1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause OR GPL-2.0
3  *
4  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
5  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
6  *
7  * This software is available to you under a choice of one of two
8  * licenses.  You may choose to be licensed under the terms of the GNU
9  * General Public License (GPL) Version 2, available from the file
10  * COPYING in the main directory of this source tree, or the
11  * OpenIB.org BSD license below:
12  *
13  *     Redistribution and use in source and binary forms, with or
14  *     without modification, are permitted provided that the following
15  *     conditions are met:
16  *
17  *      - Redistributions of source code must retain the above
18  *	copyright notice, this list of conditions and the following
19  *	disclaimer.
20  *
21  *      - Redistributions in binary form must reproduce the above
22  *	copyright notice, this list of conditions and the following
23  *	disclaimer in the documentation and/or other materials
24  *	provided with the distribution.
25  *
26  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33  * SOFTWARE.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <linux/completion.h>
40 #include <linux/fs.h>
41 #include <linux/module.h>
42 #include <linux/device.h>
43 #include <linux/err.h>
44 #include <linux/poll.h>
45 #include <linux/sched.h>
46 #include <linux/file.h>
47 #include <linux/cdev.h>
48 #include <linux/idr.h>
49 #include <linux/mutex.h>
50 #include <linux/slab.h>
51 
52 #include <asm/uaccess.h>
53 
54 #include <rdma/ib.h>
55 #include <rdma/ib_cm.h>
56 #include <rdma/ib_user_cm.h>
57 #include <rdma/ib_marshall.h>
58 
59 MODULE_AUTHOR("Libor Michalek");
60 MODULE_DESCRIPTION("InfiniBand userspace Connection Manager access");
61 MODULE_LICENSE("Dual BSD/GPL");
62 
63 struct ib_ucm_device {
64 	int			devnum;
65 	struct cdev		cdev;
66 	struct device		dev;
67 	struct ib_device	*ib_dev;
68 };
69 
70 struct ib_ucm_file {
71 	struct mutex file_mutex;
72 	struct file *filp;
73 	struct ib_ucm_device *device;
74 
75 	struct list_head  ctxs;
76 	struct list_head  events;
77 	wait_queue_head_t poll_wait;
78 };
79 
80 struct ib_ucm_context {
81 	int                 id;
82 	struct completion   comp;
83 	atomic_t            ref;
84 	int		    events_reported;
85 
86 	struct ib_ucm_file *file;
87 	struct ib_cm_id    *cm_id;
88 	__u64		   uid;
89 
90 	struct list_head    events;    /* list of pending events. */
91 	struct list_head    file_list; /* member in file ctx list */
92 };
93 
94 struct ib_ucm_event {
95 	struct ib_ucm_context *ctx;
96 	struct list_head file_list; /* member in file event list */
97 	struct list_head ctx_list;  /* member in ctx event list */
98 
99 	struct ib_cm_id *cm_id;
100 	struct ib_ucm_event_resp resp;
101 	void *data;
102 	void *info;
103 	int data_len;
104 	int info_len;
105 };
106 
107 enum {
108 	IB_UCM_MAJOR = 231,
109 	IB_UCM_BASE_MINOR = 224,
110 	IB_UCM_MAX_DEVICES = 32
111 };
112 
113 #define IB_UCM_BASE_DEV MKDEV(IB_UCM_MAJOR, IB_UCM_BASE_MINOR)
114 
115 static void ib_ucm_add_one(struct ib_device *device);
116 static void ib_ucm_remove_one(struct ib_device *device, void *client_data);
117 
118 static struct ib_client ucm_client = {
119 	.name   = "ucm",
120 	.add    = ib_ucm_add_one,
121 	.remove = ib_ucm_remove_one
122 };
123 
124 static DEFINE_MUTEX(ctx_id_mutex);
125 static DEFINE_IDR(ctx_id_table);
126 static DECLARE_BITMAP(dev_map, IB_UCM_MAX_DEVICES);
127 
128 static struct ib_ucm_context *ib_ucm_ctx_get(struct ib_ucm_file *file, int id)
129 {
130 	struct ib_ucm_context *ctx;
131 
132 	mutex_lock(&ctx_id_mutex);
133 	ctx = idr_find(&ctx_id_table, id);
134 	if (!ctx)
135 		ctx = ERR_PTR(-ENOENT);
136 	else if (ctx->file != file)
137 		ctx = ERR_PTR(-EINVAL);
138 	else
139 		atomic_inc(&ctx->ref);
140 	mutex_unlock(&ctx_id_mutex);
141 
142 	return ctx;
143 }
144 
145 static void ib_ucm_ctx_put(struct ib_ucm_context *ctx)
146 {
147 	if (atomic_dec_and_test(&ctx->ref))
148 		complete(&ctx->comp);
149 }
150 
151 static inline int ib_ucm_new_cm_id(int event)
152 {
153 	return event == IB_CM_REQ_RECEIVED || event == IB_CM_SIDR_REQ_RECEIVED;
154 }
155 
156 static void ib_ucm_cleanup_events(struct ib_ucm_context *ctx)
157 {
158 	struct ib_ucm_event *uevent;
159 
160 	mutex_lock(&ctx->file->file_mutex);
161 	list_del(&ctx->file_list);
162 	while (!list_empty(&ctx->events)) {
163 
164 		uevent = list_entry(ctx->events.next,
165 				    struct ib_ucm_event, ctx_list);
166 		list_del(&uevent->file_list);
167 		list_del(&uevent->ctx_list);
168 		mutex_unlock(&ctx->file->file_mutex);
169 
170 		/* clear incoming connections. */
171 		if (ib_ucm_new_cm_id(uevent->resp.event))
172 			ib_destroy_cm_id(uevent->cm_id);
173 
174 		kfree(uevent);
175 		mutex_lock(&ctx->file->file_mutex);
176 	}
177 	mutex_unlock(&ctx->file->file_mutex);
178 }
179 
180 static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
181 {
182 	struct ib_ucm_context *ctx;
183 
184 	ctx = kzalloc(sizeof *ctx, GFP_KERNEL);
185 	if (!ctx)
186 		return NULL;
187 
188 	atomic_set(&ctx->ref, 1);
189 	init_completion(&ctx->comp);
190 	ctx->file = file;
191 	INIT_LIST_HEAD(&ctx->events);
192 
193 	mutex_lock(&ctx_id_mutex);
194 	ctx->id = idr_alloc(&ctx_id_table, ctx, 0, 0, GFP_KERNEL);
195 	mutex_unlock(&ctx_id_mutex);
196 	if (ctx->id < 0)
197 		goto error;
198 
199 	list_add_tail(&ctx->file_list, &file->ctxs);
200 	return ctx;
201 
202 error:
203 	kfree(ctx);
204 	return NULL;
205 }
206 
207 static void ib_ucm_event_req_get(struct ib_ucm_req_event_resp *ureq,
208 				 struct ib_cm_req_event_param *kreq)
209 {
210 	ureq->remote_ca_guid             = kreq->remote_ca_guid;
211 	ureq->remote_qkey                = kreq->remote_qkey;
212 	ureq->remote_qpn                 = kreq->remote_qpn;
213 	ureq->qp_type                    = kreq->qp_type;
214 	ureq->starting_psn               = kreq->starting_psn;
215 	ureq->responder_resources        = kreq->responder_resources;
216 	ureq->initiator_depth            = kreq->initiator_depth;
217 	ureq->local_cm_response_timeout  = kreq->local_cm_response_timeout;
218 	ureq->flow_control               = kreq->flow_control;
219 	ureq->remote_cm_response_timeout = kreq->remote_cm_response_timeout;
220 	ureq->retry_count                = kreq->retry_count;
221 	ureq->rnr_retry_count            = kreq->rnr_retry_count;
222 	ureq->srq                        = kreq->srq;
223 	ureq->port			 = kreq->port;
224 
225 	ib_copy_path_rec_to_user(&ureq->primary_path, kreq->primary_path);
226 	if (kreq->alternate_path)
227 		ib_copy_path_rec_to_user(&ureq->alternate_path,
228 					 kreq->alternate_path);
229 }
230 
231 static void ib_ucm_event_rep_get(struct ib_ucm_rep_event_resp *urep,
232 				 struct ib_cm_rep_event_param *krep)
233 {
234 	urep->remote_ca_guid      = krep->remote_ca_guid;
235 	urep->remote_qkey         = krep->remote_qkey;
236 	urep->remote_qpn          = krep->remote_qpn;
237 	urep->starting_psn        = krep->starting_psn;
238 	urep->responder_resources = krep->responder_resources;
239 	urep->initiator_depth     = krep->initiator_depth;
240 	urep->target_ack_delay    = krep->target_ack_delay;
241 	urep->failover_accepted   = krep->failover_accepted;
242 	urep->flow_control        = krep->flow_control;
243 	urep->rnr_retry_count     = krep->rnr_retry_count;
244 	urep->srq                 = krep->srq;
245 }
246 
247 static void ib_ucm_event_sidr_rep_get(struct ib_ucm_sidr_rep_event_resp *urep,
248 				      struct ib_cm_sidr_rep_event_param *krep)
249 {
250 	urep->status = krep->status;
251 	urep->qkey   = krep->qkey;
252 	urep->qpn    = krep->qpn;
253 };
254 
255 static int ib_ucm_event_process(struct ib_cm_event *evt,
256 				struct ib_ucm_event *uvt)
257 {
258 	void *info = NULL;
259 
260 	switch (evt->event) {
261 	case IB_CM_REQ_RECEIVED:
262 		ib_ucm_event_req_get(&uvt->resp.u.req_resp,
263 				     &evt->param.req_rcvd);
264 		uvt->data_len      = IB_CM_REQ_PRIVATE_DATA_SIZE;
265 		uvt->resp.present  = IB_UCM_PRES_PRIMARY;
266 		uvt->resp.present |= (evt->param.req_rcvd.alternate_path ?
267 				      IB_UCM_PRES_ALTERNATE : 0);
268 		break;
269 	case IB_CM_REP_RECEIVED:
270 		ib_ucm_event_rep_get(&uvt->resp.u.rep_resp,
271 				     &evt->param.rep_rcvd);
272 		uvt->data_len = IB_CM_REP_PRIVATE_DATA_SIZE;
273 		break;
274 	case IB_CM_RTU_RECEIVED:
275 		uvt->data_len = IB_CM_RTU_PRIVATE_DATA_SIZE;
276 		uvt->resp.u.send_status = evt->param.send_status;
277 		break;
278 	case IB_CM_DREQ_RECEIVED:
279 		uvt->data_len = IB_CM_DREQ_PRIVATE_DATA_SIZE;
280 		uvt->resp.u.send_status = evt->param.send_status;
281 		break;
282 	case IB_CM_DREP_RECEIVED:
283 		uvt->data_len = IB_CM_DREP_PRIVATE_DATA_SIZE;
284 		uvt->resp.u.send_status = evt->param.send_status;
285 		break;
286 	case IB_CM_MRA_RECEIVED:
287 		uvt->resp.u.mra_resp.timeout =
288 					evt->param.mra_rcvd.service_timeout;
289 		uvt->data_len = IB_CM_MRA_PRIVATE_DATA_SIZE;
290 		break;
291 	case IB_CM_REJ_RECEIVED:
292 		uvt->resp.u.rej_resp.reason = evt->param.rej_rcvd.reason;
293 		uvt->data_len = IB_CM_REJ_PRIVATE_DATA_SIZE;
294 		uvt->info_len = evt->param.rej_rcvd.ari_length;
295 		info	      = evt->param.rej_rcvd.ari;
296 		break;
297 	case IB_CM_LAP_RECEIVED:
298 		ib_copy_path_rec_to_user(&uvt->resp.u.lap_resp.path,
299 					 evt->param.lap_rcvd.alternate_path);
300 		uvt->data_len = IB_CM_LAP_PRIVATE_DATA_SIZE;
301 		uvt->resp.present = IB_UCM_PRES_ALTERNATE;
302 		break;
303 	case IB_CM_APR_RECEIVED:
304 		uvt->resp.u.apr_resp.status = evt->param.apr_rcvd.ap_status;
305 		uvt->data_len = IB_CM_APR_PRIVATE_DATA_SIZE;
306 		uvt->info_len = evt->param.apr_rcvd.info_len;
307 		info	      = evt->param.apr_rcvd.apr_info;
308 		break;
309 	case IB_CM_SIDR_REQ_RECEIVED:
310 		uvt->resp.u.sidr_req_resp.pkey =
311 					evt->param.sidr_req_rcvd.pkey;
312 		uvt->resp.u.sidr_req_resp.port =
313 					evt->param.sidr_req_rcvd.port;
314 		uvt->data_len = IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE;
315 		break;
316 	case IB_CM_SIDR_REP_RECEIVED:
317 		ib_ucm_event_sidr_rep_get(&uvt->resp.u.sidr_rep_resp,
318 					  &evt->param.sidr_rep_rcvd);
319 		uvt->data_len = IB_CM_SIDR_REP_PRIVATE_DATA_SIZE;
320 		uvt->info_len = evt->param.sidr_rep_rcvd.info_len;
321 		info	      = evt->param.sidr_rep_rcvd.info;
322 		break;
323 	default:
324 		uvt->resp.u.send_status = evt->param.send_status;
325 		break;
326 	}
327 
328 	if (uvt->data_len) {
329 		uvt->data = kmemdup(evt->private_data, uvt->data_len, GFP_KERNEL);
330 		if (!uvt->data)
331 			goto err1;
332 
333 		uvt->resp.present |= IB_UCM_PRES_DATA;
334 	}
335 
336 	if (uvt->info_len) {
337 		uvt->info = kmemdup(info, uvt->info_len, GFP_KERNEL);
338 		if (!uvt->info)
339 			goto err2;
340 
341 		uvt->resp.present |= IB_UCM_PRES_INFO;
342 	}
343 	return 0;
344 
345 err2:
346 	kfree(uvt->data);
347 err1:
348 	return -ENOMEM;
349 }
350 
351 static int ib_ucm_event_handler(struct ib_cm_id *cm_id,
352 				struct ib_cm_event *event)
353 {
354 	struct ib_ucm_event *uevent;
355 	struct ib_ucm_context *ctx;
356 	int result = 0;
357 
358 	ctx = cm_id->context;
359 
360 	uevent = kzalloc(sizeof *uevent, GFP_KERNEL);
361 	if (!uevent)
362 		goto err1;
363 
364 	uevent->ctx = ctx;
365 	uevent->cm_id = cm_id;
366 	uevent->resp.uid = ctx->uid;
367 	uevent->resp.id = ctx->id;
368 	uevent->resp.event = event->event;
369 
370 	result = ib_ucm_event_process(event, uevent);
371 	if (result)
372 		goto err2;
373 
374 	mutex_lock(&ctx->file->file_mutex);
375 	list_add_tail(&uevent->file_list, &ctx->file->events);
376 	list_add_tail(&uevent->ctx_list, &ctx->events);
377 	wake_up_interruptible(&ctx->file->poll_wait);
378 	mutex_unlock(&ctx->file->file_mutex);
379 	return 0;
380 
381 err2:
382 	kfree(uevent);
383 err1:
384 	/* Destroy new cm_id's */
385 	return ib_ucm_new_cm_id(event->event);
386 }
387 
388 static ssize_t ib_ucm_event(struct ib_ucm_file *file,
389 			    const char __user *inbuf,
390 			    int in_len, int out_len)
391 {
392 	struct ib_ucm_context *ctx;
393 	struct ib_ucm_event_get cmd;
394 	struct ib_ucm_event *uevent;
395 	int result = 0;
396 
397 	if (out_len < sizeof(struct ib_ucm_event_resp))
398 		return -ENOSPC;
399 
400 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
401 		return -EFAULT;
402 
403 	mutex_lock(&file->file_mutex);
404 	while (list_empty(&file->events)) {
405 		mutex_unlock(&file->file_mutex);
406 
407 		if (file->filp->f_flags & O_NONBLOCK)
408 			return -EAGAIN;
409 
410 		if (wait_event_interruptible(file->poll_wait,
411 					     !list_empty(&file->events)))
412 			return -ERESTARTSYS;
413 
414 		mutex_lock(&file->file_mutex);
415 	}
416 
417 	uevent = list_entry(file->events.next, struct ib_ucm_event, file_list);
418 
419 	if (ib_ucm_new_cm_id(uevent->resp.event)) {
420 		ctx = ib_ucm_ctx_alloc(file);
421 		if (!ctx) {
422 			result = -ENOMEM;
423 			goto done;
424 		}
425 
426 		ctx->cm_id = uevent->cm_id;
427 		ctx->cm_id->context = ctx;
428 		uevent->resp.id = ctx->id;
429 	}
430 
431 	if (copy_to_user((void __user *)(unsigned long)cmd.response,
432 			 &uevent->resp, sizeof(uevent->resp))) {
433 		result = -EFAULT;
434 		goto done;
435 	}
436 
437 	if (uevent->data) {
438 		if (cmd.data_len < uevent->data_len) {
439 			result = -ENOMEM;
440 			goto done;
441 		}
442 		if (copy_to_user((void __user *)(unsigned long)cmd.data,
443 				 uevent->data, uevent->data_len)) {
444 			result = -EFAULT;
445 			goto done;
446 		}
447 	}
448 
449 	if (uevent->info) {
450 		if (cmd.info_len < uevent->info_len) {
451 			result = -ENOMEM;
452 			goto done;
453 		}
454 		if (copy_to_user((void __user *)(unsigned long)cmd.info,
455 				 uevent->info, uevent->info_len)) {
456 			result = -EFAULT;
457 			goto done;
458 		}
459 	}
460 
461 	list_del(&uevent->file_list);
462 	list_del(&uevent->ctx_list);
463 	uevent->ctx->events_reported++;
464 
465 	kfree(uevent->data);
466 	kfree(uevent->info);
467 	kfree(uevent);
468 done:
469 	mutex_unlock(&file->file_mutex);
470 	return result;
471 }
472 
473 static ssize_t ib_ucm_create_id(struct ib_ucm_file *file,
474 				const char __user *inbuf,
475 				int in_len, int out_len)
476 {
477 	struct ib_ucm_create_id cmd;
478 	struct ib_ucm_create_id_resp resp;
479 	struct ib_ucm_context *ctx;
480 	int result;
481 
482 	if (out_len < sizeof(resp))
483 		return -ENOSPC;
484 
485 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
486 		return -EFAULT;
487 
488 	mutex_lock(&file->file_mutex);
489 	ctx = ib_ucm_ctx_alloc(file);
490 	mutex_unlock(&file->file_mutex);
491 	if (!ctx)
492 		return -ENOMEM;
493 
494 	ctx->uid = cmd.uid;
495 	ctx->cm_id = ib_create_cm_id(file->device->ib_dev,
496 				     ib_ucm_event_handler, ctx);
497 	if (IS_ERR(ctx->cm_id)) {
498 		result = PTR_ERR(ctx->cm_id);
499 		goto err1;
500 	}
501 
502 	resp.id = ctx->id;
503 	if (copy_to_user((void __user *)(unsigned long)cmd.response,
504 			 &resp, sizeof(resp))) {
505 		result = -EFAULT;
506 		goto err2;
507 	}
508 	return 0;
509 
510 err2:
511 	ib_destroy_cm_id(ctx->cm_id);
512 err1:
513 	mutex_lock(&ctx_id_mutex);
514 	idr_remove(&ctx_id_table, ctx->id);
515 	mutex_unlock(&ctx_id_mutex);
516 	kfree(ctx);
517 	return result;
518 }
519 
520 static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
521 				 const char __user *inbuf,
522 				 int in_len, int out_len)
523 {
524 	struct ib_ucm_destroy_id cmd;
525 	struct ib_ucm_destroy_id_resp resp;
526 	struct ib_ucm_context *ctx;
527 	int result = 0;
528 
529 	if (out_len < sizeof(resp))
530 		return -ENOSPC;
531 
532 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
533 		return -EFAULT;
534 
535 	mutex_lock(&ctx_id_mutex);
536 	ctx = idr_find(&ctx_id_table, cmd.id);
537 	if (!ctx)
538 		ctx = ERR_PTR(-ENOENT);
539 	else if (ctx->file != file)
540 		ctx = ERR_PTR(-EINVAL);
541 	else
542 		idr_remove(&ctx_id_table, ctx->id);
543 	mutex_unlock(&ctx_id_mutex);
544 
545 	if (IS_ERR(ctx))
546 		return PTR_ERR(ctx);
547 
548 	ib_ucm_ctx_put(ctx);
549 	wait_for_completion(&ctx->comp);
550 
551 	/* No new events will be generated after destroying the cm_id. */
552 	ib_destroy_cm_id(ctx->cm_id);
553 	/* Cleanup events not yet reported to the user. */
554 	ib_ucm_cleanup_events(ctx);
555 
556 	resp.events_reported = ctx->events_reported;
557 	if (copy_to_user((void __user *)(unsigned long)cmd.response,
558 			 &resp, sizeof(resp)))
559 		result = -EFAULT;
560 
561 	kfree(ctx);
562 	return result;
563 }
564 
565 static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
566 			      const char __user *inbuf,
567 			      int in_len, int out_len)
568 {
569 	struct ib_ucm_attr_id_resp resp;
570 	struct ib_ucm_attr_id cmd;
571 	struct ib_ucm_context *ctx;
572 	int result = 0;
573 
574 	if (out_len < sizeof(resp))
575 		return -ENOSPC;
576 
577 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
578 		return -EFAULT;
579 
580 	ctx = ib_ucm_ctx_get(file, cmd.id);
581 	if (IS_ERR(ctx))
582 		return PTR_ERR(ctx);
583 
584 	resp.service_id   = ctx->cm_id->service_id;
585 	resp.service_mask = ctx->cm_id->service_mask;
586 	resp.local_id     = ctx->cm_id->local_id;
587 	resp.remote_id    = ctx->cm_id->remote_id;
588 
589 	if (copy_to_user((void __user *)(unsigned long)cmd.response,
590 			 &resp, sizeof(resp)))
591 		result = -EFAULT;
592 
593 	ib_ucm_ctx_put(ctx);
594 	return result;
595 }
596 
597 static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file *file,
598 				   const char __user *inbuf,
599 				   int in_len, int out_len)
600 {
601 	struct ib_uverbs_qp_attr resp;
602 	struct ib_ucm_init_qp_attr cmd;
603 	struct ib_ucm_context *ctx;
604 	struct ib_qp_attr qp_attr;
605 	int result = 0;
606 
607 	if (out_len < sizeof(resp))
608 		return -ENOSPC;
609 
610 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
611 		return -EFAULT;
612 
613 	ctx = ib_ucm_ctx_get(file, cmd.id);
614 	if (IS_ERR(ctx))
615 		return PTR_ERR(ctx);
616 
617 	resp.qp_attr_mask = 0;
618 	memset(&qp_attr, 0, sizeof qp_attr);
619 	qp_attr.qp_state = cmd.qp_state;
620 	result = ib_cm_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
621 	if (result)
622 		goto out;
623 
624 	ib_copy_qp_attr_to_user(&resp, &qp_attr);
625 
626 	if (copy_to_user((void __user *)(unsigned long)cmd.response,
627 			 &resp, sizeof(resp)))
628 		result = -EFAULT;
629 
630 out:
631 	ib_ucm_ctx_put(ctx);
632 	return result;
633 }
634 
635 static int ucm_validate_listen(__be64 service_id, __be64 service_mask)
636 {
637 	service_id &= service_mask;
638 
639 	if (((service_id & IB_CMA_SERVICE_ID_MASK) == IB_CMA_SERVICE_ID) ||
640 	    ((service_id & IB_SDP_SERVICE_ID_MASK) == IB_SDP_SERVICE_ID))
641 		return -EINVAL;
642 
643 	return 0;
644 }
645 
646 static ssize_t ib_ucm_listen(struct ib_ucm_file *file,
647 			     const char __user *inbuf,
648 			     int in_len, int out_len)
649 {
650 	struct ib_ucm_listen cmd;
651 	struct ib_ucm_context *ctx;
652 	int result;
653 
654 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
655 		return -EFAULT;
656 
657 	ctx = ib_ucm_ctx_get(file, cmd.id);
658 	if (IS_ERR(ctx))
659 		return PTR_ERR(ctx);
660 
661 	result = ucm_validate_listen(cmd.service_id, cmd.service_mask);
662 	if (result)
663 		goto out;
664 
665 	result = ib_cm_listen(ctx->cm_id, cmd.service_id, cmd.service_mask);
666 out:
667 	ib_ucm_ctx_put(ctx);
668 	return result;
669 }
670 
671 static ssize_t ib_ucm_notify(struct ib_ucm_file *file,
672 			     const char __user *inbuf,
673 			     int in_len, int out_len)
674 {
675 	struct ib_ucm_notify cmd;
676 	struct ib_ucm_context *ctx;
677 	int result;
678 
679 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
680 		return -EFAULT;
681 
682 	ctx = ib_ucm_ctx_get(file, cmd.id);
683 	if (IS_ERR(ctx))
684 		return PTR_ERR(ctx);
685 
686 	result = ib_cm_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
687 	ib_ucm_ctx_put(ctx);
688 	return result;
689 }
690 
691 static int ib_ucm_alloc_data(const void **dest, u64 src, u32 len)
692 {
693 	void *data;
694 
695 	*dest = NULL;
696 
697 	if (!len)
698 		return 0;
699 
700 	data = memdup_user((void __user *)(unsigned long)src, len);
701 	if (IS_ERR(data))
702 		return PTR_ERR(data);
703 
704 	*dest = data;
705 	return 0;
706 }
707 
708 static int ib_ucm_path_get(struct ib_sa_path_rec **path, u64 src)
709 {
710 	struct ib_user_path_rec upath;
711 	struct ib_sa_path_rec  *sa_path;
712 
713 	*path = NULL;
714 
715 	if (!src)
716 		return 0;
717 
718 	sa_path = kmalloc(sizeof(*sa_path), GFP_KERNEL);
719 	if (!sa_path)
720 		return -ENOMEM;
721 
722 	if (copy_from_user(&upath, (void __user *)(unsigned long)src,
723 			   sizeof(upath))) {
724 
725 		kfree(sa_path);
726 		return -EFAULT;
727 	}
728 
729 	ib_copy_path_rec_from_user(sa_path, &upath);
730 	*path = sa_path;
731 	return 0;
732 }
733 
734 static ssize_t ib_ucm_send_req(struct ib_ucm_file *file,
735 			       const char __user *inbuf,
736 			       int in_len, int out_len)
737 {
738 	struct ib_cm_req_param param;
739 	struct ib_ucm_context *ctx;
740 	struct ib_ucm_req cmd;
741 	int result;
742 
743 	param.private_data   = NULL;
744 	param.primary_path   = NULL;
745 	param.alternate_path = NULL;
746 
747 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
748 		return -EFAULT;
749 
750 	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
751 	if (result)
752 		goto done;
753 
754 	result = ib_ucm_path_get(&param.primary_path, cmd.primary_path);
755 	if (result)
756 		goto done;
757 
758 	result = ib_ucm_path_get(&param.alternate_path, cmd.alternate_path);
759 	if (result)
760 		goto done;
761 
762 	param.private_data_len           = cmd.len;
763 	param.service_id                 = cmd.sid;
764 	param.qp_num                     = cmd.qpn;
765 	param.qp_type                    = cmd.qp_type;
766 	param.starting_psn               = cmd.psn;
767 	param.peer_to_peer               = cmd.peer_to_peer;
768 	param.responder_resources        = cmd.responder_resources;
769 	param.initiator_depth            = cmd.initiator_depth;
770 	param.remote_cm_response_timeout = cmd.remote_cm_response_timeout;
771 	param.flow_control               = cmd.flow_control;
772 	param.local_cm_response_timeout  = cmd.local_cm_response_timeout;
773 	param.retry_count                = cmd.retry_count;
774 	param.rnr_retry_count            = cmd.rnr_retry_count;
775 	param.max_cm_retries             = cmd.max_cm_retries;
776 	param.srq                        = cmd.srq;
777 
778 	ctx = ib_ucm_ctx_get(file, cmd.id);
779 	if (!IS_ERR(ctx)) {
780 		result = ib_send_cm_req(ctx->cm_id, &param);
781 		ib_ucm_ctx_put(ctx);
782 	} else
783 		result = PTR_ERR(ctx);
784 
785 done:
786 	kfree(param.private_data);
787 	kfree(param.primary_path);
788 	kfree(param.alternate_path);
789 	return result;
790 }
791 
792 static ssize_t ib_ucm_send_rep(struct ib_ucm_file *file,
793 			       const char __user *inbuf,
794 			       int in_len, int out_len)
795 {
796 	struct ib_cm_rep_param param;
797 	struct ib_ucm_context *ctx;
798 	struct ib_ucm_rep cmd;
799 	int result;
800 
801 	param.private_data = NULL;
802 
803 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
804 		return -EFAULT;
805 
806 	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
807 	if (result)
808 		return result;
809 
810 	param.qp_num              = cmd.qpn;
811 	param.starting_psn        = cmd.psn;
812 	param.private_data_len    = cmd.len;
813 	param.responder_resources = cmd.responder_resources;
814 	param.initiator_depth     = cmd.initiator_depth;
815 	param.failover_accepted   = cmd.failover_accepted;
816 	param.flow_control        = cmd.flow_control;
817 	param.rnr_retry_count     = cmd.rnr_retry_count;
818 	param.srq                 = cmd.srq;
819 
820 	ctx = ib_ucm_ctx_get(file, cmd.id);
821 	if (!IS_ERR(ctx)) {
822 		ctx->uid = cmd.uid;
823 		result = ib_send_cm_rep(ctx->cm_id, &param);
824 		ib_ucm_ctx_put(ctx);
825 	} else
826 		result = PTR_ERR(ctx);
827 
828 	kfree(param.private_data);
829 	return result;
830 }
831 
832 static ssize_t ib_ucm_send_private_data(struct ib_ucm_file *file,
833 					const char __user *inbuf, int in_len,
834 					int (*func)(struct ib_cm_id *cm_id,
835 						    const void *private_data,
836 						    u8 private_data_len))
837 {
838 	struct ib_ucm_private_data cmd;
839 	struct ib_ucm_context *ctx;
840 	const void *private_data = NULL;
841 	int result;
842 
843 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
844 		return -EFAULT;
845 
846 	result = ib_ucm_alloc_data(&private_data, cmd.data, cmd.len);
847 	if (result)
848 		return result;
849 
850 	ctx = ib_ucm_ctx_get(file, cmd.id);
851 	if (!IS_ERR(ctx)) {
852 		result = func(ctx->cm_id, private_data, cmd.len);
853 		ib_ucm_ctx_put(ctx);
854 	} else
855 		result = PTR_ERR(ctx);
856 
857 	kfree(private_data);
858 	return result;
859 }
860 
861 static ssize_t ib_ucm_send_rtu(struct ib_ucm_file *file,
862 			       const char __user *inbuf,
863 			       int in_len, int out_len)
864 {
865 	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_rtu);
866 }
867 
868 static ssize_t ib_ucm_send_dreq(struct ib_ucm_file *file,
869 				const char __user *inbuf,
870 				int in_len, int out_len)
871 {
872 	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_dreq);
873 }
874 
875 static ssize_t ib_ucm_send_drep(struct ib_ucm_file *file,
876 				const char __user *inbuf,
877 				int in_len, int out_len)
878 {
879 	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_drep);
880 }
881 
882 static ssize_t ib_ucm_send_info(struct ib_ucm_file *file,
883 				const char __user *inbuf, int in_len,
884 				int (*func)(struct ib_cm_id *cm_id,
885 					    int status,
886 					    const void *info,
887 					    u8 info_len,
888 					    const void *data,
889 					    u8 data_len))
890 {
891 	struct ib_ucm_context *ctx;
892 	struct ib_ucm_info cmd;
893 	const void *data = NULL;
894 	const void *info = NULL;
895 	int result;
896 
897 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
898 		return -EFAULT;
899 
900 	result = ib_ucm_alloc_data(&data, cmd.data, cmd.data_len);
901 	if (result)
902 		goto done;
903 
904 	result = ib_ucm_alloc_data(&info, cmd.info, cmd.info_len);
905 	if (result)
906 		goto done;
907 
908 	ctx = ib_ucm_ctx_get(file, cmd.id);
909 	if (!IS_ERR(ctx)) {
910 		result = func(ctx->cm_id, cmd.status, info, cmd.info_len,
911 			      data, cmd.data_len);
912 		ib_ucm_ctx_put(ctx);
913 	} else
914 		result = PTR_ERR(ctx);
915 
916 done:
917 	kfree(data);
918 	kfree(info);
919 	return result;
920 }
921 
922 static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file,
923 			       const char __user *inbuf,
924 			       int in_len, int out_len)
925 {
926 	return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_rej);
927 }
928 
929 static ssize_t ib_ucm_send_apr(struct ib_ucm_file *file,
930 			       const char __user *inbuf,
931 			       int in_len, int out_len)
932 {
933 	return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_apr);
934 }
935 
936 static ssize_t ib_ucm_send_mra(struct ib_ucm_file *file,
937 			       const char __user *inbuf,
938 			       int in_len, int out_len)
939 {
940 	struct ib_ucm_context *ctx;
941 	struct ib_ucm_mra cmd;
942 	const void *data = NULL;
943 	int result;
944 
945 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
946 		return -EFAULT;
947 
948 	result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
949 	if (result)
950 		return result;
951 
952 	ctx = ib_ucm_ctx_get(file, cmd.id);
953 	if (!IS_ERR(ctx)) {
954 		result = ib_send_cm_mra(ctx->cm_id, cmd.timeout, data, cmd.len);
955 		ib_ucm_ctx_put(ctx);
956 	} else
957 		result = PTR_ERR(ctx);
958 
959 	kfree(data);
960 	return result;
961 }
962 
963 static ssize_t ib_ucm_send_lap(struct ib_ucm_file *file,
964 			       const char __user *inbuf,
965 			       int in_len, int out_len)
966 {
967 	struct ib_ucm_context *ctx;
968 	struct ib_sa_path_rec *path = NULL;
969 	struct ib_ucm_lap cmd;
970 	const void *data = NULL;
971 	int result;
972 
973 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
974 		return -EFAULT;
975 
976 	result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
977 	if (result)
978 		goto done;
979 
980 	result = ib_ucm_path_get(&path, cmd.path);
981 	if (result)
982 		goto done;
983 
984 	ctx = ib_ucm_ctx_get(file, cmd.id);
985 	if (!IS_ERR(ctx)) {
986 		result = ib_send_cm_lap(ctx->cm_id, path, data, cmd.len);
987 		ib_ucm_ctx_put(ctx);
988 	} else
989 		result = PTR_ERR(ctx);
990 
991 done:
992 	kfree(data);
993 	kfree(path);
994 	return result;
995 }
996 
997 static ssize_t ib_ucm_send_sidr_req(struct ib_ucm_file *file,
998 				    const char __user *inbuf,
999 				    int in_len, int out_len)
1000 {
1001 	struct ib_cm_sidr_req_param param;
1002 	struct ib_ucm_context *ctx;
1003 	struct ib_ucm_sidr_req cmd;
1004 	int result;
1005 
1006 	param.private_data = NULL;
1007 	param.path = NULL;
1008 
1009 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
1010 		return -EFAULT;
1011 
1012 	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
1013 	if (result)
1014 		goto done;
1015 
1016 	result = ib_ucm_path_get(&param.path, cmd.path);
1017 	if (result)
1018 		goto done;
1019 
1020 	param.private_data_len = cmd.len;
1021 	param.service_id       = cmd.sid;
1022 	param.timeout_ms       = cmd.timeout;
1023 	param.max_cm_retries   = cmd.max_cm_retries;
1024 
1025 	ctx = ib_ucm_ctx_get(file, cmd.id);
1026 	if (!IS_ERR(ctx)) {
1027 		result = ib_send_cm_sidr_req(ctx->cm_id, &param);
1028 		ib_ucm_ctx_put(ctx);
1029 	} else
1030 		result = PTR_ERR(ctx);
1031 
1032 done:
1033 	kfree(param.private_data);
1034 	kfree(param.path);
1035 	return result;
1036 }
1037 
1038 static ssize_t ib_ucm_send_sidr_rep(struct ib_ucm_file *file,
1039 				    const char __user *inbuf,
1040 				    int in_len, int out_len)
1041 {
1042 	struct ib_cm_sidr_rep_param param;
1043 	struct ib_ucm_sidr_rep cmd;
1044 	struct ib_ucm_context *ctx;
1045 	int result;
1046 
1047 	param.info = NULL;
1048 
1049 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
1050 		return -EFAULT;
1051 
1052 	result = ib_ucm_alloc_data(&param.private_data,
1053 				   cmd.data, cmd.data_len);
1054 	if (result)
1055 		goto done;
1056 
1057 	result = ib_ucm_alloc_data(&param.info, cmd.info, cmd.info_len);
1058 	if (result)
1059 		goto done;
1060 
1061 	param.qp_num		= cmd.qpn;
1062 	param.qkey		= cmd.qkey;
1063 	param.status		= cmd.status;
1064 	param.info_length	= cmd.info_len;
1065 	param.private_data_len	= cmd.data_len;
1066 
1067 	ctx = ib_ucm_ctx_get(file, cmd.id);
1068 	if (!IS_ERR(ctx)) {
1069 		result = ib_send_cm_sidr_rep(ctx->cm_id, &param);
1070 		ib_ucm_ctx_put(ctx);
1071 	} else
1072 		result = PTR_ERR(ctx);
1073 
1074 done:
1075 	kfree(param.private_data);
1076 	kfree(param.info);
1077 	return result;
1078 }
1079 
1080 static ssize_t (*ucm_cmd_table[])(struct ib_ucm_file *file,
1081 				  const char __user *inbuf,
1082 				  int in_len, int out_len) = {
1083 	[IB_USER_CM_CMD_CREATE_ID]     = ib_ucm_create_id,
1084 	[IB_USER_CM_CMD_DESTROY_ID]    = ib_ucm_destroy_id,
1085 	[IB_USER_CM_CMD_ATTR_ID]       = ib_ucm_attr_id,
1086 	[IB_USER_CM_CMD_LISTEN]        = ib_ucm_listen,
1087 	[IB_USER_CM_CMD_NOTIFY]        = ib_ucm_notify,
1088 	[IB_USER_CM_CMD_SEND_REQ]      = ib_ucm_send_req,
1089 	[IB_USER_CM_CMD_SEND_REP]      = ib_ucm_send_rep,
1090 	[IB_USER_CM_CMD_SEND_RTU]      = ib_ucm_send_rtu,
1091 	[IB_USER_CM_CMD_SEND_DREQ]     = ib_ucm_send_dreq,
1092 	[IB_USER_CM_CMD_SEND_DREP]     = ib_ucm_send_drep,
1093 	[IB_USER_CM_CMD_SEND_REJ]      = ib_ucm_send_rej,
1094 	[IB_USER_CM_CMD_SEND_MRA]      = ib_ucm_send_mra,
1095 	[IB_USER_CM_CMD_SEND_LAP]      = ib_ucm_send_lap,
1096 	[IB_USER_CM_CMD_SEND_APR]      = ib_ucm_send_apr,
1097 	[IB_USER_CM_CMD_SEND_SIDR_REQ] = ib_ucm_send_sidr_req,
1098 	[IB_USER_CM_CMD_SEND_SIDR_REP] = ib_ucm_send_sidr_rep,
1099 	[IB_USER_CM_CMD_EVENT]	       = ib_ucm_event,
1100 	[IB_USER_CM_CMD_INIT_QP_ATTR]  = ib_ucm_init_qp_attr,
1101 };
1102 
1103 static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
1104 			    size_t len, loff_t *pos)
1105 {
1106 	struct ib_ucm_file *file = filp->private_data;
1107 	struct ib_ucm_cmd_hdr hdr;
1108 	ssize_t result;
1109 
1110 	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
1111 		return -EACCES;
1112 
1113 	if (len < sizeof(hdr))
1114 		return -EINVAL;
1115 
1116 	if (copy_from_user(&hdr, buf, sizeof(hdr)))
1117 		return -EFAULT;
1118 
1119 	if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
1120 		return -EINVAL;
1121 
1122 	if (hdr.in + sizeof(hdr) > len)
1123 		return -EINVAL;
1124 
1125 	result = ucm_cmd_table[hdr.cmd](file, buf + sizeof(hdr),
1126 					hdr.in, hdr.out);
1127 	if (!result)
1128 		result = len;
1129 
1130 	return result;
1131 }
1132 
1133 static unsigned int ib_ucm_poll(struct file *filp,
1134 				struct poll_table_struct *wait)
1135 {
1136 	struct ib_ucm_file *file = filp->private_data;
1137 	unsigned int mask = 0;
1138 
1139 	poll_wait(filp, &file->poll_wait, wait);
1140 
1141 	if (!list_empty(&file->events))
1142 		mask = POLLIN | POLLRDNORM;
1143 
1144 	return mask;
1145 }
1146 
1147 /*
1148  * ib_ucm_open() does not need the BKL:
1149  *
1150  *  - no global state is referred to;
1151  *  - there is no ioctl method to race against;
1152  *  - no further module initialization is required for open to work
1153  *    after the device is registered.
1154  */
1155 static int ib_ucm_open(struct inode *inode, struct file *filp)
1156 {
1157 	struct ib_ucm_file *file;
1158 
1159 	file = kmalloc(sizeof(*file), GFP_KERNEL);
1160 	if (!file)
1161 		return -ENOMEM;
1162 
1163 	INIT_LIST_HEAD(&file->events);
1164 	INIT_LIST_HEAD(&file->ctxs);
1165 	init_waitqueue_head(&file->poll_wait);
1166 
1167 	mutex_init(&file->file_mutex);
1168 
1169 	filp->private_data = file;
1170 	file->filp = filp;
1171 	file->device = container_of(inode->i_cdev->si_drv1, struct ib_ucm_device, cdev);
1172 
1173 	return nonseekable_open(inode, filp);
1174 }
1175 
1176 static int ib_ucm_close(struct inode *inode, struct file *filp)
1177 {
1178 	struct ib_ucm_file *file = filp->private_data;
1179 	struct ib_ucm_context *ctx;
1180 
1181 	mutex_lock(&file->file_mutex);
1182 	while (!list_empty(&file->ctxs)) {
1183 		ctx = list_entry(file->ctxs.next,
1184 				 struct ib_ucm_context, file_list);
1185 		mutex_unlock(&file->file_mutex);
1186 
1187 		mutex_lock(&ctx_id_mutex);
1188 		idr_remove(&ctx_id_table, ctx->id);
1189 		mutex_unlock(&ctx_id_mutex);
1190 
1191 		ib_destroy_cm_id(ctx->cm_id);
1192 		ib_ucm_cleanup_events(ctx);
1193 		kfree(ctx);
1194 
1195 		mutex_lock(&file->file_mutex);
1196 	}
1197 	mutex_unlock(&file->file_mutex);
1198 	kfree(file);
1199 	return 0;
1200 }
1201 
1202 static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
1203 static void ib_ucm_release_dev(struct device *dev)
1204 {
1205 	struct ib_ucm_device *ucm_dev;
1206 
1207 	ucm_dev = container_of(dev, struct ib_ucm_device, dev);
1208 	cdev_del(&ucm_dev->cdev);
1209 	if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
1210 		clear_bit(ucm_dev->devnum, dev_map);
1211 	else
1212 		clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, overflow_map);
1213 	kfree(ucm_dev);
1214 }
1215 
1216 static const struct file_operations ucm_fops = {
1217 	.owner	 = THIS_MODULE,
1218 	.open	 = ib_ucm_open,
1219 	.release = ib_ucm_close,
1220 	.write	 = ib_ucm_write,
1221 	.poll    = ib_ucm_poll,
1222 	.llseek	 = no_llseek,
1223 };
1224 
1225 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
1226 			  char *buf)
1227 {
1228 	struct ib_ucm_device *ucm_dev;
1229 
1230 	ucm_dev = container_of(dev, struct ib_ucm_device, dev);
1231 	return sprintf(buf, "%s\n", ucm_dev->ib_dev->name);
1232 }
1233 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
1234 
1235 static dev_t overflow_maj;
1236 static int find_overflow_devnum(void)
1237 {
1238 	int ret;
1239 
1240 	if (!overflow_maj) {
1241 		ret = alloc_chrdev_region(&overflow_maj, 0, IB_UCM_MAX_DEVICES,
1242 					  "infiniband_cm");
1243 		if (ret) {
1244 			pr_err("ucm: couldn't register dynamic device number\n");
1245 			return ret;
1246 		}
1247 	}
1248 
1249 	ret = find_first_zero_bit(overflow_map, IB_UCM_MAX_DEVICES);
1250 	if (ret >= IB_UCM_MAX_DEVICES)
1251 		return -1;
1252 
1253 	return ret;
1254 }
1255 
1256 static void ib_ucm_add_one(struct ib_device *device)
1257 {
1258 	int devnum;
1259 	dev_t base;
1260 	struct ib_ucm_device *ucm_dev;
1261 
1262 	if (!device->alloc_ucontext || !rdma_cap_ib_cm(device, 1))
1263 		return;
1264 
1265 	ucm_dev = kzalloc(sizeof *ucm_dev, GFP_KERNEL);
1266 	if (!ucm_dev)
1267 		return;
1268 
1269 	ucm_dev->ib_dev = device;
1270 
1271 	devnum = find_first_zero_bit(dev_map, IB_UCM_MAX_DEVICES);
1272 	if (devnum >= IB_UCM_MAX_DEVICES) {
1273 		devnum = find_overflow_devnum();
1274 		if (devnum < 0)
1275 			goto err;
1276 
1277 		ucm_dev->devnum = devnum + IB_UCM_MAX_DEVICES;
1278 		base = devnum + overflow_maj;
1279 		set_bit(devnum, overflow_map);
1280 	} else {
1281 		ucm_dev->devnum = devnum;
1282 		base = devnum + IB_UCM_BASE_DEV;
1283 		set_bit(devnum, dev_map);
1284 	}
1285 
1286 	cdev_init(&ucm_dev->cdev, &ucm_fops);
1287 	ucm_dev->cdev.owner = THIS_MODULE;
1288 	kobject_set_name(&ucm_dev->cdev.kobj, "ucm%d", ucm_dev->devnum);
1289 	if (cdev_add(&ucm_dev->cdev, base, 1))
1290 		goto err;
1291 
1292 	ucm_dev->dev.class = &cm_class;
1293 	ucm_dev->dev.parent = device->dma_device;
1294 	ucm_dev->dev.devt = ucm_dev->cdev.dev;
1295 	ucm_dev->dev.release = ib_ucm_release_dev;
1296 	dev_set_name(&ucm_dev->dev, "ucm%d", ucm_dev->devnum);
1297 	if (device_register(&ucm_dev->dev))
1298 		goto err_cdev;
1299 
1300 	if (device_create_file(&ucm_dev->dev, &dev_attr_ibdev))
1301 		goto err_dev;
1302 
1303 	ib_set_client_data(device, &ucm_client, ucm_dev);
1304 	return;
1305 
1306 err_dev:
1307 	device_unregister(&ucm_dev->dev);
1308 err_cdev:
1309 	cdev_del(&ucm_dev->cdev);
1310 	if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
1311 		clear_bit(devnum, dev_map);
1312 	else
1313 		clear_bit(devnum, overflow_map);
1314 err:
1315 	kfree(ucm_dev);
1316 	return;
1317 }
1318 
1319 static void ib_ucm_remove_one(struct ib_device *device, void *client_data)
1320 {
1321 	struct ib_ucm_device *ucm_dev = client_data;
1322 
1323 	if (!ucm_dev)
1324 		return;
1325 
1326 	device_unregister(&ucm_dev->dev);
1327 }
1328 
1329 static CLASS_ATTR_STRING(abi_version, S_IRUGO,
1330 			 __stringify(IB_USER_CM_ABI_VERSION));
1331 
1332 static int __init ib_ucm_init(void)
1333 {
1334 	int ret;
1335 
1336 	ret = register_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES,
1337 				     "infiniband_cm");
1338 	if (ret) {
1339 		pr_err("ucm: couldn't register device number\n");
1340 		goto error1;
1341 	}
1342 
1343 	ret = class_create_file(&cm_class, &class_attr_abi_version.attr);
1344 	if (ret) {
1345 		pr_err("ucm: couldn't create abi_version attribute\n");
1346 		goto error2;
1347 	}
1348 
1349 	ret = ib_register_client(&ucm_client);
1350 	if (ret) {
1351 		pr_err("ucm: couldn't register client\n");
1352 		goto error3;
1353 	}
1354 	return 0;
1355 
1356 error3:
1357 	class_remove_file(&cm_class, &class_attr_abi_version.attr);
1358 error2:
1359 	unregister_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES);
1360 error1:
1361 	return ret;
1362 }
1363 
1364 static void __exit ib_ucm_cleanup(void)
1365 {
1366 	ib_unregister_client(&ucm_client);
1367 	class_remove_file(&cm_class, &class_attr_abi_version.attr);
1368 	unregister_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES);
1369 	if (overflow_maj)
1370 		unregister_chrdev_region(overflow_maj, IB_UCM_MAX_DEVICES);
1371 	idr_destroy(&ctx_id_table);
1372 }
1373 
1374 module_init_order(ib_ucm_init, SI_ORDER_FIFTH);
1375 module_exit_order(ib_ucm_cleanup, SI_ORDER_FIFTH);
1376