projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
IB/mthca: Convert to use ib_modify_qp_is_ok()
[deliverable/linux.git] / drivers / infiniband / core / uverbs_cmd.c
CommitLineData
bc38a6ab
RD		 1/*
2 * Copyright (c) 2005 Topspin Communications. All rights reserved.
33b9b3ee 3 * Copyright (c) 2005, 2006 Cisco Systems. All rights reserved.
eb9d3cd5 4 * Copyright (c) 2005 PathScale, Inc. All rights reserved.
bc38a6ab
RD		 5 *
6 * This software is available to you under a choice of one of two
7 * licenses. You may choose to be licensed under the terms of the GNU
8 * General Public License (GPL) Version 2, available from the file
9 * COPYING in the main directory of this source tree, or the
10 * OpenIB.org BSD license below:
11 *
12 * Redistribution and use in source and binary forms, with or
13 * without modification, are permitted provided that the following
14 * conditions are met:
15 *
16 * - Redistributions of source code must retain the above
17 * copyright notice, this list of conditions and the following
18 * disclaimer.
19 *
20 * - Redistributions in binary form must reproduce the above
21 * copyright notice, this list of conditions and the following
22 * disclaimer in the documentation and/or other materials
23 * provided with the distribution.
24 *
25 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
26 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
27 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
28 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
29 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
30 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
31 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
32 * SOFTWARE.
33 *
34 * $Id: uverbs_cmd.c 2708 2005-06-24 17:27:21Z roland $
35 */
36
6b73597e 37#include <linux/file.h>
70a30e16 38#include <linux/fs.h>
6b73597e 39
bc38a6ab
RD		 40#include <asm/uaccess.h>
41
42#include "uverbs.h"
43
44#define INIT_UDATA(udata, ibuf, obuf, ilen, olen) \
45 do { \
46 (udata)->inbuf = (void __user *) (ibuf); \
47 (udata)->outbuf = (void __user *) (obuf); \
48 (udata)->inlen = (ilen); \
49 (udata)->outlen = (olen); \
50 } while (0)
51
bc38a6ab
RD		 52ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
53 const char __user *buf,
54 int in_len, int out_len)
55{
56 struct ib_uverbs_get_context cmd;
57 struct ib_uverbs_get_context_resp resp;
58 struct ib_udata udata;
59 struct ib_device *ibdev = file->device->ib_dev;
63c47c28 60 struct ib_ucontext *ucontext;
6b73597e 61 struct file *filp;
63c47c28 62 int ret;
bc38a6ab
RD		 63
64 if (out_len < sizeof resp)
65 return -ENOSPC;
66
67 if (copy_from_user(&cmd, buf, sizeof cmd))
68 return -EFAULT;
69
95ed644f 70 mutex_lock(&file->mutex);
63c47c28
RD		 71
72 if (file->ucontext) {
73 ret = -EINVAL;
74 goto err;
75 }
76
bc38a6ab
RD		 77 INIT_UDATA(&udata, buf + sizeof cmd,
78 (unsigned long) cmd.response + sizeof resp,
79 in_len - sizeof cmd, out_len - sizeof resp);
80
63c47c28
RD		 81 ucontext = ibdev->alloc_ucontext(ibdev, &udata);
82 if (IS_ERR(ucontext))
83 return PTR_ERR(file->ucontext);
bc38a6ab 84
63c47c28
RD		 85 ucontext->device = ibdev;
86 INIT_LIST_HEAD(&ucontext->pd_list);
87 INIT_LIST_HEAD(&ucontext->mr_list);
88 INIT_LIST_HEAD(&ucontext->mw_list);
89 INIT_LIST_HEAD(&ucontext->cq_list);
90 INIT_LIST_HEAD(&ucontext->qp_list);
91 INIT_LIST_HEAD(&ucontext->srq_list);
92 INIT_LIST_HEAD(&ucontext->ah_list);
bc38a6ab 93
6b73597e
RD		 94 resp.num_comp_vectors = file->device->num_comp_vectors;
95
96 filp = ib_uverbs_alloc_event_file(file, 1, &resp.async_fd);
97 if (IS_ERR(filp)) {
98 ret = PTR_ERR(filp);
99 goto err_free;
100 }
bc38a6ab
RD		 101
102 if (copy_to_user((void __user *) (unsigned long) cmd.response,
63c47c28
RD		 103 &resp, sizeof resp)) {
104 ret = -EFAULT;
6b73597e 105 goto err_file;
63c47c28
RD		 106 }
107
6b73597e
RD		 108 file->async_file = filp->private_data;
109
110 INIT_IB_EVENT_HANDLER(&file->event_handler, file->device->ib_dev,
111 ib_uverbs_event_handler);
112 ret = ib_register_event_handler(&file->event_handler);
113 if (ret)
114 goto err_file;
115
116 kref_get(&file->async_file->ref);
117 kref_get(&file->ref);
70a30e16 118 file->ucontext = ucontext;
6b73597e
RD		 119
120 fd_install(resp.async_fd, filp);
121
95ed644f 122 mutex_unlock(&file->mutex);
bc38a6ab
RD		 123
124 return in_len;
125
6b73597e
RD		 126err_file:
127 put_unused_fd(resp.async_fd);
128 fput(filp);
129
63c47c28
RD		 130err_free:
131 ibdev->dealloc_ucontext(ucontext);
bc38a6ab 132
63c47c28 133err:
95ed644f 134 mutex_unlock(&file->mutex);
63c47c28 135 return ret;
bc38a6ab
RD		 136}
137
138ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
139 const char __user *buf,
140 int in_len, int out_len)
141{
142 struct ib_uverbs_query_device cmd;
143 struct ib_uverbs_query_device_resp resp;
144 struct ib_device_attr attr;
145 int ret;
146
147 if (out_len < sizeof resp)
148 return -ENOSPC;
149
150 if (copy_from_user(&cmd, buf, sizeof cmd))
151 return -EFAULT;
152
153 ret = ib_query_device(file->device->ib_dev, &attr);
154 if (ret)
155 return ret;
156
157 memset(&resp, 0, sizeof resp);
158
159 resp.fw_ver = attr.fw_ver;
cf311cd4 160 resp.node_guid = file->device->ib_dev->node_guid;
bc38a6ab
RD		 161 resp.sys_image_guid = attr.sys_image_guid;
162 resp.max_mr_size = attr.max_mr_size;
163 resp.page_size_cap = attr.page_size_cap;
164 resp.vendor_id = attr.vendor_id;
165 resp.vendor_part_id = attr.vendor_part_id;
166 resp.hw_ver = attr.hw_ver;
167 resp.max_qp = attr.max_qp;
168 resp.max_qp_wr = attr.max_qp_wr;
169 resp.device_cap_flags = attr.device_cap_flags;
170 resp.max_sge = attr.max_sge;
171 resp.max_sge_rd = attr.max_sge_rd;
172 resp.max_cq = attr.max_cq;
173 resp.max_cqe = attr.max_cqe;
174 resp.max_mr = attr.max_mr;
175 resp.max_pd = attr.max_pd;
176 resp.max_qp_rd_atom = attr.max_qp_rd_atom;
177 resp.max_ee_rd_atom = attr.max_ee_rd_atom;
178 resp.max_res_rd_atom = attr.max_res_rd_atom;
179 resp.max_qp_init_rd_atom = attr.max_qp_init_rd_atom;
180 resp.max_ee_init_rd_atom = attr.max_ee_init_rd_atom;
181 resp.atomic_cap = attr.atomic_cap;
182 resp.max_ee = attr.max_ee;
183 resp.max_rdd = attr.max_rdd;
184 resp.max_mw = attr.max_mw;
185 resp.max_raw_ipv6_qp = attr.max_raw_ipv6_qp;
186 resp.max_raw_ethy_qp = attr.max_raw_ethy_qp;
187 resp.max_mcast_grp = attr.max_mcast_grp;
188 resp.max_mcast_qp_attach = attr.max_mcast_qp_attach;
189 resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
190 resp.max_ah = attr.max_ah;
191 resp.max_fmr = attr.max_fmr;
192 resp.max_map_per_fmr = attr.max_map_per_fmr;
193 resp.max_srq = attr.max_srq;
194 resp.max_srq_wr = attr.max_srq_wr;
195 resp.max_srq_sge = attr.max_srq_sge;
196 resp.max_pkeys = attr.max_pkeys;
197 resp.local_ca_ack_delay = attr.local_ca_ack_delay;
198 resp.phys_port_cnt = file->device->ib_dev->phys_port_cnt;
199
200 if (copy_to_user((void __user *) (unsigned long) cmd.response,
201 &resp, sizeof resp))
202 return -EFAULT;
203
204 return in_len;
205}
206
207ssize_t ib_uverbs_query_port(struct ib_uverbs_file *file,
208 const char __user *buf,
209 int in_len, int out_len)
210{
211 struct ib_uverbs_query_port cmd;
212 struct ib_uverbs_query_port_resp resp;
213 struct ib_port_attr attr;
214 int ret;
215
216 if (out_len < sizeof resp)
217 return -ENOSPC;
218
219 if (copy_from_user(&cmd, buf, sizeof cmd))
220 return -EFAULT;
221
222 ret = ib_query_port(file->device->ib_dev, cmd.port_num, &attr);
223 if (ret)
224 return ret;
225
226 memset(&resp, 0, sizeof resp);
227
228 resp.state = attr.state;
229 resp.max_mtu = attr.max_mtu;
230 resp.active_mtu = attr.active_mtu;
231 resp.gid_tbl_len = attr.gid_tbl_len;
232 resp.port_cap_flags = attr.port_cap_flags;
233 resp.max_msg_sz = attr.max_msg_sz;
234 resp.bad_pkey_cntr = attr.bad_pkey_cntr;
235 resp.qkey_viol_cntr = attr.qkey_viol_cntr;
236 resp.pkey_tbl_len = attr.pkey_tbl_len;
237 resp.lid = attr.lid;
238 resp.sm_lid = attr.sm_lid;
239 resp.lmc = attr.lmc;
240 resp.max_vl_num = attr.max_vl_num;
241 resp.sm_sl = attr.sm_sl;
242 resp.subnet_timeout = attr.subnet_timeout;
243 resp.init_type_reply = attr.init_type_reply;
244 resp.active_width = attr.active_width;
245 resp.active_speed = attr.active_speed;
246 resp.phys_state = attr.phys_state;
247
248 if (copy_to_user((void __user *) (unsigned long) cmd.response,
249 &resp, sizeof resp))
250 return -EFAULT;
251
252 return in_len;
253}
254
bc38a6ab
RD		 255ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
256 const char __user *buf,
257 int in_len, int out_len)
258{
259 struct ib_uverbs_alloc_pd cmd;
260 struct ib_uverbs_alloc_pd_resp resp;
261 struct ib_udata udata;
262 struct ib_uobject *uobj;
263 struct ib_pd *pd;
264 int ret;
265
266 if (out_len < sizeof resp)
267 return -ENOSPC;
268
269 if (copy_from_user(&cmd, buf, sizeof cmd))
270 return -EFAULT;
271
272 INIT_UDATA(&udata, buf + sizeof cmd,
273 (unsigned long) cmd.response + sizeof resp,
274 in_len - sizeof cmd, out_len - sizeof resp);
275
276 uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
277 if (!uobj)
278 return -ENOMEM;
279
280 uobj->context = file->ucontext;
281
282 pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
283 file->ucontext, &udata);
284 if (IS_ERR(pd)) {
285 ret = PTR_ERR(pd);
286 goto err;
287 }
288
289 pd->device = file->device->ib_dev;
290 pd->uobject = uobj;
291 atomic_set(&pd->usecnt, 0);
292
95ed644f 293 mutex_lock(&ib_uverbs_idr_mutex);
eb9d3cd5 294
bc38a6ab
RD		 295retry:
296 if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
297 ret = -ENOMEM;
eb9d3cd5 298 goto err_up;
bc38a6ab
RD		 299 }
300
bc38a6ab 301 ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);
bc38a6ab
RD		 302
303 if (ret == -EAGAIN)
304 goto retry;
305 if (ret)
eb9d3cd5 306 goto err_up;
bc38a6ab
RD		 307
308 memset(&resp, 0, sizeof resp);
309 resp.pd_handle = uobj->id;
310
311 if (copy_to_user((void __user *) (unsigned long) cmd.response,
312 &resp, sizeof resp)) {
313 ret = -EFAULT;
eb9d3cd5 314 goto err_idr;
bc38a6ab
RD		 315 }
316
95ed644f 317 mutex_lock(&file->mutex);
eb9d3cd5 318 list_add_tail(&uobj->list, &file->ucontext->pd_list);
95ed644f 319 mutex_unlock(&file->mutex);
bc38a6ab 320
95ed644f 321 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab 322
eb9d3cd5
RD		 323 return in_len;
324
325err_idr:
326 idr_remove(&ib_uverbs_pd_idr, uobj->id);
327
328err_up:
95ed644f 329 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 330 ib_dealloc_pd(pd);
331
332err:
333 kfree(uobj);
334 return ret;
335}
336
337ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
338 const char __user *buf,
339 int in_len, int out_len)
340{
341 struct ib_uverbs_dealloc_pd cmd;
342 struct ib_pd *pd;
343 struct ib_uobject *uobj;
344 int ret = -EINVAL;
345
346 if (copy_from_user(&cmd, buf, sizeof cmd))
347 return -EFAULT;
348
95ed644f 349 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 350
351 pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
352 if (!pd || pd->uobject->context != file->ucontext)
353 goto out;
354
355 uobj = pd->uobject;
356
357 ret = ib_dealloc_pd(pd);
358 if (ret)
359 goto out;
360
361 idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
362
95ed644f 363 mutex_lock(&file->mutex);
bc38a6ab 364 list_del(&uobj->list);
95ed644f 365 mutex_unlock(&file->mutex);
bc38a6ab
RD		 366
367 kfree(uobj);
368
369out:
95ed644f 370 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 371
372 return ret ? ret : in_len;
373}
374
375ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
376 const char __user *buf, int in_len,
377 int out_len)
378{
379 struct ib_uverbs_reg_mr cmd;
380 struct ib_uverbs_reg_mr_resp resp;
381 struct ib_udata udata;
382 struct ib_umem_object *obj;
383 struct ib_pd *pd;
384 struct ib_mr *mr;
385 int ret;
386
387 if (out_len < sizeof resp)
388 return -ENOSPC;
389
390 if (copy_from_user(&cmd, buf, sizeof cmd))
391 return -EFAULT;
392
393 INIT_UDATA(&udata, buf + sizeof cmd,
394 (unsigned long) cmd.response + sizeof resp,
395 in_len - sizeof cmd, out_len - sizeof resp);
396
397 if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
398 return -EINVAL;
399
f575394f
RD		 400 /*
401 * Local write permission is required if remote write or
402 * remote atomic permission is also requested.
403 */
404 if (cmd.access_flags & (IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_REMOTE_WRITE) &&
405 !(cmd.access_flags & IB_ACCESS_LOCAL_WRITE))
406 return -EINVAL;
407
bc38a6ab
RD		 408 obj = kmalloc(sizeof *obj, GFP_KERNEL);
409 if (!obj)
410 return -ENOMEM;
411
412 obj->uobject.context = file->ucontext;
413
414 /*
415 * We ask for writable memory if any access flags other than
416 * "remote read" are set. "Local write" and "remote write"
417 * obviously require write access. "Remote atomic" can do
418 * things like fetch and add, which will modify memory, and
419 * "MW bind" can change permissions by binding a window.
420 */
421 ret = ib_umem_get(file->device->ib_dev, &obj->umem,
422 (void *) (unsigned long) cmd.start, cmd.length,
423 !!(cmd.access_flags & ~IB_ACCESS_REMOTE_READ));
424 if (ret)
425 goto err_free;
426
427 obj->umem.virt_base = cmd.hca_va;
428
95ed644f 429 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 430
431 pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
432 if (!pd || pd->uobject->context != file->ucontext) {
433 ret = -EINVAL;
434 goto err_up;
435 }
436
437 if (!pd->device->reg_user_mr) {
438 ret = -ENOSYS;
439 goto err_up;
440 }
441
442 mr = pd->device->reg_user_mr(pd, &obj->umem, cmd.access_flags, &udata);
443 if (IS_ERR(mr)) {
444 ret = PTR_ERR(mr);
445 goto err_up;
446 }
447
448 mr->device = pd->device;
449 mr->pd = pd;
450 mr->uobject = &obj->uobject;
451 atomic_inc(&pd->usecnt);
452 atomic_set(&mr->usecnt, 0);
453
454 memset(&resp, 0, sizeof resp);
455 resp.lkey = mr->lkey;
456 resp.rkey = mr->rkey;
457
458retry:
459 if (!idr_pre_get(&ib_uverbs_mr_idr, GFP_KERNEL)) {
460 ret = -ENOMEM;
461 goto err_unreg;
462 }
463
464 ret = idr_get_new(&ib_uverbs_mr_idr, mr, &obj->uobject.id);
465
466 if (ret == -EAGAIN)
467 goto retry;
468 if (ret)
469 goto err_unreg;
470
471 resp.mr_handle = obj->uobject.id;
472
bc38a6ab
RD		 473 if (copy_to_user((void __user *) (unsigned long) cmd.response,
474 &resp, sizeof resp)) {
475 ret = -EFAULT;
eb9d3cd5 476 goto err_idr;
bc38a6ab
RD		 477 }
478
95ed644f 479 mutex_lock(&file->mutex);
eb9d3cd5 480 list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
95ed644f 481 mutex_unlock(&file->mutex);
eb9d3cd5 482
95ed644f 483 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 484
485 return in_len;
486
eb9d3cd5
RD		 487err_idr:
488 idr_remove(&ib_uverbs_mr_idr, obj->uobject.id);
bc38a6ab
RD		 489
490err_unreg:
491 ib_dereg_mr(mr);
b4ca1a3f 492 atomic_dec(&pd->usecnt);
bc38a6ab
RD		 493
494err_up:
95ed644f 495 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 496
497 ib_umem_release(file->device->ib_dev, &obj->umem);
498
499err_free:
500 kfree(obj);
501 return ret;
502}
503
504ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
505 const char __user *buf, int in_len,
506 int out_len)
507{
508 struct ib_uverbs_dereg_mr cmd;
509 struct ib_mr *mr;
510 struct ib_umem_object *memobj;
511 int ret = -EINVAL;
512
513 if (copy_from_user(&cmd, buf, sizeof cmd))
514 return -EFAULT;
515
95ed644f 516 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 517
518 mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
519 if (!mr || mr->uobject->context != file->ucontext)
520 goto out;
521
522 memobj = container_of(mr->uobject, struct ib_umem_object, uobject);
523
524 ret = ib_dereg_mr(mr);
525 if (ret)
526 goto out;
527
528 idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
529
95ed644f 530 mutex_lock(&file->mutex);
bc38a6ab 531 list_del(&memobj->uobject.list);
95ed644f 532 mutex_unlock(&file->mutex);
bc38a6ab
RD		 533
534 ib_umem_release(file->device->ib_dev, &memobj->umem);
535 kfree(memobj);
536
537out:
95ed644f 538 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 539
540 return ret ? ret : in_len;
541}
542
6b73597e
RD		 543ssize_t ib_uverbs_create_comp_channel(struct ib_uverbs_file *file,
544 const char __user *buf, int in_len,
545 int out_len)
546{
547 struct ib_uverbs_create_comp_channel cmd;
548 struct ib_uverbs_create_comp_channel_resp resp;
549 struct file *filp;
550
551 if (out_len < sizeof resp)
552 return -ENOSPC;
553
554 if (copy_from_user(&cmd, buf, sizeof cmd))
555 return -EFAULT;
556
557 filp = ib_uverbs_alloc_event_file(file, 0, &resp.fd);
558 if (IS_ERR(filp))
559 return PTR_ERR(filp);
560
561 if (copy_to_user((void __user *) (unsigned long) cmd.response,
562 &resp, sizeof resp)) {
563 put_unused_fd(resp.fd);
564 fput(filp);
565 return -EFAULT;
566 }
567
568 fd_install(resp.fd, filp);
569 return in_len;
570}
571
bc38a6ab
RD		 572ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
573 const char __user *buf, int in_len,
574 int out_len)
575{
576 struct ib_uverbs_create_cq cmd;
577 struct ib_uverbs_create_cq_resp resp;
578 struct ib_udata udata;
63aaf647 579 struct ib_ucq_object *uobj;
6b73597e 580 struct ib_uverbs_event_file *ev_file = NULL;
bc38a6ab
RD		 581 struct ib_cq *cq;
582 int ret;
583
584 if (out_len < sizeof resp)
585 return -ENOSPC;
586
587 if (copy_from_user(&cmd, buf, sizeof cmd))
588 return -EFAULT;
589
590 INIT_UDATA(&udata, buf + sizeof cmd,
591 (unsigned long) cmd.response + sizeof resp,
592 in_len - sizeof cmd, out_len - sizeof resp);
593
6b73597e 594 if (cmd.comp_vector >= file->device->num_comp_vectors)
bc38a6ab
RD		 595 return -EINVAL;
596
597 uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
598 if (!uobj)
599 return -ENOMEM;
600
ac4e7b35
JM		 601 if (cmd.comp_channel >= 0) {
602 ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
603 if (!ev_file) {
604 ret = -EINVAL;
605 goto err;
606 }
607 }
608
63aaf647
RD		 609 uobj->uobject.user_handle = cmd.user_handle;
610 uobj->uobject.context = file->ucontext;
7162a3e0 611 uobj->uverbs_file = file;
63aaf647
RD		 612 uobj->comp_events_reported = 0;
613 uobj->async_events_reported = 0;
614 INIT_LIST_HEAD(&uobj->comp_list);
615 INIT_LIST_HEAD(&uobj->async_list);
bc38a6ab
RD		 616
617 cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,
618 file->ucontext, &udata);
619 if (IS_ERR(cq)) {
620 ret = PTR_ERR(cq);
621 goto err;
622 }
623
624 cq->device = file->device->ib_dev;
63aaf647 625 cq->uobject = &uobj->uobject;
bc38a6ab
RD		 626 cq->comp_handler = ib_uverbs_comp_handler;
627 cq->event_handler = ib_uverbs_cq_event_handler;
6b73597e 628 cq->cq_context = ev_file;
bc38a6ab
RD		 629 atomic_set(&cq->usecnt, 0);
630
95ed644f 631 mutex_lock(&ib_uverbs_idr_mutex);
eb9d3cd5 632
bc38a6ab
RD		 633retry:
634 if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
635 ret = -ENOMEM;
eb9d3cd5 636 goto err_up;
bc38a6ab
RD		 637 }
638
63aaf647 639 ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->uobject.id);
bc38a6ab
RD		 640
641 if (ret == -EAGAIN)
642 goto retry;
643 if (ret)
eb9d3cd5 644 goto err_up;
bc38a6ab
RD		 645
646 memset(&resp, 0, sizeof resp);
63aaf647 647 resp.cq_handle = uobj->uobject.id;
bc38a6ab
RD		 648 resp.cqe = cq->cqe;
649
650 if (copy_to_user((void __user *) (unsigned long) cmd.response,
651 &resp, sizeof resp)) {
652 ret = -EFAULT;
eb9d3cd5 653 goto err_idr;
bc38a6ab
RD		 654 }
655
95ed644f 656 mutex_lock(&file->mutex);
eb9d3cd5 657 list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
95ed644f 658 mutex_unlock(&file->mutex);
bc38a6ab 659
95ed644f 660 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab 661
eb9d3cd5
RD		 662 return in_len;
663
664err_idr:
665 idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
666
667err_up:
95ed644f 668 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 669 ib_destroy_cq(cq);
670
671err:
ac4e7b35
JM		 672 if (ev_file)
673 ib_uverbs_release_ucq(file, ev_file, uobj);
bc38a6ab
RD		 674 kfree(uobj);
675 return ret;
676}
677
33b9b3ee
RD		 678ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file,
679 const char __user *buf, int in_len,
680 int out_len)
681{
682 struct ib_uverbs_resize_cq cmd;
683 struct ib_uverbs_resize_cq_resp resp;
684 struct ib_udata udata;
685 struct ib_cq *cq;
686 int ret = -EINVAL;
687
688 if (copy_from_user(&cmd, buf, sizeof cmd))
689 return -EFAULT;
690
691 INIT_UDATA(&udata, buf + sizeof cmd,
692 (unsigned long) cmd.response + sizeof resp,
693 in_len - sizeof cmd, out_len - sizeof resp);
694
695 mutex_lock(&ib_uverbs_idr_mutex);
696
697 cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
698 if (!cq || cq->uobject->context != file->ucontext || !cq->device->resize_cq)
699 goto out;
700
701 ret = cq->device->resize_cq(cq, cmd.cqe, &udata);
702 if (ret)
703 goto out;
704
705 memset(&resp, 0, sizeof resp);
706 resp.cqe = cq->cqe;
707
708 if (copy_to_user((void __user *) (unsigned long) cmd.response,
709 &resp, sizeof resp))
710 ret = -EFAULT;
711
712out:
713 mutex_unlock(&ib_uverbs_idr_mutex);
714
715 return ret ? ret : in_len;
716}
717
67cdb40c
RD		 718ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
719 const char __user *buf, int in_len,
720 int out_len)
721{
722 struct ib_uverbs_poll_cq cmd;
723 struct ib_uverbs_poll_cq_resp *resp;
724 struct ib_cq *cq;
725 struct ib_wc *wc;
726 int ret = 0;
727 int i;
728 int rsize;
729
730 if (copy_from_user(&cmd, buf, sizeof cmd))
731 return -EFAULT;
732
733 wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
734 if (!wc)
735 return -ENOMEM;
736
737 rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
738 resp = kmalloc(rsize, GFP_KERNEL);
739 if (!resp) {
740 ret = -ENOMEM;
741 goto out_wc;
742 }
743
95ed644f 744 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 745 cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
746 if (!cq || cq->uobject->context != file->ucontext) {
747 ret = -EINVAL;
748 goto out;
749 }
750
751 resp->count = ib_poll_cq(cq, cmd.ne, wc);
752
753 for (i = 0; i < resp->count; i++) {
754 resp->wc[i].wr_id = wc[i].wr_id;
755 resp->wc[i].status = wc[i].status;
756 resp->wc[i].opcode = wc[i].opcode;
757 resp->wc[i].vendor_err = wc[i].vendor_err;
758 resp->wc[i].byte_len = wc[i].byte_len;
77369ed3 759 resp->wc[i].imm_data = (__u32 __force) wc[i].imm_data;
67cdb40c
RD		 760 resp->wc[i].qp_num = wc[i].qp_num;
761 resp->wc[i].src_qp = wc[i].src_qp;
762 resp->wc[i].wc_flags = wc[i].wc_flags;
763 resp->wc[i].pkey_index = wc[i].pkey_index;
764 resp->wc[i].slid = wc[i].slid;
765 resp->wc[i].sl = wc[i].sl;
766 resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
767 resp->wc[i].port_num = wc[i].port_num;
768 }
769
770 if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
771 ret = -EFAULT;
772
773out:
95ed644f 774 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 775 kfree(resp);
776
777out_wc:
778 kfree(wc);
779 return ret ? ret : in_len;
780}
781
782ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
783 const char __user *buf, int in_len,
784 int out_len)
785{
786 struct ib_uverbs_req_notify_cq cmd;
787 struct ib_cq *cq;
788 int ret = -EINVAL;
789
790 if (copy_from_user(&cmd, buf, sizeof cmd))
791 return -EFAULT;
792
95ed644f 793 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 794 cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
795 if (cq && cq->uobject->context == file->ucontext) {
796 ib_req_notify_cq(cq, cmd.solicited_only ?
797 IB_CQ_SOLICITED : IB_CQ_NEXT_COMP);
798 ret = in_len;
799 }
95ed644f 800 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 801
802 return ret;
803}
804
bc38a6ab
RD		 805ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
806 const char __user *buf, int in_len,
807 int out_len)
808{
63aaf647
RD		 809 struct ib_uverbs_destroy_cq cmd;
810 struct ib_uverbs_destroy_cq_resp resp;
811 struct ib_cq *cq;
812 struct ib_ucq_object *uobj;
6b73597e 813 struct ib_uverbs_event_file *ev_file;
63aaf647
RD		 814 u64 user_handle;
815 int ret = -EINVAL;
bc38a6ab
RD		 816
817 if (copy_from_user(&cmd, buf, sizeof cmd))
818 return -EFAULT;
819
63aaf647
RD		 820 memset(&resp, 0, sizeof resp);
821
95ed644f 822 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 823
824 cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
825 if (!cq || cq->uobject->context != file->ucontext)
826 goto out;
827
63aaf647 828 user_handle = cq->uobject->user_handle;
6b73597e
RD		 829 uobj = container_of(cq->uobject, struct ib_ucq_object, uobject);
830 ev_file = cq->cq_context;
bc38a6ab
RD		 831
832 ret = ib_destroy_cq(cq);
833 if (ret)
834 goto out;
835
836 idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
837
95ed644f 838 mutex_lock(&file->mutex);
63aaf647 839 list_del(&uobj->uobject.list);
95ed644f 840 mutex_unlock(&file->mutex);
bc38a6ab 841
70a30e16 842 ib_uverbs_release_ucq(file, ev_file, uobj);
63aaf647
RD		 843
844 resp.comp_events_reported = uobj->comp_events_reported;
845 resp.async_events_reported = uobj->async_events_reported;
846
bc38a6ab
RD		 847 kfree(uobj);
848
63aaf647
RD		 849 if (copy_to_user((void __user *) (unsigned long) cmd.response,
850 &resp, sizeof resp))
851 ret = -EFAULT;
852
bc38a6ab 853out:
95ed644f 854 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 855
856 return ret ? ret : in_len;
857}
858
859ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
860 const char __user *buf, int in_len,
861 int out_len)
862{
863 struct ib_uverbs_create_qp cmd;
864 struct ib_uverbs_create_qp_resp resp;
865 struct ib_udata udata;
f4e40156 866 struct ib_uqp_object *uobj;
bc38a6ab
RD		 867 struct ib_pd *pd;
868 struct ib_cq *scq, *rcq;
f520ba5a 869 struct ib_srq *srq;
bc38a6ab
RD		 870 struct ib_qp *qp;
871 struct ib_qp_init_attr attr;
872 int ret;
873
874 if (out_len < sizeof resp)
875 return -ENOSPC;
876
877 if (copy_from_user(&cmd, buf, sizeof cmd))
878 return -EFAULT;
879
880 INIT_UDATA(&udata, buf + sizeof cmd,
881 (unsigned long) cmd.response + sizeof resp,
882 in_len - sizeof cmd, out_len - sizeof resp);
883
884 uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
885 if (!uobj)
886 return -ENOMEM;
887
95ed644f 888 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 889
890 pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
891 scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
892 rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
f520ba5a 893 srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
bc38a6ab
RD		 894
895 if (!pd || pd->uobject->context != file->ucontext ||
896 !scq || scq->uobject->context != file->ucontext ||
f520ba5a
RD		 897 !rcq || rcq->uobject->context != file->ucontext ||
898 (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
bc38a6ab
RD		 899 ret = -EINVAL;
900 goto err_up;
901 }
902
903 attr.event_handler = ib_uverbs_qp_event_handler;
904 attr.qp_context = file;
905 attr.send_cq = scq;
906 attr.recv_cq = rcq;
f520ba5a 907 attr.srq = srq;
bc38a6ab
RD		 908 attr.sq_sig_type = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
909 attr.qp_type = cmd.qp_type;
910
911 attr.cap.max_send_wr = cmd.max_send_wr;
912 attr.cap.max_recv_wr = cmd.max_recv_wr;
913 attr.cap.max_send_sge = cmd.max_send_sge;
914 attr.cap.max_recv_sge = cmd.max_recv_sge;
915 attr.cap.max_inline_data = cmd.max_inline_data;
916
f4e40156
JM		 917 uobj->uevent.uobject.user_handle = cmd.user_handle;
918 uobj->uevent.uobject.context = file->ucontext;
919 uobj->uevent.events_reported = 0;
920 INIT_LIST_HEAD(&uobj->uevent.event_list);
921 INIT_LIST_HEAD(&uobj->mcast_list);
bc38a6ab
RD		 922
923 qp = pd->device->create_qp(pd, &attr, &udata);
924 if (IS_ERR(qp)) {
925 ret = PTR_ERR(qp);
926 goto err_up;
927 }
928
929 qp->device = pd->device;
930 qp->pd = pd;
931 qp->send_cq = attr.send_cq;
932 qp->recv_cq = attr.recv_cq;
933 qp->srq = attr.srq;
f4e40156 934 qp->uobject = &uobj->uevent.uobject;
bc38a6ab
RD		 935 qp->event_handler = attr.event_handler;
936 qp->qp_context = attr.qp_context;
937 qp->qp_type = attr.qp_type;
938 atomic_inc(&pd->usecnt);
939 atomic_inc(&attr.send_cq->usecnt);
940 atomic_inc(&attr.recv_cq->usecnt);
941 if (attr.srq)
942 atomic_inc(&attr.srq->usecnt);
943
944 memset(&resp, 0, sizeof resp);
945 resp.qpn = qp->qp_num;
946
947retry:
948 if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {
949 ret = -ENOMEM;
950 goto err_destroy;
951 }
952
f4e40156 953 ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uevent.uobject.id);
bc38a6ab
RD		 954
955 if (ret == -EAGAIN)
956 goto retry;
957 if (ret)
958 goto err_destroy;
959
f4e40156 960 resp.qp_handle = uobj->uevent.uobject.id;
77369ed3
JM		 961 resp.max_recv_sge = attr.cap.max_recv_sge;
962 resp.max_send_sge = attr.cap.max_send_sge;
963 resp.max_recv_wr = attr.cap.max_recv_wr;
964 resp.max_send_wr = attr.cap.max_send_wr;
965 resp.max_inline_data = attr.cap.max_inline_data;
bc38a6ab 966
bc38a6ab
RD		 967 if (copy_to_user((void __user *) (unsigned long) cmd.response,
968 &resp, sizeof resp)) {
969 ret = -EFAULT;
eb9d3cd5 970 goto err_idr;
bc38a6ab
RD		 971 }
972
95ed644f 973 mutex_lock(&file->mutex);
f4e40156 974 list_add_tail(&uobj->uevent.uobject.list, &file->ucontext->qp_list);
95ed644f 975 mutex_unlock(&file->mutex);
eb9d3cd5 976
95ed644f 977 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 978
979 return in_len;
980
eb9d3cd5 981err_idr:
f4e40156 982 idr_remove(&ib_uverbs_qp_idr, uobj->uevent.uobject.id);
bc38a6ab
RD		 983
984err_destroy:
985 ib_destroy_qp(qp);
b4ca1a3f
JM		 986 atomic_dec(&pd->usecnt);
987 atomic_dec(&attr.send_cq->usecnt);
988 atomic_dec(&attr.recv_cq->usecnt);
989 if (attr.srq)
990 atomic_dec(&attr.srq->usecnt);
bc38a6ab
RD		 991
992err_up:
95ed644f 993 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 994
995 kfree(uobj);
996 return ret;
997}
998
999ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
1000 const char __user *buf, int in_len,
1001 int out_len)
1002{
1003 struct ib_uverbs_modify_qp cmd;
1004 struct ib_qp *qp;
1005 struct ib_qp_attr *attr;
1006 int ret;
1007
1008 if (copy_from_user(&cmd, buf, sizeof cmd))
1009 return -EFAULT;
1010
1011 attr = kmalloc(sizeof *attr, GFP_KERNEL);
1012 if (!attr)
1013 return -ENOMEM;
1014
95ed644f 1015 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1016
1017 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1018 if (!qp || qp->uobject->context != file->ucontext) {
1019 ret = -EINVAL;
1020 goto out;
1021 }
1022
1023 attr->qp_state = cmd.qp_state;
1024 attr->cur_qp_state = cmd.cur_qp_state;
1025 attr->path_mtu = cmd.path_mtu;
1026 attr->path_mig_state = cmd.path_mig_state;
1027 attr->qkey = cmd.qkey;
1028 attr->rq_psn = cmd.rq_psn;
1029 attr->sq_psn = cmd.sq_psn;
1030 attr->dest_qp_num = cmd.dest_qp_num;
1031 attr->qp_access_flags = cmd.qp_access_flags;
1032 attr->pkey_index = cmd.pkey_index;
1033 attr->alt_pkey_index = cmd.pkey_index;
1034 attr->en_sqd_async_notify = cmd.en_sqd_async_notify;
1035 attr->max_rd_atomic = cmd.max_rd_atomic;
1036 attr->max_dest_rd_atomic = cmd.max_dest_rd_atomic;
1037 attr->min_rnr_timer = cmd.min_rnr_timer;
1038 attr->port_num = cmd.port_num;
1039 attr->timeout = cmd.timeout;
1040 attr->retry_cnt = cmd.retry_cnt;
1041 attr->rnr_retry = cmd.rnr_retry;
1042 attr->alt_port_num = cmd.alt_port_num;
1043 attr->alt_timeout = cmd.alt_timeout;
1044
1045 memcpy(attr->ah_attr.grh.dgid.raw, cmd.dest.dgid, 16);
1046 attr->ah_attr.grh.flow_label = cmd.dest.flow_label;
1047 attr->ah_attr.grh.sgid_index = cmd.dest.sgid_index;
1048 attr->ah_attr.grh.hop_limit = cmd.dest.hop_limit;
1049 attr->ah_attr.grh.traffic_class = cmd.dest.traffic_class;
1050 attr->ah_attr.dlid = cmd.dest.dlid;
1051 attr->ah_attr.sl = cmd.dest.sl;
1052 attr->ah_attr.src_path_bits = cmd.dest.src_path_bits;
1053 attr->ah_attr.static_rate = cmd.dest.static_rate;
1054 attr->ah_attr.ah_flags = cmd.dest.is_global ? IB_AH_GRH : 0;
1055 attr->ah_attr.port_num = cmd.dest.port_num;
1056
1057 memcpy(attr->alt_ah_attr.grh.dgid.raw, cmd.alt_dest.dgid, 16);
1058 attr->alt_ah_attr.grh.flow_label = cmd.alt_dest.flow_label;
1059 attr->alt_ah_attr.grh.sgid_index = cmd.alt_dest.sgid_index;
1060 attr->alt_ah_attr.grh.hop_limit = cmd.alt_dest.hop_limit;
1061 attr->alt_ah_attr.grh.traffic_class = cmd.alt_dest.traffic_class;
1062 attr->alt_ah_attr.dlid = cmd.alt_dest.dlid;
1063 attr->alt_ah_attr.sl = cmd.alt_dest.sl;
1064 attr->alt_ah_attr.src_path_bits = cmd.alt_dest.src_path_bits;
1065 attr->alt_ah_attr.static_rate = cmd.alt_dest.static_rate;
1066 attr->alt_ah_attr.ah_flags = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
1067 attr->alt_ah_attr.port_num = cmd.alt_dest.port_num;
1068
1069 ret = ib_modify_qp(qp, attr, cmd.attr_mask);
1070 if (ret)
1071 goto out;
1072
1073 ret = in_len;
1074
1075out:
95ed644f 1076 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1077 kfree(attr);
1078
1079 return ret;
1080}
1081
1082ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
1083 const char __user *buf, int in_len,
1084 int out_len)
1085{
63aaf647
RD		 1086 struct ib_uverbs_destroy_qp cmd;
1087 struct ib_uverbs_destroy_qp_resp resp;
1088 struct ib_qp *qp;
f4e40156 1089 struct ib_uqp_object *uobj;
63aaf647 1090 int ret = -EINVAL;
bc38a6ab
RD		 1091
1092 if (copy_from_user(&cmd, buf, sizeof cmd))
1093 return -EFAULT;
1094
63aaf647
RD		 1095 memset(&resp, 0, sizeof resp);
1096
95ed644f 1097 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1098
1099 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1100 if (!qp || qp->uobject->context != file->ucontext)
1101 goto out;
1102
f4e40156
JM		 1103 uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1104
1105 if (!list_empty(&uobj->mcast_list)) {
1106 ret = -EBUSY;
1107 goto out;
1108 }
bc38a6ab
RD		 1109
1110 ret = ib_destroy_qp(qp);
1111 if (ret)
1112 goto out;
1113
1114 idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
1115
95ed644f 1116 mutex_lock(&file->mutex);
f4e40156 1117 list_del(&uobj->uevent.uobject.list);
95ed644f 1118 mutex_unlock(&file->mutex);
bc38a6ab 1119
f4e40156 1120 ib_uverbs_release_uevent(file, &uobj->uevent);
63aaf647 1121
f4e40156 1122 resp.events_reported = uobj->uevent.events_reported;
63aaf647 1123
bc38a6ab
RD		 1124 kfree(uobj);
1125
63aaf647
RD		 1126 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1127 &resp, sizeof resp))
1128 ret = -EFAULT;
1129
bc38a6ab 1130out:
95ed644f 1131 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1132
1133 return ret ? ret : in_len;
1134}
1135
67cdb40c
RD		 1136ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
1137 const char __user *buf, int in_len,
1138 int out_len)
1139{
1140 struct ib_uverbs_post_send cmd;
1141 struct ib_uverbs_post_send_resp resp;
1142 struct ib_uverbs_send_wr *user_wr;
1143 struct ib_send_wr *wr = NULL, *last, *next, *bad_wr;
1144 struct ib_qp *qp;
1145 int i, sg_ind;
1146 ssize_t ret = -EINVAL;
1147
1148 if (copy_from_user(&cmd, buf, sizeof cmd))
1149 return -EFAULT;
1150
1151 if (in_len < sizeof cmd + cmd.wqe_size * cmd.wr_count +
1152 cmd.sge_count * sizeof (struct ib_uverbs_sge))
1153 return -EINVAL;
1154
1155 if (cmd.wqe_size < sizeof (struct ib_uverbs_send_wr))
1156 return -EINVAL;
1157
1158 user_wr = kmalloc(cmd.wqe_size, GFP_KERNEL);
1159 if (!user_wr)
1160 return -ENOMEM;
1161
95ed644f 1162 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1163
1164 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1165 if (!qp || qp->uobject->context != file->ucontext)
1166 goto out;
1167
1168 sg_ind = 0;
1169 last = NULL;
1170 for (i = 0; i < cmd.wr_count; ++i) {
1171 if (copy_from_user(user_wr,
1172 buf + sizeof cmd + i * cmd.wqe_size,
1173 cmd.wqe_size)) {
1174 ret = -EFAULT;
1175 goto out;
1176 }
1177
1178 if (user_wr->num_sge + sg_ind > cmd.sge_count) {
1179 ret = -EINVAL;
1180 goto out;
1181 }
1182
1183 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1184 user_wr->num_sge * sizeof (struct ib_sge),
1185 GFP_KERNEL);
1186 if (!next) {
1187 ret = -ENOMEM;
1188 goto out;
1189 }
1190
1191 if (!last)
1192 wr = next;
1193 else
1194 last->next = next;
1195 last = next;
1196
1197 next->next = NULL;
1198 next->wr_id = user_wr->wr_id;
1199 next->num_sge = user_wr->num_sge;
1200 next->opcode = user_wr->opcode;
1201 next->send_flags = user_wr->send_flags;
77369ed3 1202 next->imm_data = (__be32 __force) user_wr->imm_data;
67cdb40c
RD		 1203
1204 if (qp->qp_type == IB_QPT_UD) {
1205 next->wr.ud.ah = idr_find(&ib_uverbs_ah_idr,
1206 user_wr->wr.ud.ah);
1207 if (!next->wr.ud.ah) {
1208 ret = -EINVAL;
1209 goto out;
1210 }
1211 next->wr.ud.remote_qpn = user_wr->wr.ud.remote_qpn;
1212 next->wr.ud.remote_qkey = user_wr->wr.ud.remote_qkey;
1213 } else {
1214 switch (next->opcode) {
1215 case IB_WR_RDMA_WRITE:
1216 case IB_WR_RDMA_WRITE_WITH_IMM:
1217 case IB_WR_RDMA_READ:
1218 next->wr.rdma.remote_addr =
1219 user_wr->wr.rdma.remote_addr;
1220 next->wr.rdma.rkey =
1221 user_wr->wr.rdma.rkey;
1222 break;
1223 case IB_WR_ATOMIC_CMP_AND_SWP:
1224 case IB_WR_ATOMIC_FETCH_AND_ADD:
1225 next->wr.atomic.remote_addr =
1226 user_wr->wr.atomic.remote_addr;
1227 next->wr.atomic.compare_add =
1228 user_wr->wr.atomic.compare_add;
1229 next->wr.atomic.swap = user_wr->wr.atomic.swap;
1230 next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
1231 break;
1232 default:
1233 break;
1234 }
1235 }
1236
1237 if (next->num_sge) {
1238 next->sg_list = (void *) next +
1239 ALIGN(sizeof *next, sizeof (struct ib_sge));
1240 if (copy_from_user(next->sg_list,
1241 buf + sizeof cmd +
1242 cmd.wr_count * cmd.wqe_size +
1243 sg_ind * sizeof (struct ib_sge),
1244 next->num_sge * sizeof (struct ib_sge))) {
1245 ret = -EFAULT;
1246 goto out;
1247 }
1248 sg_ind += next->num_sge;
1249 } else
1250 next->sg_list = NULL;
1251 }
1252
1253 resp.bad_wr = 0;
1254 ret = qp->device->post_send(qp, wr, &bad_wr);
1255 if (ret)
1256 for (next = wr; next; next = next->next) {
1257 ++resp.bad_wr;
1258 if (next == bad_wr)
1259 break;
1260 }
1261
1262 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1263 &resp, sizeof resp))
1264 ret = -EFAULT;
1265
1266out:
95ed644f 1267 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1268
1269 while (wr) {
1270 next = wr->next;
1271 kfree(wr);
1272 wr = next;
1273 }
1274
1275 kfree(user_wr);
1276
1277 return ret ? ret : in_len;
1278}
1279
1280static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf,
1281 int in_len,
1282 u32 wr_count,
1283 u32 sge_count,
1284 u32 wqe_size)
1285{
1286 struct ib_uverbs_recv_wr *user_wr;
1287 struct ib_recv_wr *wr = NULL, *last, *next;
1288 int sg_ind;
1289 int i;
1290 int ret;
1291
1292 if (in_len < wqe_size * wr_count +
1293 sge_count * sizeof (struct ib_uverbs_sge))
1294 return ERR_PTR(-EINVAL);
1295
1296 if (wqe_size < sizeof (struct ib_uverbs_recv_wr))
1297 return ERR_PTR(-EINVAL);
1298
1299 user_wr = kmalloc(wqe_size, GFP_KERNEL);
1300 if (!user_wr)
1301 return ERR_PTR(-ENOMEM);
1302
1303 sg_ind = 0;
1304 last = NULL;
1305 for (i = 0; i < wr_count; ++i) {
1306 if (copy_from_user(user_wr, buf + i * wqe_size,
1307 wqe_size)) {
1308 ret = -EFAULT;
1309 goto err;
1310 }
1311
1312 if (user_wr->num_sge + sg_ind > sge_count) {
1313 ret = -EINVAL;
1314 goto err;
1315 }
1316
1317 next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
1318 user_wr->num_sge * sizeof (struct ib_sge),
1319 GFP_KERNEL);
1320 if (!next) {
1321 ret = -ENOMEM;
1322 goto err;
1323 }
1324
1325 if (!last)
1326 wr = next;
1327 else
1328 last->next = next;
1329 last = next;
1330
1331 next->next = NULL;
1332 next->wr_id = user_wr->wr_id;
1333 next->num_sge = user_wr->num_sge;
1334
1335 if (next->num_sge) {
1336 next->sg_list = (void *) next +
1337 ALIGN(sizeof *next, sizeof (struct ib_sge));
1338 if (copy_from_user(next->sg_list,
1339 buf + wr_count * wqe_size +
1340 sg_ind * sizeof (struct ib_sge),
1341 next->num_sge * sizeof (struct ib_sge))) {
1342 ret = -EFAULT;
1343 goto err;
1344 }
1345 sg_ind += next->num_sge;
1346 } else
1347 next->sg_list = NULL;
1348 }
1349
1350 kfree(user_wr);
1351 return wr;
1352
1353err:
1354 kfree(user_wr);
1355
1356 while (wr) {
1357 next = wr->next;
1358 kfree(wr);
1359 wr = next;
1360 }
1361
1362 return ERR_PTR(ret);
1363}
1364
1365ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
1366 const char __user *buf, int in_len,
1367 int out_len)
1368{
1369 struct ib_uverbs_post_recv cmd;
1370 struct ib_uverbs_post_recv_resp resp;
1371 struct ib_recv_wr *wr, *next, *bad_wr;
1372 struct ib_qp *qp;
1373 ssize_t ret = -EINVAL;
1374
1375 if (copy_from_user(&cmd, buf, sizeof cmd))
1376 return -EFAULT;
1377
1378 wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1379 in_len - sizeof cmd, cmd.wr_count,
1380 cmd.sge_count, cmd.wqe_size);
1381 if (IS_ERR(wr))
1382 return PTR_ERR(wr);
1383
95ed644f 1384 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1385
1386 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1387 if (!qp || qp->uobject->context != file->ucontext)
1388 goto out;
1389
1390 resp.bad_wr = 0;
1391 ret = qp->device->post_recv(qp, wr, &bad_wr);
1392 if (ret)
1393 for (next = wr; next; next = next->next) {
1394 ++resp.bad_wr;
1395 if (next == bad_wr)
1396 break;
1397 }
1398
1399
1400 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1401 &resp, sizeof resp))
1402 ret = -EFAULT;
1403
1404out:
95ed644f 1405 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1406
1407 while (wr) {
1408 next = wr->next;
1409 kfree(wr);
1410 wr = next;
1411 }
1412
1413 return ret ? ret : in_len;
1414}
1415
1416ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
1417 const char __user *buf, int in_len,
1418 int out_len)
1419{
1420 struct ib_uverbs_post_srq_recv cmd;
1421 struct ib_uverbs_post_srq_recv_resp resp;
1422 struct ib_recv_wr *wr, *next, *bad_wr;
1423 struct ib_srq *srq;
1424 ssize_t ret = -EINVAL;
1425
1426 if (copy_from_user(&cmd, buf, sizeof cmd))
1427 return -EFAULT;
1428
1429 wr = ib_uverbs_unmarshall_recv(buf + sizeof cmd,
1430 in_len - sizeof cmd, cmd.wr_count,
1431 cmd.sge_count, cmd.wqe_size);
1432 if (IS_ERR(wr))
1433 return PTR_ERR(wr);
1434
95ed644f 1435 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1436
1437 srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1438 if (!srq || srq->uobject->context != file->ucontext)
1439 goto out;
1440
1441 resp.bad_wr = 0;
1442 ret = srq->device->post_srq_recv(srq, wr, &bad_wr);
1443 if (ret)
1444 for (next = wr; next; next = next->next) {
1445 ++resp.bad_wr;
1446 if (next == bad_wr)
1447 break;
1448 }
1449
1450
1451 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1452 &resp, sizeof resp))
1453 ret = -EFAULT;
1454
1455out:
95ed644f 1456 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1457
1458 while (wr) {
1459 next = wr->next;
1460 kfree(wr);
1461 wr = next;
1462 }
1463
1464 return ret ? ret : in_len;
1465}
1466
1467ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
1468 const char __user *buf, int in_len,
1469 int out_len)
1470{
1471 struct ib_uverbs_create_ah cmd;
1472 struct ib_uverbs_create_ah_resp resp;
1473 struct ib_uobject *uobj;
1474 struct ib_pd *pd;
1475 struct ib_ah *ah;
1476 struct ib_ah_attr attr;
1477 int ret;
1478
1479 if (out_len < sizeof resp)
1480 return -ENOSPC;
1481
1482 if (copy_from_user(&cmd, buf, sizeof cmd))
1483 return -EFAULT;
1484
1485 uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1486 if (!uobj)
1487 return -ENOMEM;
1488
95ed644f 1489 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1490
1491 pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1492 if (!pd || pd->uobject->context != file->ucontext) {
1493 ret = -EINVAL;
1494 goto err_up;
1495 }
1496
1497 uobj->user_handle = cmd.user_handle;
1498 uobj->context = file->ucontext;
1499
1500 attr.dlid = cmd.attr.dlid;
1501 attr.sl = cmd.attr.sl;
1502 attr.src_path_bits = cmd.attr.src_path_bits;
1503 attr.static_rate = cmd.attr.static_rate;
ea5d4a6a 1504 attr.ah_flags = cmd.attr.is_global ? IB_AH_GRH : 0;
67cdb40c
RD		 1505 attr.port_num = cmd.attr.port_num;
1506 attr.grh.flow_label = cmd.attr.grh.flow_label;
1507 attr.grh.sgid_index = cmd.attr.grh.sgid_index;
1508 attr.grh.hop_limit = cmd.attr.grh.hop_limit;
1509 attr.grh.traffic_class = cmd.attr.grh.traffic_class;
1510 memcpy(attr.grh.dgid.raw, cmd.attr.grh.dgid, 16);
1511
1512 ah = ib_create_ah(pd, &attr);
1513 if (IS_ERR(ah)) {
1514 ret = PTR_ERR(ah);
1515 goto err_up;
1516 }
1517
1518 ah->uobject = uobj;
1519
1520retry:
1521 if (!idr_pre_get(&ib_uverbs_ah_idr, GFP_KERNEL)) {
1522 ret = -ENOMEM;
1523 goto err_destroy;
1524 }
1525
1526 ret = idr_get_new(&ib_uverbs_ah_idr, ah, &uobj->id);
1527
1528 if (ret == -EAGAIN)
1529 goto retry;
1530 if (ret)
1531 goto err_destroy;
1532
1533 resp.ah_handle = uobj->id;
1534
1535 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1536 &resp, sizeof resp)) {
1537 ret = -EFAULT;
1538 goto err_idr;
1539 }
1540
95ed644f 1541 mutex_lock(&file->mutex);
67cdb40c 1542 list_add_tail(&uobj->list, &file->ucontext->ah_list);
95ed644f 1543 mutex_unlock(&file->mutex);
67cdb40c 1544
95ed644f 1545 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1546
1547 return in_len;
1548
1549err_idr:
1550 idr_remove(&ib_uverbs_ah_idr, uobj->id);
1551
1552err_destroy:
1553 ib_destroy_ah(ah);
1554
1555err_up:
95ed644f 1556 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1557
1558 kfree(uobj);
1559 return ret;
1560}
1561
1562ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
1563 const char __user *buf, int in_len, int out_len)
1564{
1565 struct ib_uverbs_destroy_ah cmd;
1566 struct ib_ah *ah;
1567 struct ib_uobject *uobj;
1568 int ret = -EINVAL;
1569
1570 if (copy_from_user(&cmd, buf, sizeof cmd))
1571 return -EFAULT;
1572
95ed644f 1573 mutex_lock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1574
1575 ah = idr_find(&ib_uverbs_ah_idr, cmd.ah_handle);
1576 if (!ah || ah->uobject->context != file->ucontext)
1577 goto out;
1578
1579 uobj = ah->uobject;
1580
1581 ret = ib_destroy_ah(ah);
1582 if (ret)
1583 goto out;
1584
1585 idr_remove(&ib_uverbs_ah_idr, cmd.ah_handle);
1586
95ed644f 1587 mutex_lock(&file->mutex);
67cdb40c 1588 list_del(&uobj->list);
95ed644f 1589 mutex_unlock(&file->mutex);
67cdb40c
RD		 1590
1591 kfree(uobj);
1592
1593out:
95ed644f 1594 mutex_unlock(&ib_uverbs_idr_mutex);
67cdb40c
RD		 1595
1596 return ret ? ret : in_len;
1597}
1598
bc38a6ab
RD		 1599ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
1600 const char __user *buf, int in_len,
1601 int out_len)
1602{
1603 struct ib_uverbs_attach_mcast cmd;
1604 struct ib_qp *qp;
f4e40156
JM		 1605 struct ib_uqp_object *uobj;
1606 struct ib_uverbs_mcast_entry *mcast;
bc38a6ab
RD		 1607 int ret = -EINVAL;
1608
1609 if (copy_from_user(&cmd, buf, sizeof cmd))
1610 return -EFAULT;
1611
95ed644f 1612 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1613
1614 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
f4e40156
JM		 1615 if (!qp || qp->uobject->context != file->ucontext)
1616 goto out;
1617
1618 uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1619
1620 list_for_each_entry(mcast, &uobj->mcast_list, list)
1621 if (cmd.mlid == mcast->lid &&
1622 !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
1623 ret = 0;
1624 goto out;
1625 }
1626
1627 mcast = kmalloc(sizeof *mcast, GFP_KERNEL);
1628 if (!mcast) {
1629 ret = -ENOMEM;
1630 goto out;
1631 }
1632
1633 mcast->lid = cmd.mlid;
1634 memcpy(mcast->gid.raw, cmd.gid, sizeof mcast->gid.raw);
bc38a6ab 1635
f4e40156
JM		 1636 ret = ib_attach_mcast(qp, &mcast->gid, cmd.mlid);
1637 if (!ret) {
1638 uobj = container_of(qp->uobject, struct ib_uqp_object,
1639 uevent.uobject);
1640 list_add_tail(&mcast->list, &uobj->mcast_list);
1641 } else
1642 kfree(mcast);
1643
1644out:
95ed644f 1645 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1646
1647 return ret ? ret : in_len;
1648}
1649
1650ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
1651 const char __user *buf, int in_len,
1652 int out_len)
1653{
1654 struct ib_uverbs_detach_mcast cmd;
f4e40156 1655 struct ib_uqp_object *uobj;
bc38a6ab 1656 struct ib_qp *qp;
f4e40156 1657 struct ib_uverbs_mcast_entry *mcast;
bc38a6ab
RD		 1658 int ret = -EINVAL;
1659
1660 if (copy_from_user(&cmd, buf, sizeof cmd))
1661 return -EFAULT;
1662
95ed644f 1663 mutex_lock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1664
1665 qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
f4e40156
JM		 1666 if (!qp || qp->uobject->context != file->ucontext)
1667 goto out;
bc38a6ab 1668
f4e40156
JM		 1669 ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1670 if (ret)
1671 goto out;
1672
1673 uobj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
1674
1675 list_for_each_entry(mcast, &uobj->mcast_list, list)
1676 if (cmd.mlid == mcast->lid &&
1677 !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
1678 list_del(&mcast->list);
1679 kfree(mcast);
1680 break;
1681 }
1682
1683out:
95ed644f 1684 mutex_unlock(&ib_uverbs_idr_mutex);
bc38a6ab
RD		 1685
1686 return ret ? ret : in_len;
1687}
f520ba5a
RD		 1688
1689ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
1690 const char __user *buf, int in_len,
1691 int out_len)
1692{
1693 struct ib_uverbs_create_srq cmd;
1694 struct ib_uverbs_create_srq_resp resp;
1695 struct ib_udata udata;
63aaf647 1696 struct ib_uevent_object *uobj;
f520ba5a
RD		 1697 struct ib_pd *pd;
1698 struct ib_srq *srq;
1699 struct ib_srq_init_attr attr;
1700 int ret;
1701
1702 if (out_len < sizeof resp)
1703 return -ENOSPC;
1704
1705 if (copy_from_user(&cmd, buf, sizeof cmd))
1706 return -EFAULT;
1707
1708 INIT_UDATA(&udata, buf + sizeof cmd,
1709 (unsigned long) cmd.response + sizeof resp,
1710 in_len - sizeof cmd, out_len - sizeof resp);
1711
1712 uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1713 if (!uobj)
1714 return -ENOMEM;
1715
95ed644f 1716 mutex_lock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1717
1718 pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1719
1720 if (!pd || pd->uobject->context != file->ucontext) {
1721 ret = -EINVAL;
1722 goto err_up;
1723 }
1724
1725 attr.event_handler = ib_uverbs_srq_event_handler;
1726 attr.srq_context = file;
1727 attr.attr.max_wr = cmd.max_wr;
1728 attr.attr.max_sge = cmd.max_sge;
1729 attr.attr.srq_limit = cmd.srq_limit;
1730
63aaf647
RD		 1731 uobj->uobject.user_handle = cmd.user_handle;
1732 uobj->uobject.context = file->ucontext;
1733 uobj->events_reported = 0;
1734 INIT_LIST_HEAD(&uobj->event_list);
f520ba5a
RD		 1735
1736 srq = pd->device->create_srq(pd, &attr, &udata);
1737 if (IS_ERR(srq)) {
1738 ret = PTR_ERR(srq);
1739 goto err_up;
1740 }
1741
1742 srq->device = pd->device;
1743 srq->pd = pd;
63aaf647 1744 srq->uobject = &uobj->uobject;
f520ba5a
RD		 1745 srq->event_handler = attr.event_handler;
1746 srq->srq_context = attr.srq_context;
1747 atomic_inc(&pd->usecnt);
1748 atomic_set(&srq->usecnt, 0);
1749
1750 memset(&resp, 0, sizeof resp);
1751
1752retry:
1753 if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
1754 ret = -ENOMEM;
1755 goto err_destroy;
1756 }
1757
63aaf647 1758 ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->uobject.id);
f520ba5a
RD		 1759
1760 if (ret == -EAGAIN)
1761 goto retry;
1762 if (ret)
1763 goto err_destroy;
1764
63aaf647 1765 resp.srq_handle = uobj->uobject.id;
f520ba5a 1766
f520ba5a
RD		 1767 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1768 &resp, sizeof resp)) {
1769 ret = -EFAULT;
eb9d3cd5 1770 goto err_idr;
f520ba5a
RD		 1771 }
1772
95ed644f 1773 mutex_lock(&file->mutex);
eb9d3cd5 1774 list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
95ed644f 1775 mutex_unlock(&file->mutex);
eb9d3cd5 1776
95ed644f 1777 mutex_unlock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1778
1779 return in_len;
1780
eb9d3cd5
RD		 1781err_idr:
1782 idr_remove(&ib_uverbs_srq_idr, uobj->uobject.id);
f520ba5a
RD		 1783
1784err_destroy:
1785 ib_destroy_srq(srq);
b4ca1a3f 1786 atomic_dec(&pd->usecnt);
f520ba5a
RD		 1787
1788err_up:
95ed644f 1789 mutex_unlock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1790
1791 kfree(uobj);
1792 return ret;
1793}
1794
1795ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
1796 const char __user *buf, int in_len,
1797 int out_len)
1798{
1799 struct ib_uverbs_modify_srq cmd;
1800 struct ib_srq *srq;
1801 struct ib_srq_attr attr;
1802 int ret;
1803
1804 if (copy_from_user(&cmd, buf, sizeof cmd))
1805 return -EFAULT;
1806
95ed644f 1807 mutex_lock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1808
1809 srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1810 if (!srq || srq->uobject->context != file->ucontext) {
1811 ret = -EINVAL;
1812 goto out;
1813 }
1814
1815 attr.max_wr = cmd.max_wr;
f520ba5a
RD		 1816 attr.srq_limit = cmd.srq_limit;
1817
1818 ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
1819
1820out:
95ed644f 1821 mutex_unlock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1822
1823 return ret ? ret : in_len;
1824}
1825
1826ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
1827 const char __user *buf, int in_len,
1828 int out_len)
1829{
63aaf647
RD		 1830 struct ib_uverbs_destroy_srq cmd;
1831 struct ib_uverbs_destroy_srq_resp resp;
1832 struct ib_srq *srq;
1833 struct ib_uevent_object *uobj;
63aaf647 1834 int ret = -EINVAL;
f520ba5a
RD		 1835
1836 if (copy_from_user(&cmd, buf, sizeof cmd))
1837 return -EFAULT;
1838
95ed644f 1839 mutex_lock(&ib_uverbs_idr_mutex);
f520ba5a 1840
63aaf647
RD		 1841 memset(&resp, 0, sizeof resp);
1842
f520ba5a
RD		 1843 srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1844 if (!srq || srq->uobject->context != file->ucontext)
1845 goto out;
1846
63aaf647 1847 uobj = container_of(srq->uobject, struct ib_uevent_object, uobject);
f520ba5a
RD		 1848
1849 ret = ib_destroy_srq(srq);
1850 if (ret)
1851 goto out;
1852
1853 idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
1854
95ed644f 1855 mutex_lock(&file->mutex);
63aaf647 1856 list_del(&uobj->uobject.list);
95ed644f 1857 mutex_unlock(&file->mutex);
f520ba5a 1858
70a30e16 1859 ib_uverbs_release_uevent(file, uobj);
63aaf647
RD		 1860
1861 resp.events_reported = uobj->events_reported;
1862
f520ba5a
RD		 1863 kfree(uobj);
1864
63aaf647
RD		 1865 if (copy_to_user((void __user *) (unsigned long) cmd.response,
1866 &resp, sizeof resp))
1867 ret = -EFAULT;
1868
f520ba5a 1869out:
95ed644f 1870 mutex_unlock(&ib_uverbs_idr_mutex);
f520ba5a
RD		 1871
1872 return ret ? ret : in_len;
1873}
Linux kernel - Deliverables
This page took 0.157535 seconds and 5 git commands to generate.