drivers/infiniband/core/uverbs_cmd.c

   1 /*
   2  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
   3  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
   4  *
   5  * This software is available to you under a choice of one of two
   6  * licenses.  You may choose to be licensed under the terms of the GNU
   7  * General Public License (GPL) Version 2, available from the file
   8  * COPYING in the main directory of this source tree, or the
   9  * OpenIB.org BSD license below:
  10  *
  11  *     Redistribution and use in source and binary forms, with or
  12  *     without modification, are permitted provided that the following
  13  *     conditions are met:
  14  *
  15  *      - Redistributions of source code must retain the above
  16  *        copyright notice, this list of conditions and the following
  17  *        disclaimer.
  18  *
  19  *      - Redistributions in binary form must reproduce the above
  20  *        copyright notice, this list of conditions and the following
  21  *        disclaimer in the documentation and/or other materials
  22  *        provided with the distribution.
  23  *
  24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  25  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  26  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  27  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  28  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  29  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  30  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  31  * SOFTWARE.
  32  *
  33  * $Id: uverbs_cmd.c 2708 2005-06-24 17:27:21Z roland $
  34  */
  35
  36 #include <asm/uaccess.h>
  37
  38 #include "uverbs.h"
  39
  40 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
  41         do {                                                            \
  42                 (udata)->inbuf  = (void __user *) (ibuf);               \
  43                 (udata)->outbuf = (void __user *) (obuf);               \
  44                 (udata)->inlen  = (ilen);                               \
  45                 (udata)->outlen = (olen);                               \
  46         } while (0)
  47
  48 ssize_t ib_uverbs_query_params(struct ib_uverbs_file *file,
  49                                const char __user *buf,
  50                                int in_len, int out_len)
  51 {
  52         struct ib_uverbs_query_params      cmd;
  53         struct ib_uverbs_query_params_resp resp;
  54
  55         if (out_len < sizeof resp)
  56                 return -ENOSPC;
  57
  58         if (copy_from_user(&cmd, buf, sizeof cmd))
  59                 return -EFAULT;
  60
  61         memset(&resp, 0, sizeof resp);
  62
  63         resp.num_cq_events = file->device->num_comp;
  64
  65         if (copy_to_user((void __user *) (unsigned long) cmd.response, &resp, sizeof resp))
  66             return -EFAULT;
  67
  68         return in_len;
  69 }
  70
  71 ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
  72                               const char __user *buf,
  73                               int in_len, int out_len)
  74 {
  75         struct ib_uverbs_get_context      cmd;
  76         struct ib_uverbs_get_context_resp resp;
  77         struct ib_udata                   udata;
  78         struct ib_device                 *ibdev = file->device->ib_dev;
  79         int i;
  80         int ret = in_len;
  81
  82         if (out_len < sizeof resp)
  83                 return -ENOSPC;
  84
  85         if (copy_from_user(&cmd, buf, sizeof cmd))
  86                 return -EFAULT;
  87
  88         INIT_UDATA(&udata, buf + sizeof cmd,
  89                    (unsigned long) cmd.response + sizeof resp,
  90                    in_len - sizeof cmd, out_len - sizeof resp);
  91
  92         file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);
  93         if (IS_ERR(file->ucontext)) {
  94                 ret = PTR_ERR(file->ucontext);
  95                 file->ucontext = NULL;
  96                 return ret;
  97         }
  98
  99         file->ucontext->device = ibdev;
 100         INIT_LIST_HEAD(&file->ucontext->pd_list);
 101         INIT_LIST_HEAD(&file->ucontext->mr_list);
 102         INIT_LIST_HEAD(&file->ucontext->mw_list);
 103         INIT_LIST_HEAD(&file->ucontext->cq_list);
 104         INIT_LIST_HEAD(&file->ucontext->qp_list);
 105         INIT_LIST_HEAD(&file->ucontext->srq_list);
 106         INIT_LIST_HEAD(&file->ucontext->ah_list);
 107         spin_lock_init(&file->ucontext->lock);
 108
 109         resp.async_fd = file->async_file.fd;
 110         for (i = 0; i < file->device->num_comp; ++i)
 111                 if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
 112                                  i * sizeof (__u32),
 113                                  &file->comp_file[i].fd, sizeof (__u32)))
 114                         goto err;
 115
 116         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 117                          &resp, sizeof resp))
 118                 goto err;
 119
 120         return in_len;
 121
 122 err:
 123         ibdev->dealloc_ucontext(file->ucontext);
 124         file->ucontext = NULL;
 125
 126         return -EFAULT;
 127 }
 128
 129 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
 130                                const char __user *buf,
 131                                int in_len, int out_len)
 132 {
 133         struct ib_uverbs_query_device      cmd;
 134         struct ib_uverbs_query_device_resp resp;
 135         struct ib_device_attr              attr;
 136         int                                ret;
 137
 138         if (out_len < sizeof resp)
 139                 return -ENOSPC;
 140
 141         if (copy_from_user(&cmd, buf, sizeof cmd))
 142                 return -EFAULT;
 143
 144         ret = ib_query_device(file->device->ib_dev, &attr);
 145         if (ret)
 146                 return ret;
 147
 148         memset(&resp, 0, sizeof resp);
 149
 150         resp.fw_ver                    = attr.fw_ver;
 151         resp.node_guid                 = attr.node_guid;
 152         resp.sys_image_guid            = attr.sys_image_guid;
 153         resp.max_mr_size               = attr.max_mr_size;
 154         resp.page_size_cap             = attr.page_size_cap;
 155         resp.vendor_id                 = attr.vendor_id;
 156         resp.vendor_part_id            = attr.vendor_part_id;
 157         resp.hw_ver                    = attr.hw_ver;
 158         resp.max_qp                    = attr.max_qp;
 159         resp.max_qp_wr                 = attr.max_qp_wr;
 160         resp.device_cap_flags          = attr.device_cap_flags;
 161         resp.max_sge                   = attr.max_sge;
 162         resp.max_sge_rd                = attr.max_sge_rd;
 163         resp.max_cq                    = attr.max_cq;
 164         resp.max_cqe                   = attr.max_cqe;
 165         resp.max_mr                    = attr.max_mr;
 166         resp.max_pd                    = attr.max_pd;
 167         resp.max_qp_rd_atom            = attr.max_qp_rd_atom;
 168         resp.max_ee_rd_atom            = attr.max_ee_rd_atom;
 169         resp.max_res_rd_atom           = attr.max_res_rd_atom;
 170         resp.max_qp_init_rd_atom       = attr.max_qp_init_rd_atom;
 171         resp.max_ee_init_rd_atom       = attr.max_ee_init_rd_atom;
 172         resp.atomic_cap                = attr.atomic_cap;
 173         resp.max_ee                    = attr.max_ee;
 174         resp.max_rdd                   = attr.max_rdd;
 175         resp.max_mw                    = attr.max_mw;
 176         resp.max_raw_ipv6_qp           = attr.max_raw_ipv6_qp;
 177         resp.max_raw_ethy_qp           = attr.max_raw_ethy_qp;
 178         resp.max_mcast_grp             = attr.max_mcast_grp;
 179         resp.max_mcast_qp_attach       = attr.max_mcast_qp_attach;
 180         resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
 181         resp.max_ah                    = attr.max_ah;
 182         resp.max_fmr                   = attr.max_fmr;
 183         resp.max_map_per_fmr           = attr.max_map_per_fmr;
 184         resp.max_srq                   = attr.max_srq;
 185         resp.max_srq_wr                = attr.max_srq_wr;
 186         resp.max_srq_sge               = attr.max_srq_sge;
 187         resp.max_pkeys                 = attr.max_pkeys;
 188         resp.local_ca_ack_delay        = attr.local_ca_ack_delay;
 189         resp.phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
 190
 191         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 192                          &resp, sizeof resp))
 193                 return -EFAULT;
 194
 195         return in_len;
 196 }
 197
 198 ssize_t ib_uverbs_query_port(struct ib_uverbs_file *file,
 199                              const char __user *buf,
 200                              int in_len, int out_len)
 201 {
 202         struct ib_uverbs_query_port      cmd;
 203         struct ib_uverbs_query_port_resp resp;
 204         struct ib_port_attr              attr;
 205         int                              ret;
 206
 207         if (out_len < sizeof resp)
 208                 return -ENOSPC;
 209
 210         if (copy_from_user(&cmd, buf, sizeof cmd))
 211                 return -EFAULT;
 212
 213         ret = ib_query_port(file->device->ib_dev, cmd.port_num, &attr);
 214         if (ret)
 215                 return ret;
 216
 217         memset(&resp, 0, sizeof resp);
 218
 219         resp.state           = attr.state;
 220         resp.max_mtu         = attr.max_mtu;
 221         resp.active_mtu      = attr.active_mtu;
 222         resp.gid_tbl_len     = attr.gid_tbl_len;
 223         resp.port_cap_flags  = attr.port_cap_flags;
 224         resp.max_msg_sz      = attr.max_msg_sz;
 225         resp.bad_pkey_cntr   = attr.bad_pkey_cntr;
 226         resp.qkey_viol_cntr  = attr.qkey_viol_cntr;
 227         resp.pkey_tbl_len    = attr.pkey_tbl_len;
 228         resp.lid             = attr.lid;
 229         resp.sm_lid          = attr.sm_lid;
 230         resp.lmc             = attr.lmc;
 231         resp.max_vl_num      = attr.max_vl_num;
 232         resp.sm_sl           = attr.sm_sl;
 233         resp.subnet_timeout  = attr.subnet_timeout;
 234         resp.init_type_reply = attr.init_type_reply;
 235         resp.active_width    = attr.active_width;
 236         resp.active_speed    = attr.active_speed;
 237         resp.phys_state      = attr.phys_state;
 238
 239         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 240                          &resp, sizeof resp))
 241                 return -EFAULT;
 242
 243         return in_len;
 244 }
 245
 246 ssize_t ib_uverbs_query_gid(struct ib_uverbs_file *file,
 247                             const char __user *buf,
 248                             int in_len, int out_len)
 249 {
 250         struct ib_uverbs_query_gid      cmd;
 251         struct ib_uverbs_query_gid_resp resp;
 252         int                             ret;
 253
 254         if (out_len < sizeof resp)
 255                 return -ENOSPC;
 256
 257         if (copy_from_user(&cmd, buf, sizeof cmd))
 258                 return -EFAULT;
 259
 260         memset(&resp, 0, sizeof resp);
 261
 262         ret = ib_query_gid(file->device->ib_dev, cmd.port_num, cmd.index,
 263                            (union ib_gid *) resp.gid);
 264         if (ret)
 265                 return ret;
 266
 267         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 268                          &resp, sizeof resp))
 269                 return -EFAULT;
 270
 271         return in_len;
 272 }
 273
 274 ssize_t ib_uverbs_query_pkey(struct ib_uverbs_file *file,
 275                              const char __user *buf,
 276                              int in_len, int out_len)
 277 {
 278         struct ib_uverbs_query_pkey      cmd;
 279         struct ib_uverbs_query_pkey_resp resp;
 280         int                              ret;
 281
 282         if (out_len < sizeof resp)
 283                 return -ENOSPC;
 284
 285         if (copy_from_user(&cmd, buf, sizeof cmd))
 286                 return -EFAULT;
 287
 288         memset(&resp, 0, sizeof resp);
 289
 290         ret = ib_query_pkey(file->device->ib_dev, cmd.port_num, cmd.index,
 291                             &resp.pkey);
 292         if (ret)
 293                 return ret;
 294
 295         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 296                          &resp, sizeof resp))
 297                 return -EFAULT;
 298
 299         return in_len;
 300 }
 301
 302 ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
 303                            const char __user *buf,
 304                            int in_len, int out_len)
 305 {
 306         struct ib_uverbs_alloc_pd      cmd;
 307         struct ib_uverbs_alloc_pd_resp resp;
 308         struct ib_udata                udata;
 309         struct ib_uobject             *uobj;
 310         struct ib_pd                  *pd;
 311         int                            ret;
 312
 313         if (out_len < sizeof resp)
 314                 return -ENOSPC;
 315
 316         if (copy_from_user(&cmd, buf, sizeof cmd))
 317                 return -EFAULT;
 318
 319         INIT_UDATA(&udata, buf + sizeof cmd,
 320                    (unsigned long) cmd.response + sizeof resp,
 321                    in_len - sizeof cmd, out_len - sizeof resp);
 322
 323         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 324         if (!uobj)
 325                 return -ENOMEM;
 326
 327         uobj->context = file->ucontext;
 328
 329         pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
 330                                             file->ucontext, &udata);
 331         if (IS_ERR(pd)) {
 332                 ret = PTR_ERR(pd);
 333                 goto err;
 334         }
 335
 336         pd->device  = file->device->ib_dev;
 337         pd->uobject = uobj;
 338         atomic_set(&pd->usecnt, 0);
 339
 340 retry:
 341         if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
 342                 ret = -ENOMEM;
 343                 goto err_pd;
 344         }
 345
 346         down(&ib_uverbs_idr_mutex);
 347         ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);
 348         up(&ib_uverbs_idr_mutex);
 349
 350         if (ret == -EAGAIN)
 351                 goto retry;
 352         if (ret)
 353                 goto err_pd;
 354
 355         spin_lock_irq(&file->ucontext->lock);
 356         list_add_tail(&uobj->list, &file->ucontext->pd_list);
 357         spin_unlock_irq(&file->ucontext->lock);
 358
 359         memset(&resp, 0, sizeof resp);
 360         resp.pd_handle = uobj->id;
 361
 362         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 363                          &resp, sizeof resp)) {
 364                 ret = -EFAULT;
 365                 goto err_list;
 366         }
 367
 368         return in_len;
 369
 370 err_list:
 371         spin_lock_irq(&file->ucontext->lock);
 372         list_del(&uobj->list);
 373         spin_unlock_irq(&file->ucontext->lock);
 374
 375         down(&ib_uverbs_idr_mutex);
 376         idr_remove(&ib_uverbs_pd_idr, uobj->id);
 377         up(&ib_uverbs_idr_mutex);
 378
 379 err_pd:
 380         ib_dealloc_pd(pd);
 381
 382 err:
 383         kfree(uobj);
 384         return ret;
 385 }
 386
 387 ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 388                              const char __user *buf,
 389                              int in_len, int out_len)
 390 {
 391         struct ib_uverbs_dealloc_pd cmd;
 392         struct ib_pd               *pd;
 393         struct ib_uobject          *uobj;
 394         int                         ret = -EINVAL;
 395
 396         if (copy_from_user(&cmd, buf, sizeof cmd))
 397                 return -EFAULT;
 398
 399         down(&ib_uverbs_idr_mutex);
 400
 401         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 402         if (!pd || pd->uobject->context != file->ucontext)
 403                 goto out;
 404
 405         uobj = pd->uobject;
 406
 407         ret = ib_dealloc_pd(pd);
 408         if (ret)
 409                 goto out;
 410
 411         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 412
 413         spin_lock_irq(&file->ucontext->lock);
 414         list_del(&uobj->list);
 415         spin_unlock_irq(&file->ucontext->lock);
 416
 417         kfree(uobj);
 418
 419 out:
 420         up(&ib_uverbs_idr_mutex);
 421
 422         return ret ? ret : in_len;
 423 }
 424
 425 ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
 426                          const char __user *buf, int in_len,
 427                          int out_len)
 428 {
 429         struct ib_uverbs_reg_mr      cmd;
 430         struct ib_uverbs_reg_mr_resp resp;
 431         struct ib_udata              udata;
 432         struct ib_umem_object       *obj;
 433         struct ib_pd                *pd;
 434         struct ib_mr                *mr;
 435         int                          ret;
 436
 437         if (out_len < sizeof resp)
 438                 return -ENOSPC;
 439
 440         if (copy_from_user(&cmd, buf, sizeof cmd))
 441                 return -EFAULT;
 442
 443         INIT_UDATA(&udata, buf + sizeof cmd,
 444                    (unsigned long) cmd.response + sizeof resp,
 445                    in_len - sizeof cmd, out_len - sizeof resp);
 446
 447         if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
 448                 return -EINVAL;
 449
 450         obj = kmalloc(sizeof *obj, GFP_KERNEL);
 451         if (!obj)
 452                 return -ENOMEM;
 453
 454         obj->uobject.context = file->ucontext;
 455
 456         /*
 457          * We ask for writable memory if any access flags other than
 458          * "remote read" are set.  "Local write" and "remote write"
 459          * obviously require write access.  "Remote atomic" can do
 460          * things like fetch and add, which will modify memory, and
 461          * "MW bind" can change permissions by binding a window.
 462          */
 463         ret = ib_umem_get(file->device->ib_dev, &obj->umem,
 464                           (void *) (unsigned long) cmd.start, cmd.length,
 465                           !!(cmd.access_flags & ~IB_ACCESS_REMOTE_READ));
 466         if (ret)
 467                 goto err_free;
 468
 469         obj->umem.virt_base = cmd.hca_va;
 470
 471         down(&ib_uverbs_idr_mutex);
 472
 473         pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 474         if (!pd || pd->uobject->context != file->ucontext) {
 475                 ret = -EINVAL;
 476                 goto err_up;
 477         }
 478
 479         if (!pd->device->reg_user_mr) {
 480                 ret = -ENOSYS;
 481                 goto err_up;
 482         }
 483
 484         mr = pd->device->reg_user_mr(pd, &obj->umem, cmd.access_flags, &udata);
 485         if (IS_ERR(mr)) {
 486                 ret = PTR_ERR(mr);
 487                 goto err_up;
 488         }
 489
 490         mr->device  = pd->device;
 491         mr->pd      = pd;
 492         mr->uobject = &obj->uobject;
 493         atomic_inc(&pd->usecnt);
 494         atomic_set(&mr->usecnt, 0);
 495
 496         memset(&resp, 0, sizeof resp);
 497         resp.lkey = mr->lkey;
 498         resp.rkey = mr->rkey;
 499
 500 retry:
 501         if (!idr_pre_get(&ib_uverbs_mr_idr, GFP_KERNEL)) {
 502                 ret = -ENOMEM;
 503                 goto err_unreg;
 504         }
 505
 506         ret = idr_get_new(&ib_uverbs_mr_idr, mr, &obj->uobject.id);
 507
 508         if (ret == -EAGAIN)
 509                 goto retry;
 510         if (ret)
 511                 goto err_unreg;
 512
 513         resp.mr_handle = obj->uobject.id;
 514
 515         spin_lock_irq(&file->ucontext->lock);
 516         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
 517         spin_unlock_irq(&file->ucontext->lock);
 518
 519         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 520                          &resp, sizeof resp)) {
 521                 ret = -EFAULT;
 522                 goto err_list;
 523         }
 524
 525         up(&ib_uverbs_idr_mutex);
 526
 527         return in_len;
 528
 529 err_list:
 530         spin_lock_irq(&file->ucontext->lock);
 531         list_del(&obj->uobject.list);
 532         spin_unlock_irq(&file->ucontext->lock);
 533
 534 err_unreg:
 535         ib_dereg_mr(mr);
 536
 537 err_up:
 538         up(&ib_uverbs_idr_mutex);
 539
 540         ib_umem_release(file->device->ib_dev, &obj->umem);
 541
 542 err_free:
 543         kfree(obj);
 544         return ret;
 545 }
 546
 547 ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 548                            const char __user *buf, int in_len,
 549                            int out_len)
 550 {
 551         struct ib_uverbs_dereg_mr cmd;
 552         struct ib_mr             *mr;
 553         struct ib_umem_object    *memobj;
 554         int                       ret = -EINVAL;
 555
 556         if (copy_from_user(&cmd, buf, sizeof cmd))
 557                 return -EFAULT;
 558
 559         down(&ib_uverbs_idr_mutex);
 560
 561         mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
 562         if (!mr || mr->uobject->context != file->ucontext)
 563                 goto out;
 564
 565         memobj = container_of(mr->uobject, struct ib_umem_object, uobject);
 566
 567         ret = ib_dereg_mr(mr);
 568         if (ret)
 569                 goto out;
 570
 571         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 572
 573         spin_lock_irq(&file->ucontext->lock);
 574         list_del(&memobj->uobject.list);
 575         spin_unlock_irq(&file->ucontext->lock);
 576
 577         ib_umem_release(file->device->ib_dev, &memobj->umem);
 578         kfree(memobj);
 579
 580 out:
 581         up(&ib_uverbs_idr_mutex);
 582
 583         return ret ? ret : in_len;
 584 }
 585
 586 ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
 587                             const char __user *buf, int in_len,
 588                             int out_len)
 589 {
 590         struct ib_uverbs_create_cq      cmd;
 591         struct ib_uverbs_create_cq_resp resp;
 592         struct ib_udata                 udata;
 593         struct ib_ucq_object           *uobj;
 594         struct ib_cq                   *cq;
 595         int                             ret;
 596
 597         if (out_len < sizeof resp)
 598                 return -ENOSPC;
 599
 600         if (copy_from_user(&cmd, buf, sizeof cmd))
 601                 return -EFAULT;
 602
 603         INIT_UDATA(&udata, buf + sizeof cmd,
 604                    (unsigned long) cmd.response + sizeof resp,
 605                    in_len - sizeof cmd, out_len - sizeof resp);
 606
 607         if (cmd.event_handler >= file->device->num_comp)
 608                 return -EINVAL;
 609
 610         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 611         if (!uobj)
 612                 return -ENOMEM;
 613
 614         uobj->uobject.user_handle   = cmd.user_handle;
 615         uobj->uobject.context       = file->ucontext;
 616         uobj->comp_events_reported  = 0;
 617         uobj->async_events_reported = 0;
 618         INIT_LIST_HEAD(&uobj->comp_list);
 619         INIT_LIST_HEAD(&uobj->async_list);
 620
 621         cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,
 622                                              file->ucontext, &udata);
 623         if (IS_ERR(cq)) {
 624                 ret = PTR_ERR(cq);
 625                 goto err;
 626         }
 627
 628         cq->device        = file->device->ib_dev;
 629         cq->uobject       = &uobj->uobject;
 630         cq->comp_handler  = ib_uverbs_comp_handler;
 631         cq->event_handler = ib_uverbs_cq_event_handler;
 632         cq->cq_context    = file;
 633         atomic_set(&cq->usecnt, 0);
 634
 635 retry:
 636         if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
 637                 ret = -ENOMEM;
 638                 goto err_cq;
 639         }
 640
 641         down(&ib_uverbs_idr_mutex);
 642         ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->uobject.id);
 643         up(&ib_uverbs_idr_mutex);
 644
 645         if (ret == -EAGAIN)
 646                 goto retry;
 647         if (ret)
 648                 goto err_cq;
 649
 650         spin_lock_irq(&file->ucontext->lock);
 651         list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
 652         spin_unlock_irq(&file->ucontext->lock);
 653
 654         memset(&resp, 0, sizeof resp);
 655         resp.cq_handle = uobj->uobject.id;
 656         resp.cqe       = cq->cqe;
 657
 658         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 659                          &resp, sizeof resp)) {
 660                 ret = -EFAULT;
 661                 goto err_list;
 662         }
 663
 664         return in_len;
 665
 666 err_list:
 667         spin_lock_irq(&file->ucontext->lock);
 668         list_del(&uobj->uobject.list);
 669         spin_unlock_irq(&file->ucontext->lock);
 670
 671         down(&ib_uverbs_idr_mutex);
 672         idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
 673         up(&ib_uverbs_idr_mutex);
 674
 675 err_cq:
 676         ib_destroy_cq(cq);
 677
 678 err:
 679         kfree(uobj);
 680         return ret;
 681 }
 682
 683 ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 684                              const char __user *buf, int in_len,
 685                              int out_len)
 686 {
 687         struct ib_uverbs_destroy_cq      cmd;
 688         struct ib_uverbs_destroy_cq_resp resp;
 689         struct ib_cq                    *cq;
 690         struct ib_ucq_object            *uobj;
 691         struct ib_uverbs_event          *evt, *tmp;
 692         u64                              user_handle;
 693         int                              ret = -EINVAL;
 694
 695         if (copy_from_user(&cmd, buf, sizeof cmd))
 696                 return -EFAULT;
 697
 698         memset(&resp, 0, sizeof resp);
 699
 700         down(&ib_uverbs_idr_mutex);
 701
 702         cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
 703         if (!cq || cq->uobject->context != file->ucontext)
 704                 goto out;
 705
 706         user_handle = cq->uobject->user_handle;
 707         uobj = container_of(cq->uobject, struct ib_ucq_object, uobject);
 708
 709         ret = ib_destroy_cq(cq);
 710         if (ret)
 711                 goto out;
 712
 713         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 714
 715         spin_lock_irq(&file->ucontext->lock);
 716         list_del(&uobj->uobject.list);
 717         spin_unlock_irq(&file->ucontext->lock);
 718
 719         spin_lock_irq(&file->comp_file[0].lock);
 720         list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
 721                 list_del(&evt->list);
 722                 kfree(evt);
 723         }
 724         spin_unlock_irq(&file->comp_file[0].lock);
 725
 726         spin_lock_irq(&file->async_file.lock);
 727         list_for_each_entry_safe(evt, tmp, &uobj->async_list, obj_list) {
 728                 list_del(&evt->list);
 729                 kfree(evt);
 730         }
 731         spin_unlock_irq(&file->async_file.lock);
 732
 733         resp.comp_events_reported  = uobj->comp_events_reported;
 734         resp.async_events_reported = uobj->async_events_reported;
 735
 736         kfree(uobj);
 737
 738         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 739                          &resp, sizeof resp))
 740                 ret = -EFAULT;
 741
 742 out:
 743         up(&ib_uverbs_idr_mutex);
 744
 745         return ret ? ret : in_len;
 746 }
 747
 748 ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
 749                             const char __user *buf, int in_len,
 750                             int out_len)
 751 {
 752         struct ib_uverbs_create_qp      cmd;
 753         struct ib_uverbs_create_qp_resp resp;
 754         struct ib_udata                 udata;
 755         struct ib_uevent_object        *uobj;
 756         struct ib_pd                   *pd;
 757         struct ib_cq                   *scq, *rcq;
 758         struct ib_srq                  *srq;
 759         struct ib_qp                   *qp;
 760         struct ib_qp_init_attr          attr;
 761         int ret;
 762
 763         if (out_len < sizeof resp)
 764                 return -ENOSPC;
 765
 766         if (copy_from_user(&cmd, buf, sizeof cmd))
 767                 return -EFAULT;
 768
 769         INIT_UDATA(&udata, buf + sizeof cmd,
 770                    (unsigned long) cmd.response + sizeof resp,
 771                    in_len - sizeof cmd, out_len - sizeof resp);
 772
 773         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 774         if (!uobj)
 775                 return -ENOMEM;
 776
 777         down(&ib_uverbs_idr_mutex);
 778
 779         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
 780         scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
 781         rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
 782         srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
 783
 784         if (!pd  || pd->uobject->context  != file->ucontext ||
 785             !scq || scq->uobject->context != file->ucontext ||
 786             !rcq || rcq->uobject->context != file->ucontext ||
 787             (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
 788                 ret = -EINVAL;
 789                 goto err_up;
 790         }
 791
 792         attr.event_handler = ib_uverbs_qp_event_handler;
 793         attr.qp_context    = file;
 794         attr.send_cq       = scq;
 795         attr.recv_cq       = rcq;
 796         attr.srq           = srq;
 797         attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
 798         attr.qp_type       = cmd.qp_type;
 799
 800         attr.cap.max_send_wr     = cmd.max_send_wr;
 801         attr.cap.max_recv_wr     = cmd.max_recv_wr;
 802         attr.cap.max_send_sge    = cmd.max_send_sge;
 803         attr.cap.max_recv_sge    = cmd.max_recv_sge;
 804         attr.cap.max_inline_data = cmd.max_inline_data;
 805
 806         uobj->uobject.user_handle = cmd.user_handle;
 807         uobj->uobject.context     = file->ucontext;
 808         uobj->events_reported     = 0;
 809         INIT_LIST_HEAD(&uobj->event_list);
 810
 811         qp = pd->device->create_qp(pd, &attr, &udata);
 812         if (IS_ERR(qp)) {
 813                 ret = PTR_ERR(qp);
 814                 goto err_up;
 815         }
 816
 817         qp->device        = pd->device;
 818         qp->pd            = pd;
 819         qp->send_cq       = attr.send_cq;
 820         qp->recv_cq       = attr.recv_cq;
 821         qp->srq           = attr.srq;
 822         qp->uobject       = &uobj->uobject;
 823         qp->event_handler = attr.event_handler;
 824         qp->qp_context    = attr.qp_context;
 825         qp->qp_type       = attr.qp_type;
 826         atomic_inc(&pd->usecnt);
 827         atomic_inc(&attr.send_cq->usecnt);
 828         atomic_inc(&attr.recv_cq->usecnt);
 829         if (attr.srq)
 830                 atomic_inc(&attr.srq->usecnt);
 831
 832         memset(&resp, 0, sizeof resp);
 833         resp.qpn = qp->qp_num;
 834
 835 retry:
 836         if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {
 837                 ret = -ENOMEM;
 838                 goto err_destroy;
 839         }
 840
 841         ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uobject.id);
 842
 843         if (ret == -EAGAIN)
 844                 goto retry;
 845         if (ret)
 846                 goto err_destroy;
 847
 848         resp.qp_handle = uobj->uobject.id;
 849
 850         spin_lock_irq(&file->ucontext->lock);
 851         list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
 852         spin_unlock_irq(&file->ucontext->lock);
 853
 854         if (copy_to_user((void __user *) (unsigned long) cmd.response,
 855                          &resp, sizeof resp)) {
 856                 ret = -EFAULT;
 857                 goto err_list;
 858         }
 859
 860         up(&ib_uverbs_idr_mutex);
 861
 862         return in_len;
 863
 864 err_list:
 865         spin_lock_irq(&file->ucontext->lock);
 866         list_del(&uobj->uobject.list);
 867         spin_unlock_irq(&file->ucontext->lock);
 868
 869 err_destroy:
 870         ib_destroy_qp(qp);
 871
 872 err_up:
 873         up(&ib_uverbs_idr_mutex);
 874
 875         kfree(uobj);
 876         return ret;
 877 }
 878
 879 ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 880                             const char __user *buf, int in_len,
 881                             int out_len)
 882 {
 883         struct ib_uverbs_modify_qp cmd;
 884         struct ib_qp              *qp;
 885         struct ib_qp_attr         *attr;
 886         int                        ret;
 887
 888         if (copy_from_user(&cmd, buf, sizeof cmd))
 889                 return -EFAULT;
 890
 891         attr = kmalloc(sizeof *attr, GFP_KERNEL);
 892         if (!attr)
 893                 return -ENOMEM;
 894
 895         down(&ib_uverbs_idr_mutex);
 896
 897         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 898         if (!qp || qp->uobject->context != file->ucontext) {
 899                 ret = -EINVAL;
 900                 goto out;
 901         }
 902
 903         attr->qp_state            = cmd.qp_state;
 904         attr->cur_qp_state        = cmd.cur_qp_state;
 905         attr->path_mtu            = cmd.path_mtu;
 906         attr->path_mig_state      = cmd.path_mig_state;
 907         attr->qkey                = cmd.qkey;
 908         attr->rq_psn              = cmd.rq_psn;
 909         attr->sq_psn              = cmd.sq_psn;
 910         attr->dest_qp_num         = cmd.dest_qp_num;
 911         attr->qp_access_flags     = cmd.qp_access_flags;
 912         attr->pkey_index          = cmd.pkey_index;
 913         attr->alt_pkey_index      = cmd.pkey_index;
 914         attr->en_sqd_async_notify = cmd.en_sqd_async_notify;
 915         attr->max_rd_atomic       = cmd.max_rd_atomic;
 916         attr->max_dest_rd_atomic  = cmd.max_dest_rd_atomic;
 917         attr->min_rnr_timer       = cmd.min_rnr_timer;
 918         attr->port_num            = cmd.port_num;
 919         attr->timeout             = cmd.timeout;
 920         attr->retry_cnt           = cmd.retry_cnt;
 921         attr->rnr_retry           = cmd.rnr_retry;
 922         attr->alt_port_num        = cmd.alt_port_num;
 923         attr->alt_timeout         = cmd.alt_timeout;
 924
 925         memcpy(attr->ah_attr.grh.dgid.raw, cmd.dest.dgid, 16);
 926         attr->ah_attr.grh.flow_label        = cmd.dest.flow_label;
 927         attr->ah_attr.grh.sgid_index        = cmd.dest.sgid_index;
 928         attr->ah_attr.grh.hop_limit         = cmd.dest.hop_limit;
 929         attr->ah_attr.grh.traffic_class     = cmd.dest.traffic_class;
 930         attr->ah_attr.dlid                  = cmd.dest.dlid;
 931         attr->ah_attr.sl                    = cmd.dest.sl;
 932         attr->ah_attr.src_path_bits         = cmd.dest.src_path_bits;
 933         attr->ah_attr.static_rate           = cmd.dest.static_rate;
 934         attr->ah_attr.ah_flags              = cmd.dest.is_global ? IB_AH_GRH : 0;
 935         attr->ah_attr.port_num              = cmd.dest.port_num;
 936
 937         memcpy(attr->alt_ah_attr.grh.dgid.raw, cmd.alt_dest.dgid, 16);
 938         attr->alt_ah_attr.grh.flow_label    = cmd.alt_dest.flow_label;
 939         attr->alt_ah_attr.grh.sgid_index    = cmd.alt_dest.sgid_index;
 940         attr->alt_ah_attr.grh.hop_limit     = cmd.alt_dest.hop_limit;
 941         attr->alt_ah_attr.grh.traffic_class = cmd.alt_dest.traffic_class;
 942         attr->alt_ah_attr.dlid              = cmd.alt_dest.dlid;
 943         attr->alt_ah_attr.sl                = cmd.alt_dest.sl;
 944         attr->alt_ah_attr.src_path_bits     = cmd.alt_dest.src_path_bits;
 945         attr->alt_ah_attr.static_rate       = cmd.alt_dest.static_rate;
 946         attr->alt_ah_attr.ah_flags          = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
 947         attr->alt_ah_attr.port_num          = cmd.alt_dest.port_num;
 948
 949         ret = ib_modify_qp(qp, attr, cmd.attr_mask);
 950         if (ret)
 951                 goto out;
 952
 953         ret = in_len;
 954
 955 out:
 956         up(&ib_uverbs_idr_mutex);
 957         kfree(attr);
 958
 959         return ret;
 960 }
 961
 962 ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
 963                              const char __user *buf, int in_len,
 964                              int out_len)
 965 {
 966         struct ib_uverbs_destroy_qp      cmd;
 967         struct ib_uverbs_destroy_qp_resp resp;
 968         struct ib_qp                    *qp;
 969         struct ib_uevent_object         *uobj;
 970         struct ib_uverbs_event          *evt, *tmp;
 971         int                              ret = -EINVAL;
 972
 973         if (copy_from_user(&cmd, buf, sizeof cmd))
 974                 return -EFAULT;
 975
 976         memset(&resp, 0, sizeof resp);
 977
 978         down(&ib_uverbs_idr_mutex);
 979
 980         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
 981         if (!qp || qp->uobject->context != file->ucontext)
 982                 goto out;
 983
 984         uobj = container_of(qp->uobject, struct ib_uevent_object, uobject);
 985
 986         ret = ib_destroy_qp(qp);
 987         if (ret)
 988                 goto out;
 989
 990         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
 991
 992         spin_lock_irq(&file->ucontext->lock);
 993         list_del(&uobj->uobject.list);
 994         spin_unlock_irq(&file->ucontext->lock);
 995
 996         spin_lock_irq(&file->async_file.lock);
 997         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
 998                 list_del(&evt->list);
 999                 kfree(evt);
1000         }
1001         spin_unlock_irq(&file->async_file.lock);
1002
1003         resp.events_reported = uobj->events_reported;
1004
1005         kfree(uobj);
1006
1007         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1008                          &resp, sizeof resp))
1009                 ret = -EFAULT;
1010
1011 out:
1012         up(&ib_uverbs_idr_mutex);
1013
1014         return ret ? ret : in_len;
1015 }
1016
1017 ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
1018                                const char __user *buf, int in_len,
1019                                int out_len)
1020 {
1021         struct ib_uverbs_attach_mcast cmd;
1022         struct ib_qp                 *qp;
1023         int                           ret = -EINVAL;
1024
1025         if (copy_from_user(&cmd, buf, sizeof cmd))
1026                 return -EFAULT;
1027
1028         down(&ib_uverbs_idr_mutex);
1029
1030         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1031         if (qp && qp->uobject->context == file->ucontext)
1032                 ret = ib_attach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1033
1034         up(&ib_uverbs_idr_mutex);
1035
1036         return ret ? ret : in_len;
1037 }
1038
1039 ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
1040                                const char __user *buf, int in_len,
1041                                int out_len)
1042 {
1043         struct ib_uverbs_detach_mcast cmd;
1044         struct ib_qp                 *qp;
1045         int                           ret = -EINVAL;
1046
1047         if (copy_from_user(&cmd, buf, sizeof cmd))
1048                 return -EFAULT;
1049
1050         down(&ib_uverbs_idr_mutex);
1051
1052         qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
1053         if (qp && qp->uobject->context == file->ucontext)
1054                 ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
1055
1056         up(&ib_uverbs_idr_mutex);
1057
1058         return ret ? ret : in_len;
1059 }
1060
1061 ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
1062                              const char __user *buf, int in_len,
1063                              int out_len)
1064 {
1065         struct ib_uverbs_create_srq      cmd;
1066         struct ib_uverbs_create_srq_resp resp;
1067         struct ib_udata                  udata;
1068         struct ib_uevent_object         *uobj;
1069         struct ib_pd                    *pd;
1070         struct ib_srq                   *srq;
1071         struct ib_srq_init_attr          attr;
1072         int ret;
1073
1074         if (out_len < sizeof resp)
1075                 return -ENOSPC;
1076
1077         if (copy_from_user(&cmd, buf, sizeof cmd))
1078                 return -EFAULT;
1079
1080         INIT_UDATA(&udata, buf + sizeof cmd,
1081                    (unsigned long) cmd.response + sizeof resp,
1082                    in_len - sizeof cmd, out_len - sizeof resp);
1083
1084         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
1085         if (!uobj)
1086                 return -ENOMEM;
1087
1088         down(&ib_uverbs_idr_mutex);
1089
1090         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
1091
1092         if (!pd || pd->uobject->context != file->ucontext) {
1093                 ret = -EINVAL;
1094                 goto err_up;
1095         }
1096
1097         attr.event_handler  = ib_uverbs_srq_event_handler;
1098         attr.srq_context    = file;
1099         attr.attr.max_wr    = cmd.max_wr;
1100         attr.attr.max_sge   = cmd.max_sge;
1101         attr.attr.srq_limit = cmd.srq_limit;
1102
1103         uobj->uobject.user_handle = cmd.user_handle;
1104         uobj->uobject.context     = file->ucontext;
1105         uobj->events_reported     = 0;
1106         INIT_LIST_HEAD(&uobj->event_list);
1107
1108         srq = pd->device->create_srq(pd, &attr, &udata);
1109         if (IS_ERR(srq)) {
1110                 ret = PTR_ERR(srq);
1111                 goto err_up;
1112         }
1113
1114         srq->device        = pd->device;
1115         srq->pd            = pd;
1116         srq->uobject       = &uobj->uobject;
1117         srq->event_handler = attr.event_handler;
1118         srq->srq_context   = attr.srq_context;
1119         atomic_inc(&pd->usecnt);
1120         atomic_set(&srq->usecnt, 0);
1121
1122         memset(&resp, 0, sizeof resp);
1123
1124 retry:
1125         if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
1126                 ret = -ENOMEM;
1127                 goto err_destroy;
1128         }
1129
1130         ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->uobject.id);
1131
1132         if (ret == -EAGAIN)
1133                 goto retry;
1134         if (ret)
1135                 goto err_destroy;
1136
1137         resp.srq_handle = uobj->uobject.id;
1138
1139         spin_lock_irq(&file->ucontext->lock);
1140         list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
1141         spin_unlock_irq(&file->ucontext->lock);
1142
1143         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1144                          &resp, sizeof resp)) {
1145                 ret = -EFAULT;
1146                 goto err_list;
1147         }
1148
1149         up(&ib_uverbs_idr_mutex);
1150
1151         return in_len;
1152
1153 err_list:
1154         spin_lock_irq(&file->ucontext->lock);
1155         list_del(&uobj->uobject.list);
1156         spin_unlock_irq(&file->ucontext->lock);
1157
1158 err_destroy:
1159         ib_destroy_srq(srq);
1160
1161 err_up:
1162         up(&ib_uverbs_idr_mutex);
1163
1164         kfree(uobj);
1165         return ret;
1166 }
1167
1168 ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
1169                              const char __user *buf, int in_len,
1170                              int out_len)
1171 {
1172         struct ib_uverbs_modify_srq cmd;
1173         struct ib_srq              *srq;
1174         struct ib_srq_attr          attr;
1175         int                         ret;
1176
1177         if (copy_from_user(&cmd, buf, sizeof cmd))
1178                 return -EFAULT;
1179
1180         down(&ib_uverbs_idr_mutex);
1181
1182         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1183         if (!srq || srq->uobject->context != file->ucontext) {
1184                 ret = -EINVAL;
1185                 goto out;
1186         }
1187
1188         attr.max_wr    = cmd.max_wr;
1189         attr.max_sge   = cmd.max_sge;
1190         attr.srq_limit = cmd.srq_limit;
1191
1192         ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
1193
1194 out:
1195         up(&ib_uverbs_idr_mutex);
1196
1197         return ret ? ret : in_len;
1198 }
1199
1200 ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
1201                               const char __user *buf, int in_len,
1202                               int out_len)
1203 {
1204         struct ib_uverbs_destroy_srq      cmd;
1205         struct ib_uverbs_destroy_srq_resp resp;
1206         struct ib_srq                    *srq;
1207         struct ib_uevent_object          *uobj;
1208         struct ib_uverbs_event           *evt, *tmp;
1209         int                               ret = -EINVAL;
1210
1211         if (copy_from_user(&cmd, buf, sizeof cmd))
1212                 return -EFAULT;
1213
1214         down(&ib_uverbs_idr_mutex);
1215
1216         memset(&resp, 0, sizeof resp);
1217
1218         srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
1219         if (!srq || srq->uobject->context != file->ucontext)
1220                 goto out;
1221
1222         uobj = container_of(srq->uobject, struct ib_uevent_object, uobject);
1223
1224         ret = ib_destroy_srq(srq);
1225         if (ret)
1226                 goto out;
1227
1228         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
1229
1230         spin_lock_irq(&file->ucontext->lock);
1231         list_del(&uobj->uobject.list);
1232         spin_unlock_irq(&file->ucontext->lock);
1233
1234         spin_lock_irq(&file->async_file.lock);
1235         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
1236                 list_del(&evt->list);
1237                 kfree(evt);
1238         }
1239         spin_unlock_irq(&file->async_file.lock);
1240
1241         resp.events_reported = uobj->events_reported;
1242
1243         kfree(uobj);
1244
1245         if (copy_to_user((void __user *) (unsigned long) cmd.response,
1246                          &resp, sizeof resp))
1247                 ret = -EFAULT;
1248
1249 out:
1250         up(&ib_uverbs_idr_mutex);
1251
1252         return ret ? ret : in_len;
1253 }