drivers/infiniband/core/uverbs_cmd.c

   1 /*
   2  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
   3  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   4  * Copyright (c) 2005 PathScale, Inc.  All rights reserved.
   5  *
   6  * This software is available to you under a choice of one of two
   7  * licenses.  You may choose to be licensed under the terms of the GNU
   8  * General Public License (GPL) Version 2, available from the file
   9  * COPYING in the main directory of this source tree, or the
  10  * OpenIB.org BSD license below:
  11  *
  12  *     Redistribution and use in source and binary forms, with or
  13  *     without modification, are permitted provided that the following
  14  *     conditions are met:
  15  *
  16  *      - Redistributions of source code must retain the above
  17  *        copyright notice, this list of conditions and the following
  18  *        disclaimer.
  19  *
  20  *      - Redistributions in binary form must reproduce the above
  21  *        copyright notice, this list of conditions and the following
  22  *        disclaimer in the documentation and/or other materials
  23  *        provided with the distribution.
  24  *
  25  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  26  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  27  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  28  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  29  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  30  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  31  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  32  * SOFTWARE.
  33  *
  34  * $Id: uverbs_cmd.c 2708 2005-06-24 17:27:21Z roland $
  35  */
  36
  37 #include <linux/file.h>
  38 #include <linux/fs.h>
  39
  40 #include <asm/uaccess.h>
  41
  42 #include "uverbs.h"
  43
  44 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
  45         do {                                                            \
  46                 (udata)->inbuf  = (void __user *) (ibuf);               \
  47                 (udata)->outbuf = (void __user *) (obuf);               \
  48                 (udata)->inlen  = (ilen);                               \
  49                 (udata)->outlen = (olen);                               \
  50         } while (0)
  51
  52 ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
  53                               const char __user *buf,
  54                               int in_len, int out_len)
  55 {
  56         struct ib_uverbs_get_context      cmd;
  57         struct ib_uverbs_get_context_resp resp;
  58         struct ib_udata                   udata;
  59         struct ib_device                 *ibdev = file->device->ib_dev;
  60         struct ib_ucontext               *ucontext;
  61         struct file                      *filp;
  62         int ret;
  63
  64         if (out_len < sizeof resp)
  65                 return -ENOSPC;
  66
  67         if (copy_from_user(&cmd, buf, sizeof cmd))
  68                 return -EFAULT;
  69
  70         down(&file->mutex);
  71
  72         if (file->ucontext) {
  73                 ret = -EINVAL;
  74                 goto err;
  75         }
  76
  77         INIT_UDATA(&udata, buf + sizeof cmd,
  78                    (unsigned long) cmd.response + sizeof resp,
  79                    in_len - sizeof cmd, out_len - sizeof resp);
  80
  81         ucontext = ibdev->alloc_ucontext(ibdev, &udata);
  82         if (IS_ERR(ucontext))
  83                 return PTR_ERR(file->ucontext);
  84
  85         ucontext->device = ibdev;
  86         INIT_LIST_HEAD(&ucontext->pd_list);
  87         INIT_LIST_HEAD(&ucontext->mr_list);
  88         INIT_LIST_HEAD(&ucontext->mw_list);
  89         INIT_LIST_HEAD(&ucontext->cq_list);
  90         INIT_LIST_HEAD(&ucontext->qp_list);
  91         INIT_LIST_HEAD(&ucontext->srq_list);
  92         INIT_LIST_HEAD(&ucontext->ah_list);
  93
  94         resp.num_comp_vectors = file->device->num_comp_vectors;
  95
  96         filp = ib_uverbs_alloc_event_file(file, 1, &resp.async_fd);
  97         if (IS_ERR(filp)) {
  98                 ret = PTR_ERR(filp);
  99                 goto err_free;
 100         }
 101
 102         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 103                          &resp, sizeof resp)) {
 104                 ret = -EFAULT;
 105                 goto err_file;
 106         }
 107
 108         file->async_file = filp->private_data;
 109
 110         INIT_IB_EVENT_HANDLER(&file->event_handler, file->device->ib_dev,
 111                               ib_uverbs_event_handler);
 112         ret = ib_register_event_handler(&file->event_handler);
 113         if (ret)
 114                 goto err_file;
 115
 116         kref_get(&file->async_file->ref);
 117         kref_get(&file->ref);
 118         file->ucontext = ucontext;
 119
 120         fd_install(resp.async_fd, filp);
 121
 122         up(&file->mutex);
 123
 124         return in_len;
 125
 126 err_file:
 127         put_unused_fd(resp.async_fd);
 128         fput(filp);
 129
 130 err_free:
 131         ibdev->dealloc_ucontext(ucontext);
 132
 133 err:
 134         up(&file->mutex);
 135         return ret;
 136 }
 137
 138 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
 139                                const char __user *buf,
 140                                int in_len, int out_len)
 141 {
 142         struct ib_uverbs_query_device      cmd;
 143         struct ib_uverbs_query_device_resp resp;
 144         struct ib_device_attr              attr;
 145         int                                ret;
 146
 147         if (out_len < sizeof resp)
 148                 return -ENOSPC;
 149
 150         if (copy_from_user(&cmd, buf, sizeof cmd))
 151                 return -EFAULT;
 152
 153         ret = ib_query_device(file->device->ib_dev, &attr);
 154         if (ret)
 155                 return ret;
 156
 157         memset(&resp, 0, sizeof resp);
 158
 159         resp.fw_ver                    = attr.fw_ver;
 160         resp.node_guid                 = attr.node_guid;
 161         resp.sys_image_guid            = attr.sys_image_guid;
 162         resp.max_mr_size               = attr.max_mr_size;
 163         resp.page_size_cap             = attr.page_size_cap;
 164         resp.vendor_id                 = attr.vendor_id;
 165         resp.vendor_part_id            = attr.vendor_part_id;
 166         resp.hw_ver                    = attr.hw_ver;
 167         resp.max_qp                    = attr.max_qp;
 168         resp.max_qp_wr                 = attr.max_qp_wr;
 169         resp.device_cap_flags          = attr.device_cap_flags;
 170         resp.max_sge                   = attr.max_sge;
 171         resp.max_sge_rd                = attr.max_sge_rd;
 172         resp.max_cq                    = attr.max_cq;
 173         resp.max_cqe                   = attr.max_cqe;
 174         resp.max_mr                    = attr.max_mr;
 175         resp.max_pd                    = attr.max_pd;
 176         resp.max_qp_rd_atom            = attr.max_qp_rd_atom;
 177         resp.max_ee_rd_atom            = attr.max_ee_rd_atom;
 178         resp.max_res_rd_atom           = attr.max_res_rd_atom;
 179         resp.max_qp_init_rd_atom       = attr.max_qp_init_rd_atom;
 180         resp.max_ee_init_rd_atom       = attr.max_ee_init_rd_atom;
 181         resp.atomic_cap                = attr.atomic_cap;
 182         resp.max_ee                    = attr.max_ee;
 183         resp.max_rdd                   = attr.max_rdd;
 184         resp.max_mw                    = attr.max_mw;
 185         resp.max_raw_ipv6_qp           = attr.max_raw_ipv6_qp;
 186         resp.max_raw_ethy_qp           = attr.max_raw_ethy_qp;
 187         resp.max_mcast_grp             = attr.max_mcast_grp;
 188         resp.max_mcast_qp_attach       = attr.max_mcast_qp_attach;
 189         resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
 190         resp.max_ah                    = attr.max_ah;
 191         resp.max_fmr                   = attr.max_fmr;
 192         resp.max_map_per_fmr           = attr.max_map_per_fmr;
 193         resp.max_srq                   = attr.max_srq;
 194         resp.max_srq_wr                = attr.max_srq_wr;
 195         resp.max_srq_sge               = attr.max_srq_sge;
 196         resp.max_pkeys                 = attr.max_pkeys;
 197         resp.local_ca_ack_delay        = attr.local_ca_ack_delay;
 198         resp.phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
 199
 200         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 201                          &resp, sizeof resp))
 202                 return -EFAULT;
 203
 204         return in_len;
 205 }
 206
 207 ssize_t ib_uverbs_query_port(struct ib_uverbs_file *file,
 208                              const char __user *buf,
 209                              int in_len, int out_len)
 210 {
 211         struct ib_uverbs_query_port      cmd;
 212         struct ib_uverbs_query_port_resp resp;
 213         struct ib_port_attr              attr;
 214         int                              ret;
 215
 216         if (out_len < sizeof resp)
 217                 return -ENOSPC;
 218
 219         if (copy_from_user(&cmd, buf, sizeof cmd))
 220                 return -EFAULT;
 221
 222         ret = ib_query_port(file->device->ib_dev, cmd.port_num, &attr);
 223         if (ret)
 224                 return ret;
 225
 226         memset(&resp, 0, sizeof resp);
 227
 228         resp.state           = attr.state;
 229         resp.max_mtu         = attr.max_mtu;
 230         resp.active_mtu      = attr.active_mtu;
 231         resp.gid_tbl_len     = attr.gid_tbl_len;
 232         resp.port_cap_flags  = attr.port_cap_flags;
 233         resp.max_msg_sz      = attr.max_msg_sz;
 234         resp.bad_pkey_cntr   = attr.bad_pkey_cntr;
 235         resp.qkey_viol_cntr  = attr.qkey_viol_cntr;
 236         resp.pkey_tbl_len    = attr.pkey_tbl_len;
 237         resp.lid             = attr.lid;
 238         resp.sm_lid          = attr.sm_lid;
 239         resp.lmc             = attr.lmc;
 240         resp.max_vl_num      = attr.max_vl_num;
 241         resp.sm_sl           = attr.sm_sl;
 242         resp.subnet_timeout  = attr.subnet_timeout;
 243         resp.init_type_reply = attr.init_type_reply;
 244         resp.active_width    = attr.active_width;
 245         resp.active_speed    = attr.active_speed;
 246         resp.phys_state      = attr.phys_state;
 247
 248         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 249                          &resp, sizeof resp))
 250                 return -EFAULT;
 251
 252         return in_len;
 253 }
 254
 255 ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
 256                            const char __user *buf,
 257                            int in_len, int out_len)
 258 {
 259         struct ib_uverbs_alloc_pd      cmd;
 260         struct ib_uverbs_alloc_pd_resp resp;
 261         struct ib_udata                udata;
 262         struct ib_uobject             *uobj;
 263         struct ib_pd                  *pd;
 264         int                            ret;
 265
 266         if (out_len < sizeof resp)
 267                 return -ENOSPC;
 268
 269         if (copy_from_user(&cmd, buf, sizeof cmd))
 270                 return -EFAULT;
 271
 272         INIT_UDATA(&udata, buf + sizeof cmd,
 273                    (unsigned long) cmd.response + sizeof resp,
 274                    in_len - sizeof cmd, out_len - sizeof resp);
 275
 276         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 277         if (!uobj)
 278                 return -ENOMEM;
 279
 280         uobj->context = file->ucontext;
 281
 282         pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
 283                                             file->ucontext, &udata);
 284         if (IS_ERR(pd)) {
 285                 ret = PTR_ERR(pd);
 286                 goto err;
 287         }
 288
 289         pd->device  = file->device->ib_dev;
 290         pd->uobject = uobj;
 291         atomic_set(&pd->usecnt, 0);
 292
 293         down(&ib_uverbs_idr_mutex);
 294
 295 retry:
 296         if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
 297                 ret = -ENOMEM;
 298                 goto err_up;
 299         }
 300
 301         ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);
 302
 303         if (ret == -EAGAIN)
 304                 goto retry;
 305         if (ret)
 306                 goto err_up;
 307
 308         memset(&resp, 0, sizeof resp);
 309         resp.pd_handle = uobj->id;
 310
 311         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 312                          &resp, sizeof resp)) {
 313                 ret = -EFAULT;
 314                 goto err_idr;
 315         }
 316
 317         down(&file->mutex);
 318         list_add_tail(&uobj->list, &file->ucontext->pd_list);
 319         up(&file->mutex);
 320
 321         up(&ib_uverbs_idr_mutex);
 322
 323         return in_len;
 324
 325 err_idr:
 326         idr_remove(&ib_uverbs_pd_idr, uobj->id);
 327
 328 err_up:
 329         up(&ib_uverbs_idr_mutex);
 330         ib_dealloc_pd(pd);
 331
 332 err:
 333         kfree(uobj);
 334         return ret;
 335 }
 336
 337 ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 338                              const char __user *buf,
 339                              int in_len, int out_len)
 340 {
 341         struct ib_uverbs_dealloc_pd cmd;
 342         struct ib_pd               *pd;
 343         struct ib_uobject          *uobj;
 344         int                         ret = -EINVAL;
 345
 346         if (copy_from_user(&cmd, buf, sizeof cmd))
 347                 return -EFAULT;
 348
 349         down(&ib_uverbs_idr_mutex);
 350
 351         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 352         if (!pd || pd->uobject->context != file->ucontext)
 353                 goto out;
 354
 355         uobj = pd->uobject;
 356
 357         ret = ib_dealloc_pd(pd);
 358         if (ret)
 359                 goto out;
 360
 361         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 362
 363         down(&file->mutex);
 364         list_del(&uobj->list);
 365         up(&file->mutex);
 366
 367         kfree(uobj);
 368
 369 out:
 370         up(&ib_uverbs_idr_mutex);
 371
 372         return ret ? ret : in_len;
 373 }
 374
 375 ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
 376                          const char __user *buf, int in_len,
 377                          int out_len)
 378 {
 379         struct ib_uverbs_reg_mr      cmd;
 380         struct ib_uverbs_reg_mr_resp resp;
 381         struct ib_udata              udata;
 382         struct ib_umem_object       *obj;
 383         struct ib_pd                *pd;
 384         struct ib_mr                *mr;
 385         int                          ret;
 386
 387         if (out_len < sizeof resp)
 388                 return -ENOSPC;
 389
 390         if (copy_from_user(&cmd, buf, sizeof cmd))
 391                 return -EFAULT;
 392
 393         INIT_UDATA(&udata, buf + sizeof cmd,
 394                    (unsigned long) cmd.response + sizeof resp,
 395                    in_len - sizeof cmd, out_len - sizeof resp);
 396
 397         if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
 398                 return -EINVAL;
 399
 400         /*
 401          * Local write permission is required if remote write or
 402          * remote atomic permission is also requested.
 403          */
 404         if (cmd.access_flags & (IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_REMOTE_WRITE) &&
 405             !(cmd.access_flags & IB_ACCESS_LOCAL_WRITE))
 406                 return -EINVAL;
 407
 408         obj = kmalloc(sizeof *obj, GFP_KERNEL);
 409         if (!obj)
 410                 return -ENOMEM;
 411
 412         obj->uobject.context = file->ucontext;
 413
 414         /*
 415          * We ask for writable memory if any access flags other than
 416          * "remote read" are set.  "Local write" and "remote write"
 417          * obviously require write access.  "Remote atomic" can do
 418          * things like fetch and add, which will modify memory, and
 419          * "MW bind" can change permissions by binding a window.
 420          */
 421         ret = ib_umem_get(file->device->ib_dev, &obj->umem,
 422                           (void *) (unsigned long) cmd.start, cmd.length,
 423                           !!(cmd.access_flags & ~IB_ACCESS_REMOTE_READ));
 424         if (ret)
 425                 goto err_free;
 426
 427         obj->umem.virt_base = cmd.hca_va;
 428
 429         down(&ib_uverbs_idr_mutex);
 430
 431         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 432         if (!pd || pd->uobject->context != file->ucontext) {
 433                 ret = -EINVAL;
 434                 goto err_up;
 435         }
 436
 437         if (!pd->device->reg_user_mr) {
 438                 ret = -ENOSYS;
 439                 goto err_up;
 440         }
 441
 442         mr = pd->device->reg_user_mr(pd, &obj->umem, cmd.access_flags, &udata);
 443         if (IS_ERR(mr)) {
 444                 ret = PTR_ERR(mr);
 445                 goto err_up;
 446         }
 447
 448         mr->device  = pd->device;
 449         mr->pd      = pd;
 450         mr->uobject = &obj->uobject;
 451         atomic_inc(&pd->usecnt);
 452         atomic_set(&mr->usecnt, 0);
 453
 454         memset(&resp, 0, sizeof resp);
 455         resp.lkey = mr->lkey;
 456         resp.rkey = mr->rkey;
 457
 458 retry:
 459         if (!idr_pre_get(&ib_uverbs_mr_idr, GFP_KERNEL)) {
 460                 ret = -ENOMEM;
 461                 goto err_unreg;
 462         }
 463
 464         ret = idr_get_new(&ib_uverbs_mr_idr, mr, &obj->uobject.id);
 465
 466         if (ret == -EAGAIN)
 467                 goto retry;
 468         if (ret)
 469                 goto err_unreg;
 470
 471         resp.mr_handle = obj->uobject.id;
 472
 473         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 474                          &resp, sizeof resp)) {
 475                 ret = -EFAULT;
 476                 goto err_idr;
 477         }
 478
 479         down(&file->mutex);
 480         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
 481         up(&file->mutex);
 482
 483         up(&ib_uverbs_idr_mutex);
 484
 485         return in_len;
 486
 487 err_idr:
 488         idr_remove(&ib_uverbs_mr_idr, obj->uobject.id);
 489
 490 err_unreg:
 491         ib_dereg_mr(mr);
 492
 493 err_up:
 494         up(&ib_uverbs_idr_mutex);
 495
 496         ib_umem_release(file->device->ib_dev, &obj->umem);
 497
 498 err_free:
 499         kfree(obj);
 500         return ret;
 501 }
 502
 503 ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 504                            const char __user *buf, int in_len,
 505                            int out_len)
 506 {
 507         struct ib_uverbs_dereg_mr cmd;
 508         struct ib_mr             *mr;
 509         struct ib_umem_object    *memobj;
 510         int                       ret = -EINVAL;
 511
 512         if (copy_from_user(&cmd, buf, sizeof cmd))
 513                 return -EFAULT;
 514
 515         down(&ib_uverbs_idr_mutex);
 516
 517         mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
 518         if (!mr || mr->uobject->context != file->ucontext)
 519                 goto out;
 520
 521         memobj = container_of(mr->uobject, struct ib_umem_object, uobject);
 522
 523         ret = ib_dereg_mr(mr);
 524         if (ret)
 525                 goto out;
 526
 527         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 528
 529         down(&file->mutex);
 530         list_del(&memobj->uobject.list);
 531         up(&file->mutex);
 532
 533         ib_umem_release(file->device->ib_dev, &memobj->umem);
 534         kfree(memobj);
 535
 536 out:
 537         up(&ib_uverbs_idr_mutex);
 538
 539         return ret ? ret : in_len;
 540 }
 541
 542 ssize_t ib_uverbs_create_comp_channel(struct ib_uverbs_file *file,
 543                                       const char __user *buf, int in_len,
 544                                       int out_len)
 545 {
 546         struct ib_uverbs_create_comp_channel       cmd;
 547         struct ib_uverbs_create_comp_channel_resp  resp;
 548         struct file                               *filp;
 549
 550         if (out_len < sizeof resp)
 551                 return -ENOSPC;
 552
 553         if (copy_from_user(&cmd, buf, sizeof cmd))
 554                 return -EFAULT;
 555
 556         filp = ib_uverbs_alloc_event_file(file, 0, &resp.fd);
 557         if (IS_ERR(filp))
 558                 return PTR_ERR(filp);
 559
 560         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 561                          &resp, sizeof resp)) {
 562                 put_unused_fd(resp.fd);
 563                 fput(filp);
 564                 return -EFAULT;
 565         }
 566
 567         fd_install(resp.fd, filp);
 568         return in_len;
 569 }
 570
 571 ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
 572                             const char __user *buf, int in_len,
 573                             int out_len)
 574 {
 575         struct ib_uverbs_create_cq      cmd;
 576         struct ib_uverbs_create_cq_resp resp;
 577         struct ib_udata                 udata;
 578         struct ib_ucq_object           *uobj;
 579         struct ib_uverbs_event_file    *ev_file = NULL;
 580         struct ib_cq                   *cq;
 581         int                             ret;
 582
 583         if (out_len < sizeof resp)
 584                 return -ENOSPC;
 585
 586         if (copy_from_user(&cmd, buf, sizeof cmd))
 587                 return -EFAULT;
 588
 589         INIT_UDATA(&udata, buf + sizeof cmd,
 590                    (unsigned long) cmd.response + sizeof resp,
 591                    in_len - sizeof cmd, out_len - sizeof resp);
 592
 593         if (cmd.comp_vector >= file->device->num_comp_vectors)
 594                 return -EINVAL;
 595
 596         if (cmd.comp_channel >= 0)
 597                 ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
 598
 599         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 600         if (!uobj)
 601                 return -ENOMEM;
 602
 603         uobj->uobject.user_handle   = cmd.user_handle;
 604         uobj->uobject.context       = file->ucontext;
 605         uobj->comp_events_reported  = 0;
 606         uobj->async_events_reported = 0;
 607         INIT_LIST_HEAD(&uobj->comp_list);
 608         INIT_LIST_HEAD(&uobj->async_list);
 609
 610         cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,
 611                                              file->ucontext, &udata);
 612         if (IS_ERR(cq)) {
 613                 ret = PTR_ERR(cq);
 614                 goto err;
 615         }
 616
 617         cq->device        = file->device->ib_dev;
 618         cq->uobject       = &uobj->uobject;
 619         cq->comp_handler  = ib_uverbs_comp_handler;
 620         cq->event_handler = ib_uverbs_cq_event_handler;
 621         cq->cq_context    = ev_file;
 622         atomic_set(&cq->usecnt, 0);
 623
 624         down(&ib_uverbs_idr_mutex);
 625
 626 retry:
 627         if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
 628                 ret = -ENOMEM;
 629                 goto err_up;
 630         }
 631
 632         ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->uobject.id);
 633
 634         if (ret == -EAGAIN)
 635                 goto retry;
 636         if (ret)
 637                 goto err_up;
 638
 639         memset(&resp, 0, sizeof resp);
 640         resp.cq_handle = uobj->uobject.id;
 641         resp.cqe       = cq->cqe;
 642
 643         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 644                          &resp, sizeof resp)) {
 645                 ret = -EFAULT;
 646                 goto err_idr;
 647         }
 648
 649         down(&file->mutex);
 650         list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
 651         up(&file->mutex);
 652
 653         up(&ib_uverbs_idr_mutex);
 654
 655         return in_len;
 656
 657 err_idr:
 658         idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
 659
 660 err_up:
 661         up(&ib_uverbs_idr_mutex);
 662         ib_destroy_cq(cq);
 663
 664 err:
 665         kfree(uobj);
 666         return ret;
 667 }
 668
 669 ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
 670                           const char __user *buf, int in_len,
 671                           int out_len)
 672 {
 673         struct ib_uverbs_poll_cq       cmd;
 674         struct ib_uverbs_poll_cq_resp *resp;
 675         struct ib_cq                  *cq;
 676         struct ib_wc                  *wc;
 677         int                            ret = 0;
 678         int                            i;
 679         int                            rsize;
 680
 681         if (copy_from_user(&cmd, buf, sizeof cmd))
 682                 return -EFAULT;
 683
 684         wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
 685         if (!wc)
 686                 return -ENOMEM;
 687
 688         rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
 689         resp = kmalloc(rsize, GFP_KERNEL);
 690         if (!resp) {
 691                 ret = -ENOMEM;
 692                 goto out_wc;
 693         }
 694
 695         down(&ib_uverbs_idr_mutex);
 696         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 697         if (!cq || cq->uobject->context != file->ucontext) {
 698                 ret = -EINVAL;
 699                 goto out;
 700         }
 701
 702         resp->count = ib_poll_cq(cq, cmd.ne, wc);
 703
 704         for (i = 0; i < resp->count; i++) {
 705                 resp->wc[i].wr_id          = wc[i].wr_id;
 706                 resp->wc[i].status         = wc[i].status;
 707                 resp->wc[i].opcode         = wc[i].opcode;
 708                 resp->wc[i].vendor_err     = wc[i].vendor_err;
 709                 resp->wc[i].byte_len       = wc[i].byte_len;
 710                 resp->wc[i].imm_data       = wc[i].imm_data;
 711                 resp->wc[i].qp_num         = wc[i].qp_num;
 712                 resp->wc[i].src_qp         = wc[i].src_qp;
 713                 resp->wc[i].wc_flags       = wc[i].wc_flags;
 714                 resp->wc[i].pkey_index     = wc[i].pkey_index;
 715                 resp->wc[i].slid           = wc[i].slid;
 716                 resp->wc[i].sl             = wc[i].sl;
 717                 resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
 718                 resp->wc[i].port_num       = wc[i].port_num;
 719         }
 720
 721         if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
 722                 ret = -EFAULT;
 723
 724 out:
 725         up(&ib_uverbs_idr_mutex);
 726         kfree(resp);
 727
 728 out_wc:
 729         kfree(wc);
 730         return ret ? ret : in_len;
 731 }
 732
 733 ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
 734                                 const char __user *buf, int in_len,
 735                                 int out_len)
 736 {
 737         struct ib_uverbs_req_notify_cq cmd;
 738         struct ib_cq                  *cq;
 739         int                            ret = -EINVAL;
 740
 741         if (copy_from_user(&cmd, buf, sizeof cmd))
 742                 return -EFAULT;
 743
 744         down(&ib_uverbs_idr_mutex);
 745         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 746         if (cq && cq->uobject->context == file->ucontext) {
 747                 ib_req_notify_cq(cq, cmd.solicited_only ?
 748                                         IB_CQ_SOLICITED : IB_CQ_NEXT_COMP);
 749                 ret = in_len;
 750         }
 751         up(&ib_uverbs_idr_mutex);
 752
 753         return ret;
 754 }
 755
 756 ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 757                              const char __user *buf, int in_len,
 758                              int out_len)
 759 {
 760         struct ib_uverbs_destroy_cq      cmd;
 761         struct ib_uverbs_destroy_cq_resp resp;
 762         struct ib_cq                    *cq;
 763         struct ib_ucq_object            *uobj;
 764         struct ib_uverbs_event_file     *ev_file;
 765         u64                              user_handle;
 766         int                              ret = -EINVAL;
 767
 768         if (copy_from_user(&cmd, buf, sizeof cmd))
 769                 return -EFAULT;
 770
 771         memset(&resp, 0, sizeof resp);
 772
 773         down(&ib_uverbs_idr_mutex);
 774
 775         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 776         if (!cq || cq->uobject->context != file->ucontext)
 777                 goto out;
 778
 779         user_handle = cq->uobject->user_handle;
 780         uobj        = container_of(cq->uobject, struct ib_ucq_object, uobject);
 781         ev_file     = cq->cq_context;
 782
 783         ret = ib_destroy_cq(cq);
 784         if (ret)
 785                 goto out;
 786
 787         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 788
 789         down(&file->mutex);
 790         list_del(&uobj->uobject.list);
 791         up(&file->mutex);
 792
 793         ib_uverbs_release_ucq(file, ev_file, uobj);
 794
 795         resp.comp_events_reported  = uobj->comp_events_reported;
 796         resp.async_events_reported = uobj->async_events_reported;
 797
 798         kfree(uobj);
 799
 800         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 801                          &resp, sizeof resp))
 802                 ret = -EFAULT;
 803
 804 out:
 805         up(&ib_uverbs_idr_mutex);
 806
 807         return ret ? ret : in_len;
 808 }
 809
 810 ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
 811                             const char __user *buf, int in_len,
 812                             int out_len)
 813 {
 814         struct ib_uverbs_create_qp      cmd;
 815         struct ib_uverbs_create_qp_resp resp;
 816         struct ib_udata                 udata;
 817         struct ib_uevent_object        *uobj;
 818         struct ib_pd                   *pd;
 819         struct ib_cq                   *scq, *rcq;
 820         struct ib_srq                  *srq;
 821         struct ib_qp                   *qp;
 822         struct ib_qp_init_attr          attr;
 823         int ret;
 824
 825         if (out_len < sizeof resp)
 826                 return -ENOSPC;
 827
 828         if (copy_from_user(&cmd, buf, sizeof cmd))
 829                 return -EFAULT;
 830
 831         INIT_UDATA(&udata, buf + sizeof cmd,
 832                    (unsigned long) cmd.response + sizeof resp,
 833                    in_len - sizeof cmd, out_len - sizeof resp);
 834
 835         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 836         if (!uobj)
 837                 return -ENOMEM;
 838
 839         down(&ib_uverbs_idr_mutex);
 840
 841         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 842         scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
 843         rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
 844         srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
 845
 846         if (!pd  || pd->uobject->context  != file->ucontext ||
 847             !scq || scq->uobject->context != file->ucontext ||
 848             !rcq || rcq->uobject->context != file->ucontext ||
 849             (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
 850                 ret = -EINVAL;
 851                 goto err_up;
 852         }
 853
 854         attr.event_handler = ib_uverbs_qp_event_handler;
 855         attr.qp_context    = file;
 856         attr.send_cq       = scq;
 857         attr.recv_cq       = rcq;
 858         attr.srq           = srq;
 859         attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
 860         attr.qp_type       = cmd.qp_type;
 861
 862         attr.cap.max_send_wr     = cmd.max_send_wr;
 863         attr.cap.max_recv_wr     = cmd.max_recv_wr;
 864         attr.cap.max_send_sge    = cmd.max_send_sge;
 865         attr.cap.max_recv_sge    = cmd.max_recv_sge;
 866         attr.cap.max_inline_data = cmd.max_inline_data;
 867
 868         uobj->uobject.user_handle = cmd.user_handle;
 869         uobj->uobject.context     = file->ucontext;
 870         uobj->events_reported     = 0;
 871         INIT_LIST_HEAD(&uobj->event_list);
 872
 873         qp = pd->device->create_qp(pd, &attr, &udata);
 874         if (IS_ERR(qp)) {
 875                 ret = PTR_ERR(qp);
 876                 goto err_up;
 877         }
 878
 879         qp->device        = pd->device;
 880         qp->pd            = pd;
 881         qp->send_cq       = attr.send_cq;
 882         qp->recv_cq       = attr.recv_cq;
 883         qp->srq           = attr.srq;
 884         qp->uobject       = &uobj->uobject;
 885         qp->event_handler = attr.event_handler;
 886         qp->qp_context    = attr.qp_context;
 887         qp->qp_type       = attr.qp_type;
 888         atomic_inc(&pd->usecnt);
 889         atomic_inc(&attr.send_cq->usecnt);
 890         atomic_inc(&attr.recv_cq->usecnt);
 891         if (attr.srq)
 892                 atomic_inc(&attr.srq->usecnt);
 893
 894         memset(&resp, 0, sizeof resp);
 895         resp.qpn = qp->qp_num;
 896
 897 retry:
 898         if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {
 899                 ret = -ENOMEM;
 900                 goto err_destroy;
 901         }
 902
 903         ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uobject.id);
 904
 905         if (ret == -EAGAIN)
 906                 goto retry;
 907         if (ret)
 908                 goto err_destroy;
 909
 910         resp.qp_handle = uobj->uobject.id;
 911
 912         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 913                          &resp, sizeof resp)) {
 914                 ret = -EFAULT;
 915                 goto err_idr;
 916         }
 917
 918         down(&file->mutex);
 919         list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
 920         up(&file->mutex);
 921
 922         up(&ib_uverbs_idr_mutex);
 923
 924         return in_len;
 925
 926 err_idr:
 927         idr_remove(&ib_uverbs_qp_idr, uobj->uobject.id);
 928
 929 err_destroy:
 930         ib_destroy_qp(qp);
 931
 932 err_up:
 933         up(&ib_uverbs_idr_mutex);
 934
 935         kfree(uobj);
 936         return ret;
 937 }
 938
 939 ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 940                             const char __user *buf, int in_len,
 941                             int out_len)
 942 {
 943         struct ib_uverbs_modify_qp cmd;
 944         struct ib_qp              *qp;
 945         struct ib_qp_attr         *attr;
 946         int                        ret;
 947
 948         if (copy_from_user(&cmd, buf, sizeof cmd))
 949                 return -EFAULT;
 950
 951         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 952         if (!attr)
 953                 return -ENOMEM;
 954
 955         down(&ib_uverbs_idr_mutex);
 956
 957         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 958         if (!qp || qp->uobject->context != file->ucontext) {
 959                 ret = -EINVAL;
 960                 goto out;
 961         }
 962
 963         attr->qp_state            = cmd.qp_state;
 964         attr->cur_qp_state        = cmd.cur_qp_state;
 965         attr->path_mtu            = cmd.path_mtu;
 966         attr->path_mig_state      = cmd.path_mig_state;
 967         attr->qkey                = cmd.qkey;
 968         attr->rq_psn              = cmd.rq_psn;
 969         attr->sq_psn              = cmd.sq_psn;
 970         attr->dest_qp_num         = cmd.dest_qp_num;
 971         attr->qp_access_flags     = cmd.qp_access_flags;
 972         attr->pkey_index          = cmd.pkey_index;
 973         attr->alt_pkey_index      = cmd.pkey_index;
 974         attr->en_sqd_async_notify = cmd.en_sqd_async_notify;
 975         attr->max_rd_atomic       = cmd.max_rd_atomic;
 976         attr->max_dest_rd_atomic  = cmd.max_dest_rd_atomic;
 977         attr->min_rnr_timer       = cmd.min_rnr_timer;
 978         attr->port_num            = cmd.port_num;
 979         attr->timeout             = cmd.timeout;
 980         attr->retry_cnt           = cmd.retry_cnt;
 981         attr->rnr_retry           = cmd.rnr_retry;
 982         attr->alt_port_num        = cmd.alt_port_num;
 983         attr->alt_timeout         = cmd.alt_timeout;
 984
 985         memcpy(attr->ah_attr.grh.dgid.raw, cmd.dest.dgid, 16);
 986         attr->ah_attr.grh.flow_label        = cmd.dest.flow_label;
 987         attr->ah_attr.grh.sgid_index        = cmd.dest.sgid_index;
 988         attr->ah_attr.grh.hop_limit         = cmd.dest.hop_limit;
 989         attr->ah_attr.grh.traffic_class     = cmd.dest.traffic_class;
 990         attr->ah_attr.dlid                  = cmd.dest.dlid;
 991         attr->ah_attr.sl                    = cmd.dest.sl;
 992         attr->ah_attr.src_path_bits         = cmd.dest.src_path_bits;
 993         attr->ah_attr.static_rate           = cmd.dest.static_rate;
 994         attr->ah_attr.ah_flags              = cmd.dest.is_global ? IB_AH_GRH : 0;
 995         attr->ah_attr.port_num              = cmd.dest.port_num;
 996
 997         memcpy(attr->alt_ah_attr.grh.dgid.raw, cmd.alt_dest.dgid, 16);
 998         attr->alt_ah_attr.grh.flow_label    = cmd.alt_dest.flow_label;
 999         attr->alt_ah_attr.grh.sgid_index    = cmd.alt_dest.sgid_index;
1000         attr->alt_ah_attr.grh.hop_limit     = cmd.alt_dest.hop_limit;
1001         attr->alt_ah_attr.grh.traffic_class = cmd.alt_dest.traffic_class;
1002         attr->alt_ah_attr.dlid              = cmd.alt_dest.dlid;
1003         attr->alt_ah_attr.sl                = cmd.alt_dest.sl;
1004         attr->alt_ah_attr.src_path_bits     = cmd.alt_dest.src_path_bits;
1005         attr->alt_ah_attr.static_rate       = cmd.alt_dest.static_rate;
1006         attr->alt_ah_attr.ah_flags          = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
1007         attr->alt_ah_attr.port_num          = cmd.alt_dest.port_num;
1008
1009         ret = ib_modify_qp(qp, attr, cmd.attr_mask);
1010         if (ret)
1011                 goto out;
1012
1013         ret = in_len;
1014
1015 out:
1016         up(&ib_uverbs_idr_mutex);
1017         kfree(attr);
1018
1019         return ret;
1020 }
1021
1022 ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
1023                              const char __user *buf, int in_len,
1024                              int out_len)
1025 {
1026         struct ib_uverbs_destroy_qp      cmd;
1027         struct ib_uverbs_destroy_qp_resp resp;
1028         struct ib_qp                    *qp;
1029         struct ib_uevent_object         *uobj;
1030         int                              ret = -EINVAL;
1031
1032         if (copy_from_user(&cmd, buf, sizeof cmd))
1033                 return -EFAULT;
1034
1035         memset(&resp, 0, sizeof resp);
1036
1037         down(&ib_uverbs_idr_mutex);
1038
1039         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1040         if (!qp || qp->uobject->context != file->ucontext)
1041                 goto out;
1042
1043         uobj = container_of(qp->uobject, struct ib_uevent_object, uobject);
1044
1045         ret = ib_destroy_qp(qp);
1046         if (ret)
1047                 goto out;
1048
1049         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
1050
1051         down(&file->mutex);
1052         list_del(&uobj->uobject.list);
1053         up(&file->mutex);
1054
1055         ib_uverbs_release_uevent(file, uobj);
1056
1057         resp.events_reported = uobj->events_reported;
1058
1059         kfree(uobj);
1060
1061         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1062                          &resp, sizeof resp))
1063                 ret = -EFAULT;
1064
1065 out:
1066         up(&ib_uverbs_idr_mutex);
1067
1068         return ret ? ret : in_len;
1069 }
1070
1071 ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
1072                             const char __user *buf, int in_len,
1073                             int out_len)
1074 {
1075         struct ib_uverbs_post_send      cmd;
1076         struct ib_uverbs_post_send_resp resp;
1077         struct ib_uverbs_send_wr       *user_wr;
1078         struct ib_send_wr              *wr = NULL, *last, *next, *bad_wr;
1079         struct ib_qp                   *qp;
1080         int                             i, sg_ind;
1081         ssize_t                         ret = -EINVAL;
1082
1083         if (copy_from_user(&cmd, buf, sizeof cmd))
1084                 return -EFAULT;
1085
1086         if (in_len < sizeof cmd + cmd.wqe_size * cmd.wr_count +
1087             cmd.sge_count * sizeof (struct ib_uverbs_sge))
1088                 return -EINVAL;
1089
1090         if (cmd.wqe_size < sizeof (struct ib_uverbs_send_wr))
1091                 return -EINVAL;
1092
1093         user_wr = kmalloc(cmd.wqe_size, GFP_KERNEL);
1094         if (!user_wr)
1095                 return -ENOMEM;
1096
1097         down(&ib_uverbs_idr_mutex);
1098
1099         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1100         if (!qp || qp->uobject->context != file->ucontext)
1101                 goto out;
1102
1103         sg_ind = 0;
1104         last = NULL;
1105         for (i = 0; i < cmd.wr_count; ++i) {
1106                 if (copy_from_user(user_wr,
1107                                    buf + sizeof cmd + i * cmd.wqe_size,
1108                                    cmd.wqe_size)) {
1109                         ret = -EFAULT;
1110                         goto out;
1111                 }
1112
1113                 if (user_wr->num_sge + sg_ind > cmd.sge_count) {
1114                         ret = -EINVAL;
1115                         goto out;
1116                 }
1117
1118                 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1119                                user_wr->num_sge * sizeof (struct ib_sge),
1120                                GFP_KERNEL);
1121                 if (!next) {
1122                         ret = -ENOMEM;
1123                         goto out;
1124                 }
1125
1126                 if (!last)
1127                         wr = next;
1128                 else
1129                         last->next = next;
1130                 last = next;
1131
1132                 next->next       = NULL;
1133                 next->wr_id      = user_wr->wr_id;
1134                 next->num_sge    = user_wr->num_sge;
1135                 next->opcode     = user_wr->opcode;
1136                 next->send_flags = user_wr->send_flags;
1137                 next->imm_data   = user_wr->imm_data;
1138
1139                 if (qp->qp_type == IB_QPT_UD) {
1140                         next->wr.ud.ah = idr_find(&ib_uverbs_ah_idr,
1141                                                   user_wr->wr.ud.ah);
1142                         if (!next->wr.ud.ah) {
1143                                 ret = -EINVAL;
1144                                 goto out;
1145                         }
1146                         next->wr.ud.remote_qpn  = user_wr->wr.ud.remote_qpn;
1147                         next->wr.ud.remote_qkey = user_wr->wr.ud.remote_qkey;
1148                 } else {
1149                         switch (next->opcode) {
1150                         case IB_WR_RDMA_WRITE:
1151                         case IB_WR_RDMA_WRITE_WITH_IMM:
1152                         case IB_WR_RDMA_READ:
1153                                 next->wr.rdma.remote_addr =
1154                                         user_wr->wr.rdma.remote_addr;
1155                                 next->wr.rdma.rkey        =
1156                                         user_wr->wr.rdma.rkey;
1157                                 break;
1158                         case IB_WR_ATOMIC_CMP_AND_SWP:
1159                         case IB_WR_ATOMIC_FETCH_AND_ADD:
1160                                 next->wr.atomic.remote_addr =
1161                                         user_wr->wr.atomic.remote_addr;
1162                                 next->wr.atomic.compare_add =
1163                                         user_wr->wr.atomic.compare_add;
1164                                 next->wr.atomic.swap = user_wr->wr.atomic.swap;
1165                                 next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
1166                                 break;
1167                         default:
1168                                 break;
1169                         }
1170                 }
1171
1172                 if (next->num_sge) {
1173                         next->sg_list = (void *) next +
1174                                 ALIGN(sizeof *next, sizeof (struct ib_sge));
1175                         if (copy_from_user(next->sg_list,
1176                                            buf + sizeof cmd +
1177                                            cmd.wr_count * cmd.wqe_size +
1178                                            sg_ind * sizeof (struct ib_sge),
1179                                            next->num_sge * sizeof (struct ib_sge))) {
1180                                 ret = -EFAULT;
1181                                 goto out;
1182                         }
1183                         sg_ind += next->num_sge;
1184                 } else
1185                         next->sg_list = NULL;
1186         }
1187
1188         resp.bad_wr = 0;
1189         ret = qp->device->post_send(qp, wr, &bad_wr);
1190         if (ret)
1191                 for (next = wr; next; next = next->next) {
1192                         ++resp.bad_wr;
1193                         if (next == bad_wr)
1194                                 break;
1195                 }
1196
1197         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1198                          &resp, sizeof resp))
1199                 ret = -EFAULT;
1200
1201 out:
1202         up(&ib_uverbs_idr_mutex);
1203
1204         while (wr) {
1205                 next = wr->next;
1206                 kfree(wr);
1207                 wr = next;
1208         }
1209
1210         kfree(user_wr);
1211
1212         return ret ? ret : in_len;
1213 }
1214
1215 static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf,
1216                                                     int in_len,
1217                                                     u32 wr_count,
1218                                                     u32 sge_count,
1219                                                     u32 wqe_size)
1220 {
1221         struct ib_uverbs_recv_wr *user_wr;
1222         struct ib_recv_wr        *wr = NULL, *last, *next;
1223         int                       sg_ind;
1224         int                       i;
1225         int                       ret;
1226
1227         if (in_len < wqe_size * wr_count +
1228             sge_count * sizeof (struct ib_uverbs_sge))
1229                 return ERR_PTR(-EINVAL);
1230
1231         if (wqe_size < sizeof (struct ib_uverbs_recv_wr))
1232                 return ERR_PTR(-EINVAL);
1233
1234         user_wr = kmalloc(wqe_size, GFP_KERNEL);
1235         if (!user_wr)
1236                 return ERR_PTR(-ENOMEM);
1237
1238         sg_ind = 0;
1239         last = NULL;
1240         for (i = 0; i < wr_count; ++i) {
1241                 if (copy_from_user(user_wr, buf + i * wqe_size,
1242                                    wqe_size)) {
1243                         ret = -EFAULT;
1244                         goto err;
1245                 }
1246
1247                 if (user_wr->num_sge + sg_ind > sge_count) {
1248                         ret = -EINVAL;
1249                         goto err;
1250                 }
1251
1252                 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1253                                user_wr->num_sge * sizeof (struct ib_sge),
1254                                GFP_KERNEL);
1255                 if (!next) {
1256                         ret = -ENOMEM;
1257                         goto err;
1258                 }
1259
1260                 if (!last)
1261                         wr = next;
1262                 else
1263                         last->next = next;
1264                 last = next;
1265
1266                 next->next       = NULL;
1267                 next->wr_id      = user_wr->wr_id;
1268                 next->num_sge    = user_wr->num_sge;
1269
1270                 if (next->num_sge) {
1271                         next->sg_list = (void *) next +
1272                                 ALIGN(sizeof *next, sizeof (struct ib_sge));
1273                         if (copy_from_user(next->sg_list,
1274                                            buf + wr_count * wqe_size +
1275                                            sg_ind * sizeof (struct ib_sge),
1276                                            next->num_sge * sizeof (struct ib_sge))) {
1277                                 ret = -EFAULT;
1278                                 goto err;
1279                         }
1280                         sg_ind += next->num_sge;
1281                 } else
1282                         next->sg_list = NULL;
1283         }
1284
1285         kfree(user_wr);
1286         return wr;
1287
1288 err:
1289         kfree(user_wr);
1290
1291         while (wr) {
1292                 next = wr->next;
1293                 kfree(wr);
1294                 wr = next;
1295         }
1296
1297         return ERR_PTR(ret);
1298 }
1299
1300 ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
1301                             const char __user *buf, int in_len,
1302                             int out_len)
1303 {
1304         struct ib_uverbs_post_recv      cmd;
1305         struct ib_uverbs_post_recv_resp resp;
1306         struct ib_recv_wr              *wr, *next, *bad_wr;
1307         struct ib_qp                   *qp;
1308         ssize_t                         ret = -EINVAL;
1309
1310         if (copy_from_user(&cmd, buf, sizeof cmd))
1311                 return -EFAULT;
1312
1313         wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1314                                        in_len - sizeof cmd, cmd.wr_count,
1315                                        cmd.sge_count, cmd.wqe_size);
1316         if (IS_ERR(wr))
1317                 return PTR_ERR(wr);
1318
1319         down(&ib_uverbs_idr_mutex);
1320
1321         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1322         if (!qp || qp->uobject->context != file->ucontext)
1323                 goto out;
1324
1325         resp.bad_wr = 0;
1326         ret = qp->device->post_recv(qp, wr, &bad_wr);
1327         if (ret)
1328                 for (next = wr; next; next = next->next) {
1329                         ++resp.bad_wr;
1330                         if (next == bad_wr)
1331                                 break;
1332                 }
1333
1334
1335         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1336                          &resp, sizeof resp))
1337                 ret = -EFAULT;
1338
1339 out:
1340         up(&ib_uverbs_idr_mutex);
1341
1342         while (wr) {
1343                 next = wr->next;
1344                 kfree(wr);
1345                 wr = next;
1346         }
1347
1348         return ret ? ret : in_len;
1349 }
1350
1351 ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
1352                             const char __user *buf, int in_len,
1353                             int out_len)
1354 {
1355         struct ib_uverbs_post_srq_recv      cmd;
1356         struct ib_uverbs_post_srq_recv_resp resp;
1357         struct ib_recv_wr                  *wr, *next, *bad_wr;
1358         struct ib_srq                      *srq;
1359         ssize_t                             ret = -EINVAL;
1360
1361         if (copy_from_user(&cmd, buf, sizeof cmd))
1362                 return -EFAULT;
1363
1364         wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1365                                        in_len - sizeof cmd, cmd.wr_count,
1366                                        cmd.sge_count, cmd.wqe_size);
1367         if (IS_ERR(wr))
1368                 return PTR_ERR(wr);
1369
1370         down(&ib_uverbs_idr_mutex);
1371
1372         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1373         if (!srq || srq->uobject->context != file->ucontext)
1374                 goto out;
1375
1376         resp.bad_wr = 0;
1377         ret = srq->device->post_srq_recv(srq, wr, &bad_wr);
1378         if (ret)
1379                 for (next = wr; next; next = next->next) {
1380                         ++resp.bad_wr;
1381                         if (next == bad_wr)
1382                                 break;
1383                 }
1384
1385
1386         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1387                          &resp, sizeof resp))
1388                 ret = -EFAULT;
1389
1390 out:
1391         up(&ib_uverbs_idr_mutex);
1392
1393         while (wr) {
1394                 next = wr->next;
1395                 kfree(wr);
1396                 wr = next;
1397         }
1398
1399         return ret ? ret : in_len;
1400 }
1401
1402 ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
1403                             const char __user *buf, int in_len,
1404                             int out_len)
1405 {
1406         struct ib_uverbs_create_ah       cmd;
1407         struct ib_uverbs_create_ah_resp  resp;
1408         struct ib_uobject               *uobj;
1409         struct ib_pd                    *pd;
1410         struct ib_ah                    *ah;
1411         struct ib_ah_attr               attr;
1412         int ret;
1413
1414         if (out_len < sizeof resp)
1415                 return -ENOSPC;
1416
1417         if (copy_from_user(&cmd, buf, sizeof cmd))
1418                 return -EFAULT;
1419
1420         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1421         if (!uobj)
1422                 return -ENOMEM;
1423
1424         down(&ib_uverbs_idr_mutex);
1425
1426         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1427         if (!pd || pd->uobject->context != file->ucontext) {
1428                 ret = -EINVAL;
1429                 goto err_up;
1430         }
1431
1432         uobj->user_handle = cmd.user_handle;
1433         uobj->context     = file->ucontext;
1434
1435         attr.dlid              = cmd.attr.dlid;
1436         attr.sl                = cmd.attr.sl;
1437         attr.src_path_bits     = cmd.attr.src_path_bits;
1438         attr.static_rate       = cmd.attr.static_rate;
1439         attr.port_num          = cmd.attr.port_num;
1440         attr.grh.flow_label    = cmd.attr.grh.flow_label;
1441         attr.grh.sgid_index    = cmd.attr.grh.sgid_index;
1442         attr.grh.hop_limit     = cmd.attr.grh.hop_limit;
1443         attr.grh.traffic_class = cmd.attr.grh.traffic_class;
1444         memcpy(attr.grh.dgid.raw, cmd.attr.grh.dgid, 16);
1445
1446         ah = ib_create_ah(pd, &attr);
1447         if (IS_ERR(ah)) {
1448                 ret = PTR_ERR(ah);
1449                 goto err_up;
1450         }
1451
1452         ah->uobject = uobj;
1453
1454 retry:
1455         if (!idr_pre_get(&ib_uverbs_ah_idr, GFP_KERNEL)) {
1456                 ret = -ENOMEM;
1457                 goto err_destroy;
1458         }
1459
1460         ret = idr_get_new(&ib_uverbs_ah_idr, ah, &uobj->id);
1461
1462         if (ret == -EAGAIN)
1463                 goto retry;
1464         if (ret)
1465                 goto err_destroy;
1466
1467         resp.ah_handle = uobj->id;
1468
1469         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1470                          &resp, sizeof resp)) {
1471                 ret = -EFAULT;
1472                 goto err_idr;
1473         }
1474
1475         down(&file->mutex);
1476         list_add_tail(&uobj->list, &file->ucontext->ah_list);
1477         up(&file->mutex);
1478
1479         up(&ib_uverbs_idr_mutex);
1480
1481         return in_len;
1482
1483 err_idr:
1484         idr_remove(&ib_uverbs_ah_idr, uobj->id);
1485
1486 err_destroy:
1487         ib_destroy_ah(ah);
1488
1489 err_up:
1490         up(&ib_uverbs_idr_mutex);
1491
1492         kfree(uobj);
1493         return ret;
1494 }
1495
1496 ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
1497                              const char __user *buf, int in_len, int out_len)
1498 {
1499         struct ib_uverbs_destroy_ah cmd;
1500         struct ib_ah               *ah;
1501         struct ib_uobject          *uobj;
1502         int                         ret = -EINVAL;
1503
1504         if (copy_from_user(&cmd, buf, sizeof cmd))
1505                 return -EFAULT;
1506
1507         down(&ib_uverbs_idr_mutex);
1508
1509         ah = idr_find(&ib_uverbs_ah_idr, cmd.ah_handle);
1510         if (!ah || ah->uobject->context != file->ucontext)
1511                 goto out;
1512
1513         uobj = ah->uobject;
1514
1515         ret = ib_destroy_ah(ah);
1516         if (ret)
1517                 goto out;
1518
1519         idr_remove(&ib_uverbs_ah_idr, cmd.ah_handle);
1520
1521         down(&file->mutex);
1522         list_del(&uobj->list);
1523         up(&file->mutex);
1524
1525         kfree(uobj);
1526
1527 out:
1528         up(&ib_uverbs_idr_mutex);
1529
1530         return ret ? ret : in_len;
1531 }
1532
1533 ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
1534                                const char __user *buf, int in_len,
1535                                int out_len)
1536 {
1537         struct ib_uverbs_attach_mcast cmd;
1538         struct ib_qp                 *qp;
1539         int                           ret = -EINVAL;
1540
1541         if (copy_from_user(&cmd, buf, sizeof cmd))
1542                 return -EFAULT;
1543
1544         down(&ib_uverbs_idr_mutex);
1545
1546         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1547         if (qp && qp->uobject->context == file->ucontext)
1548                 ret = ib_attach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1549
1550         up(&ib_uverbs_idr_mutex);
1551
1552         return ret ? ret : in_len;
1553 }
1554
1555 ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
1556                                const char __user *buf, int in_len,
1557                                int out_len)
1558 {
1559         struct ib_uverbs_detach_mcast cmd;
1560         struct ib_qp                 *qp;
1561         int                           ret = -EINVAL;
1562
1563         if (copy_from_user(&cmd, buf, sizeof cmd))
1564                 return -EFAULT;
1565
1566         down(&ib_uverbs_idr_mutex);
1567
1568         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1569         if (qp && qp->uobject->context == file->ucontext)
1570                 ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1571
1572         up(&ib_uverbs_idr_mutex);
1573
1574         return ret ? ret : in_len;
1575 }
1576
1577 ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
1578                              const char __user *buf, int in_len,
1579                              int out_len)
1580 {
1581         struct ib_uverbs_create_srq      cmd;
1582         struct ib_uverbs_create_srq_resp resp;
1583         struct ib_udata                  udata;
1584         struct ib_uevent_object         *uobj;
1585         struct ib_pd                    *pd;
1586         struct ib_srq                   *srq;
1587         struct ib_srq_init_attr          attr;
1588         int ret;
1589
1590         if (out_len < sizeof resp)
1591                 return -ENOSPC;
1592
1593         if (copy_from_user(&cmd, buf, sizeof cmd))
1594                 return -EFAULT;
1595
1596         INIT_UDATA(&udata, buf + sizeof cmd,
1597                    (unsigned long) cmd.response + sizeof resp,
1598                    in_len - sizeof cmd, out_len - sizeof resp);
1599
1600         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1601         if (!uobj)
1602                 return -ENOMEM;
1603
1604         down(&ib_uverbs_idr_mutex);
1605
1606         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1607
1608         if (!pd || pd->uobject->context != file->ucontext) {
1609                 ret = -EINVAL;
1610                 goto err_up;
1611         }
1612
1613         attr.event_handler  = ib_uverbs_srq_event_handler;
1614         attr.srq_context    = file;
1615         attr.attr.max_wr    = cmd.max_wr;
1616         attr.attr.max_sge   = cmd.max_sge;
1617         attr.attr.srq_limit = cmd.srq_limit;
1618
1619         uobj->uobject.user_handle = cmd.user_handle;
1620         uobj->uobject.context     = file->ucontext;
1621         uobj->events_reported     = 0;
1622         INIT_LIST_HEAD(&uobj->event_list);
1623
1624         srq = pd->device->create_srq(pd, &attr, &udata);
1625         if (IS_ERR(srq)) {
1626                 ret = PTR_ERR(srq);
1627                 goto err_up;
1628         }
1629
1630         srq->device        = pd->device;
1631         srq->pd            = pd;
1632         srq->uobject       = &uobj->uobject;
1633         srq->event_handler = attr.event_handler;
1634         srq->srq_context   = attr.srq_context;
1635         atomic_inc(&pd->usecnt);
1636         atomic_set(&srq->usecnt, 0);
1637
1638         memset(&resp, 0, sizeof resp);
1639
1640 retry:
1641         if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
1642                 ret = -ENOMEM;
1643                 goto err_destroy;
1644         }
1645
1646         ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->uobject.id);
1647
1648         if (ret == -EAGAIN)
1649                 goto retry;
1650         if (ret)
1651                 goto err_destroy;
1652
1653         resp.srq_handle = uobj->uobject.id;
1654
1655         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1656                          &resp, sizeof resp)) {
1657                 ret = -EFAULT;
1658                 goto err_idr;
1659         }
1660
1661         down(&file->mutex);
1662         list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
1663         up(&file->mutex);
1664
1665         up(&ib_uverbs_idr_mutex);
1666
1667         return in_len;
1668
1669 err_idr:
1670         idr_remove(&ib_uverbs_srq_idr, uobj->uobject.id);
1671
1672 err_destroy:
1673         ib_destroy_srq(srq);
1674
1675 err_up:
1676         up(&ib_uverbs_idr_mutex);
1677
1678         kfree(uobj);
1679         return ret;
1680 }
1681
1682 ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
1683                              const char __user *buf, int in_len,
1684                              int out_len)
1685 {
1686         struct ib_uverbs_modify_srq cmd;
1687         struct ib_srq              *srq;
1688         struct ib_srq_attr          attr;
1689         int                         ret;
1690
1691         if (copy_from_user(&cmd, buf, sizeof cmd))
1692                 return -EFAULT;
1693
1694         down(&ib_uverbs_idr_mutex);
1695
1696         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1697         if (!srq || srq->uobject->context != file->ucontext) {
1698                 ret = -EINVAL;
1699                 goto out;
1700         }
1701
1702         attr.max_wr    = cmd.max_wr;
1703         attr.max_sge   = cmd.max_sge;
1704         attr.srq_limit = cmd.srq_limit;
1705
1706         ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
1707
1708 out:
1709         up(&ib_uverbs_idr_mutex);
1710
1711         return ret ? ret : in_len;
1712 }
1713
1714 ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
1715                               const char __user *buf, int in_len,
1716                               int out_len)
1717 {
1718         struct ib_uverbs_destroy_srq      cmd;
1719         struct ib_uverbs_destroy_srq_resp resp;
1720         struct ib_srq                    *srq;
1721         struct ib_uevent_object          *uobj;
1722         int                               ret = -EINVAL;
1723
1724         if (copy_from_user(&cmd, buf, sizeof cmd))
1725                 return -EFAULT;
1726
1727         down(&ib_uverbs_idr_mutex);
1728
1729         memset(&resp, 0, sizeof resp);
1730
1731         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1732         if (!srq || srq->uobject->context != file->ucontext)
1733                 goto out;
1734
1735         uobj = container_of(srq->uobject, struct ib_uevent_object, uobject);
1736
1737         ret = ib_destroy_srq(srq);
1738         if (ret)
1739                 goto out;
1740
1741         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
1742
1743         down(&file->mutex);
1744         list_del(&uobj->uobject.list);
1745         up(&file->mutex);
1746
1747         ib_uverbs_release_uevent(file, uobj);
1748
1749         resp.events_reported = uobj->events_reported;
1750
1751         kfree(uobj);
1752
1753         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1754                          &resp, sizeof resp))
1755                 ret = -EFAULT;
1756
1757 out:
1758         up(&ib_uverbs_idr_mutex);
1759
1760         return ret ? ret : in_len;
1761 }