SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/infiniband/core/uverbs_cmd.c

   1 /*
   2  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
   3  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   4  *
   5  * This software is available to you under a choice of one of two
   6  * licenses.  You may choose to be licensed under the terms of the GNU
   7  * General Public License (GPL) Version 2, available from the file
   8  * COPYING in the main directory of this source tree, or the
   9  * OpenIB.org BSD license below:
  10  *
  11  *     Redistribution and use in source and binary forms, with or
  12  *     without modification, are permitted provided that the following
  13  *     conditions are met:
  14  *
  15  *      - Redistributions of source code must retain the above
  16  *        copyright notice, this list of conditions and the following
  17  *        disclaimer.
  18  *
  19  *      - Redistributions in binary form must reproduce the above
  20  *        copyright notice, this list of conditions and the following
  21  *        disclaimer in the documentation and/or other materials
  22  *        provided with the distribution.
  23  *
  24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  25  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  26  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  27  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  28  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  29  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  30  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  31  * SOFTWARE.
  32  *
  33  * $Id: uverbs_cmd.c 2708 2005-06-24 17:27:21Z roland $
  34  */
  35
  36 #include <asm/uaccess.h>
  37
  38 #include "uverbs.h"
  39
  40 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
  41         do {                                                            \
  42                 (udata)->inbuf  = (void __user *) (ibuf);               \
  43                 (udata)->outbuf = (void __user *) (obuf);               \
  44                 (udata)->inlen  = (ilen);                               \
  45                 (udata)->outlen = (olen);                               \
  46         } while (0)
  47
  48 ssize_t ib_uverbs_query_params(struct ib_uverbs_file *file,
  49                                const char __user *buf,
  50                                int in_len, int out_len)
  51 {
  52         struct ib_uverbs_query_params      cmd;
  53         struct ib_uverbs_query_params_resp resp;
  54
  55         if (out_len < sizeof resp)
  56                 return -ENOSPC;
  57
  58         if (copy_from_user(&cmd, buf, sizeof cmd))
  59                 return -EFAULT;
  60
  61         memset(&resp, 0, sizeof resp);
  62
  63         resp.num_cq_events = file->device->num_comp;
  64
  65         if (copy_to_user((void __user *) (unsigned long) cmd.response, &resp, sizeof resp))
  66             return -EFAULT;
  67
  68         return in_len;
  69 }
  70
  71 ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
  72                               const char __user *buf,
  73                               int in_len, int out_len)
  74 {
  75         struct ib_uverbs_get_context      cmd;
  76         struct ib_uverbs_get_context_resp resp;
  77         struct ib_udata                   udata;
  78         struct ib_device                 *ibdev = file->device->ib_dev;
  79         int i;
  80         int ret = in_len;
  81
  82         if (out_len < sizeof resp)
  83                 return -ENOSPC;
  84
  85         if (copy_from_user(&cmd, buf, sizeof cmd))
  86                 return -EFAULT;
  87
  88         INIT_UDATA(&udata, buf + sizeof cmd,
  89                    (unsigned long) cmd.response + sizeof resp,
  90                    in_len - sizeof cmd, out_len - sizeof resp);
  91
  92         file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);
  93         if (IS_ERR(file->ucontext)) {
  94                 ret = PTR_ERR(file->ucontext);
  95                 file->ucontext = NULL;
  96                 return ret;
  97         }
  98
  99         file->ucontext->device = ibdev;
 100         INIT_LIST_HEAD(&file->ucontext->pd_list);
 101         INIT_LIST_HEAD(&file->ucontext->mr_list);
 102         INIT_LIST_HEAD(&file->ucontext->mw_list);
 103         INIT_LIST_HEAD(&file->ucontext->cq_list);
 104         INIT_LIST_HEAD(&file->ucontext->qp_list);
 105         INIT_LIST_HEAD(&file->ucontext->srq_list);
 106         INIT_LIST_HEAD(&file->ucontext->ah_list);
 107         spin_lock_init(&file->ucontext->lock);
 108
 109         resp.async_fd = file->async_file.fd;
 110         for (i = 0; i < file->device->num_comp; ++i)
 111                 if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
 112                                  i * sizeof (__u32),
 113                                  &file->comp_file[i].fd, sizeof (__u32)))
 114                         goto err;
 115
 116         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 117                          &resp, sizeof resp))
 118                 goto err;
 119
 120         return in_len;
 121
 122 err:
 123         ibdev->dealloc_ucontext(file->ucontext);
 124         file->ucontext = NULL;
 125
 126         return -EFAULT;
 127 }
 128
 129 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
 130                                const char __user *buf,
 131                                int in_len, int out_len)
 132 {
 133         struct ib_uverbs_query_device      cmd;
 134         struct ib_uverbs_query_device_resp resp;
 135         struct ib_device_attr              attr;
 136         int                                ret;
 137
 138         if (out_len < sizeof resp)
 139                 return -ENOSPC;
 140
 141         if (copy_from_user(&cmd, buf, sizeof cmd))
 142                 return -EFAULT;
 143
 144         ret = ib_query_device(file->device->ib_dev, &attr);
 145         if (ret)
 146                 return ret;
 147
 148         memset(&resp, 0, sizeof resp);
 149
 150         resp.fw_ver                    = attr.fw_ver;
 151         resp.node_guid                 = attr.node_guid;
 152         resp.sys_image_guid            = attr.sys_image_guid;
 153         resp.max_mr_size               = attr.max_mr_size;
 154         resp.page_size_cap             = attr.page_size_cap;
 155         resp.vendor_id                 = attr.vendor_id;
 156         resp.vendor_part_id            = attr.vendor_part_id;
 157         resp.hw_ver                    = attr.hw_ver;
 158         resp.max_qp                    = attr.max_qp;
 159         resp.max_qp_wr                 = attr.max_qp_wr;
 160         resp.device_cap_flags          = attr.device_cap_flags;
 161         resp.max_sge                   = attr.max_sge;
 162         resp.max_sge_rd                = attr.max_sge_rd;
 163         resp.max_cq                    = attr.max_cq;
 164         resp.max_cqe                   = attr.max_cqe;
 165         resp.max_mr                    = attr.max_mr;
 166         resp.max_pd                    = attr.max_pd;
 167         resp.max_qp_rd_atom            = attr.max_qp_rd_atom;
 168         resp.max_ee_rd_atom            = attr.max_ee_rd_atom;
 169         resp.max_res_rd_atom           = attr.max_res_rd_atom;
 170         resp.max_qp_init_rd_atom       = attr.max_qp_init_rd_atom;
 171         resp.max_ee_init_rd_atom       = attr.max_ee_init_rd_atom;
 172         resp.atomic_cap                = attr.atomic_cap;
 173         resp.max_ee                    = attr.max_ee;
 174         resp.max_rdd                   = attr.max_rdd;
 175         resp.max_mw                    = attr.max_mw;
 176         resp.max_raw_ipv6_qp           = attr.max_raw_ipv6_qp;
 177         resp.max_raw_ethy_qp           = attr.max_raw_ethy_qp;
 178         resp.max_mcast_grp             = attr.max_mcast_grp;
 179         resp.max_mcast_qp_attach       = attr.max_mcast_qp_attach;
 180         resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
 181         resp.max_ah                    = attr.max_ah;
 182         resp.max_fmr                   = attr.max_fmr;
 183         resp.max_map_per_fmr           = attr.max_map_per_fmr;
 184         resp.max_srq                   = attr.max_srq;
 185         resp.max_srq_wr                = attr.max_srq_wr;
 186         resp.max_srq_sge               = attr.max_srq_sge;
 187         resp.max_pkeys                 = attr.max_pkeys;
 188         resp.local_ca_ack_delay        = attr.local_ca_ack_delay;
 189         resp.phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
 190
 191         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 192                          &resp, sizeof resp))
 193                 return -EFAULT;
 194
 195         return in_len;
 196 }
 197
 198 ssize_t ib_uverbs_query_port(struct ib_uverbs_file *file,
 199                              const char __user *buf,
 200                              int in_len, int out_len)
 201 {
 202         struct ib_uverbs_query_port      cmd;
 203         struct ib_uverbs_query_port_resp resp;
 204         struct ib_port_attr              attr;
 205         int                              ret;
 206
 207         if (out_len < sizeof resp)
 208                 return -ENOSPC;
 209
 210         if (copy_from_user(&cmd, buf, sizeof cmd))
 211                 return -EFAULT;
 212
 213         ret = ib_query_port(file->device->ib_dev, cmd.port_num, &attr);
 214         if (ret)
 215                 return ret;
 216
 217         memset(&resp, 0, sizeof resp);
 218
 219         resp.state           = attr.state;
 220         resp.max_mtu         = attr.max_mtu;
 221         resp.active_mtu      = attr.active_mtu;
 222         resp.gid_tbl_len     = attr.gid_tbl_len;
 223         resp.port_cap_flags  = attr.port_cap_flags;
 224         resp.max_msg_sz      = attr.max_msg_sz;
 225         resp.bad_pkey_cntr   = attr.bad_pkey_cntr;
 226         resp.qkey_viol_cntr  = attr.qkey_viol_cntr;
 227         resp.pkey_tbl_len    = attr.pkey_tbl_len;
 228         resp.lid             = attr.lid;
 229         resp.sm_lid          = attr.sm_lid;
 230         resp.lmc             = attr.lmc;
 231         resp.max_vl_num      = attr.max_vl_num;
 232         resp.sm_sl           = attr.sm_sl;
 233         resp.subnet_timeout  = attr.subnet_timeout;
 234         resp.init_type_reply = attr.init_type_reply;
 235         resp.active_width    = attr.active_width;
 236         resp.active_speed    = attr.active_speed;
 237         resp.phys_state      = attr.phys_state;
 238
 239         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 240                          &resp, sizeof resp))
 241                 return -EFAULT;
 242
 243         return in_len;
 244 }
 245
 246 ssize_t ib_uverbs_query_gid(struct ib_uverbs_file *file,
 247                             const char __user *buf,
 248                             int in_len, int out_len)
 249 {
 250         struct ib_uverbs_query_gid      cmd;
 251         struct ib_uverbs_query_gid_resp resp;
 252         int                             ret;
 253
 254         if (out_len < sizeof resp)
 255                 return -ENOSPC;
 256
 257         if (copy_from_user(&cmd, buf, sizeof cmd))
 258                 return -EFAULT;
 259
 260         memset(&resp, 0, sizeof resp);
 261
 262         ret = ib_query_gid(file->device->ib_dev, cmd.port_num, cmd.index,
 263                            (union ib_gid *) resp.gid);
 264         if (ret)
 265                 return ret;
 266
 267         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 268                          &resp, sizeof resp))
 269                 return -EFAULT;
 270
 271         return in_len;
 272 }
 273
 274 ssize_t ib_uverbs_query_pkey(struct ib_uverbs_file *file,
 275                              const char __user *buf,
 276                              int in_len, int out_len)
 277 {
 278         struct ib_uverbs_query_pkey      cmd;
 279         struct ib_uverbs_query_pkey_resp resp;
 280         int                              ret;
 281
 282         if (out_len < sizeof resp)
 283                 return -ENOSPC;
 284
 285         if (copy_from_user(&cmd, buf, sizeof cmd))
 286                 return -EFAULT;
 287
 288         memset(&resp, 0, sizeof resp);
 289
 290         ret = ib_query_pkey(file->device->ib_dev, cmd.port_num, cmd.index,
 291                             &resp.pkey);
 292         if (ret)
 293                 return ret;
 294
 295         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 296                          &resp, sizeof resp))
 297                 return -EFAULT;
 298
 299         return in_len;
 300 }
 301
 302 ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
 303                            const char __user *buf,
 304                            int in_len, int out_len)
 305 {
 306         struct ib_uverbs_alloc_pd      cmd;
 307         struct ib_uverbs_alloc_pd_resp resp;
 308         struct ib_udata                udata;
 309         struct ib_uobject             *uobj;
 310         struct ib_pd                  *pd;
 311         int                            ret;
 312
 313         if (out_len < sizeof resp)
 314                 return -ENOSPC;
 315
 316         if (copy_from_user(&cmd, buf, sizeof cmd))
 317                 return -EFAULT;
 318
 319         INIT_UDATA(&udata, buf + sizeof cmd,
 320                    (unsigned long) cmd.response + sizeof resp,
 321                    in_len - sizeof cmd, out_len - sizeof resp);
 322
 323         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 324         if (!uobj)
 325                 return -ENOMEM;
 326
 327         uobj->context = file->ucontext;
 328
 329         pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
 330                                             file->ucontext, &udata);
 331         if (IS_ERR(pd)) {
 332                 ret = PTR_ERR(pd);
 333                 goto err;
 334         }
 335
 336         pd->device  = file->device->ib_dev;
 337         pd->uobject = uobj;
 338         atomic_set(&pd->usecnt, 0);
 339
 340 retry:
 341         if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
 342                 ret = -ENOMEM;
 343                 goto err_pd;
 344         }
 345
 346         down(&ib_uverbs_idr_mutex);
 347         ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);
 348         up(&ib_uverbs_idr_mutex);
 349
 350         if (ret == -EAGAIN)
 351                 goto retry;
 352         if (ret)
 353                 goto err_pd;
 354
 355         spin_lock_irq(&file->ucontext->lock);
 356         list_add_tail(&uobj->list, &file->ucontext->pd_list);
 357         spin_unlock_irq(&file->ucontext->lock);
 358
 359         memset(&resp, 0, sizeof resp);
 360         resp.pd_handle = uobj->id;
 361
 362         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 363                          &resp, sizeof resp)) {
 364                 ret = -EFAULT;
 365                 goto err_list;
 366         }
 367
 368         return in_len;
 369
 370 err_list:
 371         spin_lock_irq(&file->ucontext->lock);
 372         list_del(&uobj->list);
 373         spin_unlock_irq(&file->ucontext->lock);
 374
 375         down(&ib_uverbs_idr_mutex);
 376         idr_remove(&ib_uverbs_pd_idr, uobj->id);
 377         up(&ib_uverbs_idr_mutex);
 378
 379 err_pd:
 380         ib_dealloc_pd(pd);
 381
 382 err:
 383         kfree(uobj);
 384         return ret;
 385 }
 386
 387 ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 388                              const char __user *buf,
 389                              int in_len, int out_len)
 390 {
 391         struct ib_uverbs_dealloc_pd cmd;
 392         struct ib_pd               *pd;
 393         struct ib_uobject          *uobj;
 394         int                         ret = -EINVAL;
 395
 396         if (copy_from_user(&cmd, buf, sizeof cmd))
 397                 return -EFAULT;
 398
 399         down(&ib_uverbs_idr_mutex);
 400
 401         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 402         if (!pd || pd->uobject->context != file->ucontext)
 403                 goto out;
 404
 405         uobj = pd->uobject;
 406
 407         ret = ib_dealloc_pd(pd);
 408         if (ret)
 409                 goto out;
 410
 411         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 412
 413         spin_lock_irq(&file->ucontext->lock);
 414         list_del(&uobj->list);
 415         spin_unlock_irq(&file->ucontext->lock);
 416
 417         kfree(uobj);
 418
 419 out:
 420         up(&ib_uverbs_idr_mutex);
 421
 422         return ret ? ret : in_len;
 423 }
 424
 425 ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
 426                          const char __user *buf, int in_len,
 427                          int out_len)
 428 {
 429         struct ib_uverbs_reg_mr      cmd;
 430         struct ib_uverbs_reg_mr_resp resp;
 431         struct ib_udata              udata;
 432         struct ib_umem_object       *obj;
 433         struct ib_pd                *pd;
 434         struct ib_mr                *mr;
 435         int                          ret;
 436
 437         if (out_len < sizeof resp)
 438                 return -ENOSPC;
 439
 440         if (copy_from_user(&cmd, buf, sizeof cmd))
 441                 return -EFAULT;
 442
 443         INIT_UDATA(&udata, buf + sizeof cmd,
 444                    (unsigned long) cmd.response + sizeof resp,
 445                    in_len - sizeof cmd, out_len - sizeof resp);
 446
 447         if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
 448                 return -EINVAL;
 449
 450         obj = kmalloc(sizeof *obj, GFP_KERNEL);
 451         if (!obj)
 452                 return -ENOMEM;
 453
 454         obj->uobject.context = file->ucontext;
 455
 456         /*
 457          * We ask for writable memory if any access flags other than
 458          * "remote read" are set.  "Local write" and "remote write"
 459          * obviously require write access.  "Remote atomic" can do
 460          * things like fetch and add, which will modify memory, and
 461          * "MW bind" can change permissions by binding a window.
 462          */
 463         ret = ib_umem_get(file->device->ib_dev, &obj->umem,
 464                           (void *) (unsigned long) cmd.start, cmd.length,
 465                           !!(cmd.access_flags & ~IB_ACCESS_REMOTE_READ));
 466         if (ret)
 467                 goto err_free;
 468
 469         obj->umem.virt_base = cmd.hca_va;
 470
 471         down(&ib_uverbs_idr_mutex);
 472
 473         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 474         if (!pd || pd->uobject->context != file->ucontext) {
 475                 ret = -EINVAL;
 476                 goto err_up;
 477         }
 478
 479         if (!pd->device->reg_user_mr) {
 480                 ret = -ENOSYS;
 481                 goto err_up;
 482         }
 483
 484         mr = pd->device->reg_user_mr(pd, &obj->umem, cmd.access_flags, &udata);
 485         if (IS_ERR(mr)) {
 486                 ret = PTR_ERR(mr);
 487                 goto err_up;
 488         }
 489
 490         mr->device  = pd->device;
 491         mr->pd      = pd;
 492         mr->uobject = &obj->uobject;
 493         atomic_inc(&pd->usecnt);
 494         atomic_set(&mr->usecnt, 0);
 495
 496         memset(&resp, 0, sizeof resp);
 497         resp.lkey = mr->lkey;
 498         resp.rkey = mr->rkey;
 499
 500 retry:
 501         if (!idr_pre_get(&ib_uverbs_mr_idr, GFP_KERNEL)) {
 502                 ret = -ENOMEM;
 503                 goto err_unreg;
 504         }
 505
 506         ret = idr_get_new(&ib_uverbs_mr_idr, mr, &obj->uobject.id);
 507
 508         if (ret == -EAGAIN)
 509                 goto retry;
 510         if (ret)
 511                 goto err_unreg;
 512
 513         resp.mr_handle = obj->uobject.id;
 514
 515         spin_lock_irq(&file->ucontext->lock);
 516         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
 517         spin_unlock_irq(&file->ucontext->lock);
 518
 519         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 520                          &resp, sizeof resp)) {
 521                 ret = -EFAULT;
 522                 goto err_list;
 523         }
 524
 525         up(&ib_uverbs_idr_mutex);
 526
 527         return in_len;
 528
 529 err_list:
 530         spin_lock_irq(&file->ucontext->lock);
 531         list_del(&obj->uobject.list);
 532         spin_unlock_irq(&file->ucontext->lock);
 533
 534 err_unreg:
 535         ib_dereg_mr(mr);
 536
 537 err_up:
 538         up(&ib_uverbs_idr_mutex);
 539
 540         ib_umem_release(file->device->ib_dev, &obj->umem);
 541
 542 err_free:
 543         kfree(obj);
 544         return ret;
 545 }
 546
 547 ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 548                            const char __user *buf, int in_len,
 549                            int out_len)
 550 {
 551         struct ib_uverbs_dereg_mr cmd;
 552         struct ib_mr             *mr;
 553         struct ib_umem_object    *memobj;
 554         int                       ret = -EINVAL;
 555
 556         if (copy_from_user(&cmd, buf, sizeof cmd))
 557                 return -EFAULT;
 558
 559         down(&ib_uverbs_idr_mutex);
 560
 561         mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
 562         if (!mr || mr->uobject->context != file->ucontext)
 563                 goto out;
 564
 565         memobj = container_of(mr->uobject, struct ib_umem_object, uobject);
 566
 567         ret = ib_dereg_mr(mr);
 568         if (ret)
 569                 goto out;
 570
 571         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 572
 573         spin_lock_irq(&file->ucontext->lock);
 574         list_del(&memobj->uobject.list);
 575         spin_unlock_irq(&file->ucontext->lock);
 576
 577         ib_umem_release(file->device->ib_dev, &memobj->umem);
 578         kfree(memobj);
 579
 580 out:
 581         up(&ib_uverbs_idr_mutex);
 582
 583         return ret ? ret : in_len;
 584 }
 585
 586 ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
 587                             const char __user *buf, int in_len,
 588                             int out_len)
 589 {
 590         struct ib_uverbs_create_cq      cmd;
 591         struct ib_uverbs_create_cq_resp resp;
 592         struct ib_udata                 udata;
 593         struct ib_uobject              *uobj;
 594         struct ib_cq                   *cq;
 595         int                             ret;
 596
 597         if (out_len < sizeof resp)
 598                 return -ENOSPC;
 599
 600         if (copy_from_user(&cmd, buf, sizeof cmd))
 601                 return -EFAULT;
 602
 603         INIT_UDATA(&udata, buf + sizeof cmd,
 604                    (unsigned long) cmd.response + sizeof resp,
 605                    in_len - sizeof cmd, out_len - sizeof resp);
 606
 607         if (cmd.event_handler >= file->device->num_comp)
 608                 return -EINVAL;
 609
 610         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 611         if (!uobj)
 612                 return -ENOMEM;
 613
 614         uobj->user_handle = cmd.user_handle;
 615         uobj->context     = file->ucontext;
 616
 617         cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,
 618                                              file->ucontext, &udata);
 619         if (IS_ERR(cq)) {
 620                 ret = PTR_ERR(cq);
 621                 goto err;
 622         }
 623
 624         cq->device        = file->device->ib_dev;
 625         cq->uobject       = uobj;
 626         cq->comp_handler  = ib_uverbs_comp_handler;
 627         cq->event_handler = ib_uverbs_cq_event_handler;
 628         cq->cq_context    = file;
 629         atomic_set(&cq->usecnt, 0);
 630
 631 retry:
 632         if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
 633                 ret = -ENOMEM;
 634                 goto err_cq;
 635         }
 636
 637         down(&ib_uverbs_idr_mutex);
 638         ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->id);
 639         up(&ib_uverbs_idr_mutex);
 640
 641         if (ret == -EAGAIN)
 642                 goto retry;
 643         if (ret)
 644                 goto err_cq;
 645
 646         spin_lock_irq(&file->ucontext->lock);
 647         list_add_tail(&uobj->list, &file->ucontext->cq_list);
 648         spin_unlock_irq(&file->ucontext->lock);
 649
 650         memset(&resp, 0, sizeof resp);
 651         resp.cq_handle = uobj->id;
 652         resp.cqe       = cq->cqe;
 653
 654         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 655                          &resp, sizeof resp)) {
 656                 ret = -EFAULT;
 657                 goto err_list;
 658         }
 659
 660         return in_len;
 661
 662 err_list:
 663         spin_lock_irq(&file->ucontext->lock);
 664         list_del(&uobj->list);
 665         spin_unlock_irq(&file->ucontext->lock);
 666
 667         down(&ib_uverbs_idr_mutex);
 668         idr_remove(&ib_uverbs_cq_idr, uobj->id);
 669         up(&ib_uverbs_idr_mutex);
 670
 671 err_cq:
 672         ib_destroy_cq(cq);
 673
 674 err:
 675         kfree(uobj);
 676         return ret;
 677 }
 678
 679 ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 680                              const char __user *buf, int in_len,
 681                              int out_len)
 682 {
 683         struct ib_uverbs_destroy_cq cmd;
 684         struct ib_cq               *cq;
 685         struct ib_uobject          *uobj;
 686         int                         ret = -EINVAL;
 687
 688         if (copy_from_user(&cmd, buf, sizeof cmd))
 689                 return -EFAULT;
 690
 691         down(&ib_uverbs_idr_mutex);
 692
 693         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 694         if (!cq || cq->uobject->context != file->ucontext)
 695                 goto out;
 696
 697         uobj = cq->uobject;
 698
 699         ret = ib_destroy_cq(cq);
 700         if (ret)
 701                 goto out;
 702
 703         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 704
 705         spin_lock_irq(&file->ucontext->lock);
 706         list_del(&uobj->list);
 707         spin_unlock_irq(&file->ucontext->lock);
 708
 709         kfree(uobj);
 710
 711 out:
 712         up(&ib_uverbs_idr_mutex);
 713
 714         return ret ? ret : in_len;
 715 }
 716
 717 ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
 718                             const char __user *buf, int in_len,
 719                             int out_len)
 720 {
 721         struct ib_uverbs_create_qp      cmd;
 722         struct ib_uverbs_create_qp_resp resp;
 723         struct ib_udata                 udata;
 724         struct ib_uobject              *uobj;
 725         struct ib_pd                   *pd;
 726         struct ib_cq                   *scq, *rcq;
 727         struct ib_srq                  *srq;
 728         struct ib_qp                   *qp;
 729         struct ib_qp_init_attr          attr;
 730         int ret;
 731
 732         if (out_len < sizeof resp)
 733                 return -ENOSPC;
 734
 735         if (copy_from_user(&cmd, buf, sizeof cmd))
 736                 return -EFAULT;
 737
 738         INIT_UDATA(&udata, buf + sizeof cmd,
 739                    (unsigned long) cmd.response + sizeof resp,
 740                    in_len - sizeof cmd, out_len - sizeof resp);
 741
 742         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 743         if (!uobj)
 744                 return -ENOMEM;
 745
 746         down(&ib_uverbs_idr_mutex);
 747
 748         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 749         scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
 750         rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
 751         srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
 752
 753         if (!pd  || pd->uobject->context  != file->ucontext ||
 754             !scq || scq->uobject->context != file->ucontext ||
 755             !rcq || rcq->uobject->context != file->ucontext ||
 756             (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
 757                 ret = -EINVAL;
 758                 goto err_up;
 759         }
 760
 761         attr.event_handler = ib_uverbs_qp_event_handler;
 762         attr.qp_context    = file;
 763         attr.send_cq       = scq;
 764         attr.recv_cq       = rcq;
 765         attr.srq           = srq;
 766         attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
 767         attr.qp_type       = cmd.qp_type;
 768
 769         attr.cap.max_send_wr     = cmd.max_send_wr;
 770         attr.cap.max_recv_wr     = cmd.max_recv_wr;
 771         attr.cap.max_send_sge    = cmd.max_send_sge;
 772         attr.cap.max_recv_sge    = cmd.max_recv_sge;
 773         attr.cap.max_inline_data = cmd.max_inline_data;
 774
 775         uobj->user_handle = cmd.user_handle;
 776         uobj->context     = file->ucontext;
 777
 778         qp = pd->device->create_qp(pd, &attr, &udata);
 779         if (IS_ERR(qp)) {
 780                 ret = PTR_ERR(qp);
 781                 goto err_up;
 782         }
 783
 784         qp->device        = pd->device;
 785         qp->pd            = pd;
 786         qp->send_cq       = attr.send_cq;
 787         qp->recv_cq       = attr.recv_cq;
 788         qp->srq           = attr.srq;
 789         qp->uobject       = uobj;
 790         qp->event_handler = attr.event_handler;
 791         qp->qp_context    = attr.qp_context;
 792         qp->qp_type       = attr.qp_type;
 793         atomic_inc(&pd->usecnt);
 794         atomic_inc(&attr.send_cq->usecnt);
 795         atomic_inc(&attr.recv_cq->usecnt);
 796         if (attr.srq)
 797                 atomic_inc(&attr.srq->usecnt);
 798
 799         memset(&resp, 0, sizeof resp);
 800         resp.qpn = qp->qp_num;
 801
 802 retry:
 803         if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {
 804                 ret = -ENOMEM;
 805                 goto err_destroy;
 806         }
 807
 808         ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->id);
 809
 810         if (ret == -EAGAIN)
 811                 goto retry;
 812         if (ret)
 813                 goto err_destroy;
 814
 815         resp.qp_handle = uobj->id;
 816
 817         spin_lock_irq(&file->ucontext->lock);
 818         list_add_tail(&uobj->list, &file->ucontext->qp_list);
 819         spin_unlock_irq(&file->ucontext->lock);
 820
 821         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 822                          &resp, sizeof resp)) {
 823                 ret = -EFAULT;
 824                 goto err_list;
 825         }
 826
 827         up(&ib_uverbs_idr_mutex);
 828
 829         return in_len;
 830
 831 err_list:
 832         spin_lock_irq(&file->ucontext->lock);
 833         list_del(&uobj->list);
 834         spin_unlock_irq(&file->ucontext->lock);
 835
 836 err_destroy:
 837         ib_destroy_qp(qp);
 838
 839 err_up:
 840         up(&ib_uverbs_idr_mutex);
 841
 842         kfree(uobj);
 843         return ret;
 844 }
 845
 846 ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 847                             const char __user *buf, int in_len,
 848                             int out_len)
 849 {
 850         struct ib_uverbs_modify_qp cmd;
 851         struct ib_qp              *qp;
 852         struct ib_qp_attr         *attr;
 853         int                        ret;
 854
 855         if (copy_from_user(&cmd, buf, sizeof cmd))
 856                 return -EFAULT;
 857
 858         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 859         if (!attr)
 860                 return -ENOMEM;
 861
 862         down(&ib_uverbs_idr_mutex);
 863
 864         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 865         if (!qp || qp->uobject->context != file->ucontext) {
 866                 ret = -EINVAL;
 867                 goto out;
 868         }
 869
 870         attr->qp_state            = cmd.qp_state;
 871         attr->cur_qp_state        = cmd.cur_qp_state;
 872         attr->path_mtu            = cmd.path_mtu;
 873         attr->path_mig_state      = cmd.path_mig_state;
 874         attr->qkey                = cmd.qkey;
 875         attr->rq_psn              = cmd.rq_psn;
 876         attr->sq_psn              = cmd.sq_psn;
 877         attr->dest_qp_num         = cmd.dest_qp_num;
 878         attr->qp_access_flags     = cmd.qp_access_flags;
 879         attr->pkey_index          = cmd.pkey_index;
 880         attr->alt_pkey_index      = cmd.pkey_index;
 881         attr->en_sqd_async_notify = cmd.en_sqd_async_notify;
 882         attr->max_rd_atomic       = cmd.max_rd_atomic;
 883         attr->max_dest_rd_atomic  = cmd.max_dest_rd_atomic;
 884         attr->min_rnr_timer       = cmd.min_rnr_timer;
 885         attr->port_num            = cmd.port_num;
 886         attr->timeout             = cmd.timeout;
 887         attr->retry_cnt           = cmd.retry_cnt;
 888         attr->rnr_retry           = cmd.rnr_retry;
 889         attr->alt_port_num        = cmd.alt_port_num;
 890         attr->alt_timeout         = cmd.alt_timeout;
 891
 892         memcpy(attr->ah_attr.grh.dgid.raw, cmd.dest.dgid, 16);
 893         attr->ah_attr.grh.flow_label        = cmd.dest.flow_label;
 894         attr->ah_attr.grh.sgid_index        = cmd.dest.sgid_index;
 895         attr->ah_attr.grh.hop_limit         = cmd.dest.hop_limit;
 896         attr->ah_attr.grh.traffic_class     = cmd.dest.traffic_class;
 897         attr->ah_attr.dlid                  = cmd.dest.dlid;
 898         attr->ah_attr.sl                    = cmd.dest.sl;
 899         attr->ah_attr.src_path_bits         = cmd.dest.src_path_bits;
 900         attr->ah_attr.static_rate           = cmd.dest.static_rate;
 901         attr->ah_attr.ah_flags              = cmd.dest.is_global ? IB_AH_GRH : 0;
 902         attr->ah_attr.port_num              = cmd.dest.port_num;
 903
 904         memcpy(attr->alt_ah_attr.grh.dgid.raw, cmd.alt_dest.dgid, 16);
 905         attr->alt_ah_attr.grh.flow_label    = cmd.alt_dest.flow_label;
 906         attr->alt_ah_attr.grh.sgid_index    = cmd.alt_dest.sgid_index;
 907         attr->alt_ah_attr.grh.hop_limit     = cmd.alt_dest.hop_limit;
 908         attr->alt_ah_attr.grh.traffic_class = cmd.alt_dest.traffic_class;
 909         attr->alt_ah_attr.dlid              = cmd.alt_dest.dlid;
 910         attr->alt_ah_attr.sl                = cmd.alt_dest.sl;
 911         attr->alt_ah_attr.src_path_bits     = cmd.alt_dest.src_path_bits;
 912         attr->alt_ah_attr.static_rate       = cmd.alt_dest.static_rate;
 913         attr->alt_ah_attr.ah_flags          = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
 914         attr->alt_ah_attr.port_num          = cmd.alt_dest.port_num;
 915
 916         ret = ib_modify_qp(qp, attr, cmd.attr_mask);
 917         if (ret)
 918                 goto out;
 919
 920         ret = in_len;
 921
 922 out:
 923         up(&ib_uverbs_idr_mutex);
 924         kfree(attr);
 925
 926         return ret;
 927 }
 928
 929 ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
 930                              const char __user *buf, int in_len,
 931                              int out_len)
 932 {
 933         struct ib_uverbs_destroy_qp cmd;
 934         struct ib_qp               *qp;
 935         struct ib_uobject          *uobj;
 936         int                         ret = -EINVAL;
 937
 938         if (copy_from_user(&cmd, buf, sizeof cmd))
 939                 return -EFAULT;
 940
 941         down(&ib_uverbs_idr_mutex);
 942
 943         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 944         if (!qp || qp->uobject->context != file->ucontext)
 945                 goto out;
 946
 947         uobj = qp->uobject;
 948
 949         ret = ib_destroy_qp(qp);
 950         if (ret)
 951                 goto out;
 952
 953         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
 954
 955         spin_lock_irq(&file->ucontext->lock);
 956         list_del(&uobj->list);
 957         spin_unlock_irq(&file->ucontext->lock);
 958
 959         kfree(uobj);
 960
 961 out:
 962         up(&ib_uverbs_idr_mutex);
 963
 964         return ret ? ret : in_len;
 965 }
 966
 967 ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
 968                                const char __user *buf, int in_len,
 969                                int out_len)
 970 {
 971         struct ib_uverbs_attach_mcast cmd;
 972         struct ib_qp                 *qp;
 973         int                           ret = -EINVAL;
 974
 975         if (copy_from_user(&cmd, buf, sizeof cmd))
 976                 return -EFAULT;
 977
 978         down(&ib_uverbs_idr_mutex);
 979
 980         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 981         if (qp && qp->uobject->context == file->ucontext)
 982                 ret = ib_attach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
 983
 984         up(&ib_uverbs_idr_mutex);
 985
 986         return ret ? ret : in_len;
 987 }
 988
 989 ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
 990                                const char __user *buf, int in_len,
 991                                int out_len)
 992 {
 993         struct ib_uverbs_detach_mcast cmd;
 994         struct ib_qp                 *qp;
 995         int                           ret = -EINVAL;
 996
 997         if (copy_from_user(&cmd, buf, sizeof cmd))
 998                 return -EFAULT;
 999
1000         down(&ib_uverbs_idr_mutex);
1001
1002         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1003         if (qp && qp->uobject->context == file->ucontext)
1004                 ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1005
1006         up(&ib_uverbs_idr_mutex);
1007
1008         return ret ? ret : in_len;
1009 }
1010
1011 ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
1012                              const char __user *buf, int in_len,
1013                              int out_len)
1014 {
1015         struct ib_uverbs_create_srq      cmd;
1016         struct ib_uverbs_create_srq_resp resp;
1017         struct ib_udata                  udata;
1018         struct ib_uobject               *uobj;
1019         struct ib_pd                    *pd;
1020         struct ib_srq                   *srq;
1021         struct ib_srq_init_attr          attr;
1022         int ret;
1023
1024         if (out_len < sizeof resp)
1025                 return -ENOSPC;
1026
1027         if (copy_from_user(&cmd, buf, sizeof cmd))
1028                 return -EFAULT;
1029
1030         INIT_UDATA(&udata, buf + sizeof cmd,
1031                    (unsigned long) cmd.response + sizeof resp,
1032                    in_len - sizeof cmd, out_len - sizeof resp);
1033
1034         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1035         if (!uobj)
1036                 return -ENOMEM;
1037
1038         down(&ib_uverbs_idr_mutex);
1039
1040         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1041
1042         if (!pd || pd->uobject->context != file->ucontext) {
1043                 ret = -EINVAL;
1044                 goto err_up;
1045         }
1046
1047         attr.event_handler  = ib_uverbs_srq_event_handler;
1048         attr.srq_context    = file;
1049         attr.attr.max_wr    = cmd.max_wr;
1050         attr.attr.max_sge   = cmd.max_sge;
1051         attr.attr.srq_limit = cmd.srq_limit;
1052
1053         uobj->user_handle = cmd.user_handle;
1054         uobj->context     = file->ucontext;
1055
1056         srq = pd->device->create_srq(pd, &attr, &udata);
1057         if (IS_ERR(srq)) {
1058                 ret = PTR_ERR(srq);
1059                 goto err_up;
1060         }
1061
1062         srq->device        = pd->device;
1063         srq->pd            = pd;
1064         srq->uobject       = uobj;
1065         srq->event_handler = attr.event_handler;
1066         srq->srq_context   = attr.srq_context;
1067         atomic_inc(&pd->usecnt);
1068         atomic_set(&srq->usecnt, 0);
1069
1070         memset(&resp, 0, sizeof resp);
1071
1072 retry:
1073         if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
1074                 ret = -ENOMEM;
1075                 goto err_destroy;
1076         }
1077
1078         ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->id);
1079
1080         if (ret == -EAGAIN)
1081                 goto retry;
1082         if (ret)
1083                 goto err_destroy;
1084
1085         resp.srq_handle = uobj->id;
1086
1087         spin_lock_irq(&file->ucontext->lock);
1088         list_add_tail(&uobj->list, &file->ucontext->srq_list);
1089         spin_unlock_irq(&file->ucontext->lock);
1090
1091         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1092                          &resp, sizeof resp)) {
1093                 ret = -EFAULT;
1094                 goto err_list;
1095         }
1096
1097         up(&ib_uverbs_idr_mutex);
1098
1099         return in_len;
1100
1101 err_list:
1102         spin_lock_irq(&file->ucontext->lock);
1103         list_del(&uobj->list);
1104         spin_unlock_irq(&file->ucontext->lock);
1105
1106 err_destroy:
1107         ib_destroy_srq(srq);
1108
1109 err_up:
1110         up(&ib_uverbs_idr_mutex);
1111
1112         kfree(uobj);
1113         return ret;
1114 }
1115
1116 ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
1117                              const char __user *buf, int in_len,
1118                              int out_len)
1119 {
1120         struct ib_uverbs_modify_srq cmd;
1121         struct ib_srq              *srq;
1122         struct ib_srq_attr          attr;
1123         int                         ret;
1124
1125         if (copy_from_user(&cmd, buf, sizeof cmd))
1126                 return -EFAULT;
1127
1128         down(&ib_uverbs_idr_mutex);
1129
1130         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1131         if (!srq || srq->uobject->context != file->ucontext) {
1132                 ret = -EINVAL;
1133                 goto out;
1134         }
1135
1136         attr.max_wr    = cmd.max_wr;
1137         attr.max_sge   = cmd.max_sge;
1138         attr.srq_limit = cmd.srq_limit;
1139
1140         ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
1141
1142 out:
1143         up(&ib_uverbs_idr_mutex);
1144
1145         return ret ? ret : in_len;
1146 }
1147
1148 ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
1149                               const char __user *buf, int in_len,
1150                               int out_len)
1151 {
1152         struct ib_uverbs_destroy_srq cmd;
1153         struct ib_srq               *srq;
1154         struct ib_uobject           *uobj;
1155         int                          ret = -EINVAL;
1156
1157         if (copy_from_user(&cmd, buf, sizeof cmd))
1158                 return -EFAULT;
1159
1160         down(&ib_uverbs_idr_mutex);
1161
1162         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1163         if (!srq || srq->uobject->context != file->ucontext)
1164                 goto out;
1165
1166         uobj = srq->uobject;
1167
1168         ret = ib_destroy_srq(srq);
1169         if (ret)
1170                 goto out;
1171
1172         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
1173
1174         spin_lock_irq(&file->ucontext->lock);
1175         list_del(&uobj->list);
1176         spin_unlock_irq(&file->ucontext->lock);
1177
1178         kfree(uobj);
1179
1180 out:
1181         up(&ib_uverbs_idr_mutex);
1182
1183         return ret ? ret : in_len;
1184 }