1/*
   2 * Copyright (c) 2004 Topspin Communications.  All rights reserved.
   3 * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
   4 * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
   5 * Copyright (c) 2008 Cisco. All rights reserved.
   6 *
   7 * This software is available to you under a choice of one of two
   8 * licenses.  You may choose to be licensed under the terms of the GNU
   9 * General Public License (GPL) Version 2, available from the file
  10 * COPYING in the main directory of this source tree, or the
  11 * OpenIB.org BSD license below:
  12 *
  13 *     Redistribution and use in source and binary forms, with or
  14 *     without modification, are permitted provided that the following
  15 *     conditions are met:
  16 *
  17 *      - Redistributions of source code must retain the above
  18 *        copyright notice, this list of conditions and the following
  19 *        disclaimer.
  20 *
  21 *      - Redistributions in binary form must reproduce the above
  22 *        copyright notice, this list of conditions and the following
  23 *        disclaimer in the documentation and/or other materials
  24 *        provided with the distribution.
  25 *
  26 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  27 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  28 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  29 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  30 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  31 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  32 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  33 * SOFTWARE.
  34 */
  35
  36#include <linux/module.h>
  37#include <linux/init.h>
  38#include <linux/device.h>
  39#include <linux/err.h>
  40#include <linux/fs.h>
  41#include <linux/cdev.h>
  42#include <linux/dma-mapping.h>
  43#include <linux/poll.h>
  44#include <linux/mutex.h>
  45#include <linux/kref.h>
  46#include <linux/compat.h>
  47#include <linux/sched.h>
  48#include <linux/semaphore.h>
  49#include <linux/slab.h>
  50
  51#include <asm/uaccess.h>
  52
  53#include <rdma/ib_mad.h>
  54#include <rdma/ib_user_mad.h>
  55
  56MODULE_AUTHOR("Roland Dreier");
  57MODULE_DESCRIPTION("InfiniBand userspace MAD packet access");
  58MODULE_LICENSE("Dual BSD/GPL");
  59
  60enum {
  61	IB_UMAD_MAX_PORTS  = 64,
  62	IB_UMAD_MAX_AGENTS = 32,
  63
  64	IB_UMAD_MAJOR      = 231,
  65	IB_UMAD_MINOR_BASE = 0
  66};
  67
  68/*
  69 * Our lifetime rules for these structs are the following:
  70 * device special file is opened, we take a reference on the
  71 * ib_umad_port's struct ib_umad_device. We drop these
  72 * references in the corresponding close().
  73 *
  74 * In addition to references coming from open character devices, there
  75 * is one more reference to each ib_umad_device representing the
  76 * module's reference taken when allocating the ib_umad_device in
  77 * ib_umad_add_one().
  78 *
  79 * When destroying an ib_umad_device, we drop the module's reference.
  80 */
  81
  82struct ib_umad_port {
  83	struct cdev           cdev;
  84	struct device	      *dev;
  85
  86	struct cdev           sm_cdev;
  87	struct device	      *sm_dev;
  88	struct semaphore       sm_sem;
  89
  90	struct mutex	       file_mutex;
  91	struct list_head       file_list;
  92
  93	struct ib_device      *ib_dev;
  94	struct ib_umad_device *umad_dev;
  95	int                    dev_num;
  96	u8                     port_num;
  97};
  98
  99struct ib_umad_device {
 100	int                  start_port, end_port;
 101	struct kref          ref;
 102	struct ib_umad_port  port[0];
 103};
 104
 105struct ib_umad_file {
 106	struct mutex		mutex;
 107	struct ib_umad_port    *port;
 108	struct list_head	recv_list;
 109	struct list_head	send_list;
 110	struct list_head	port_list;
 111	spinlock_t		send_lock;
 112	wait_queue_head_t	recv_wait;
 113	struct ib_mad_agent    *agent[IB_UMAD_MAX_AGENTS];
 114	int			agents_dead;
 115	u8			use_pkey_index;
 116	u8			already_used;
 117};
 118
 119struct ib_umad_packet {
 120	struct ib_mad_send_buf *msg;
 121	struct ib_mad_recv_wc  *recv_wc;
 122	struct list_head   list;
 123	int		   length;
 124	struct ib_user_mad mad;
 125};
 126
 127static struct class *umad_class;
 128
 129static const dev_t base_dev = MKDEV(IB_UMAD_MAJOR, IB_UMAD_MINOR_BASE);
 130
 131static DEFINE_SPINLOCK(port_lock);
 132static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS);
 133
 134static void ib_umad_add_one(struct ib_device *device);
 135static void ib_umad_remove_one(struct ib_device *device);
 136
 137static void ib_umad_release_dev(struct kref *ref)
 138{
 139	struct ib_umad_device *dev =
 140		container_of(ref, struct ib_umad_device, ref);
 141
 142	kfree(dev);
 143}
 144
 145static int hdr_size(struct ib_umad_file *file)
 146{
 147	return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) :
 148		sizeof (struct ib_user_mad_hdr_old);
 149}
 150
 151/* caller must hold file->mutex */
 152static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id)
 153{
 154	return file->agents_dead ? NULL : file->agent[id];
 155}
 156
 157static int queue_packet(struct ib_umad_file *file,
 158			struct ib_mad_agent *agent,
 159			struct ib_umad_packet *packet)
 160{
 161	int ret = 1;
 162
 163	mutex_lock(&file->mutex);
 164
 165	for (packet->mad.hdr.id = 0;
 166	     packet->mad.hdr.id < IB_UMAD_MAX_AGENTS;
 167	     packet->mad.hdr.id++)
 168		if (agent == __get_agent(file, packet->mad.hdr.id)) {
 169			list_add_tail(&packet->list, &file->recv_list);
 170			wake_up_interruptible(&file->recv_wait);
 171			ret = 0;
 172			break;
 173		}
 174
 175	mutex_unlock(&file->mutex);
 176
 177	return ret;
 178}
 179
 180static void dequeue_send(struct ib_umad_file *file,
 181			 struct ib_umad_packet *packet)
 182{
 183	spin_lock_irq(&file->send_lock);
 184	list_del(&packet->list);
 185	spin_unlock_irq(&file->send_lock);
 186}
 187
 188static void send_handler(struct ib_mad_agent *agent,
 189			 struct ib_mad_send_wc *send_wc)
 190{
 191	struct ib_umad_file *file = agent->context;
 192	struct ib_umad_packet *packet = send_wc->send_buf->context[0];
 193
 194	dequeue_send(file, packet);
 195	ib_destroy_ah(packet->msg->ah);
 196	ib_free_send_mad(packet->msg);
 197
 198	if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) {
 199		packet->length = IB_MGMT_MAD_HDR;
 200		packet->mad.hdr.status = ETIMEDOUT;
 201		if (!queue_packet(file, agent, packet))
 202			return;
 203	}
 204	kfree(packet);
 205}
 206
 207static void recv_handler(struct ib_mad_agent *agent,
 208			 struct ib_mad_recv_wc *mad_recv_wc)
 209{
 210	struct ib_umad_file *file = agent->context;
 211	struct ib_umad_packet *packet;
 212
 213	if (mad_recv_wc->wc->status != IB_WC_SUCCESS)
 214		goto err1;
 215
 216	packet = kzalloc(sizeof *packet, GFP_KERNEL);
 217	if (!packet)
 218		goto err1;
 219
 220	packet->length = mad_recv_wc->mad_len;
 221	packet->recv_wc = mad_recv_wc;
 222
 223	packet->mad.hdr.status	   = 0;
 224	packet->mad.hdr.length	   = hdr_size(file) + mad_recv_wc->mad_len;
 225	packet->mad.hdr.qpn	   = cpu_to_be32(mad_recv_wc->wc->src_qp);
 226	packet->mad.hdr.lid	   = cpu_to_be16(mad_recv_wc->wc->slid);
 227	packet->mad.hdr.sl	   = mad_recv_wc->wc->sl;
 228	packet->mad.hdr.path_bits  = mad_recv_wc->wc->dlid_path_bits;
 229	packet->mad.hdr.pkey_index = mad_recv_wc->wc->pkey_index;
 230	packet->mad.hdr.grh_present = !!(mad_recv_wc->wc->wc_flags & IB_WC_GRH);
 231	if (packet->mad.hdr.grh_present) {
 232		struct ib_ah_attr ah_attr;
 233
 234		ib_init_ah_from_wc(agent->device, agent->port_num,
 235				   mad_recv_wc->wc, mad_recv_wc->recv_buf.grh,
 236				   &ah_attr);
 237
 238		packet->mad.hdr.gid_index = ah_attr.grh.sgid_index;
 239		packet->mad.hdr.hop_limit = ah_attr.grh.hop_limit;
 240		packet->mad.hdr.traffic_class = ah_attr.grh.traffic_class;
 241		memcpy(packet->mad.hdr.gid, &ah_attr.grh.dgid, 16);
 242		packet->mad.hdr.flow_label = cpu_to_be32(ah_attr.grh.flow_label);
 243	}
 244
 245	if (queue_packet(file, agent, packet))
 246		goto err2;
 247	return;
 248
 249err2:
 250	kfree(packet);
 251err1:
 252	ib_free_recv_mad(mad_recv_wc);
 253}
 254
 255static ssize_t copy_recv_mad(struct ib_umad_file *file, char __user *buf,
 256			     struct ib_umad_packet *packet, size_t count)
 257{
 258	struct ib_mad_recv_buf *recv_buf;
 259	int left, seg_payload, offset, max_seg_payload;
 260
 261	/* We need enough room to copy the first (or only) MAD segment. */
 262	recv_buf = &packet->recv_wc->recv_buf;
 263	if ((packet->length <= sizeof (*recv_buf->mad) &&
 264	     count < hdr_size(file) + packet->length) ||
 265	    (packet->length > sizeof (*recv_buf->mad) &&
 266	     count < hdr_size(file) + sizeof (*recv_buf->mad)))
 267		return -EINVAL;
 268
 269	if (copy_to_user(buf, &packet->mad, hdr_size(file)))
 270		return -EFAULT;
 271
 272	buf += hdr_size(file);
 273	seg_payload = min_t(int, packet->length, sizeof (*recv_buf->mad));
 274	if (copy_to_user(buf, recv_buf->mad, seg_payload))
 275		return -EFAULT;
 276
 277	if (seg_payload < packet->length) {
 278		/*
 279		 * Multipacket RMPP MAD message. Copy remainder of message.
 280		 * Note that last segment may have a shorter payload.
 281		 */
 282		if (count < hdr_size(file) + packet->length) {
 283			/*
 284			 * The buffer is too small, return the first RMPP segment,
 285			 * which includes the RMPP message length.
 286			 */
 287			return -ENOSPC;
 288		}
 289		offset = ib_get_mad_data_offset(recv_buf->mad->mad_hdr.mgmt_class);
 290		max_seg_payload = sizeof (struct ib_mad) - offset;
 291
 292		for (left = packet->length - seg_payload, buf += seg_payload;
 293		     left; left -= seg_payload, buf += seg_payload) {
 294			recv_buf = container_of(recv_buf->list.next,
 295						struct ib_mad_recv_buf, list);
 296			seg_payload = min(left, max_seg_payload);
 297			if (copy_to_user(buf, ((void *) recv_buf->mad) + offset,
 298					 seg_payload))
 299				return -EFAULT;
 300		}
 301	}
 302	return hdr_size(file) + packet->length;
 303}
 304
 305static ssize_t copy_send_mad(struct ib_umad_file *file, char __user *buf,
 306			     struct ib_umad_packet *packet, size_t count)
 307{
 308	ssize_t size = hdr_size(file) + packet->length;
 309
 310	if (count < size)
 311		return -EINVAL;
 312
 313	if (copy_to_user(buf, &packet->mad, hdr_size(file)))
 314		return -EFAULT;
 315
 316	buf += hdr_size(file);
 317
 318	if (copy_to_user(buf, packet->mad.data, packet->length))
 319		return -EFAULT;
 320
 321	return size;
 322}
 323
 324static ssize_t ib_umad_read(struct file *filp, char __user *buf,
 325			    size_t count, loff_t *pos)
 326{
 327	struct ib_umad_file *file = filp->private_data;
 328	struct ib_umad_packet *packet;
 329	ssize_t ret;
 330
 331	if (count < hdr_size(file))
 332		return -EINVAL;
 333
 334	mutex_lock(&file->mutex);
 335
 336	while (list_empty(&file->recv_list)) {
 337		mutex_unlock(&file->mutex);
 338
 339		if (filp->f_flags & O_NONBLOCK)
 340			return -EAGAIN;
 341
 342		if (wait_event_interruptible(file->recv_wait,
 343					     !list_empty(&file->recv_list)))
 344			return -ERESTARTSYS;
 345
 346		mutex_lock(&file->mutex);
 347	}
 348
 349	packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
 350	list_del(&packet->list);
 351
 352	mutex_unlock(&file->mutex);
 353
 354	if (packet->recv_wc)
 355		ret = copy_recv_mad(file, buf, packet, count);
 356	else
 357		ret = copy_send_mad(file, buf, packet, count);
 358
 359	if (ret < 0) {
 360		/* Requeue packet */
 361		mutex_lock(&file->mutex);
 362		list_add(&packet->list, &file->recv_list);
 363		mutex_unlock(&file->mutex);
 364	} else {
 365		if (packet->recv_wc)
 366			ib_free_recv_mad(packet->recv_wc);
 367		kfree(packet);
 368	}
 369	return ret;
 370}
 371
 372static int copy_rmpp_mad(struct ib_mad_send_buf *msg, const char __user *buf)
 373{
 374	int left, seg;
 375
 376	/* Copy class specific header */
 377	if ((msg->hdr_len > IB_MGMT_RMPP_HDR) &&
 378	    copy_from_user(msg->mad + IB_MGMT_RMPP_HDR, buf + IB_MGMT_RMPP_HDR,
 379			   msg->hdr_len - IB_MGMT_RMPP_HDR))
 380		return -EFAULT;
 381
 382	/* All headers are in place.  Copy data segments. */
 383	for (seg = 1, left = msg->data_len, buf += msg->hdr_len; left > 0;
 384	     seg++, left -= msg->seg_size, buf += msg->seg_size) {
 385		if (copy_from_user(ib_get_rmpp_segment(msg, seg), buf,
 386				   min(left, msg->seg_size)))
 387			return -EFAULT;
 388	}
 389	return 0;
 390}
 391
 392static int same_destination(struct ib_user_mad_hdr *hdr1,
 393			    struct ib_user_mad_hdr *hdr2)
 394{
 395	if (!hdr1->grh_present && !hdr2->grh_present)
 396	   return (hdr1->lid == hdr2->lid);
 397
 398	if (hdr1->grh_present && hdr2->grh_present)
 399	   return !memcmp(hdr1->gid, hdr2->gid, 16);
 400
 401	return 0;
 402}
 403
 404static int is_duplicate(struct ib_umad_file *file,
 405			struct ib_umad_packet *packet)
 406{
 407	struct ib_umad_packet *sent_packet;
 408	struct ib_mad_hdr *sent_hdr, *hdr;
 409
 410	hdr = (struct ib_mad_hdr *) packet->mad.data;
 411	list_for_each_entry(sent_packet, &file->send_list, list) {
 412		sent_hdr = (struct ib_mad_hdr *) sent_packet->mad.data;
 413
 414		if ((hdr->tid != sent_hdr->tid) ||
 415		    (hdr->mgmt_class != sent_hdr->mgmt_class))
 416			continue;
 417
 418		/*
 419		 * No need to be overly clever here.  If two new operations have
 420		 * the same TID, reject the second as a duplicate.  This is more
 421		 * restrictive than required by the spec.
 422		 */
 423		if (!ib_response_mad((struct ib_mad *) hdr)) {
 424			if (!ib_response_mad((struct ib_mad *) sent_hdr))
 425				return 1;
 426			continue;
 427		} else if (!ib_response_mad((struct ib_mad *) sent_hdr))
 428			continue;
 429
 430		if (same_destination(&packet->mad.hdr, &sent_packet->mad.hdr))
 431			return 1;
 432	}
 433
 434	return 0;
 435}
 436
 437static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
 438			     size_t count, loff_t *pos)
 439{
 440	struct ib_umad_file *file = filp->private_data;
 441	struct ib_umad_packet *packet;
 442	struct ib_mad_agent *agent;
 443	struct ib_ah_attr ah_attr;
 444	struct ib_ah *ah;
 445	struct ib_rmpp_mad *rmpp_mad;
 446	__be64 *tid;
 447	int ret, data_len, hdr_len, copy_offset, rmpp_active;
 448
 449	if (count < hdr_size(file) + IB_MGMT_RMPP_HDR)
 450		return -EINVAL;
 451
 452	packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL);
 453	if (!packet)
 454		return -ENOMEM;
 455
 456	if (copy_from_user(&packet->mad, buf, hdr_size(file))) {
 457		ret = -EFAULT;
 458		goto err;
 459	}
 460
 461	if (packet->mad.hdr.id < 0 ||
 462	    packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) {
 463		ret = -EINVAL;
 464		goto err;
 465	}
 466
 467	buf += hdr_size(file);
 468
 469	if (copy_from_user(packet->mad.data, buf, IB_MGMT_RMPP_HDR)) {
 470		ret = -EFAULT;
 471		goto err;
 472	}
 473
 474	mutex_lock(&file->mutex);
 475
 476	agent = __get_agent(file, packet->mad.hdr.id);
 477	if (!agent) {
 478		ret = -EINVAL;
 479		goto err_up;
 480	}
 481
 482	memset(&ah_attr, 0, sizeof ah_attr);
 483	ah_attr.dlid          = be16_to_cpu(packet->mad.hdr.lid);
 484	ah_attr.sl            = packet->mad.hdr.sl;
 485	ah_attr.src_path_bits = packet->mad.hdr.path_bits;
 486	ah_attr.port_num      = file->port->port_num;
 487	if (packet->mad.hdr.grh_present) {
 488		ah_attr.ah_flags = IB_AH_GRH;
 489		memcpy(ah_attr.grh.dgid.raw, packet->mad.hdr.gid, 16);
 490		ah_attr.grh.sgid_index	   = packet->mad.hdr.gid_index;
 491		ah_attr.grh.flow_label	   = be32_to_cpu(packet->mad.hdr.flow_label);
 492		ah_attr.grh.hop_limit	   = packet->mad.hdr.hop_limit;
 493		ah_attr.grh.traffic_class  = packet->mad.hdr.traffic_class;
 494	}
 495
 496	ah = ib_create_ah(agent->qp->pd, &ah_attr);
 497	if (IS_ERR(ah)) {
 498		ret = PTR_ERR(ah);
 499		goto err_up;
 500	}
 501
 502	rmpp_mad = (struct ib_rmpp_mad *) packet->mad.data;
 503	hdr_len = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class);
 504	if (!ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class)) {
 505		copy_offset = IB_MGMT_MAD_HDR;
 506		rmpp_active = 0;
 507	} else {
 508		copy_offset = IB_MGMT_RMPP_HDR;
 509		rmpp_active = ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
 510			      IB_MGMT_RMPP_FLAG_ACTIVE;
 511	}
 512
 513	data_len = count - hdr_size(file) - hdr_len;
 514	packet->msg = ib_create_send_mad(agent,
 515					 be32_to_cpu(packet->mad.hdr.qpn),
 516					 packet->mad.hdr.pkey_index, rmpp_active,
 517					 hdr_len, data_len, GFP_KERNEL);
 518	if (IS_ERR(packet->msg)) {
 519		ret = PTR_ERR(packet->msg);
 520		goto err_ah;
 521	}
 522
 523	packet->msg->ah		= ah;
 524	packet->msg->timeout_ms = packet->mad.hdr.timeout_ms;
 525	packet->msg->retries	= packet->mad.hdr.retries;
 526	packet->msg->context[0] = packet;
 527
 528	/* Copy MAD header.  Any RMPP header is already in place. */
 529	memcpy(packet->msg->mad, packet->mad.data, IB_MGMT_MAD_HDR);
 530
 531	if (!rmpp_active) {
 532		if (copy_from_user(packet->msg->mad + copy_offset,
 533				   buf + copy_offset,
 534				   hdr_len + data_len - copy_offset)) {
 535			ret = -EFAULT;
 536			goto err_msg;
 537		}
 538	} else {
 539		ret = copy_rmpp_mad(packet->msg, buf);
 540		if (ret)
 541			goto err_msg;
 542	}
 543
 544	/*
 545	 * Set the high-order part of the transaction ID to make MADs from
 546	 * different agents unique, and allow routing responses back to the
 547	 * original requestor.
 548	 */
 549	if (!ib_response_mad(packet->msg->mad)) {
 550		tid = &((struct ib_mad_hdr *) packet->msg->mad)->tid;
 551		*tid = cpu_to_be64(((u64) agent->hi_tid) << 32 |
 552				   (be64_to_cpup(tid) & 0xffffffff));
 553		rmpp_mad->mad_hdr.tid = *tid;
 554	}
 555
 556	spin_lock_irq(&file->send_lock);
 557	ret = is_duplicate(file, packet);
 558	if (!ret)
 559		list_add_tail(&packet->list, &file->send_list);
 560	spin_unlock_irq(&file->send_lock);
 561	if (ret) {
 562		ret = -EINVAL;
 563		goto err_msg;
 564	}
 565
 566	ret = ib_post_send_mad(packet->msg, NULL);
 567	if (ret)
 568		goto err_send;
 569
 570	mutex_unlock(&file->mutex);
 571	return count;
 572
 573err_send:
 574	dequeue_send(file, packet);
 575err_msg:
 576	ib_free_send_mad(packet->msg);
 577err_ah:
 578	ib_destroy_ah(ah);
 579err_up:
 580	mutex_unlock(&file->mutex);
 581err:
 582	kfree(packet);
 583	return ret;
 584}
 585
 586static unsigned int ib_umad_poll(struct file *filp, struct poll_table_struct *wait)
 587{
 588	struct ib_umad_file *file = filp->private_data;
 589
 590	/* we will always be able to post a MAD send */
 591	unsigned int mask = POLLOUT | POLLWRNORM;
 592
 593	poll_wait(filp, &file->recv_wait, wait);
 594
 595	if (!list_empty(&file->recv_list))
 596		mask |= POLLIN | POLLRDNORM;
 597
 598	return mask;
 599}
 600
 601static int ib_umad_reg_agent(struct ib_umad_file *file, void __user *arg,
 602			     int compat_method_mask)
 603{
 604	struct ib_user_mad_reg_req ureq;
 605	struct ib_mad_reg_req req;
 606	struct ib_mad_agent *agent = NULL;
 607	int agent_id;
 608	int ret;
 609
 610	mutex_lock(&file->port->file_mutex);
 611	mutex_lock(&file->mutex);
 612
 613	if (!file->port->ib_dev) {
 614		ret = -EPIPE;
 615		goto out;
 616	}
 617
 618	if (copy_from_user(&ureq, arg, sizeof ureq)) {
 619		ret = -EFAULT;
 620		goto out;
 621	}
 622
 623	if (ureq.qpn != 0 && ureq.qpn != 1) {
 624		ret = -EINVAL;
 625		goto out;
 626	}
 627
 628	for (agent_id = 0; agent_id < IB_UMAD_MAX_AGENTS; ++agent_id)
 629		if (!__get_agent(file, agent_id))
 630			goto found;
 631
 632	ret = -ENOMEM;
 633	goto out;
 634
 635found:
 636	if (ureq.mgmt_class) {
 637		req.mgmt_class         = ureq.mgmt_class;
 638		req.mgmt_class_version = ureq.mgmt_class_version;
 639		memcpy(req.oui, ureq.oui, sizeof req.oui);
 640
 641		if (compat_method_mask) {
 642			u32 *umm = (u32 *) ureq.method_mask;
 643			int i;
 644
 645			for (i = 0; i < BITS_TO_LONGS(IB_MGMT_MAX_METHODS); ++i)
 646				req.method_mask[i] =
 647					umm[i * 2] | ((u64) umm[i * 2 + 1] << 32);
 648		} else
 649			memcpy(req.method_mask, ureq.method_mask,
 650			       sizeof req.method_mask);
 651	}
 652
 653	agent = ib_register_mad_agent(file->port->ib_dev, file->port->port_num,
 654				      ureq.qpn ? IB_QPT_GSI : IB_QPT_SMI,
 655				      ureq.mgmt_class ? &req : NULL,
 656				      ureq.rmpp_version,
 657				      send_handler, recv_handler, file);
 658	if (IS_ERR(agent)) {
 659		ret = PTR_ERR(agent);
 660		agent = NULL;
 661		goto out;
 662	}
 663
 664	if (put_user(agent_id,
 665		     (u32 __user *) (arg + offsetof(struct ib_user_mad_reg_req, id)))) {
 666		ret = -EFAULT;
 667		goto out;
 668	}
 669
 670	if (!file->already_used) {
 671		file->already_used = 1;
 672		if (!file->use_pkey_index) {
 673			printk(KERN_WARNING "user_mad: process %s did not enable "
 674			       "P_Key index support.\n", current->comm);
 675			printk(KERN_WARNING "user_mad:   Documentation/infiniband/user_mad.txt "
 676			       "has info on the new ABI.\n");
 677		}
 678	}
 679
 680	file->agent[agent_id] = agent;
 681	ret = 0;
 682
 683out:
 684	mutex_unlock(&file->mutex);
 685
 686	if (ret && agent)
 687		ib_unregister_mad_agent(agent);
 688
 689	mutex_unlock(&file->port->file_mutex);
 690
 691	return ret;
 692}
 693
 694static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
 695{
 696	struct ib_mad_agent *agent = NULL;
 697	u32 id;
 698	int ret = 0;
 699
 700	if (get_user(id, arg))
 701		return -EFAULT;
 702
 703	mutex_lock(&file->port->file_mutex);
 704	mutex_lock(&file->mutex);
 705
 706	if (id < 0 || id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
 707		ret = -EINVAL;
 708		goto out;
 709	}
 710
 711	agent = file->agent[id];
 712	file->agent[id] = NULL;
 713
 714out:
 715	mutex_unlock(&file->mutex);
 716
 717	if (agent)
 718		ib_unregister_mad_agent(agent);
 719
 720	mutex_unlock(&file->port->file_mutex);
 721
 722	return ret;
 723}
 724
 725static long ib_umad_enable_pkey(struct ib_umad_file *file)
 726{
 727	int ret = 0;
 728
 729	mutex_lock(&file->mutex);
 730	if (file->already_used)
 731		ret = -EINVAL;
 732	else
 733		file->use_pkey_index = 1;
 734	mutex_unlock(&file->mutex);
 735
 736	return ret;
 737}
 738
 739static long ib_umad_ioctl(struct file *filp, unsigned int cmd,
 740			  unsigned long arg)
 741{
 742	switch (cmd) {
 743	case IB_USER_MAD_REGISTER_AGENT:
 744		return ib_umad_reg_agent(filp->private_data, (void __user *) arg, 0);
 745	case IB_USER_MAD_UNREGISTER_AGENT:
 746		return ib_umad_unreg_agent(filp->private_data, (__u32 __user *) arg);
 747	case IB_USER_MAD_ENABLE_PKEY:
 748		return ib_umad_enable_pkey(filp->private_data);
 749	default:
 750		return -ENOIOCTLCMD;
 751	}
 752}
 753
 754#ifdef CONFIG_COMPAT
 755static long ib_umad_compat_ioctl(struct file *filp, unsigned int cmd,
 756				 unsigned long arg)
 757{
 758	switch (cmd) {
 759	case IB_USER_MAD_REGISTER_AGENT:
 760		return ib_umad_reg_agent(filp->private_data, compat_ptr(arg), 1);
 761	case IB_USER_MAD_UNREGISTER_AGENT:
 762		return ib_umad_unreg_agent(filp->private_data, compat_ptr(arg));
 763	case IB_USER_MAD_ENABLE_PKEY:
 764		return ib_umad_enable_pkey(filp->private_data);
 765	default:
 766		return -ENOIOCTLCMD;
 767	}
 768}
 769#endif
 770
 771/*
 772 * ib_umad_open() does not need the BKL:
 773 *
 774 *  - the ib_umad_port structures are properly reference counted, and
 775 *    everything else is purely local to the file being created, so
 776 *    races against other open calls are not a problem;
 777 *  - the ioctl method does not affect any global state outside of the
 778 *    file structure being operated on;
 779 */
 780static int ib_umad_open(struct inode *inode, struct file *filp)
 781{
 782	struct ib_umad_port *port;
 783	struct ib_umad_file *file;
 784	int ret;
 785
 786	port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
 787	if (port)
 788		kref_get(&port->umad_dev->ref);
 789	else
 790		return -ENXIO;
 791
 792	mutex_lock(&port->file_mutex);
 793
 794	if (!port->ib_dev) {
 795		ret = -ENXIO;
 796		goto out;
 797	}
 798
 799	file = kzalloc(sizeof *file, GFP_KERNEL);
 800	if (!file) {
 801		kref_put(&port->umad_dev->ref, ib_umad_release_dev);
 802		ret = -ENOMEM;
 803		goto out;
 804	}
 805
 806	mutex_init(&file->mutex);
 807	spin_lock_init(&file->send_lock);
 808	INIT_LIST_HEAD(&file->recv_list);
 809	INIT_LIST_HEAD(&file->send_list);
 810	init_waitqueue_head(&file->recv_wait);
 811
 812	file->port = port;
 813	filp->private_data = file;
 814
 815	list_add_tail(&file->port_list, &port->file_list);
 816
 817	ret = nonseekable_open(inode, filp);
 818
 819out:
 820	mutex_unlock(&port->file_mutex);
 821	return ret;
 822}
 823
 824static int ib_umad_close(struct inode *inode, struct file *filp)
 825{
 826	struct ib_umad_file *file = filp->private_data;
 827	struct ib_umad_device *dev = file->port->umad_dev;
 828	struct ib_umad_packet *packet, *tmp;
 829	int already_dead;
 830	int i;
 831
 832	mutex_lock(&file->port->file_mutex);
 833	mutex_lock(&file->mutex);
 834
 835	already_dead = file->agents_dead;
 836	file->agents_dead = 1;
 837
 838	list_for_each_entry_safe(packet, tmp, &file->recv_list, list) {
 839		if (packet->recv_wc)
 840			ib_free_recv_mad(packet->recv_wc);
 841		kfree(packet);
 842	}
 843
 844	list_del(&file->port_list);
 845
 846	mutex_unlock(&file->mutex);
 847
 848	if (!already_dead)
 849		for (i = 0; i < IB_UMAD_MAX_AGENTS; ++i)
 850			if (file->agent[i])
 851				ib_unregister_mad_agent(file->agent[i]);
 852
 853	mutex_unlock(&file->port->file_mutex);
 854
 855	kfree(file);
 856	kref_put(&dev->ref, ib_umad_release_dev);
 857
 858	return 0;
 859}
 860
 861static const struct file_operations umad_fops = {
 862	.owner		= THIS_MODULE,
 863	.read		= ib_umad_read,
 864	.write		= ib_umad_write,
 865	.poll		= ib_umad_poll,
 866	.unlocked_ioctl = ib_umad_ioctl,
 867#ifdef CONFIG_COMPAT
 868	.compat_ioctl	= ib_umad_compat_ioctl,
 869#endif
 870	.open		= ib_umad_open,
 871	.release	= ib_umad_close,
 872	.llseek		= no_llseek,
 873};
 874
 875static int ib_umad_sm_open(struct inode *inode, struct file *filp)
 876{
 877	struct ib_umad_port *port;
 878	struct ib_port_modify props = {
 879		.set_port_cap_mask = IB_PORT_SM
 880	};
 881	int ret;
 882
 883	port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev);
 884	if (port)
 885		kref_get(&port->umad_dev->ref);
 886	else
 887		return -ENXIO;
 888
 889	if (filp->f_flags & O_NONBLOCK) {
 890		if (down_trylock(&port->sm_sem)) {
 891			ret = -EAGAIN;
 892			goto fail;
 893		}
 894	} else {
 895		if (down_interruptible(&port->sm_sem)) {
 896			ret = -ERESTARTSYS;
 897			goto fail;
 898		}
 899	}
 900
 901	ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props);
 902	if (ret) {
 903		up(&port->sm_sem);
 904		goto fail;
 905	}
 906
 907	filp->private_data = port;
 908
 909	return nonseekable_open(inode, filp);
 910
 911fail:
 912	kref_put(&port->umad_dev->ref, ib_umad_release_dev);
 913	return ret;
 914}
 915
 916static int ib_umad_sm_close(struct inode *inode, struct file *filp)
 917{
 918	struct ib_umad_port *port = filp->private_data;
 919	struct ib_port_modify props = {
 920		.clr_port_cap_mask = IB_PORT_SM
 921	};
 922	int ret = 0;
 923
 924	mutex_lock(&port->file_mutex);
 925	if (port->ib_dev)
 926		ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props);
 927	mutex_unlock(&port->file_mutex);
 928
 929	up(&port->sm_sem);
 930
 931	kref_put(&port->umad_dev->ref, ib_umad_release_dev);
 932
 933	return ret;
 934}
 935
 936static const struct file_operations umad_sm_fops = {
 937	.owner	 = THIS_MODULE,
 938	.open	 = ib_umad_sm_open,
 939	.release = ib_umad_sm_close,
 940	.llseek	 = no_llseek,
 941};
 942
 943static struct ib_client umad_client = {
 944	.name   = "umad",
 945	.add    = ib_umad_add_one,
 946	.remove = ib_umad_remove_one
 947};
 948
 949static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
 950			  char *buf)
 951{
 952	struct ib_umad_port *port = dev_get_drvdata(dev);
 953
 954	if (!port)
 955		return -ENODEV;
 956
 957	return sprintf(buf, "%s\n", port->ib_dev->name);
 958}
 959static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
 960
 961static ssize_t show_port(struct device *dev, struct device_attribute *attr,
 962			 char *buf)
 963{
 964	struct ib_umad_port *port = dev_get_drvdata(dev);
 965
 966	if (!port)
 967		return -ENODEV;
 968
 969	return sprintf(buf, "%d\n", port->port_num);
 970}
 971static DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
 972
 973static CLASS_ATTR_STRING(abi_version, S_IRUGO,
 974			 __stringify(IB_USER_MAD_ABI_VERSION));
 975
 976static dev_t overflow_maj;
 977static DECLARE_BITMAP(overflow_map, IB_UMAD_MAX_PORTS);
 978static int find_overflow_devnum(void)
 979{
 980	int ret;
 981
 982	if (!overflow_maj) {
 983		ret = alloc_chrdev_region(&overflow_maj, 0, IB_UMAD_MAX_PORTS * 2,
 984					  "infiniband_mad");
 985		if (ret) {
 986			printk(KERN_ERR "user_mad: couldn't register dynamic device number\n");
 987			return ret;
 988		}
 989	}
 990
 991	ret = find_first_zero_bit(overflow_map, IB_UMAD_MAX_PORTS);
 992	if (ret >= IB_UMAD_MAX_PORTS)
 993		return -1;
 994
 995	return ret;
 996}
 997
 998static int ib_umad_init_port(struct ib_device *device, int port_num,
 999			     struct ib_umad_port *port)
1000{
1001	int devnum;
1002	dev_t base;
1003
1004	spin_lock(&port_lock);
1005	devnum = find_first_zero_bit(dev_map, IB_UMAD_MAX_PORTS);
1006	if (devnum >= IB_UMAD_MAX_PORTS) {
1007		spin_unlock(&port_lock);
1008		devnum = find_overflow_devnum();
1009		if (devnum < 0)
1010			return -1;
1011
1012		spin_lock(&port_lock);
1013		port->dev_num = devnum + IB_UMAD_MAX_PORTS;
1014		base = devnum + overflow_maj;
1015		set_bit(devnum, overflow_map);
1016	} else {
1017		port->dev_num = devnum;
1018		base = devnum + base_dev;
1019		set_bit(devnum, dev_map);
1020	}
1021	spin_unlock(&port_lock);
1022
1023	port->ib_dev   = device;
1024	port->port_num = port_num;
1025	sema_init(&port->sm_sem, 1);
1026	mutex_init(&port->file_mutex);
1027	INIT_LIST_HEAD(&port->file_list);
1028
1029	cdev_init(&port->cdev, &umad_fops);
1030	port->cdev.owner = THIS_MODULE;
1031	kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num);
1032	if (cdev_add(&port->cdev, base, 1))
1033		goto err_cdev;
1034
1035	port->dev = device_create(umad_class, device->dma_device,
1036				  port->cdev.dev, port,
1037				  "umad%d", port->dev_num);
1038	if (IS_ERR(port->dev))
1039		goto err_cdev;
1040
1041	if (device_create_file(port->dev, &dev_attr_ibdev))
1042		goto err_dev;
1043	if (device_create_file(port->dev, &dev_attr_port))
1044		goto err_dev;
1045
1046	base += IB_UMAD_MAX_PORTS;
1047	cdev_init(&port->sm_cdev, &umad_sm_fops);
1048	port->sm_cdev.owner = THIS_MODULE;
1049	kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num);
1050	if (cdev_add(&port->sm_cdev, base, 1))
1051		goto err_sm_cdev;
1052
1053	port->sm_dev = device_create(umad_class, device->dma_device,
1054				     port->sm_cdev.dev, port,
1055				     "issm%d", port->dev_num);
1056	if (IS_ERR(port->sm_dev))
1057		goto err_sm_cdev;
1058
1059	if (device_create_file(port->sm_dev, &dev_attr_ibdev))
1060		goto err_sm_dev;
1061	if (device_create_file(port->sm_dev, &dev_attr_port))
1062		goto err_sm_dev;
1063
1064	return 0;
1065
1066err_sm_dev:
1067	device_destroy(umad_class, port->sm_cdev.dev);
1068
1069err_sm_cdev:
1070	cdev_del(&port->sm_cdev);
1071
1072err_dev:
1073	device_destroy(umad_class, port->cdev.dev);
1074
1075err_cdev:
1076	cdev_del(&port->cdev);
1077	if (port->dev_num < IB_UMAD_MAX_PORTS)
1078		clear_bit(devnum, dev_map);
1079	else
1080		clear_bit(devnum, overflow_map);
1081
1082	return -1;
1083}
1084
1085static void ib_umad_kill_port(struct ib_umad_port *port)
1086{
1087	struct ib_umad_file *file;
1088	int id;
1089
1090	dev_set_drvdata(port->dev,    NULL);
1091	dev_set_drvdata(port->sm_dev, NULL);
1092
1093	device_destroy(umad_class, port->cdev.dev);
1094	device_destroy(umad_class, port->sm_cdev.dev);
1095
1096	cdev_del(&port->cdev);
1097	cdev_del(&port->sm_cdev);
1098
1099	mutex_lock(&port->file_mutex);
1100
1101	port->ib_dev = NULL;
1102
1103	list_for_each_entry(file, &port->file_list, port_list) {
1104		mutex_lock(&file->mutex);
1105		file->agents_dead = 1;
1106		mutex_unlock(&file->mutex);
1107
1108		for (id = 0; id < IB_UMAD_MAX_AGENTS; ++id)
1109			if (file->agent[id])
1110				ib_unregister_mad_agent(file->agent[id]);
1111	}
1112
1113	mutex_unlock(&port->file_mutex);
1114
1115	if (port->dev_num < IB_UMAD_MAX_PORTS)
1116		clear_bit(port->dev_num, dev_map);
1117	else
1118		clear_bit(port->dev_num - IB_UMAD_MAX_PORTS, overflow_map);
1119}
1120
1121static void ib_umad_add_one(struct ib_device *device)
1122{
1123	struct ib_umad_device *umad_dev;
1124	int s, e, i;
1125
1126	if (rdma_node_get_transport(device->node_type) != RDMA_TRANSPORT_IB)
1127		return;
1128
1129	if (device->node_type == RDMA_NODE_IB_SWITCH)
1130		s = e = 0;
1131	else {
1132		s = 1;
1133		e = device->phys_port_cnt;
1134	}
1135
1136	umad_dev = kzalloc(sizeof *umad_dev +
1137			   (e - s + 1) * sizeof (struct ib_umad_port),
1138			   GFP_KERNEL);
1139	if (!umad_dev)
1140		return;
1141
1142	kref_init(&umad_dev->ref);
1143
1144	umad_dev->start_port = s;
1145	umad_dev->end_port   = e;
1146
1147	for (i = s; i <= e; ++i) {
1148		umad_dev->port[i - s].umad_dev = umad_dev;
1149
1150		if (ib_umad_init_port(device, i, &umad_dev->port[i - s]))
1151			goto err;
1152	}
1153
1154	ib_set_client_data(device, &umad_client, umad_dev);
1155
1156	return;
1157
1158err:
1159	while (--i >= s)
1160		ib_umad_kill_port(&umad_dev->port[i - s]);
1161
1162	kref_put(&umad_dev->ref, ib_umad_release_dev);
1163}
1164
1165static void ib_umad_remove_one(struct ib_device *device)
1166{
1167	struct ib_umad_device *umad_dev = ib_get_client_data(device, &umad_client);
1168	int i;
1169
1170	if (!umad_dev)
1171		return;
1172
1173	for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i)
1174		ib_umad_kill_port(&umad_dev->port[i]);
1175
1176	kref_put(&umad_dev->ref, ib_umad_release_dev);
1177}
1178
1179static char *umad_devnode(struct device *dev, mode_t *mode)
1180{
1181	return kasprintf(GFP_KERNEL, "infiniband/%s", dev_name(dev));
1182}
1183
1184static int __init ib_umad_init(void)
1185{
1186	int ret;
1187
1188	ret = register_chrdev_region(base_dev, IB_UMAD_MAX_PORTS * 2,
1189				     "infiniband_mad");
1190	if (ret) {
1191		printk(KERN_ERR "user_mad: couldn't register device number\n");
1192		goto out;
1193	}
1194
1195	umad_class = class_create(THIS_MODULE, "infiniband_mad");
1196	if (IS_ERR(umad_class)) {
1197		ret = PTR_ERR(umad_class);
1198		printk(KERN_ERR "user_mad: couldn't create class infiniband_mad\n");
1199		goto out_chrdev;
1200	}
1201
1202	umad_class->devnode = umad_devnode;
1203
1204	ret = class_create_file(umad_class, &class_attr_abi_version.attr);
1205	if (ret) {
1206		printk(KERN_ERR "user_mad: couldn't create abi_version attribute\n");
1207		goto out_class;
1208	}
1209
1210	ret = ib_register_client(&umad_client);
1211	if (ret) {
1212		printk(KERN_ERR "user_mad: couldn't register ib_umad client\n");
1213		goto out_class;
1214	}
1215
1216	return 0;
1217
1218out_class:
1219	class_destroy(umad_class);
1220
1221out_chrdev:
1222	unregister_chrdev_region(base_dev, IB_UMAD_MAX_PORTS * 2);
1223
1224out:
1225	return ret;
1226}
1227
1228static void __exit ib_umad_cleanup(void)
1229{
1230	ib_unregister_client(&umad_client);
1231	class_destroy(umad_class);
1232	unregister_chrdev_region(base_dev, IB_UMAD_MAX_PORTS * 2);
1233	if (overflow_maj)
1234		unregister_chrdev_region(overflow_maj, IB_UMAD_MAX_PORTS * 2);
1235}
1236
1237module_init(ib_umad_init);
1238module_exit(ib_umad_cleanup);