IB/uverbs: track multicast group membership for userspace QPs
[linux-block.git] / drivers / infiniband / core / uverbs_cmd.c
index 2e959acf2ff16a16d3ee9cf8d81112967b7e1bda..a57d021d435ae2d4f0a694c134d643d2836582c7 100644 (file)
@@ -35,6 +35,7 @@
  */
 
 #include <linux/file.h>
+#include <linux/fs.h>
 
 #include <asm/uaccess.h>
 
@@ -114,7 +115,7 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
 
        kref_get(&file->async_file->ref);
        kref_get(&file->ref);
-       file->ucontext   = ucontext;
+       file->ucontext = ucontext;
 
        fd_install(resp.async_fd, filp);
 
@@ -601,6 +602,7 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
 
        uobj->uobject.user_handle   = cmd.user_handle;
        uobj->uobject.context       = file->ucontext;
+       uobj->uverbs_file           = file;
        uobj->comp_events_reported  = 0;
        uobj->async_events_reported = 0;
        INIT_LIST_HEAD(&uobj->comp_list);
@@ -665,6 +667,93 @@ err:
        return ret;
 }
 
+ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
+                         const char __user *buf, int in_len,
+                         int out_len)
+{
+       struct ib_uverbs_poll_cq       cmd;
+       struct ib_uverbs_poll_cq_resp *resp;
+       struct ib_cq                  *cq;
+       struct ib_wc                  *wc;
+       int                            ret = 0;
+       int                            i;
+       int                            rsize;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
+       if (!wc)
+               return -ENOMEM;
+
+       rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
+       resp = kmalloc(rsize, GFP_KERNEL);
+       if (!resp) {
+               ret = -ENOMEM;
+               goto out_wc;
+       }
+
+       down(&ib_uverbs_idr_mutex);
+       cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
+       if (!cq || cq->uobject->context != file->ucontext) {
+               ret = -EINVAL;
+               goto out;
+       }
+
+       resp->count = ib_poll_cq(cq, cmd.ne, wc);
+
+       for (i = 0; i < resp->count; i++) {
+               resp->wc[i].wr_id          = wc[i].wr_id;
+               resp->wc[i].status         = wc[i].status;
+               resp->wc[i].opcode         = wc[i].opcode;
+               resp->wc[i].vendor_err     = wc[i].vendor_err;
+               resp->wc[i].byte_len       = wc[i].byte_len;
+               resp->wc[i].imm_data       = (__u32 __force) wc[i].imm_data;
+               resp->wc[i].qp_num         = wc[i].qp_num;
+               resp->wc[i].src_qp         = wc[i].src_qp;
+               resp->wc[i].wc_flags       = wc[i].wc_flags;
+               resp->wc[i].pkey_index     = wc[i].pkey_index;
+               resp->wc[i].slid           = wc[i].slid;
+               resp->wc[i].sl             = wc[i].sl;
+               resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
+               resp->wc[i].port_num       = wc[i].port_num;
+       }
+
+       if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
+               ret = -EFAULT;
+
+out:
+       up(&ib_uverbs_idr_mutex);
+       kfree(resp);
+
+out_wc:
+       kfree(wc);
+       return ret ? ret : in_len;
+}
+
+ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
+                               const char __user *buf, int in_len,
+                               int out_len)
+{
+       struct ib_uverbs_req_notify_cq cmd;
+       struct ib_cq                  *cq;
+       int                            ret = -EINVAL;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       down(&ib_uverbs_idr_mutex);
+       cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
+       if (cq && cq->uobject->context == file->ucontext) {
+               ib_req_notify_cq(cq, cmd.solicited_only ?
+                                       IB_CQ_SOLICITED : IB_CQ_NEXT_COMP);
+               ret = in_len;
+       }
+       up(&ib_uverbs_idr_mutex);
+
+       return ret;
+}
+
 ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
                             const char __user *buf, int in_len,
                             int out_len)
@@ -674,7 +763,6 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
        struct ib_cq                    *cq;
        struct ib_ucq_object            *uobj;
        struct ib_uverbs_event_file     *ev_file;
-       struct ib_uverbs_event          *evt, *tmp;
        u64                              user_handle;
        int                              ret = -EINVAL;
 
@@ -703,23 +791,7 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
        list_del(&uobj->uobject.list);
        up(&file->mutex);
 
-       if (ev_file) {
-               spin_lock_irq(&ev_file->lock);
-               list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
-                       list_del(&evt->list);
-                       kfree(evt);
-               }
-               spin_unlock_irq(&ev_file->lock);
-
-               kref_put(&ev_file->ref, ib_uverbs_release_event_file);
-       }
-
-       spin_lock_irq(&file->async_file->lock);
-       list_for_each_entry_safe(evt, tmp, &uobj->async_list, obj_list) {
-               list_del(&evt->list);
-               kfree(evt);
-       }
-       spin_unlock_irq(&file->async_file->lock);
+       ib_uverbs_release_ucq(file, ev_file, uobj);
 
        resp.comp_events_reported  = uobj->comp_events_reported;
        resp.async_events_reported = uobj->async_events_reported;
@@ -743,7 +815,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        struct ib_uverbs_create_qp      cmd;
        struct ib_uverbs_create_qp_resp resp;
        struct ib_udata                 udata;
-       struct ib_uevent_object        *uobj;
+       struct ib_uqp_object           *uobj;
        struct ib_pd                   *pd;
        struct ib_cq                   *scq, *rcq;
        struct ib_srq                  *srq;
@@ -794,10 +866,11 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        attr.cap.max_recv_sge    = cmd.max_recv_sge;
        attr.cap.max_inline_data = cmd.max_inline_data;
 
-       uobj->uobject.user_handle = cmd.user_handle;
-       uobj->uobject.context     = file->ucontext;
-       uobj->events_reported     = 0;
-       INIT_LIST_HEAD(&uobj->event_list);
+       uobj->uevent.uobject.user_handle = cmd.user_handle;
+       uobj->uevent.uobject.context     = file->ucontext;
+       uobj->uevent.events_reported     = 0;
+       INIT_LIST_HEAD(&uobj->uevent.event_list);
+       INIT_LIST_HEAD(&uobj->mcast_list);
 
        qp = pd->device->create_qp(pd, &attr, &udata);
        if (IS_ERR(qp)) {
@@ -810,7 +883,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        qp->send_cq       = attr.send_cq;
        qp->recv_cq       = attr.recv_cq;
        qp->srq           = attr.srq;
-       qp->uobject       = &uobj->uobject;
+       qp->uobject       = &uobj->uevent.uobject;
        qp->event_handler = attr.event_handler;
        qp->qp_context    = attr.qp_context;
        qp->qp_type       = attr.qp_type;
@@ -829,14 +902,19 @@ retry:
                goto err_destroy;
        }
 
-       ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uobject.id);
+       ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uevent.uobject.id);
 
        if (ret == -EAGAIN)
                goto retry;
        if (ret)
                goto err_destroy;
 
-       resp.qp_handle = uobj->uobject.id;
+       resp.qp_handle       = uobj->uevent.uobject.id;
+       resp.max_recv_sge    = attr.cap.max_recv_sge;
+       resp.max_send_sge    = attr.cap.max_send_sge;
+       resp.max_recv_wr     = attr.cap.max_recv_wr;
+       resp.max_send_wr     = attr.cap.max_send_wr;
+       resp.max_inline_data = attr.cap.max_inline_data;
 
        if (copy_to_user((void __user *) (unsigned long) cmd.response,
                         &resp, sizeof resp)) {
@@ -845,7 +923,7 @@ retry:
        }
 
        down(&file->mutex);
-       list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
+       list_add_tail(&uobj->uevent.uobject.list, &file->ucontext->qp_list);
        up(&file->mutex);
 
        up(&ib_uverbs_idr_mutex);
@@ -853,7 +931,7 @@ retry:
        return in_len;
 
 err_idr:
-       idr_remove(&ib_uverbs_qp_idr, uobj->uobject.id);
+       idr_remove(&ib_uverbs_qp_idr, uobj->uevent.uobject.id);
 
 err_destroy:
        ib_destroy_qp(qp);
@@ -955,8 +1033,7 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        struct ib_uverbs_destroy_qp      cmd;
        struct ib_uverbs_destroy_qp_resp resp;
        struct ib_qp                    *qp;
-       struct ib_uevent_object         *uobj;
-       struct ib_uverbs_event          *evt, *tmp;
+       struct ib_uqp_object            *uobj;
        int                              ret = -EINVAL;
 
        if (copy_from_user(&cmd, buf, sizeof cmd))
@@ -970,7 +1047,12 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        if (!qp || qp->uobject->context != file->ucontext)
                goto out;
 
-       uobj = container_of(qp->uobject, struct ib_uevent_object, uobject);
+       uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
+
+       if (!list_empty(&uobj->mcast_list)) {
+               ret = -EBUSY;
+               goto out;
+       }
 
        ret = ib_destroy_qp(qp);
        if (ret)
@@ -979,17 +1061,12 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
 
        down(&file->mutex);
-       list_del(&uobj->uobject.list);
+       list_del(&uobj->uevent.uobject.list);
        up(&file->mutex);
 
-       spin_lock_irq(&file->async_file->lock);
-       list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
-               list_del(&evt->list);
-               kfree(evt);
-       }
-       spin_unlock_irq(&file->async_file->lock);
+       ib_uverbs_release_uevent(file, &uobj->uevent);
 
-       resp.events_reported = uobj->events_reported;
+       resp.events_reported = uobj->uevent.events_reported;
 
        kfree(uobj);
 
@@ -1003,12 +1080,476 @@ out:
        return ret ? ret : in_len;
 }
 
+ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
+                            const char __user *buf, int in_len,
+                            int out_len)
+{
+       struct ib_uverbs_post_send      cmd;
+       struct ib_uverbs_post_send_resp resp;
+       struct ib_uverbs_send_wr       *user_wr;
+       struct ib_send_wr              *wr = NULL, *last, *next, *bad_wr;
+       struct ib_qp                   *qp;
+       int                             i, sg_ind;
+       ssize_t                         ret = -EINVAL;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       if (in_len < sizeof cmd + cmd.wqe_size * cmd.wr_count +
+           cmd.sge_count * sizeof (struct ib_uverbs_sge))
+               return -EINVAL;
+
+       if (cmd.wqe_size < sizeof (struct ib_uverbs_send_wr))
+               return -EINVAL;
+
+       user_wr = kmalloc(cmd.wqe_size, GFP_KERNEL);
+       if (!user_wr)
+               return -ENOMEM;
+
+       down(&ib_uverbs_idr_mutex);
+
+       qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
+       if (!qp || qp->uobject->context != file->ucontext)
+               goto out;
+
+       sg_ind = 0;
+       last = NULL;
+       for (i = 0; i < cmd.wr_count; ++i) {
+               if (copy_from_user(user_wr,
+                                  buf + sizeof cmd + i * cmd.wqe_size,
+                                  cmd.wqe_size)) {
+                       ret = -EFAULT;
+                       goto out;
+               }
+
+               if (user_wr->num_sge + sg_ind > cmd.sge_count) {
+                       ret = -EINVAL;
+                       goto out;
+               }
+
+               next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
+                              user_wr->num_sge * sizeof (struct ib_sge),
+                              GFP_KERNEL);
+               if (!next) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
+
+               if (!last)
+                       wr = next;
+               else
+                       last->next = next;
+               last = next;
+
+               next->next       = NULL;
+               next->wr_id      = user_wr->wr_id;
+               next->num_sge    = user_wr->num_sge;
+               next->opcode     = user_wr->opcode;
+               next->send_flags = user_wr->send_flags;
+               next->imm_data   = (__be32 __force) user_wr->imm_data;
+
+               if (qp->qp_type == IB_QPT_UD) {
+                       next->wr.ud.ah = idr_find(&ib_uverbs_ah_idr,
+                                                 user_wr->wr.ud.ah);
+                       if (!next->wr.ud.ah) {
+                               ret = -EINVAL;
+                               goto out;
+                       }
+                       next->wr.ud.remote_qpn  = user_wr->wr.ud.remote_qpn;
+                       next->wr.ud.remote_qkey = user_wr->wr.ud.remote_qkey;
+               } else {
+                       switch (next->opcode) {
+                       case IB_WR_RDMA_WRITE:
+                       case IB_WR_RDMA_WRITE_WITH_IMM:
+                       case IB_WR_RDMA_READ:
+                               next->wr.rdma.remote_addr =
+                                       user_wr->wr.rdma.remote_addr;
+                               next->wr.rdma.rkey        =
+                                       user_wr->wr.rdma.rkey;
+                               break;
+                       case IB_WR_ATOMIC_CMP_AND_SWP:
+                       case IB_WR_ATOMIC_FETCH_AND_ADD:
+                               next->wr.atomic.remote_addr =
+                                       user_wr->wr.atomic.remote_addr;
+                               next->wr.atomic.compare_add =
+                                       user_wr->wr.atomic.compare_add;
+                               next->wr.atomic.swap = user_wr->wr.atomic.swap;
+                               next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
+                               break;
+                       default:
+                               break;
+                       }
+               }
+
+               if (next->num_sge) {
+                       next->sg_list = (void *) next +
+                               ALIGN(sizeof *next, sizeof (struct ib_sge));
+                       if (copy_from_user(next->sg_list,
+                                          buf + sizeof cmd +
+                                          cmd.wr_count * cmd.wqe_size +
+                                          sg_ind * sizeof (struct ib_sge),
+                                          next->num_sge * sizeof (struct ib_sge))) {
+                               ret = -EFAULT;
+                               goto out;
+                       }
+                       sg_ind += next->num_sge;
+               } else
+                       next->sg_list = NULL;
+       }
+
+       resp.bad_wr = 0;
+       ret = qp->device->post_send(qp, wr, &bad_wr);
+       if (ret)
+               for (next = wr; next; next = next->next) {
+                       ++resp.bad_wr;
+                       if (next == bad_wr)
+                               break;
+               }
+
+       if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                        &resp, sizeof resp))
+               ret = -EFAULT;
+
+out:
+       up(&ib_uverbs_idr_mutex);
+
+       while (wr) {
+               next = wr->next;
+               kfree(wr);
+               wr = next;
+       }
+
+       kfree(user_wr);
+
+       return ret ? ret : in_len;
+}
+
+static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf,
+                                                   int in_len,
+                                                   u32 wr_count,
+                                                   u32 sge_count,
+                                                   u32 wqe_size)
+{
+       struct ib_uverbs_recv_wr *user_wr;
+       struct ib_recv_wr        *wr = NULL, *last, *next;
+       int                       sg_ind;
+       int                       i;
+       int                       ret;
+
+       if (in_len < wqe_size * wr_count +
+           sge_count * sizeof (struct ib_uverbs_sge))
+               return ERR_PTR(-EINVAL);
+
+       if (wqe_size < sizeof (struct ib_uverbs_recv_wr))
+               return ERR_PTR(-EINVAL);
+
+       user_wr = kmalloc(wqe_size, GFP_KERNEL);
+       if (!user_wr)
+               return ERR_PTR(-ENOMEM);
+
+       sg_ind = 0;
+       last = NULL;
+       for (i = 0; i < wr_count; ++i) {
+               if (copy_from_user(user_wr, buf + i * wqe_size,
+                                  wqe_size)) {
+                       ret = -EFAULT;
+                       goto err;
+               }
+
+               if (user_wr->num_sge + sg_ind > sge_count) {
+                       ret = -EINVAL;
+                       goto err;
+               }
+
+               next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
+                              user_wr->num_sge * sizeof (struct ib_sge),
+                              GFP_KERNEL);
+               if (!next) {
+                       ret = -ENOMEM;
+                       goto err;
+               }
+
+               if (!last)
+                       wr = next;
+               else
+                       last->next = next;
+               last = next;
+
+               next->next       = NULL;
+               next->wr_id      = user_wr->wr_id;
+               next->num_sge    = user_wr->num_sge;
+
+               if (next->num_sge) {
+                       next->sg_list = (void *) next +
+                               ALIGN(sizeof *next, sizeof (struct ib_sge));
+                       if (copy_from_user(next->sg_list,
+                                          buf + wr_count * wqe_size +
+                                          sg_ind * sizeof (struct ib_sge),
+                                          next->num_sge * sizeof (struct ib_sge))) {
+                               ret = -EFAULT;
+                               goto err;
+                       }
+                       sg_ind += next->num_sge;
+               } else
+                       next->sg_list = NULL;
+       }
+
+       kfree(user_wr);
+       return wr;
+
+err:
+       kfree(user_wr);
+
+       while (wr) {
+               next = wr->next;
+               kfree(wr);
+               wr = next;
+       }
+
+       return ERR_PTR(ret);
+}
+
+ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
+                            const char __user *buf, int in_len,
+                            int out_len)
+{
+       struct ib_uverbs_post_recv      cmd;
+       struct ib_uverbs_post_recv_resp resp;
+       struct ib_recv_wr              *wr, *next, *bad_wr;
+       struct ib_qp                   *qp;
+       ssize_t                         ret = -EINVAL;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
+                                      in_len - sizeof cmd, cmd.wr_count,
+                                      cmd.sge_count, cmd.wqe_size);
+       if (IS_ERR(wr))
+               return PTR_ERR(wr);
+
+       down(&ib_uverbs_idr_mutex);
+
+       qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
+       if (!qp || qp->uobject->context != file->ucontext)
+               goto out;
+
+       resp.bad_wr = 0;
+       ret = qp->device->post_recv(qp, wr, &bad_wr);
+       if (ret)
+               for (next = wr; next; next = next->next) {
+                       ++resp.bad_wr;
+                       if (next == bad_wr)
+                               break;
+               }
+
+
+       if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                        &resp, sizeof resp))
+               ret = -EFAULT;
+
+out:
+       up(&ib_uverbs_idr_mutex);
+
+       while (wr) {
+               next = wr->next;
+               kfree(wr);
+               wr = next;
+       }
+
+       return ret ? ret : in_len;
+}
+
+ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
+                            const char __user *buf, int in_len,
+                            int out_len)
+{
+       struct ib_uverbs_post_srq_recv      cmd;
+       struct ib_uverbs_post_srq_recv_resp resp;
+       struct ib_recv_wr                  *wr, *next, *bad_wr;
+       struct ib_srq                      *srq;
+       ssize_t                             ret = -EINVAL;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
+                                      in_len - sizeof cmd, cmd.wr_count,
+                                      cmd.sge_count, cmd.wqe_size);
+       if (IS_ERR(wr))
+               return PTR_ERR(wr);
+
+       down(&ib_uverbs_idr_mutex);
+
+       srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
+       if (!srq || srq->uobject->context != file->ucontext)
+               goto out;
+
+       resp.bad_wr = 0;
+       ret = srq->device->post_srq_recv(srq, wr, &bad_wr);
+       if (ret)
+               for (next = wr; next; next = next->next) {
+                       ++resp.bad_wr;
+                       if (next == bad_wr)
+                               break;
+               }
+
+
+       if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                        &resp, sizeof resp))
+               ret = -EFAULT;
+
+out:
+       up(&ib_uverbs_idr_mutex);
+
+       while (wr) {
+               next = wr->next;
+               kfree(wr);
+               wr = next;
+       }
+
+       return ret ? ret : in_len;
+}
+
+ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
+                           const char __user *buf, int in_len,
+                           int out_len)
+{
+       struct ib_uverbs_create_ah       cmd;
+       struct ib_uverbs_create_ah_resp  resp;
+       struct ib_uobject               *uobj;
+       struct ib_pd                    *pd;
+       struct ib_ah                    *ah;
+       struct ib_ah_attr               attr;
+       int ret;
+
+       if (out_len < sizeof resp)
+               return -ENOSPC;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
+       if (!uobj)
+               return -ENOMEM;
+
+       down(&ib_uverbs_idr_mutex);
+
+       pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
+       if (!pd || pd->uobject->context != file->ucontext) {
+               ret = -EINVAL;
+               goto err_up;
+       }
+
+       uobj->user_handle = cmd.user_handle;
+       uobj->context     = file->ucontext;
+
+       attr.dlid              = cmd.attr.dlid;
+       attr.sl                = cmd.attr.sl;
+       attr.src_path_bits     = cmd.attr.src_path_bits;
+       attr.static_rate       = cmd.attr.static_rate;
+       attr.port_num          = cmd.attr.port_num;
+       attr.grh.flow_label    = cmd.attr.grh.flow_label;
+       attr.grh.sgid_index    = cmd.attr.grh.sgid_index;
+       attr.grh.hop_limit     = cmd.attr.grh.hop_limit;
+       attr.grh.traffic_class = cmd.attr.grh.traffic_class;
+       memcpy(attr.grh.dgid.raw, cmd.attr.grh.dgid, 16);
+
+       ah = ib_create_ah(pd, &attr);
+       if (IS_ERR(ah)) {
+               ret = PTR_ERR(ah);
+               goto err_up;
+       }
+
+       ah->uobject = uobj;
+
+retry:
+       if (!idr_pre_get(&ib_uverbs_ah_idr, GFP_KERNEL)) {
+               ret = -ENOMEM;
+               goto err_destroy;
+       }
+
+       ret = idr_get_new(&ib_uverbs_ah_idr, ah, &uobj->id);
+
+       if (ret == -EAGAIN)
+               goto retry;
+       if (ret)
+               goto err_destroy;
+
+       resp.ah_handle = uobj->id;
+
+       if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                        &resp, sizeof resp)) {
+               ret = -EFAULT;
+               goto err_idr;
+       }
+
+       down(&file->mutex);
+       list_add_tail(&uobj->list, &file->ucontext->ah_list);
+       up(&file->mutex);
+
+       up(&ib_uverbs_idr_mutex);
+
+       return in_len;
+
+err_idr:
+       idr_remove(&ib_uverbs_ah_idr, uobj->id);
+
+err_destroy:
+       ib_destroy_ah(ah);
+
+err_up:
+       up(&ib_uverbs_idr_mutex);
+
+       kfree(uobj);
+       return ret;
+}
+
+ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
+                            const char __user *buf, int in_len, int out_len)
+{
+       struct ib_uverbs_destroy_ah cmd;
+       struct ib_ah               *ah;
+       struct ib_uobject          *uobj;
+       int                         ret = -EINVAL;
+
+       if (copy_from_user(&cmd, buf, sizeof cmd))
+               return -EFAULT;
+
+       down(&ib_uverbs_idr_mutex);
+
+       ah = idr_find(&ib_uverbs_ah_idr, cmd.ah_handle);
+       if (!ah || ah->uobject->context != file->ucontext)
+               goto out;
+
+       uobj = ah->uobject;
+
+       ret = ib_destroy_ah(ah);
+       if (ret)
+               goto out;
+
+       idr_remove(&ib_uverbs_ah_idr, cmd.ah_handle);
+
+       down(&file->mutex);
+       list_del(&uobj->list);
+       up(&file->mutex);
+
+       kfree(uobj);
+
+out:
+       up(&ib_uverbs_idr_mutex);
+
+       return ret ? ret : in_len;
+}
+
 ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
                               const char __user *buf, int in_len,
                               int out_len)
 {
        struct ib_uverbs_attach_mcast cmd;
        struct ib_qp                 *qp;
+       struct ib_uqp_object         *uobj;
+       struct ib_uverbs_mcast_entry *mcast;
        int                           ret = -EINVAL;
 
        if (copy_from_user(&cmd, buf, sizeof cmd))
@@ -1017,9 +1558,36 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
        down(&ib_uverbs_idr_mutex);
 
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
-       if (qp && qp->uobject->context == file->ucontext)
-               ret = ib_attach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
+       if (!qp || qp->uobject->context != file->ucontext)
+               goto out;
+
+       uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
+
+       list_for_each_entry(mcast, &uobj->mcast_list, list)
+               if (cmd.mlid == mcast->lid &&
+                   !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
+                       ret = 0;
+                       goto out;
+               }
 
+       mcast = kmalloc(sizeof *mcast, GFP_KERNEL);
+       if (!mcast) {
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       mcast->lid = cmd.mlid;
+       memcpy(mcast->gid.raw, cmd.gid, sizeof mcast->gid.raw);
+
+       ret = ib_attach_mcast(qp, &mcast->gid, cmd.mlid);
+       if (!ret) {
+               uobj = container_of(qp->uobject, struct ib_uqp_object,
+                                   uevent.uobject);
+               list_add_tail(&mcast->list, &uobj->mcast_list);
+       } else
+               kfree(mcast);
+
+out:
        up(&ib_uverbs_idr_mutex);
 
        return ret ? ret : in_len;
@@ -1030,7 +1598,9 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
                               int out_len)
 {
        struct ib_uverbs_detach_mcast cmd;
+       struct ib_uqp_object         *uobj;
        struct ib_qp                 *qp;
+       struct ib_uverbs_mcast_entry *mcast;
        int                           ret = -EINVAL;
 
        if (copy_from_user(&cmd, buf, sizeof cmd))
@@ -1039,9 +1609,24 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
        down(&ib_uverbs_idr_mutex);
 
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
-       if (qp && qp->uobject->context == file->ucontext)
-               ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
+       if (!qp || qp->uobject->context != file->ucontext)
+               goto out;
 
+       ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
+       if (ret)
+               goto out;
+
+       uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
+
+       list_for_each_entry(mcast, &uobj->mcast_list, list)
+               if (cmd.mlid == mcast->lid &&
+                   !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
+                       list_del(&mcast->list);
+                       kfree(mcast);
+                       break;
+               }
+
+out:
        up(&ib_uverbs_idr_mutex);
 
        return ret ? ret : in_len;
@@ -1173,7 +1758,6 @@ ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
        }
 
        attr.max_wr    = cmd.max_wr;
-       attr.max_sge   = cmd.max_sge;
        attr.srq_limit = cmd.srq_limit;
 
        ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
@@ -1192,7 +1776,6 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        struct ib_uverbs_destroy_srq_resp resp;
        struct ib_srq                    *srq;
        struct ib_uevent_object          *uobj;
-       struct ib_uverbs_event           *evt, *tmp;
        int                               ret = -EINVAL;
 
        if (copy_from_user(&cmd, buf, sizeof cmd))
@@ -1218,12 +1801,7 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        list_del(&uobj->uobject.list);
        up(&file->mutex);
 
-       spin_lock_irq(&file->async_file->lock);
-       list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
-               list_del(&evt->list);
-               kfree(evt);
-       }
-       spin_unlock_irq(&file->async_file->lock);
+       ib_uverbs_release_uevent(file, uobj);
 
        resp.events_reported = uobj->events_reported;