111                               ib_uverbs_event_handler);
 112         ret = ib_register_event_handler(&file->event_handler);
 113         if (ret)
 114                 goto err_file;
 115
 116         kref_get(&file->async_file->ref);
 117         kref_get(&file->ref);
 118         file->ucontext = ucontext;
 119
 120         fd_install(resp.async_fd, filp);
 121
 122         mutex_unlock(&file->mutex);
 123
 124         return in_len;
 125
 126 err_file:
 127         put_unused_fd(resp.async_fd);
 128         fput(filp);
 129
 130 err_free:
 131         ibdev->dealloc_ucontext(ucontext);
 132
 133 err:
 134         mutex_unlock(&file->mutex);
 135         return ret;
 136 }
 137
 138 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
 139                                const char __user *buf,
 140                                int in_len, int out_len)
 141 {
 142         struct ib_uverbs_query_device      cmd;
 143         struct ib_uverbs_query_device_resp resp;
 144         struct ib_device_attr              attr;
 145         int                                ret;
 146
 147         if (out_len < sizeof resp)
 148                 return -ENOSPC;
 149
 150         if (copy_from_user(&cmd, buf, sizeof cmd))
 151                 return -EFAULT;
 152
 153         ret = ib_query_device(file->device->ib_dev, &attr);
 154         if (ret)
 155                 return ret;
 156
 157         memset(&resp, 0, sizeof resp);
 158
 159         resp.fw_ver                    = attr.fw_ver;
 160         resp.node_guid                 = file->device->ib_dev->node_guid;
 161         resp.sys_image_guid            = attr.sys_image_guid;
 162         resp.max_mr_size               = attr.max_mr_size;
 163         resp.page_size_cap             = attr.page_size_cap;
 164         resp.vendor_id                 = attr.vendor_id;
 165         resp.vendor_part_id            = attr.vendor_part_id;
 166         resp.hw_ver                    = attr.hw_ver;
 167         resp.max_qp                    = attr.max_qp;
 168         resp.max_qp_wr                 = attr.max_qp_wr;
 169         resp.device_cap_flags          = attr.device_cap_flags;
 170         resp.max_sge                   = attr.max_sge;
 171         resp.max_sge_rd                = attr.max_sge_rd;
 172         resp.max_cq                    = attr.max_cq;
 173         resp.max_cqe                   = attr.max_cqe;
 174         resp.max_mr                    = attr.max_mr;
 175         resp.max_pd                    = attr.max_pd;
 176         resp.max_qp_rd_atom            = attr.max_qp_rd_atom;
 177         resp.max_ee_rd_atom            = attr.max_ee_rd_atom;
 178         resp.max_res_rd_atom           = attr.max_res_rd_atom;
 179         resp.max_qp_init_rd_atom       = attr.max_qp_init_rd_atom;
 180         resp.max_ee_init_rd_atom       = attr.max_ee_init_rd_atom;
 181         resp.atomic_cap                = attr.atomic_cap;
 182         resp.max_ee                    = attr.max_ee;
 183         resp.max_rdd                   = attr.max_rdd;
 184         resp.max_mw                    = attr.max_mw;
 185         resp.max_raw_ipv6_qp           = attr.max_raw_ipv6_qp;
 186         resp.max_raw_ethy_qp           = attr.max_raw_ethy_qp;
 187         resp.max_mcast_grp             = attr.max_mcast_grp;
 188         resp.max_mcast_qp_attach       = attr.max_mcast_qp_attach;
 189         resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
 190         resp.max_ah                    = attr.max_ah;
 191         resp.max_fmr                   = attr.max_fmr;
 192         resp.max_map_per_fmr           = attr.max_map_per_fmr;
 193         resp.max_srq                   = attr.max_srq;
 194         resp.max_srq_wr                = attr.max_srq_wr;
 195         resp.max_srq_sge               = attr.max_srq_sge;
 196         resp.max_pkeys                 = attr.max_pkeys;
 197         resp.local_ca_ack_delay        = attr.local_ca_ack_delay;
 198         resp.phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
 199
 200         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 201                          &resp, sizeof resp))
 202                 return -EFAULT;
 203
 204         return in_len;
 205 }
 206
 207 ssize_t ib_uverbs_query_port(struct ib_uverbs_file *file,
 208                              const char __user *buf,
 209                              int in_len, int out_len)
 210 {
 211         struct ib_uverbs_query_port      cmd;
 212         struct ib_uverbs_query_port_resp resp;
 213         struct ib_port_attr              attr;
 214         int                              ret;
 215
 216         if (out_len < sizeof resp)
 217                 return -ENOSPC;
 218
 219         if (copy_from_user(&cmd, buf, sizeof cmd))
 220                 return -EFAULT;
 221
 222         ret = ib_query_port(file->device->ib_dev, cmd.port_num, &attr);
 223         if (ret)
 224                 return ret;
 225
 226         memset(&resp, 0, sizeof resp);
 227
 228         resp.state           = attr.state;
 229         resp.max_mtu         = attr.max_mtu;
 230         resp.active_mtu      = attr.active_mtu;
 231         resp.gid_tbl_len     = attr.gid_tbl_len;
 232         resp.port_cap_flags  = attr.port_cap_flags;
 233         resp.max_msg_sz      = attr.max_msg_sz;
 234         resp.bad_pkey_cntr   = attr.bad_pkey_cntr;
 235         resp.qkey_viol_cntr  = attr.qkey_viol_cntr;
 236         resp.pkey_tbl_len    = attr.pkey_tbl_len;
 237         resp.lid             = attr.lid;
 238         resp.sm_lid          = attr.sm_lid;
 239         resp.lmc             = attr.lmc;
 240         resp.max_vl_num      = attr.max_vl_num;
 241         resp.sm_sl           = attr.sm_sl;
 242         resp.subnet_timeout  = attr.subnet_timeout;
 243         resp.init_type_reply = attr.init_type_reply;
 244         resp.active_width    = attr.active_width;
 245         resp.active_speed    = attr.active_speed;
 246         resp.phys_state      = attr.phys_state;
 247
 248         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 249                          &resp, sizeof resp))
 250                 return -EFAULT;
 251
 252         return in_len;
 253 }
 254
 255 ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
 256                            const char __user *buf,
 257                            int in_len, int out_len)
 258 {
 259         struct ib_uverbs_alloc_pd      cmd;
 260         struct ib_uverbs_alloc_pd_resp resp;
 261         struct ib_udata                udata;
 262         struct ib_uobject             *uobj;
 263         struct ib_pd                  *pd;
 264         int                            ret;
 265
 266         if (out_len < sizeof resp)
 267                 return -ENOSPC;
 268
 269         if (copy_from_user(&cmd, buf, sizeof cmd))
 270                 return -EFAULT;
 271
 272         INIT_UDATA(&udata, buf + sizeof cmd,
 273                    (unsigned long) cmd.response + sizeof resp,
 274                    in_len - sizeof cmd, out_len - sizeof resp);
 275
 276         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 277         if (!uobj)
 278                 return -ENOMEM;
 279
 280         uobj->context = file->ucontext;
 281
 282         pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
 283                                             file->ucontext, &udata);
 284         if (IS_ERR(pd)) {
 285                 ret = PTR_ERR(pd);
 286                 goto err;
 287         }
 288
 289         pd->device  = file->device->ib_dev;
 290         pd->uobject = uobj;
 291         atomic_set(&pd->usecnt, 0);
 292
 293         mutex_lock(&ib_uverbs_idr_mutex);
 294
 295 retry:
 296         if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
 297                 ret = -ENOMEM;
 298                 goto err_up;
 299         }
 300
 301         ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);
 302
 303         if (ret == -EAGAIN)
 304                 goto retry;
 305         if (ret)
 306                 goto err_up;
 307
 308         memset(&resp, 0, sizeof resp);
 309         resp.pd_handle = uobj->id;
 310
 311         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 312                          &resp, sizeof resp)) {
 313                 ret = -EFAULT;
 314                 goto err_idr;
 315         }
 316
 317         mutex_lock(&file->mutex);
 318         list_add_tail(&uobj->list, &file->ucontext->pd_list);
 319         mutex_unlock(&file->mutex);
 320
 321         mutex_unlock(&ib_uverbs_idr_mutex);
 322
 323         return in_len;
 324
 325 err_idr:
 326         idr_remove(&ib_uverbs_pd_idr, uobj->id);
 327
 328 err_up:
 329         mutex_unlock(&ib_uverbs_idr_mutex);
 330         ib_dealloc_pd(pd);
 331
 332 err:
 333         kfree(uobj);
 334         return ret;
 335 }
 336
 337 ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 338                              const char __user *buf,
 339                              int in_len, int out_len)
 340 {
 341         struct ib_uverbs_dealloc_pd cmd;
 342         struct ib_pd               *pd;
 343         struct ib_uobject          *uobj;
 344         int                         ret = -EINVAL;
 345
 346         if (copy_from_user(&cmd, buf, sizeof cmd))
 347                 return -EFAULT;
 348
 349         mutex_lock(&ib_uverbs_idr_mutex);
 350
 351         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 352         if (!pd || pd->uobject->context != file->ucontext)
 353                 goto out;
 354
 355         uobj = pd->uobject;
 356
 357         ret = ib_dealloc_pd(pd);
 358         if (ret)
 359                 goto out;
 360
 361         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 362
 363         mutex_lock(&file->mutex);
 364         list_del(&uobj->list);
 365         mutex_unlock(&file->mutex);
 366
 367         kfree(uobj);
 368
 369 out:
 370         mutex_unlock(&ib_uverbs_idr_mutex);
 371
 372         return ret ? ret : in_len;
 373 }
 374
 375 ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
 376                          const char __user *buf, int in_len,
 377                          int out_len)
 378 {
 379         struct ib_uverbs_reg_mr      cmd;
 380         struct ib_uverbs_reg_mr_resp resp;
 381         struct ib_udata              udata;
 382         struct ib_umem_object       *obj;
 383         struct ib_pd                *pd;
 384         struct ib_mr                *mr;
 385         int                          ret;
 386
 387         if (out_len < sizeof resp)
 388                 return -ENOSPC;
 389
 390         if (copy_from_user(&cmd, buf, sizeof cmd))
 391                 return -EFAULT;
 392
 393         INIT_UDATA(&udata, buf + sizeof cmd,
 394                    (unsigned long) cmd.response + sizeof resp,
 395                    in_len - sizeof cmd, out_len - sizeof resp);
 396
 397         if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
 398                 return -EINVAL;
 399
 400         /*
 401          * Local write permission is required if remote write or
 402          * remote atomic permission is also requested.
 403          */
 404         if (cmd.access_flags & (IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_REMOTE_WRITE) &&
 405             !(cmd.access_flags & IB_ACCESS_LOCAL_WRITE))
 406                 return -EINVAL;
 407
 408         obj = kmalloc(sizeof *obj, GFP_KERNEL);
 409         if (!obj)
 410                 return -ENOMEM;
 411
 412         obj->uobject.context = file->ucontext;
 413
 414         /*
 415          * We ask for writable memory if any access flags other than
 416          * "remote read" are set.  "Local write" and "remote write"
 417          * obviously require write access.  "Remote atomic" can do
 418          * things like fetch and add, which will modify memory, and
 419          * "MW bind" can change permissions by binding a window.
 420          */
 421         ret = ib_umem_get(file->device->ib_dev, &obj->umem,
 422                           (void *) (unsigned long) cmd.start, cmd.length,
 423                           !!(cmd.access_flags & ~IB_ACCESS_REMOTE_READ));
 424         if (ret)
 425                 goto err_free;
 426
 427         obj->umem.virt_base = cmd.hca_va;
 428
 429         mutex_lock(&ib_uverbs_idr_mutex);
 430
 431         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 432         if (!pd || pd->uobject->context != file->ucontext) {
 433                 ret = -EINVAL;
 434                 goto err_up;
 435         }
 436
 437         if (!pd->device->reg_user_mr) {
 438                 ret = -ENOSYS;
 439                 goto err_up;
 440         }
 441
 442         mr = pd->device->reg_user_mr(pd, &obj->umem, cmd.access_flags, &udata);
 443         if (IS_ERR(mr)) {
 444                 ret = PTR_ERR(mr);
 445                 goto err_up;
 446         }
 447
 448         mr->device  = pd->device;
 449         mr->pd      = pd;
 450         mr->uobject = &obj->uobject;
 451         atomic_inc(&pd->usecnt);
 452         atomic_set(&mr->usecnt, 0);
 453
 454         memset(&resp, 0, sizeof resp);
 455         resp.lkey = mr->lkey;
 456         resp.rkey = mr->rkey;
 457
 458 retry:
 459         if (!idr_pre_get(&ib_uverbs_mr_idr, GFP_KERNEL)) {
 460                 ret = -ENOMEM;
 461                 goto err_unreg;
 462         }
 463
 464         ret = idr_get_new(&ib_uverbs_mr_idr, mr, &obj->uobject.id);
 465
 466         if (ret == -EAGAIN)
 467                 goto retry;
 468         if (ret)
 469                 goto err_unreg;
 470
 471         resp.mr_handle = obj->uobject.id;
 472
 473         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 474                          &resp, sizeof resp)) {
 475                 ret = -EFAULT;
 476                 goto err_idr;
 477         }
 478
 479         mutex_lock(&file->mutex);
 480         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
 481         mutex_unlock(&file->mutex);
 482
 483         mutex_unlock(&ib_uverbs_idr_mutex);
 484
 485         return in_len;
 486
 487 err_idr:
 488         idr_remove(&ib_uverbs_mr_idr, obj->uobject.id);
 489
 490 err_unreg:
 491         ib_dereg_mr(mr);
 492         atomic_dec(&pd->usecnt);
 493
 494 err_up:
 495         mutex_unlock(&ib_uverbs_idr_mutex);
 496
 497         ib_umem_release(file->device->ib_dev, &obj->umem);
 498
 499 err_free:
 500         kfree(obj);
 501         return ret;
 502 }
 503
 504 ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 505                            const char __user *buf, int in_len,
 506                            int out_len)
 507 {
 508         struct ib_uverbs_dereg_mr cmd;
 509         struct ib_mr             *mr;
 510         struct ib_umem_object    *memobj;
 511         int                       ret = -EINVAL;
 512
 513         if (copy_from_user(&cmd, buf, sizeof cmd))
 514                 return -EFAULT;
 515
 516         mutex_lock(&ib_uverbs_idr_mutex);
 517
 518         mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
 519         if (!mr || mr->uobject->context != file->ucontext)
 520                 goto out;
 521
 522         memobj = container_of(mr->uobject, struct ib_umem_object, uobject);
 523
 524         ret = ib_dereg_mr(mr);
 525         if (ret)
 526                 goto out;
 527
 528         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 529
 530         mutex_lock(&file->mutex);
 531         list_del(&memobj->uobject.list);
 532         mutex_unlock(&file->mutex);
 533
 534         ib_umem_release(file->device->ib_dev, &memobj->umem);
 535         kfree(memobj);
 536
 537 out:
 538         mutex_unlock(&ib_uverbs_idr_mutex);
 539
 540         return ret ? ret : in_len;
 541 }
 542
 543 ssize_t ib_uverbs_create_comp_channel(struct ib_uverbs_file *file,
 544                                       const char __user *buf, int in_len,
 545                                       int out_len)
 546 {
 547         struct ib_uverbs_create_comp_channel       cmd;
 548         struct ib_uverbs_create_comp_channel_resp  resp;
 549         struct file                               *filp;
 550
 551         if (out_len < sizeof resp)
 552                 return -ENOSPC;
 553
 554         if (copy_from_user(&cmd, buf, sizeof cmd))
 555                 return -EFAULT;
 556
 557         filp = ib_uverbs_alloc_event_file(file, 0, &resp.fd);
 558         if (IS_ERR(filp))
 559                 return PTR_ERR(filp);
 560
 561         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 562                          &resp, sizeof resp)) {
 563                 put_unused_fd(resp.fd);
 564                 fput(filp);
 565                 return -EFAULT;
 566         }
 567
 568         fd_install(resp.fd, filp);
 569         return in_len;
 570 }
 571
 572 ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
 573                             const char __user *buf, int in_len,
 574                             int out_len)
 575 {
 576         struct ib_uverbs_create_cq      cmd;
 577         struct ib_uverbs_create_cq_resp resp;
 578         struct ib_udata                 udata;
 579         struct ib_ucq_object           *uobj;
 580         struct ib_uverbs_event_file    *ev_file = NULL;
 581         struct ib_cq                   *cq;
 582         int                             ret;
 583
 584         if (out_len < sizeof resp)
 585                 return -ENOSPC;
 586
 587         if (copy_from_user(&cmd, buf, sizeof cmd))
 588                 return -EFAULT;
 589
 590         INIT_UDATA(&udata, buf + sizeof cmd,
 591                    (unsigned long) cmd.response + sizeof resp,
 592                    in_len - sizeof cmd, out_len - sizeof resp);
 593
 594         if (cmd.comp_vector >= file->device->num_comp_vectors)
 595                 return -EINVAL;
 596
 597         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 598         if (!uobj)
 599                 return -ENOMEM;
 600
 601         if (cmd.comp_channel >= 0) {
 602                 ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
 603                 if (!ev_file) {
 604                         ret = -EINVAL;
 605                         goto err;
 606                 }
 607         }
 608
 609         uobj->uobject.user_handle   = cmd.user_handle;
 610         uobj->uobject.context       = file->ucontext;
 611         uobj->uverbs_file           = file;
 612         uobj->comp_events_reported  = 0;
 613         uobj->async_events_reported = 0;
 614         INIT_LIST_HEAD(&uobj->comp_list);
 615         INIT_LIST_HEAD(&uobj->async_list);
 616
 617         cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,
 618                                              file->ucontext, &udata);
 619         if (IS_ERR(cq)) {
 620                 ret = PTR_ERR(cq);
 621                 goto err;
 622         }
 623
 624         cq->device        = file->device->ib_dev;
 625         cq->uobject       = &uobj->uobject;
 626         cq->comp_handler  = ib_uverbs_comp_handler;
 627         cq->event_handler = ib_uverbs_cq_event_handler;
 628         cq->cq_context    = ev_file;
 629         atomic_set(&cq->usecnt, 0);
 630
 631         mutex_lock(&ib_uverbs_idr_mutex);
 632
 633 retry:
 634         if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
 635                 ret = -ENOMEM;
 636                 goto err_up;
 637         }
 638
 639         ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->uobject.id);
 640
 641         if (ret == -EAGAIN)
 642                 goto retry;
 643         if (ret)
 644                 goto err_up;
 645
 646         memset(&resp, 0, sizeof resp);
 647         resp.cq_handle = uobj->uobject.id;
 648         resp.cqe       = cq->cqe;
 649
 650         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 651                          &resp, sizeof resp)) {
 652                 ret = -EFAULT;
 653                 goto err_idr;
 654         }
 655
 656         mutex_lock(&file->mutex);
 657         list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
 658         mutex_unlock(&file->mutex);
 659
 660         mutex_unlock(&ib_uverbs_idr_mutex);
 661
 662         return in_len;
 663
 664 err_idr:
 665         idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
 666
 667 err_up:
 668         mutex_unlock(&ib_uverbs_idr_mutex);
 669         ib_destroy_cq(cq);
 670
 671 err:
 672         if (ev_file)
 673                 ib_uverbs_release_ucq(file, ev_file, uobj);
 674         kfree(uobj);
 675         return ret;
 676 }
 677
 678 ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file,
 679                             const char __user *buf, int in_len,
 680                             int out_len)
 681 {
 682         struct ib_uverbs_resize_cq      cmd;
 683         struct ib_uverbs_resize_cq_resp resp;
 684         struct ib_udata                 udata;
 685         struct ib_cq                    *cq;
 686         int                             ret = -EINVAL;
 687
 688         if (copy_from_user(&cmd, buf, sizeof cmd))
 689                 return -EFAULT;
 690
 691         INIT_UDATA(&udata, buf + sizeof cmd,
 692                    (unsigned long) cmd.response + sizeof resp,
 693                    in_len - sizeof cmd, out_len - sizeof resp);
 694
 695         mutex_lock(&ib_uverbs_idr_mutex);
 696
 697         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 698         if (!cq || cq->uobject->context != file->ucontext || !cq->device->resize_cq)
 699                 goto out;
 700
 701         ret = cq->device->resize_cq(cq, cmd.cqe, &udata);
 702         if (ret)
 703                 goto out;
 704
 705         memset(&resp, 0, sizeof resp);
 706         resp.cqe = cq->cqe;
 707
 708         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 709                          &resp, sizeof resp))
 710                 ret = -EFAULT;
 711
 712 out:
 713         mutex_unlock(&ib_uverbs_idr_mutex);
 714
 715         return ret ? ret : in_len;
 716 }
 717
 718 ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
 719                           const char __user *buf, int in_len,
 720                           int out_len)
 721 {
 722         struct ib_uverbs_poll_cq       cmd;
 723         struct ib_uverbs_poll_cq_resp *resp;
 724         struct ib_cq                  *cq;
 725         struct ib_wc                  *wc;
 726         int                            ret = 0;
 727         int                            i;
 728         int                            rsize;
 729
 730         if (copy_from_user(&cmd, buf, sizeof cmd))
 731                 return -EFAULT;
 732
 733         wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
 734         if (!wc)
 735                 return -ENOMEM;
 736
 737         rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
 738         resp = kmalloc(rsize, GFP_KERNEL);
 739         if (!resp) {
 740                 ret = -ENOMEM;
 741                 goto out_wc;
 742         }
 743
 744         mutex_lock(&ib_uverbs_idr_mutex);
 745         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 746         if (!cq || cq->uobject->context != file->ucontext) {
 747                 ret = -EINVAL;
 748                 goto out;
 749         }
 750
 751         resp->count = ib_poll_cq(cq, cmd.ne, wc);
 752
 753         for (i = 0; i < resp->count; i++) {
 754                 resp->wc[i].wr_id          = wc[i].wr_id;
 755                 resp->wc[i].status         = wc[i].status;
 756                 resp->wc[i].opcode         = wc[i].opcode;
 757                 resp->wc[i].vendor_err     = wc[i].vendor_err;
 758                 resp->wc[i].byte_len       = wc[i].byte_len;
 759                 resp->wc[i].imm_data       = (__u32 __force) wc[i].imm_data;
 760                 resp->wc[i].qp_num         = wc[i].qp_num;
 761                 resp->wc[i].src_qp         = wc[i].src_qp;
 762                 resp->wc[i].wc_flags       = wc[i].wc_flags;
 763                 resp->wc[i].pkey_index     = wc[i].pkey_index;
 764                 resp->wc[i].slid           = wc[i].slid;
 765                 resp->wc[i].sl             = wc[i].sl;
 766                 resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
 767                 resp->wc[i].port_num       = wc[i].port_num;
 768         }
 769
 770         if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
 771                 ret = -EFAULT;
 772
 773 out:
 774         mutex_unlock(&ib_uverbs_idr_mutex);
 775         kfree(resp);
 776
 777 out_wc:
 778         kfree(wc);
 779         return ret ? ret : in_len;
 780 }
 781
 782 ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
 783                                 const char __user *buf, int in_len,
 784                                 int out_len)
 785 {
 786         struct ib_uverbs_req_notify_cq cmd;
 787         struct ib_cq                  *cq;
 788         int                            ret = -EINVAL;
 789
 790         if (copy_from_user(&cmd, buf, sizeof cmd))
 791                 return -EFAULT;
 792
 793         mutex_lock(&ib_uverbs_idr_mutex);
 794         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 795         if (cq && cq->uobject->context == file->ucontext) {
 796                 ib_req_notify_cq(cq, cmd.solicited_only ?
 797                                         IB_CQ_SOLICITED : IB_CQ_NEXT_COMP);
 798                 ret = in_len;
 799         }
 800         mutex_unlock(&ib_uverbs_idr_mutex);
 801
 802         return ret;
 803 }
 804
 805 ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 806                              const char __user *buf, int in_len,
 807                              int out_len)
 808 {
 809         struct ib_uverbs_destroy_cq      cmd;
 810         struct ib_uverbs_destroy_cq_resp resp;
 811         struct ib_cq                    *cq;
 812         struct ib_ucq_object            *uobj;
 813         struct ib_uverbs_event_file     *ev_file;
 814         u64                              user_handle;
 815         int                              ret = -EINVAL;
 816
 817         if (copy_from_user(&cmd, buf, sizeof cmd))
 818                 return -EFAULT;
 819
 820         memset(&resp, 0, sizeof resp);
 821
 822         mutex_lock(&ib_uverbs_idr_mutex);
 823
 824         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 825         if (!cq || cq->uobject->context != file->ucontext)
 826                 goto out;
 827
 828         user_handle = cq->uobject->user_handle;
 829         uobj        = container_of(cq->uobject, struct ib_ucq_object, uobject);
 830         ev_file     = cq->cq_context;
 831
 832         ret = ib_destroy_cq(cq);
 833         if (ret)
 834                 goto out;
 835
 836         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 837
 838         mutex_lock(&file->mutex);
 839         list_del(&uobj->uobject.list);
 840         mutex_unlock(&file->mutex);
 841
 842         ib_uverbs_release_ucq(file, ev_file, uobj);
 843
 844         resp.comp_events_reported  = uobj->comp_events_reported;
 845         resp.async_events_reported = uobj->async_events_reported;
 846
 847         kfree(uobj);
 848
 849         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 850                          &resp, sizeof resp))
 851                 ret = -EFAULT;
 852
 853 out:
 854         mutex_unlock(&ib_uverbs_idr_mutex);
 855
 856         return ret ? ret : in_len;
 857 }
 858
 859 ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
 860                             const char __user *buf, int in_len,
 861                             int out_len)
 862 {
 863         struct ib_uverbs_create_qp      cmd;
 864         struct ib_uverbs_create_qp_resp resp;
 865         struct ib_udata                 udata;
 866         struct ib_uqp_object           *uobj;
 867         struct ib_pd                   *pd;
 868         struct ib_cq                   *scq, *rcq;
 869         struct ib_srq                  *srq;
 870         struct ib_qp                   *qp;
 871         struct ib_qp_init_attr          attr;
 872         int ret;
 873
 874         if (out_len < sizeof resp)
 875                 return -ENOSPC;
 876
 877         if (copy_from_user(&cmd, buf, sizeof cmd))
 878                 return -EFAULT;
 879
 880         INIT_UDATA(&udata, buf + sizeof cmd,
 881                    (unsigned long) cmd.response + sizeof resp,
 882                    in_len - sizeof cmd, out_len - sizeof resp);
 883
 884         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 885         if (!uobj)
 886                 return -ENOMEM;
 887
 888         mutex_lock(&ib_uverbs_idr_mutex);
 889
 890         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 891         scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
 892         rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
 893         srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
 894
 895         if (!pd  || pd->uobject->context  != file->ucontext ||
 896             !scq || scq->uobject->context != file->ucontext ||
 897             !rcq || rcq->uobject->context != file->ucontext ||
 898             (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
 899                 ret = -EINVAL;
 900                 goto err_up;
 901         }
 902
 903         attr.event_handler = ib_uverbs_qp_event_handler;
 904         attr.qp_context    = file;
 905         attr.send_cq       = scq;
 906         attr.recv_cq       = rcq;
 907         attr.srq           = srq;
 908         attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
 909         attr.qp_type       = cmd.qp_type;
 910
 911         attr.cap.max_send_wr     = cmd.max_send_wr;
 912         attr.cap.max_recv_wr     = cmd.max_recv_wr;
 913         attr.cap.max_send_sge    = cmd.max_send_sge;
 914         attr.cap.max_recv_sge    = cmd.max_recv_sge;
 915         attr.cap.max_inline_data = cmd.max_inline_data;
 916
 917         uobj->uevent.uobject.user_handle = cmd.user_handle;
 918         uobj->uevent.uobject.context     = file->ucontext;
 919         uobj->uevent.events_reported     = 0;
 920         INIT_LIST_HEAD(&uobj->uevent.event_list);
 921         INIT_LIST_HEAD(&uobj->mcast_list);
 922
 923         qp = pd->device->create_qp(pd, &attr, &udata);
 924         if (IS_ERR(qp)) {
 925                 ret = PTR_ERR(qp);
 926                 goto err_up;
 927         }
 928
 929         qp->device        = pd->device;
 930         qp->pd            = pd;
 931         qp->send_cq       = attr.send_cq;
 932         qp->recv_cq       = attr.recv_cq;
 933         qp->srq           = attr.srq;
 934         qp->uobject       = &uobj->uevent.uobject;
 935         qp->event_handler = attr.event_handler;
 936         qp->qp_context    = attr.qp_context;
 937         qp->qp_type       = attr.qp_type;
 938         atomic_inc(&pd->usecnt);
 939         atomic_inc(&attr.send_cq->usecnt);
 940         atomic_inc(&attr.recv_cq->usecnt);
 941         if (attr.srq)
 942                 atomic_inc(&attr.srq->usecnt);
 943
 944         memset(&resp, 0, sizeof resp);
 945         resp.qpn = qp->qp_num;
 946
 947 retry:
 948         if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {
 949                 ret = -ENOMEM;
 950                 goto err_destroy;
 951         }
 952
 953         ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uevent.uobject.id);
 954
 955         if (ret == -EAGAIN)
 956                 goto retry;
 957         if (ret)
 958                 goto err_destroy;
 959
 960         resp.qp_handle       = uobj->uevent.uobject.id;
 961         resp.max_recv_sge    = attr.cap.max_recv_sge;
 962         resp.max_send_sge    = attr.cap.max_send_sge;
 963         resp.max_recv_wr     = attr.cap.max_recv_wr;
 964         resp.max_send_wr     = attr.cap.max_send_wr;
 965         resp.max_inline_data = attr.cap.max_inline_data;
 966
 967         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 968                          &resp, sizeof resp)) {
 969                 ret = -EFAULT;
 970                 goto err_idr;
 971         }
 972
 973         mutex_lock(&file->mutex);
 974         list_add_tail(&uobj->uevent.uobject.list, &file->ucontext->qp_list);
 975         mutex_unlock(&file->mutex);
 976
 977         mutex_unlock(&ib_uverbs_idr_mutex);
 978
 979         return in_len;
 980
 981 err_idr:
 982         idr_remove(&ib_uverbs_qp_idr, uobj->uevent.uobject.id);
 983
 984 err_destroy:
 985         ib_destroy_qp(qp);
 986         atomic_dec(&pd->usecnt);
 987         atomic_dec(&attr.send_cq->usecnt);
 988         atomic_dec(&attr.recv_cq->usecnt);
 989         if (attr.srq)
 990                 atomic_dec(&attr.srq->usecnt);
 991
 992 err_up:
 993         mutex_unlock(&ib_uverbs_idr_mutex);
 994
 995         kfree(uobj);
 996         return ret;
 997 }
 998
 999 ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
1000                             const char __user *buf, int in_len,
1001                             int out_len)
1002 {
1003         struct ib_uverbs_modify_qp cmd;
1004         struct ib_qp              *qp;
1005         struct ib_qp_attr         *attr;
1006         int                        ret;
1007
1008         if (copy_from_user(&cmd, buf, sizeof cmd))
1009                 return -EFAULT;
1010
1011         attr = kmalloc(sizeof *attr, GFP_KERNEL);
1012         if (!attr)
1013                 return -ENOMEM;
1014
1015         mutex_lock(&ib_uverbs_idr_mutex);
1016
1017         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1018         if (!qp || qp->uobject->context != file->ucontext) {
1019                 ret = -EINVAL;
1020                 goto out;
1021         }
1022
1023         attr->qp_state            = cmd.qp_state;
1024         attr->cur_qp_state        = cmd.cur_qp_state;
1025         attr->path_mtu            = cmd.path_mtu;
1026         attr->path_mig_state      = cmd.path_mig_state;
1027         attr->qkey                = cmd.qkey;
1028         attr->rq_psn              = cmd.rq_psn;
1029         attr->sq_psn              = cmd.sq_psn;
1030         attr->dest_qp_num         = cmd.dest_qp_num;
1031         attr->qp_access_flags     = cmd.qp_access_flags;
1032         attr->pkey_index          = cmd.pkey_index;
1033         attr->alt_pkey_index      = cmd.pkey_index;
1034         attr->en_sqd_async_notify = cmd.en_sqd_async_notify;
1035         attr->max_rd_atomic       = cmd.max_rd_atomic;
1036         attr->max_dest_rd_atomic  = cmd.max_dest_rd_atomic;
1037         attr->min_rnr_timer       = cmd.min_rnr_timer;
1038         attr->port_num            = cmd.port_num;
1039         attr->timeout             = cmd.timeout;
1040         attr->retry_cnt           = cmd.retry_cnt;
1041         attr->rnr_retry           = cmd.rnr_retry;
1042         attr->alt_port_num        = cmd.alt_port_num;
1043         attr->alt_timeout         = cmd.alt_timeout;
1044
1045         memcpy(attr->ah_attr.grh.dgid.raw, cmd.dest.dgid, 16);
1046         attr->ah_attr.grh.flow_label        = cmd.dest.flow_label;
1047         attr->ah_attr.grh.sgid_index        = cmd.dest.sgid_index;
1048         attr->ah_attr.grh.hop_limit         = cmd.dest.hop_limit;
1049         attr->ah_attr.grh.traffic_class     = cmd.dest.traffic_class;
1050         attr->ah_attr.dlid                  = cmd.dest.dlid;
1051         attr->ah_attr.sl                    = cmd.dest.sl;
1052         attr->ah_attr.src_path_bits         = cmd.dest.src_path_bits;
1053         attr->ah_attr.static_rate           = cmd.dest.static_rate;
1054         attr->ah_attr.ah_flags              = cmd.dest.is_global ? IB_AH_GRH : 0;
1055         attr->ah_attr.port_num              = cmd.dest.port_num;
1056
1057         memcpy(attr->alt_ah_attr.grh.dgid.raw, cmd.alt_dest.dgid, 16);
1058         attr->alt_ah_attr.grh.flow_label    = cmd.alt_dest.flow_label;
1059         attr->alt_ah_attr.grh.sgid_index    = cmd.alt_dest.sgid_index;
1060         attr->alt_ah_attr.grh.hop_limit     = cmd.alt_dest.hop_limit;
1061         attr->alt_ah_attr.grh.traffic_class = cmd.alt_dest.traffic_class;
1062         attr->alt_ah_attr.dlid              = cmd.alt_dest.dlid;
1063         attr->alt_ah_attr.sl                = cmd.alt_dest.sl;
1064         attr->alt_ah_attr.src_path_bits     = cmd.alt_dest.src_path_bits;
1065         attr->alt_ah_attr.static_rate       = cmd.alt_dest.static_rate;
1066         attr->alt_ah_attr.ah_flags          = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
1067         attr->alt_ah_attr.port_num          = cmd.alt_dest.port_num;
1068
1069         ret = ib_modify_qp(qp, attr, cmd.attr_mask);
1070         if (ret)
1071                 goto out;
1072
1073         ret = in_len;
1074
1075 out:
1076         mutex_unlock(&ib_uverbs_idr_mutex);
1077         kfree(attr);
1078
1079         return ret;
1080 }
1081
1082 ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
1083                              const char __user *buf, int in_len,
1084                              int out_len)
1085 {
1086         struct ib_uverbs_destroy_qp      cmd;
1087         struct ib_uverbs_destroy_qp_resp resp;
1088         struct ib_qp                    *qp;
1089         struct ib_uqp_object            *uobj;
1090         int                              ret = -EINVAL;
1091
1092         if (copy_from_user(&cmd, buf, sizeof cmd))
1093                 return -EFAULT;
1094
1095         memset(&resp, 0, sizeof resp);
1096
1097         mutex_lock(&ib_uverbs_idr_mutex);
1098
1099         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1100         if (!qp || qp->uobject->context != file->ucontext)
1101                 goto out;
1102
1103         uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1104
1105         if (!list_empty(&uobj->mcast_list)) {
1106                 ret = -EBUSY;
1107                 goto out;
1108         }
1109
1110         ret = ib_destroy_qp(qp);
1111         if (ret)
1112                 goto out;
1113
1114         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
1115
1116         mutex_lock(&file->mutex);
1117         list_del(&uobj->uevent.uobject.list);
1118         mutex_unlock(&file->mutex);
1119
1120         ib_uverbs_release_uevent(file, &uobj->uevent);
1121
1122         resp.events_reported = uobj->uevent.events_reported;
1123
1124         kfree(uobj);
1125
1126         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1127                          &resp, sizeof resp))
1128                 ret = -EFAULT;
1129
1130 out:
1131         mutex_unlock(&ib_uverbs_idr_mutex);
1132
1133         return ret ? ret : in_len;
1134 }
1135
1136 ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
1137                             const char __user *buf, int in_len,
1138                             int out_len)
1139 {
1140         struct ib_uverbs_post_send      cmd;
1141         struct ib_uverbs_post_send_resp resp;
1142         struct ib_uverbs_send_wr       *user_wr;
1143         struct ib_send_wr              *wr = NULL, *last, *next, *bad_wr;
1144         struct ib_qp                   *qp;
1145         int                             i, sg_ind;
1146         ssize_t                         ret = -EINVAL;
1147
1148         if (copy_from_user(&cmd, buf, sizeof cmd))
1149                 return -EFAULT;
1150
1151         if (in_len < sizeof cmd + cmd.wqe_size * cmd.wr_count +
1152             cmd.sge_count * sizeof (struct ib_uverbs_sge))
1153                 return -EINVAL;
1154
1155         if (cmd.wqe_size < sizeof (struct ib_uverbs_send_wr))
1156                 return -EINVAL;
1157
1158         user_wr = kmalloc(cmd.wqe_size, GFP_KERNEL);
1159         if (!user_wr)
1160                 return -ENOMEM;
1161
1162         mutex_lock(&ib_uverbs_idr_mutex);
1163
1164         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1165         if (!qp || qp->uobject->context != file->ucontext)
1166                 goto out;
1167
1168         sg_ind = 0;
1169         last = NULL;
1170         for (i = 0; i < cmd.wr_count; ++i) {
1171                 if (copy_from_user(user_wr,
1172                                    buf + sizeof cmd + i * cmd.wqe_size,
1173                                    cmd.wqe_size)) {
1174                         ret = -EFAULT;
1175                         goto out;
1176                 }
1177
1178                 if (user_wr->num_sge + sg_ind > cmd.sge_count) {
1179                         ret = -EINVAL;
1180                         goto out;
1181                 }
1182
1183                 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1184                                user_wr->num_sge * sizeof (struct ib_sge),
1185                                GFP_KERNEL);
1186                 if (!next) {
1187                         ret = -ENOMEM;
1188                         goto out;
1189                 }
1190
1191                 if (!last)
1192                         wr = next;
1193                 else
1194                         last->next = next;
1195                 last = next;
1196
1197                 next->next       = NULL;
1198                 next->wr_id      = user_wr->wr_id;
1199                 next->num_sge    = user_wr->num_sge;
1200                 next->opcode     = user_wr->opcode;
1201                 next->send_flags = user_wr->send_flags;
1202                 next->imm_data   = (__be32 __force) user_wr->imm_data;
1203
1204                 if (qp->qp_type == IB_QPT_UD) {
1205                         next->wr.ud.ah = idr_find(&ib_uverbs_ah_idr,
1206                                                   user_wr->wr.ud.ah);
1207                         if (!next->wr.ud.ah) {
1208                                 ret = -EINVAL;
1209                                 goto out;
1210                         }
1211                         next->wr.ud.remote_qpn  = user_wr->wr.ud.remote_qpn;
1212                         next->wr.ud.remote_qkey = user_wr->wr.ud.remote_qkey;
1213                 } else {
1214                         switch (next->opcode) {
1215                         case IB_WR_RDMA_WRITE:
1216                         case IB_WR_RDMA_WRITE_WITH_IMM:
1217                         case IB_WR_RDMA_READ:
1218                                 next->wr.rdma.remote_addr =
1219                                         user_wr->wr.rdma.remote_addr;
1220                                 next->wr.rdma.rkey        =
1221                                         user_wr->wr.rdma.rkey;
1222                                 break;
1223                         case IB_WR_ATOMIC_CMP_AND_SWP:
1224                         case IB_WR_ATOMIC_FETCH_AND_ADD:
1225                                 next->wr.atomic.remote_addr =
1226                                         user_wr->wr.atomic.remote_addr;
1227                                 next->wr.atomic.compare_add =
1228                                         user_wr->wr.atomic.compare_add;
1229                                 next->wr.atomic.swap = user_wr->wr.atomic.swap;
1230                                 next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
1231                                 break;
1232                         default:
1233                                 break;
1234                         }
1235                 }
1236
1237                 if (next->num_sge) {
1238                         next->sg_list = (void *) next +
1239                                 ALIGN(sizeof *next, sizeof (struct ib_sge));
1240                         if (copy_from_user(next->sg_list,
1241                                            buf + sizeof cmd +
1242                                            cmd.wr_count * cmd.wqe_size +
1243                                            sg_ind * sizeof (struct ib_sge),
1244                                            next->num_sge * sizeof (struct ib_sge))) {
1245                                 ret = -EFAULT;
1246                                 goto out;
1247                         }
1248                         sg_ind += next->num_sge;
1249                 } else
1250                         next->sg_list = NULL;
1251         }
1252
1253         resp.bad_wr = 0;
1254         ret = qp->device->post_send(qp, wr, &bad_wr);
1255         if (ret)
1256                 for (next = wr; next; next = next->next) {
1257                         ++resp.bad_wr;
1258                         if (next == bad_wr)
1259                                 break;
1260                 }
1261
1262         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1263                          &resp, sizeof resp))
1264                 ret = -EFAULT;
1265
1266 out:
1267         mutex_unlock(&ib_uverbs_idr_mutex);
1268
1269         while (wr) {
1270                 next = wr->next;
1271                 kfree(wr);
1272                 wr = next;
1273         }
1274
1275         kfree(user_wr);
1276
1277         return ret ? ret : in_len;
1278 }
1279
1280 static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf,
1281                                                     int in_len,
1282                                                     u32 wr_count,
1283                                                     u32 sge_count,
1284                                                     u32 wqe_size)
1285 {
1286         struct ib_uverbs_recv_wr *user_wr;
1287         struct ib_recv_wr        *wr = NULL, *last, *next;
1288         int                       sg_ind;
1289         int                       i;
1290         int                       ret;
1291
1292         if (in_len < wqe_size * wr_count +
1293             sge_count * sizeof (struct ib_uverbs_sge))
1294                 return ERR_PTR(-EINVAL);
1295
1296         if (wqe_size < sizeof (struct ib_uverbs_recv_wr))
1297                 return ERR_PTR(-EINVAL);
1298
1299         user_wr = kmalloc(wqe_size, GFP_KERNEL);
1300         if (!user_wr)
1301                 return ERR_PTR(-ENOMEM);
1302
1303         sg_ind = 0;
1304         last = NULL;
1305         for (i = 0; i < wr_count; ++i) {
1306                 if (copy_from_user(user_wr, buf + i * wqe_size,
1307                                    wqe_size)) {
1308                         ret = -EFAULT;
1309                         goto err;
1310                 }
1311
1312                 if (user_wr->num_sge + sg_ind > sge_count) {
1313                         ret = -EINVAL;
1314                         goto err;
1315                 }
1316
1317                 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1318                                user_wr->num_sge * sizeof (struct ib_sge),
1319                                GFP_KERNEL);
1320                 if (!next) {
1321                         ret = -ENOMEM;
1322                         goto err;
1323                 }
1324
1325                 if (!last)
1326                         wr = next;
1327                 else
1328                         last->next = next;
1329                 last = next;
1330
1331                 next->next       = NULL;
1332                 next->wr_id      = user_wr->wr_id;
1333                 next->num_sge    = user_wr->num_sge;
1334
1335                 if (next->num_sge) {
1336                         next->sg_list = (void *) next +
1337                                 ALIGN(sizeof *next, sizeof (struct ib_sge));
1338                         if (copy_from_user(next->sg_list,
1339                                            buf + wr_count * wqe_size +
1340                                            sg_ind * sizeof (struct ib_sge),
1341                                            next->num_sge * sizeof (struct ib_sge))) {
1342                                 ret = -EFAULT;
1343                                 goto err;
1344                         }
1345                         sg_ind += next->num_sge;
1346                 } else
1347                         next->sg_list = NULL;
1348         }
1349
1350         kfree(user_wr);
1351         return wr;
1352
1353 err:
1354         kfree(user_wr);
1355
1356         while (wr) {
1357                 next = wr->next;
1358                 kfree(wr);
1359                 wr = next;
1360         }
1361
1362         return ERR_PTR(ret);
1363 }
1364
1365 ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
1366                             const char __user *buf, int in_len,
1367                             int out_len)
1368 {
1369         struct ib_uverbs_post_recv      cmd;
1370         struct ib_uverbs_post_recv_resp resp;
1371         struct ib_recv_wr              *wr, *next, *bad_wr;
1372         struct ib_qp                   *qp;
1373         ssize_t                         ret = -EINVAL;
1374
1375         if (copy_from_user(&cmd, buf, sizeof cmd))
1376                 return -EFAULT;
1377
1378         wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1379                                        in_len - sizeof cmd, cmd.wr_count,
1380                                        cmd.sge_count, cmd.wqe_size);
1381         if (IS_ERR(wr))
1382                 return PTR_ERR(wr);
1383
1384         mutex_lock(&ib_uverbs_idr_mutex);
1385
1386         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1387         if (!qp || qp->uobject->context != file->ucontext)
1388                 goto out;
1389
1390         resp.bad_wr = 0;
1391         ret = qp->device->post_recv(qp, wr, &bad_wr);
1392         if (ret)
1393                 for (next = wr; next; next = next->next) {
1394                         ++resp.bad_wr;
1395                         if (next == bad_wr)
1396                                 break;
1397                 }
1398
1399
1400         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1401                          &resp, sizeof resp))
1402                 ret = -EFAULT;
1403
1404 out:
1405         mutex_unlock(&ib_uverbs_idr_mutex);
1406
1407         while (wr) {
1408                 next = wr->next;
1409                 kfree(wr);
1410                 wr = next;
1411         }
1412
1413         return ret ? ret : in_len;
1414 }
1415
1416 ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
1417                             const char __user *buf, int in_len,
1418                             int out_len)
1419 {
1420         struct ib_uverbs_post_srq_recv      cmd;
1421         struct ib_uverbs_post_srq_recv_resp resp;
1422         struct ib_recv_wr                  *wr, *next, *bad_wr;
1423         struct ib_srq                      *srq;
1424         ssize_t                             ret = -EINVAL;
1425
1426         if (copy_from_user(&cmd, buf, sizeof cmd))
1427                 return -EFAULT;
1428
1429         wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1430                                        in_len - sizeof cmd, cmd.wr_count,
1431                                        cmd.sge_count, cmd.wqe_size);
1432         if (IS_ERR(wr))
1433                 return PTR_ERR(wr);
1434
1435         mutex_lock(&ib_uverbs_idr_mutex);
1436
1437         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1438         if (!srq || srq->uobject->context != file->ucontext)
1439                 goto out;
1440
1441         resp.bad_wr = 0;
1442         ret = srq->device->post_srq_recv(srq, wr, &bad_wr);
1443         if (ret)
1444                 for (next = wr; next; next = next->next) {
1445                         ++resp.bad_wr;
1446                         if (next == bad_wr)
1447                                 break;
1448                 }
1449
1450
1451         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1452                          &resp, sizeof resp))
1453                 ret = -EFAULT;
1454
1455 out:
1456         mutex_unlock(&ib_uverbs_idr_mutex);
1457
1458         while (wr) {
1459                 next = wr->next;
1460                 kfree(wr);
1461                 wr = next;
1462         }
1463
1464         return ret ? ret : in_len;
1465 }
1466
1467 ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
1468                             const char __user *buf, int in_len,
1469                             int out_len)
1470 {
1471         struct ib_uverbs_create_ah       cmd;
1472         struct ib_uverbs_create_ah_resp  resp;
1473         struct ib_uobject               *uobj;
1474         struct ib_pd                    *pd;
1475         struct ib_ah                    *ah;
1476         struct ib_ah_attr               attr;
1477         int ret;
1478
1479         if (out_len < sizeof resp)
1480                 return -ENOSPC;
1481
1482         if (copy_from_user(&cmd, buf, sizeof cmd))
1483                 return -EFAULT;
1484
1485         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1486         if (!uobj)
1487                 return -ENOMEM;
1488
1489         mutex_lock(&ib_uverbs_idr_mutex);
1490
1491         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1492         if (!pd || pd->uobject->context != file->ucontext) {
1493                 ret = -EINVAL;
1494                 goto err_up;
1495         }
1496
1497         uobj->user_handle = cmd.user_handle;
1498         uobj->context     = file->ucontext;
1499
1500         attr.dlid              = cmd.attr.dlid;
1501         attr.sl                = cmd.attr.sl;
1502         attr.src_path_bits     = cmd.attr.src_path_bits;
1503         attr.static_rate       = cmd.attr.static_rate;
1504         attr.ah_flags          = cmd.attr.is_global ? IB_AH_GRH : 0;
1505         attr.port_num          = cmd.attr.port_num;
1506         attr.grh.flow_label    = cmd.attr.grh.flow_label;
1507         attr.grh.sgid_index    = cmd.attr.grh.sgid_index;
1508         attr.grh.hop_limit     = cmd.attr.grh.hop_limit;
1509         attr.grh.traffic_class = cmd.attr.grh.traffic_class;
1510         memcpy(attr.grh.dgid.raw, cmd.attr.grh.dgid, 16);
1511
1512         ah = ib_create_ah(pd, &attr);
1513         if (IS_ERR(ah)) {
1514                 ret = PTR_ERR(ah);
1515                 goto err_up;
1516         }
1517
1518         ah->uobject = uobj;
1519
1520 retry:
1521         if (!idr_pre_get(&ib_uverbs_ah_idr, GFP_KERNEL)) {
1522                 ret = -ENOMEM;
1523                 goto err_destroy;
1524         }
1525
1526         ret = idr_get_new(&ib_uverbs_ah_idr, ah, &uobj->id);
1527
1528         if (ret == -EAGAIN)
1529                 goto retry;
1530         if (ret)
1531                 goto err_destroy;
1532
1533         resp.ah_handle = uobj->id;
1534
1535         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1536                          &resp, sizeof resp)) {
1537                 ret = -EFAULT;
1538                 goto err_idr;
1539         }
1540
1541         mutex_lock(&file->mutex);
1542         list_add_tail(&uobj->list, &file->ucontext->ah_list);
1543         mutex_unlock(&file->mutex);
1544
1545         mutex_unlock(&ib_uverbs_idr_mutex);
1546
1547         return in_len;
1548
1549 err_idr:
1550         idr_remove(&ib_uverbs_ah_idr, uobj->id);
1551
1552 err_destroy:
1553         ib_destroy_ah(ah);
1554
1555 err_up:
1556         mutex_unlock(&ib_uverbs_idr_mutex);
1557
1558         kfree(uobj);
1559         return ret;
1560 }
1561
1562 ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
1563                              const char __user *buf, int in_len, int out_len)
1564 {
1565         struct ib_uverbs_destroy_ah cmd;
1566         struct ib_ah               *ah;
1567         struct ib_uobject          *uobj;
1568         int                         ret = -EINVAL;
1569
1570         if (copy_from_user(&cmd, buf, sizeof cmd))
1571                 return -EFAULT;
1572
1573         mutex_lock(&ib_uverbs_idr_mutex);
1574
1575         ah = idr_find(&ib_uverbs_ah_idr, cmd.ah_handle);
1576         if (!ah || ah->uobject->context != file->ucontext)
1577                 goto out;
1578
1579         uobj = ah->uobject;
1580
1581         ret = ib_destroy_ah(ah);
1582         if (ret)
1583                 goto out;
1584
1585         idr_remove(&ib_uverbs_ah_idr, cmd.ah_handle);
1586
1587         mutex_lock(&file->mutex);
1588         list_del(&uobj->list);
1589         mutex_unlock(&file->mutex);
1590
1591         kfree(uobj);
1592
1593 out:
1594         mutex_unlock(&ib_uverbs_idr_mutex);
1595
1596         return ret ? ret : in_len;
1597 }
1598
1599 ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
1600                                const char __user *buf, int in_len,
1601                                int out_len)
1602 {
1603         struct ib_uverbs_attach_mcast cmd;
1604         struct ib_qp                 *qp;
1605         struct ib_uqp_object         *uobj;
1606         struct ib_uverbs_mcast_entry *mcast;
1607         int                           ret = -EINVAL;
1608
1609         if (copy_from_user(&cmd, buf, sizeof cmd))
1610                 return -EFAULT;
1611
1612         mutex_lock(&ib_uverbs_idr_mutex);
1613
1614         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1615         if (!qp || qp->uobject->context != file->ucontext)
1616                 goto out;
1617
1618         uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1619
1620         list_for_each_entry(mcast, &uobj->mcast_list, list)
1621                 if (cmd.mlid == mcast->lid &&
1622                     !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
1623                         ret = 0;
1624                         goto out;
1625                 }
1626
1627         mcast = kmalloc(sizeof *mcast, GFP_KERNEL);
1628         if (!mcast) {
1629                 ret = -ENOMEM;
1630                 goto out;
1631         }
1632
1633         mcast->lid = cmd.mlid;
1634         memcpy(mcast->gid.raw, cmd.gid, sizeof mcast->gid.raw);
1635
1636         ret = ib_attach_mcast(qp, &mcast->gid, cmd.mlid);
1637         if (!ret) {
1638                 uobj = container_of(qp->uobject, struct ib_uqp_object,
1639                                     uevent.uobject);
1640                 list_add_tail(&mcast->list, &uobj->mcast_list);
1641         } else
1642                 kfree(mcast);
1643
1644 out:
1645         mutex_unlock(&ib_uverbs_idr_mutex);
1646
1647         return ret ? ret : in_len;
1648 }
1649
1650 ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
1651                                const char __user *buf, int in_len,
1652                                int out_len)
1653 {
1654         struct ib_uverbs_detach_mcast cmd;
1655         struct ib_uqp_object         *uobj;
1656         struct ib_qp                 *qp;
1657         struct ib_uverbs_mcast_entry *mcast;
1658         int                           ret = -EINVAL;
1659
1660         if (copy_from_user(&cmd, buf, sizeof cmd))
1661                 return -EFAULT;
1662
1663         mutex_lock(&ib_uverbs_idr_mutex);
1664
1665         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1666         if (!qp || qp->uobject->context != file->ucontext)
1667                 goto out;
1668
1669         ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1670         if (ret)
1671                 goto out;
1672
1673         uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1674
1675         list_for_each_entry(mcast, &uobj->mcast_list, list)
1676                 if (cmd.mlid == mcast->lid &&
1677                     !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
1678                         list_del(&mcast->list);
1679                         kfree(mcast);
1680                         break;
1681                 }
1682
1683 out:
1684         mutex_unlock(&ib_uverbs_idr_mutex);
1685
1686         return ret ? ret : in_len;
1687 }
1688
1689 ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
1690                              const char __user *buf, int in_len,
1691                              int out_len)
1692 {
1693         struct ib_uverbs_create_srq      cmd;
1694         struct ib_uverbs_create_srq_resp resp;
1695         struct ib_udata                  udata;
1696         struct ib_uevent_object         *uobj;
1697         struct ib_pd                    *pd;
1698         struct ib_srq                   *srq;
1699         struct ib_srq_init_attr          attr;
1700         int ret;
1701
1702         if (out_len < sizeof resp)
1703                 return -ENOSPC;
1704
1705         if (copy_from_user(&cmd, buf, sizeof cmd))
1706                 return -EFAULT;
1707
1708         INIT_UDATA(&udata, buf + sizeof cmd,
1709                    (unsigned long) cmd.response + sizeof resp,
1710                    in_len - sizeof cmd, out_len - sizeof resp);
1711
1712         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1713         if (!uobj)
1714                 return -ENOMEM;
1715
1716         mutex_lock(&ib_uverbs_idr_mutex);
1717
1718         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1719
1720         if (!pd || pd->uobject->context != file->ucontext) {
1721                 ret = -EINVAL;
1722                 goto err_up;
1723         }
1724
1725         attr.event_handler  = ib_uverbs_srq_event_handler;
1726         attr.srq_context    = file;
1727         attr.attr.max_wr    = cmd.max_wr;
1728         attr.attr.max_sge   = cmd.max_sge;
1729         attr.attr.srq_limit = cmd.srq_limit;
1730
1731         uobj->uobject.user_handle = cmd.user_handle;
1732         uobj->uobject.context     = file->ucontext;
1733         uobj->events_reported     = 0;
1734         INIT_LIST_HEAD(&uobj->event_list);
1735
1736         srq = pd->device->create_srq(pd, &attr, &udata);
1737         if (IS_ERR(srq)) {
1738                 ret = PTR_ERR(srq);
1739                 goto err_up;
1740         }
1741
1742         srq->device        = pd->device;
1743         srq->pd            = pd;
1744         srq->uobject       = &uobj->uobject;
1745         srq->event_handler = attr.event_handler;
1746         srq->srq_context   = attr.srq_context;
1747         atomic_inc(&pd->usecnt);
1748         atomic_set(&srq->usecnt, 0);
1749
1750         memset(&resp, 0, sizeof resp);
1751
1752 retry:
1753         if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
1754                 ret = -ENOMEM;
1755                 goto err_destroy;
1756         }
1757
1758         ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->uobject.id);
1759
1760         if (ret == -EAGAIN)
1761                 goto retry;
1762         if (ret)
1763                 goto err_destroy;
1764
1765         resp.srq_handle = uobj->uobject.id;
1766
1767         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1768                          &resp, sizeof resp)) {
1769                 ret = -EFAULT;
1770                 goto err_idr;
1771         }
1772
1773         mutex_lock(&file->mutex);
1774         list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
1775         mutex_unlock(&file->mutex);
1776
1777         mutex_unlock(&ib_uverbs_idr_mutex);
1778
1779         return in_len;
1780
1781 err_idr:
1782         idr_remove(&ib_uverbs_srq_idr, uobj->uobject.id);
1783
1784 err_destroy:
1785         ib_destroy_srq(srq);
1786         atomic_dec(&pd->usecnt);
1787
1788 err_up:
1789         mutex_unlock(&ib_uverbs_idr_mutex);
1790
1791         kfree(uobj);
1792         return ret;
1793 }
1794
1795 ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
1796                              const char __user *buf, int in_len,
1797                              int out_len)
1798 {
1799         struct ib_uverbs_modify_srq cmd;
1800         struct ib_srq              *srq;
1801         struct ib_srq_attr          attr;
1802         int                         ret;
1803
1804         if (copy_from_user(&cmd, buf, sizeof cmd))
1805                 return -EFAULT;
1806
1807         mutex_lock(&ib_uverbs_idr_mutex);
1808
1809         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1810         if (!srq || srq->uobject->context != file->ucontext) {
1811                 ret = -EINVAL;
1812                 goto out;
1813         }
1814
1815         attr.max_wr    = cmd.max_wr;
1816         attr.srq_limit = cmd.srq_limit;
1817
1818         ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
1819
1820 out:
1821         mutex_unlock(&ib_uverbs_idr_mutex);
1822
1823         return ret ? ret : in_len;
1824 }
1825
1826 ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
1827                               const char __user *buf, int in_len,
1828                               int out_len)
1829 {
1830         struct ib_uverbs_destroy_srq      cmd;
1831         struct ib_uverbs_destroy_srq_resp resp;
1832         struct ib_srq                    *srq;
1833         struct ib_uevent_object          *uobj;
1834         int                               ret = -EINVAL;
1835
1836         if (copy_from_user(&cmd, buf, sizeof cmd))
1837                 return -EFAULT;
1838
1839         mutex_lock(&ib_uverbs_idr_mutex);
1840
1841         memset(&resp, 0, sizeof resp);
1842
1843         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1844         if (!srq || srq->uobject->context != file->ucontext)
1845                 goto out;
1846
1847         uobj = container_of(srq->uobject, struct ib_uevent_object, uobject);
1848
1849         ret = ib_destroy_srq(srq);
1850         if (ret)
1851                 goto out;
1852
1853         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
1854
1855         mutex_lock(&file->mutex);
1856         list_del(&uobj->uobject.list);
1857         mutex_unlock(&file->mutex);
1858
1859         ib_uverbs_release_uevent(file, uobj);
1860
1861         resp.events_reported = uobj->events_reported;
1862
1863         kfree(uobj);
1864
1865         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1866                          &resp, sizeof resp))
1867                 ret = -EFAULT;
1868
1869 out:
1870         mutex_unlock(&ib_uverbs_idr_mutex);
1871
1872         return ret ? ret : in_len;
1873 }