1/*-
2 * SPDX-License-Identifier: BSD-2-Clause OR GPL-2.0
3 *
4 * Copyright (c) 2005 Topspin Communications.  All rights reserved.
5 * Copyright (c) 2005 Intel Corporation.  All rights reserved.
6 *
7 * This software is available to you under a choice of one of two
8 * licenses.  You may choose to be licensed under the terms of the GNU
9 * General Public License (GPL) Version 2, available from the file
10 * COPYING in the main directory of this source tree, or the
11 * OpenIB.org BSD license below:
12 *
13 *     Redistribution and use in source and binary forms, with or
14 *     without modification, are permitted provided that the following
15 *     conditions are met:
16 *
17 *      - Redistributions of source code must retain the above
18 *	copyright notice, this list of conditions and the following
19 *	disclaimer.
20 *
21 *      - Redistributions in binary form must reproduce the above
22 *	copyright notice, this list of conditions and the following
23 *	disclaimer in the documentation and/or other materials
24 *	provided with the distribution.
25 *
26 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
30 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
31 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
32 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33 * SOFTWARE.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD$");
38
39#include <linux/completion.h>
40#include <linux/fs.h>
41#include <linux/module.h>
42#include <linux/device.h>
43#include <linux/err.h>
44#include <linux/poll.h>
45#include <linux/sched.h>
46#include <linux/file.h>
47#include <linux/cdev.h>
48#include <linux/idr.h>
49#include <linux/mutex.h>
50#include <linux/slab.h>
51
52#include <asm/uaccess.h>
53
54#include <rdma/ib.h>
55#include <rdma/ib_cm.h>
56#include <rdma/ib_user_cm.h>
57#include <rdma/ib_marshall.h>
58
59MODULE_AUTHOR("Libor Michalek");
60MODULE_DESCRIPTION("InfiniBand userspace Connection Manager access");
61MODULE_LICENSE("Dual BSD/GPL");
62
63struct ib_ucm_device {
64	int			devnum;
65	struct cdev		cdev;
66	struct device		dev;
67	struct ib_device	*ib_dev;
68};
69
70struct ib_ucm_file {
71	struct mutex file_mutex;
72	struct file *filp;
73	struct ib_ucm_device *device;
74
75	struct list_head  ctxs;
76	struct list_head  events;
77	wait_queue_head_t poll_wait;
78};
79
80struct ib_ucm_context {
81	int                 id;
82	struct completion   comp;
83	atomic_t            ref;
84	int		    events_reported;
85
86	struct ib_ucm_file *file;
87	struct ib_cm_id    *cm_id;
88	__u64		   uid;
89
90	struct list_head    events;    /* list of pending events. */
91	struct list_head    file_list; /* member in file ctx list */
92};
93
94struct ib_ucm_event {
95	struct ib_ucm_context *ctx;
96	struct list_head file_list; /* member in file event list */
97	struct list_head ctx_list;  /* member in ctx event list */
98
99	struct ib_cm_id *cm_id;
100	struct ib_ucm_event_resp resp;
101	void *data;
102	void *info;
103	int data_len;
104	int info_len;
105};
106
107enum {
108	IB_UCM_MAJOR = 231,
109	IB_UCM_BASE_MINOR = 224,
110	IB_UCM_MAX_DEVICES = 32
111};
112
113#define IB_UCM_BASE_DEV MKDEV(IB_UCM_MAJOR, IB_UCM_BASE_MINOR)
114
115static void ib_ucm_add_one(struct ib_device *device);
116static void ib_ucm_remove_one(struct ib_device *device, void *client_data);
117
118static struct ib_client ucm_client = {
119	.name   = "ucm",
120	.add    = ib_ucm_add_one,
121	.remove = ib_ucm_remove_one
122};
123
124static DEFINE_MUTEX(ctx_id_mutex);
125static DEFINE_IDR(ctx_id_table);
126static DECLARE_BITMAP(dev_map, IB_UCM_MAX_DEVICES);
127
128static struct ib_ucm_context *ib_ucm_ctx_get(struct ib_ucm_file *file, int id)
129{
130	struct ib_ucm_context *ctx;
131
132	mutex_lock(&ctx_id_mutex);
133	ctx = idr_find(&ctx_id_table, id);
134	if (!ctx)
135		ctx = ERR_PTR(-ENOENT);
136	else if (ctx->file != file)
137		ctx = ERR_PTR(-EINVAL);
138	else
139		atomic_inc(&ctx->ref);
140	mutex_unlock(&ctx_id_mutex);
141
142	return ctx;
143}
144
145static void ib_ucm_ctx_put(struct ib_ucm_context *ctx)
146{
147	if (atomic_dec_and_test(&ctx->ref))
148		complete(&ctx->comp);
149}
150
151static inline int ib_ucm_new_cm_id(int event)
152{
153	return event == IB_CM_REQ_RECEIVED || event == IB_CM_SIDR_REQ_RECEIVED;
154}
155
156static void ib_ucm_cleanup_events(struct ib_ucm_context *ctx)
157{
158	struct ib_ucm_event *uevent;
159
160	mutex_lock(&ctx->file->file_mutex);
161	list_del(&ctx->file_list);
162	while (!list_empty(&ctx->events)) {
163
164		uevent = list_entry(ctx->events.next,
165				    struct ib_ucm_event, ctx_list);
166		list_del(&uevent->file_list);
167		list_del(&uevent->ctx_list);
168		mutex_unlock(&ctx->file->file_mutex);
169
170		/* clear incoming connections. */
171		if (ib_ucm_new_cm_id(uevent->resp.event))
172			ib_destroy_cm_id(uevent->cm_id);
173
174		kfree(uevent);
175		mutex_lock(&ctx->file->file_mutex);
176	}
177	mutex_unlock(&ctx->file->file_mutex);
178}
179
180static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
181{
182	struct ib_ucm_context *ctx;
183
184	ctx = kzalloc(sizeof *ctx, GFP_KERNEL);
185	if (!ctx)
186		return NULL;
187
188	atomic_set(&ctx->ref, 1);
189	init_completion(&ctx->comp);
190	ctx->file = file;
191	INIT_LIST_HEAD(&ctx->events);
192
193	mutex_lock(&ctx_id_mutex);
194	ctx->id = idr_alloc(&ctx_id_table, ctx, 0, 0, GFP_KERNEL);
195	mutex_unlock(&ctx_id_mutex);
196	if (ctx->id < 0)
197		goto error;
198
199	list_add_tail(&ctx->file_list, &file->ctxs);
200	return ctx;
201
202error:
203	kfree(ctx);
204	return NULL;
205}
206
207static void ib_ucm_event_req_get(struct ib_ucm_req_event_resp *ureq,
208				 struct ib_cm_req_event_param *kreq)
209{
210	ureq->remote_ca_guid             = kreq->remote_ca_guid;
211	ureq->remote_qkey                = kreq->remote_qkey;
212	ureq->remote_qpn                 = kreq->remote_qpn;
213	ureq->qp_type                    = kreq->qp_type;
214	ureq->starting_psn               = kreq->starting_psn;
215	ureq->responder_resources        = kreq->responder_resources;
216	ureq->initiator_depth            = kreq->initiator_depth;
217	ureq->local_cm_response_timeout  = kreq->local_cm_response_timeout;
218	ureq->flow_control               = kreq->flow_control;
219	ureq->remote_cm_response_timeout = kreq->remote_cm_response_timeout;
220	ureq->retry_count                = kreq->retry_count;
221	ureq->rnr_retry_count            = kreq->rnr_retry_count;
222	ureq->srq                        = kreq->srq;
223	ureq->port			 = kreq->port;
224
225	ib_copy_path_rec_to_user(&ureq->primary_path, kreq->primary_path);
226	if (kreq->alternate_path)
227		ib_copy_path_rec_to_user(&ureq->alternate_path,
228					 kreq->alternate_path);
229}
230
231static void ib_ucm_event_rep_get(struct ib_ucm_rep_event_resp *urep,
232				 struct ib_cm_rep_event_param *krep)
233{
234	urep->remote_ca_guid      = krep->remote_ca_guid;
235	urep->remote_qkey         = krep->remote_qkey;
236	urep->remote_qpn          = krep->remote_qpn;
237	urep->starting_psn        = krep->starting_psn;
238	urep->responder_resources = krep->responder_resources;
239	urep->initiator_depth     = krep->initiator_depth;
240	urep->target_ack_delay    = krep->target_ack_delay;
241	urep->failover_accepted   = krep->failover_accepted;
242	urep->flow_control        = krep->flow_control;
243	urep->rnr_retry_count     = krep->rnr_retry_count;
244	urep->srq                 = krep->srq;
245}
246
247static void ib_ucm_event_sidr_rep_get(struct ib_ucm_sidr_rep_event_resp *urep,
248				      struct ib_cm_sidr_rep_event_param *krep)
249{
250	urep->status = krep->status;
251	urep->qkey   = krep->qkey;
252	urep->qpn    = krep->qpn;
253};
254
255static int ib_ucm_event_process(struct ib_cm_event *evt,
256				struct ib_ucm_event *uvt)
257{
258	void *info = NULL;
259
260	switch (evt->event) {
261	case IB_CM_REQ_RECEIVED:
262		ib_ucm_event_req_get(&uvt->resp.u.req_resp,
263				     &evt->param.req_rcvd);
264		uvt->data_len      = IB_CM_REQ_PRIVATE_DATA_SIZE;
265		uvt->resp.present  = IB_UCM_PRES_PRIMARY;
266		uvt->resp.present |= (evt->param.req_rcvd.alternate_path ?
267				      IB_UCM_PRES_ALTERNATE : 0);
268		break;
269	case IB_CM_REP_RECEIVED:
270		ib_ucm_event_rep_get(&uvt->resp.u.rep_resp,
271				     &evt->param.rep_rcvd);
272		uvt->data_len = IB_CM_REP_PRIVATE_DATA_SIZE;
273		break;
274	case IB_CM_RTU_RECEIVED:
275		uvt->data_len = IB_CM_RTU_PRIVATE_DATA_SIZE;
276		uvt->resp.u.send_status = evt->param.send_status;
277		break;
278	case IB_CM_DREQ_RECEIVED:
279		uvt->data_len = IB_CM_DREQ_PRIVATE_DATA_SIZE;
280		uvt->resp.u.send_status = evt->param.send_status;
281		break;
282	case IB_CM_DREP_RECEIVED:
283		uvt->data_len = IB_CM_DREP_PRIVATE_DATA_SIZE;
284		uvt->resp.u.send_status = evt->param.send_status;
285		break;
286	case IB_CM_MRA_RECEIVED:
287		uvt->resp.u.mra_resp.timeout =
288					evt->param.mra_rcvd.service_timeout;
289		uvt->data_len = IB_CM_MRA_PRIVATE_DATA_SIZE;
290		break;
291	case IB_CM_REJ_RECEIVED:
292		uvt->resp.u.rej_resp.reason = evt->param.rej_rcvd.reason;
293		uvt->data_len = IB_CM_REJ_PRIVATE_DATA_SIZE;
294		uvt->info_len = evt->param.rej_rcvd.ari_length;
295		info	      = evt->param.rej_rcvd.ari;
296		break;
297	case IB_CM_LAP_RECEIVED:
298		ib_copy_path_rec_to_user(&uvt->resp.u.lap_resp.path,
299					 evt->param.lap_rcvd.alternate_path);
300		uvt->data_len = IB_CM_LAP_PRIVATE_DATA_SIZE;
301		uvt->resp.present = IB_UCM_PRES_ALTERNATE;
302		break;
303	case IB_CM_APR_RECEIVED:
304		uvt->resp.u.apr_resp.status = evt->param.apr_rcvd.ap_status;
305		uvt->data_len = IB_CM_APR_PRIVATE_DATA_SIZE;
306		uvt->info_len = evt->param.apr_rcvd.info_len;
307		info	      = evt->param.apr_rcvd.apr_info;
308		break;
309	case IB_CM_SIDR_REQ_RECEIVED:
310		uvt->resp.u.sidr_req_resp.pkey =
311					evt->param.sidr_req_rcvd.pkey;
312		uvt->resp.u.sidr_req_resp.port =
313					evt->param.sidr_req_rcvd.port;
314		uvt->data_len = IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE;
315		break;
316	case IB_CM_SIDR_REP_RECEIVED:
317		ib_ucm_event_sidr_rep_get(&uvt->resp.u.sidr_rep_resp,
318					  &evt->param.sidr_rep_rcvd);
319		uvt->data_len = IB_CM_SIDR_REP_PRIVATE_DATA_SIZE;
320		uvt->info_len = evt->param.sidr_rep_rcvd.info_len;
321		info	      = evt->param.sidr_rep_rcvd.info;
322		break;
323	default:
324		uvt->resp.u.send_status = evt->param.send_status;
325		break;
326	}
327
328	if (uvt->data_len) {
329		uvt->data = kmemdup(evt->private_data, uvt->data_len, GFP_KERNEL);
330		if (!uvt->data)
331			goto err1;
332
333		uvt->resp.present |= IB_UCM_PRES_DATA;
334	}
335
336	if (uvt->info_len) {
337		uvt->info = kmemdup(info, uvt->info_len, GFP_KERNEL);
338		if (!uvt->info)
339			goto err2;
340
341		uvt->resp.present |= IB_UCM_PRES_INFO;
342	}
343	return 0;
344
345err2:
346	kfree(uvt->data);
347err1:
348	return -ENOMEM;
349}
350
351static int ib_ucm_event_handler(struct ib_cm_id *cm_id,
352				struct ib_cm_event *event)
353{
354	struct ib_ucm_event *uevent;
355	struct ib_ucm_context *ctx;
356	int result = 0;
357
358	ctx = cm_id->context;
359
360	uevent = kzalloc(sizeof *uevent, GFP_KERNEL);
361	if (!uevent)
362		goto err1;
363
364	uevent->ctx = ctx;
365	uevent->cm_id = cm_id;
366	uevent->resp.uid = ctx->uid;
367	uevent->resp.id = ctx->id;
368	uevent->resp.event = event->event;
369
370	result = ib_ucm_event_process(event, uevent);
371	if (result)
372		goto err2;
373
374	mutex_lock(&ctx->file->file_mutex);
375	list_add_tail(&uevent->file_list, &ctx->file->events);
376	list_add_tail(&uevent->ctx_list, &ctx->events);
377	wake_up_interruptible(&ctx->file->poll_wait);
378	mutex_unlock(&ctx->file->file_mutex);
379	return 0;
380
381err2:
382	kfree(uevent);
383err1:
384	/* Destroy new cm_id's */
385	return ib_ucm_new_cm_id(event->event);
386}
387
388static ssize_t ib_ucm_event(struct ib_ucm_file *file,
389			    const char __user *inbuf,
390			    int in_len, int out_len)
391{
392	struct ib_ucm_context *ctx;
393	struct ib_ucm_event_get cmd;
394	struct ib_ucm_event *uevent;
395	int result = 0;
396
397	if (out_len < sizeof(struct ib_ucm_event_resp))
398		return -ENOSPC;
399
400	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
401		return -EFAULT;
402
403	mutex_lock(&file->file_mutex);
404	while (list_empty(&file->events)) {
405		mutex_unlock(&file->file_mutex);
406
407		if (file->filp->f_flags & O_NONBLOCK)
408			return -EAGAIN;
409
410		if (wait_event_interruptible(file->poll_wait,
411					     !list_empty(&file->events)))
412			return -ERESTARTSYS;
413
414		mutex_lock(&file->file_mutex);
415	}
416
417	uevent = list_entry(file->events.next, struct ib_ucm_event, file_list);
418
419	if (ib_ucm_new_cm_id(uevent->resp.event)) {
420		ctx = ib_ucm_ctx_alloc(file);
421		if (!ctx) {
422			result = -ENOMEM;
423			goto done;
424		}
425
426		ctx->cm_id = uevent->cm_id;
427		ctx->cm_id->context = ctx;
428		uevent->resp.id = ctx->id;
429	}
430
431	if (copy_to_user((void __user *)(unsigned long)cmd.response,
432			 &uevent->resp, sizeof(uevent->resp))) {
433		result = -EFAULT;
434		goto done;
435	}
436
437	if (uevent->data) {
438		if (cmd.data_len < uevent->data_len) {
439			result = -ENOMEM;
440			goto done;
441		}
442		if (copy_to_user((void __user *)(unsigned long)cmd.data,
443				 uevent->data, uevent->data_len)) {
444			result = -EFAULT;
445			goto done;
446		}
447	}
448
449	if (uevent->info) {
450		if (cmd.info_len < uevent->info_len) {
451			result = -ENOMEM;
452			goto done;
453		}
454		if (copy_to_user((void __user *)(unsigned long)cmd.info,
455				 uevent->info, uevent->info_len)) {
456			result = -EFAULT;
457			goto done;
458		}
459	}
460
461	list_del(&uevent->file_list);
462	list_del(&uevent->ctx_list);
463	uevent->ctx->events_reported++;
464
465	kfree(uevent->data);
466	kfree(uevent->info);
467	kfree(uevent);
468done:
469	mutex_unlock(&file->file_mutex);
470	return result;
471}
472
473static ssize_t ib_ucm_create_id(struct ib_ucm_file *file,
474				const char __user *inbuf,
475				int in_len, int out_len)
476{
477	struct ib_ucm_create_id cmd;
478	struct ib_ucm_create_id_resp resp;
479	struct ib_ucm_context *ctx;
480	int result;
481
482	if (out_len < sizeof(resp))
483		return -ENOSPC;
484
485	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
486		return -EFAULT;
487
488	mutex_lock(&file->file_mutex);
489	ctx = ib_ucm_ctx_alloc(file);
490	mutex_unlock(&file->file_mutex);
491	if (!ctx)
492		return -ENOMEM;
493
494	ctx->uid = cmd.uid;
495	ctx->cm_id = ib_create_cm_id(file->device->ib_dev,
496				     ib_ucm_event_handler, ctx);
497	if (IS_ERR(ctx->cm_id)) {
498		result = PTR_ERR(ctx->cm_id);
499		goto err1;
500	}
501
502	resp.id = ctx->id;
503	if (copy_to_user((void __user *)(unsigned long)cmd.response,
504			 &resp, sizeof(resp))) {
505		result = -EFAULT;
506		goto err2;
507	}
508	return 0;
509
510err2:
511	ib_destroy_cm_id(ctx->cm_id);
512err1:
513	mutex_lock(&ctx_id_mutex);
514	idr_remove(&ctx_id_table, ctx->id);
515	mutex_unlock(&ctx_id_mutex);
516	kfree(ctx);
517	return result;
518}
519
520static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
521				 const char __user *inbuf,
522				 int in_len, int out_len)
523{
524	struct ib_ucm_destroy_id cmd;
525	struct ib_ucm_destroy_id_resp resp;
526	struct ib_ucm_context *ctx;
527	int result = 0;
528
529	if (out_len < sizeof(resp))
530		return -ENOSPC;
531
532	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
533		return -EFAULT;
534
535	mutex_lock(&ctx_id_mutex);
536	ctx = idr_find(&ctx_id_table, cmd.id);
537	if (!ctx)
538		ctx = ERR_PTR(-ENOENT);
539	else if (ctx->file != file)
540		ctx = ERR_PTR(-EINVAL);
541	else
542		idr_remove(&ctx_id_table, ctx->id);
543	mutex_unlock(&ctx_id_mutex);
544
545	if (IS_ERR(ctx))
546		return PTR_ERR(ctx);
547
548	ib_ucm_ctx_put(ctx);
549	wait_for_completion(&ctx->comp);
550
551	/* No new events will be generated after destroying the cm_id. */
552	ib_destroy_cm_id(ctx->cm_id);
553	/* Cleanup events not yet reported to the user. */
554	ib_ucm_cleanup_events(ctx);
555
556	resp.events_reported = ctx->events_reported;
557	if (copy_to_user((void __user *)(unsigned long)cmd.response,
558			 &resp, sizeof(resp)))
559		result = -EFAULT;
560
561	kfree(ctx);
562	return result;
563}
564
565static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
566			      const char __user *inbuf,
567			      int in_len, int out_len)
568{
569	struct ib_ucm_attr_id_resp resp;
570	struct ib_ucm_attr_id cmd;
571	struct ib_ucm_context *ctx;
572	int result = 0;
573
574	if (out_len < sizeof(resp))
575		return -ENOSPC;
576
577	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
578		return -EFAULT;
579
580	ctx = ib_ucm_ctx_get(file, cmd.id);
581	if (IS_ERR(ctx))
582		return PTR_ERR(ctx);
583
584	resp.service_id   = ctx->cm_id->service_id;
585	resp.service_mask = ctx->cm_id->service_mask;
586	resp.local_id     = ctx->cm_id->local_id;
587	resp.remote_id    = ctx->cm_id->remote_id;
588
589	if (copy_to_user((void __user *)(unsigned long)cmd.response,
590			 &resp, sizeof(resp)))
591		result = -EFAULT;
592
593	ib_ucm_ctx_put(ctx);
594	return result;
595}
596
597static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file *file,
598				   const char __user *inbuf,
599				   int in_len, int out_len)
600{
601	struct ib_uverbs_qp_attr resp;
602	struct ib_ucm_init_qp_attr cmd;
603	struct ib_ucm_context *ctx;
604	struct ib_qp_attr qp_attr;
605	int result = 0;
606
607	if (out_len < sizeof(resp))
608		return -ENOSPC;
609
610	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
611		return -EFAULT;
612
613	ctx = ib_ucm_ctx_get(file, cmd.id);
614	if (IS_ERR(ctx))
615		return PTR_ERR(ctx);
616
617	resp.qp_attr_mask = 0;
618	memset(&qp_attr, 0, sizeof qp_attr);
619	qp_attr.qp_state = cmd.qp_state;
620	result = ib_cm_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
621	if (result)
622		goto out;
623
624	ib_copy_qp_attr_to_user(&resp, &qp_attr);
625
626	if (copy_to_user((void __user *)(unsigned long)cmd.response,
627			 &resp, sizeof(resp)))
628		result = -EFAULT;
629
630out:
631	ib_ucm_ctx_put(ctx);
632	return result;
633}
634
635static int ucm_validate_listen(__be64 service_id, __be64 service_mask)
636{
637	service_id &= service_mask;
638
639	if (((service_id & IB_CMA_SERVICE_ID_MASK) == IB_CMA_SERVICE_ID) ||
640	    ((service_id & IB_SDP_SERVICE_ID_MASK) == IB_SDP_SERVICE_ID))
641		return -EINVAL;
642
643	return 0;
644}
645
646static ssize_t ib_ucm_listen(struct ib_ucm_file *file,
647			     const char __user *inbuf,
648			     int in_len, int out_len)
649{
650	struct ib_ucm_listen cmd;
651	struct ib_ucm_context *ctx;
652	int result;
653
654	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
655		return -EFAULT;
656
657	ctx = ib_ucm_ctx_get(file, cmd.id);
658	if (IS_ERR(ctx))
659		return PTR_ERR(ctx);
660
661	result = ucm_validate_listen(cmd.service_id, cmd.service_mask);
662	if (result)
663		goto out;
664
665	result = ib_cm_listen(ctx->cm_id, cmd.service_id, cmd.service_mask);
666out:
667	ib_ucm_ctx_put(ctx);
668	return result;
669}
670
671static ssize_t ib_ucm_notify(struct ib_ucm_file *file,
672			     const char __user *inbuf,
673			     int in_len, int out_len)
674{
675	struct ib_ucm_notify cmd;
676	struct ib_ucm_context *ctx;
677	int result;
678
679	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
680		return -EFAULT;
681
682	ctx = ib_ucm_ctx_get(file, cmd.id);
683	if (IS_ERR(ctx))
684		return PTR_ERR(ctx);
685
686	result = ib_cm_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
687	ib_ucm_ctx_put(ctx);
688	return result;
689}
690
691static int ib_ucm_alloc_data(const void **dest, u64 src, u32 len)
692{
693	void *data;
694
695	*dest = NULL;
696
697	if (!len)
698		return 0;
699
700	data = memdup_user((void __user *)(unsigned long)src, len);
701	if (IS_ERR(data))
702		return PTR_ERR(data);
703
704	*dest = data;
705	return 0;
706}
707
708static int ib_ucm_path_get(struct ib_sa_path_rec **path, u64 src)
709{
710	struct ib_user_path_rec upath;
711	struct ib_sa_path_rec  *sa_path;
712
713	*path = NULL;
714
715	if (!src)
716		return 0;
717
718	sa_path = kmalloc(sizeof(*sa_path), GFP_KERNEL);
719	if (!sa_path)
720		return -ENOMEM;
721
722	if (copy_from_user(&upath, (void __user *)(unsigned long)src,
723			   sizeof(upath))) {
724
725		kfree(sa_path);
726		return -EFAULT;
727	}
728
729	ib_copy_path_rec_from_user(sa_path, &upath);
730	*path = sa_path;
731	return 0;
732}
733
734static ssize_t ib_ucm_send_req(struct ib_ucm_file *file,
735			       const char __user *inbuf,
736			       int in_len, int out_len)
737{
738	struct ib_cm_req_param param;
739	struct ib_ucm_context *ctx;
740	struct ib_ucm_req cmd;
741	int result;
742
743	param.private_data   = NULL;
744	param.primary_path   = NULL;
745	param.alternate_path = NULL;
746
747	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
748		return -EFAULT;
749
750	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
751	if (result)
752		goto done;
753
754	result = ib_ucm_path_get(&param.primary_path, cmd.primary_path);
755	if (result)
756		goto done;
757
758	result = ib_ucm_path_get(&param.alternate_path, cmd.alternate_path);
759	if (result)
760		goto done;
761
762	param.private_data_len           = cmd.len;
763	param.service_id                 = cmd.sid;
764	param.qp_num                     = cmd.qpn;
765	param.qp_type                    = cmd.qp_type;
766	param.starting_psn               = cmd.psn;
767	param.peer_to_peer               = cmd.peer_to_peer;
768	param.responder_resources        = cmd.responder_resources;
769	param.initiator_depth            = cmd.initiator_depth;
770	param.remote_cm_response_timeout = cmd.remote_cm_response_timeout;
771	param.flow_control               = cmd.flow_control;
772	param.local_cm_response_timeout  = cmd.local_cm_response_timeout;
773	param.retry_count                = cmd.retry_count;
774	param.rnr_retry_count            = cmd.rnr_retry_count;
775	param.max_cm_retries             = cmd.max_cm_retries;
776	param.srq                        = cmd.srq;
777
778	ctx = ib_ucm_ctx_get(file, cmd.id);
779	if (!IS_ERR(ctx)) {
780		result = ib_send_cm_req(ctx->cm_id, &param);
781		ib_ucm_ctx_put(ctx);
782	} else
783		result = PTR_ERR(ctx);
784
785done:
786	kfree(param.private_data);
787	kfree(param.primary_path);
788	kfree(param.alternate_path);
789	return result;
790}
791
792static ssize_t ib_ucm_send_rep(struct ib_ucm_file *file,
793			       const char __user *inbuf,
794			       int in_len, int out_len)
795{
796	struct ib_cm_rep_param param;
797	struct ib_ucm_context *ctx;
798	struct ib_ucm_rep cmd;
799	int result;
800
801	param.private_data = NULL;
802
803	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
804		return -EFAULT;
805
806	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
807	if (result)
808		return result;
809
810	param.qp_num              = cmd.qpn;
811	param.starting_psn        = cmd.psn;
812	param.private_data_len    = cmd.len;
813	param.responder_resources = cmd.responder_resources;
814	param.initiator_depth     = cmd.initiator_depth;
815	param.failover_accepted   = cmd.failover_accepted;
816	param.flow_control        = cmd.flow_control;
817	param.rnr_retry_count     = cmd.rnr_retry_count;
818	param.srq                 = cmd.srq;
819
820	ctx = ib_ucm_ctx_get(file, cmd.id);
821	if (!IS_ERR(ctx)) {
822		ctx->uid = cmd.uid;
823		result = ib_send_cm_rep(ctx->cm_id, &param);
824		ib_ucm_ctx_put(ctx);
825	} else
826		result = PTR_ERR(ctx);
827
828	kfree(param.private_data);
829	return result;
830}
831
832static ssize_t ib_ucm_send_private_data(struct ib_ucm_file *file,
833					const char __user *inbuf, int in_len,
834					int (*func)(struct ib_cm_id *cm_id,
835						    const void *private_data,
836						    u8 private_data_len))
837{
838	struct ib_ucm_private_data cmd;
839	struct ib_ucm_context *ctx;
840	const void *private_data = NULL;
841	int result;
842
843	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
844		return -EFAULT;
845
846	result = ib_ucm_alloc_data(&private_data, cmd.data, cmd.len);
847	if (result)
848		return result;
849
850	ctx = ib_ucm_ctx_get(file, cmd.id);
851	if (!IS_ERR(ctx)) {
852		result = func(ctx->cm_id, private_data, cmd.len);
853		ib_ucm_ctx_put(ctx);
854	} else
855		result = PTR_ERR(ctx);
856
857	kfree(private_data);
858	return result;
859}
860
861static ssize_t ib_ucm_send_rtu(struct ib_ucm_file *file,
862			       const char __user *inbuf,
863			       int in_len, int out_len)
864{
865	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_rtu);
866}
867
868static ssize_t ib_ucm_send_dreq(struct ib_ucm_file *file,
869				const char __user *inbuf,
870				int in_len, int out_len)
871{
872	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_dreq);
873}
874
875static ssize_t ib_ucm_send_drep(struct ib_ucm_file *file,
876				const char __user *inbuf,
877				int in_len, int out_len)
878{
879	return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_drep);
880}
881
882static ssize_t ib_ucm_send_info(struct ib_ucm_file *file,
883				const char __user *inbuf, int in_len,
884				int (*func)(struct ib_cm_id *cm_id,
885					    int status,
886					    const void *info,
887					    u8 info_len,
888					    const void *data,
889					    u8 data_len))
890{
891	struct ib_ucm_context *ctx;
892	struct ib_ucm_info cmd;
893	const void *data = NULL;
894	const void *info = NULL;
895	int result;
896
897	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
898		return -EFAULT;
899
900	result = ib_ucm_alloc_data(&data, cmd.data, cmd.data_len);
901	if (result)
902		goto done;
903
904	result = ib_ucm_alloc_data(&info, cmd.info, cmd.info_len);
905	if (result)
906		goto done;
907
908	ctx = ib_ucm_ctx_get(file, cmd.id);
909	if (!IS_ERR(ctx)) {
910		result = func(ctx->cm_id, cmd.status, info, cmd.info_len,
911			      data, cmd.data_len);
912		ib_ucm_ctx_put(ctx);
913	} else
914		result = PTR_ERR(ctx);
915
916done:
917	kfree(data);
918	kfree(info);
919	return result;
920}
921
922static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file,
923			       const char __user *inbuf,
924			       int in_len, int out_len)
925{
926	return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_rej);
927}
928
929static ssize_t ib_ucm_send_apr(struct ib_ucm_file *file,
930			       const char __user *inbuf,
931			       int in_len, int out_len)
932{
933	return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_apr);
934}
935
936static ssize_t ib_ucm_send_mra(struct ib_ucm_file *file,
937			       const char __user *inbuf,
938			       int in_len, int out_len)
939{
940	struct ib_ucm_context *ctx;
941	struct ib_ucm_mra cmd;
942	const void *data = NULL;
943	int result;
944
945	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
946		return -EFAULT;
947
948	result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
949	if (result)
950		return result;
951
952	ctx = ib_ucm_ctx_get(file, cmd.id);
953	if (!IS_ERR(ctx)) {
954		result = ib_send_cm_mra(ctx->cm_id, cmd.timeout, data, cmd.len);
955		ib_ucm_ctx_put(ctx);
956	} else
957		result = PTR_ERR(ctx);
958
959	kfree(data);
960	return result;
961}
962
963static ssize_t ib_ucm_send_lap(struct ib_ucm_file *file,
964			       const char __user *inbuf,
965			       int in_len, int out_len)
966{
967	struct ib_ucm_context *ctx;
968	struct ib_sa_path_rec *path = NULL;
969	struct ib_ucm_lap cmd;
970	const void *data = NULL;
971	int result;
972
973	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
974		return -EFAULT;
975
976	result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
977	if (result)
978		goto done;
979
980	result = ib_ucm_path_get(&path, cmd.path);
981	if (result)
982		goto done;
983
984	ctx = ib_ucm_ctx_get(file, cmd.id);
985	if (!IS_ERR(ctx)) {
986		result = ib_send_cm_lap(ctx->cm_id, path, data, cmd.len);
987		ib_ucm_ctx_put(ctx);
988	} else
989		result = PTR_ERR(ctx);
990
991done:
992	kfree(data);
993	kfree(path);
994	return result;
995}
996
997static ssize_t ib_ucm_send_sidr_req(struct ib_ucm_file *file,
998				    const char __user *inbuf,
999				    int in_len, int out_len)
1000{
1001	struct ib_cm_sidr_req_param param;
1002	struct ib_ucm_context *ctx;
1003	struct ib_ucm_sidr_req cmd;
1004	int result;
1005
1006	param.private_data = NULL;
1007	param.path = NULL;
1008
1009	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
1010		return -EFAULT;
1011
1012	result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
1013	if (result)
1014		goto done;
1015
1016	result = ib_ucm_path_get(&param.path, cmd.path);
1017	if (result)
1018		goto done;
1019
1020	param.private_data_len = cmd.len;
1021	param.service_id       = cmd.sid;
1022	param.timeout_ms       = cmd.timeout;
1023	param.max_cm_retries   = cmd.max_cm_retries;
1024
1025	ctx = ib_ucm_ctx_get(file, cmd.id);
1026	if (!IS_ERR(ctx)) {
1027		result = ib_send_cm_sidr_req(ctx->cm_id, &param);
1028		ib_ucm_ctx_put(ctx);
1029	} else
1030		result = PTR_ERR(ctx);
1031
1032done:
1033	kfree(param.private_data);
1034	kfree(param.path);
1035	return result;
1036}
1037
1038static ssize_t ib_ucm_send_sidr_rep(struct ib_ucm_file *file,
1039				    const char __user *inbuf,
1040				    int in_len, int out_len)
1041{
1042	struct ib_cm_sidr_rep_param param;
1043	struct ib_ucm_sidr_rep cmd;
1044	struct ib_ucm_context *ctx;
1045	int result;
1046
1047	param.info = NULL;
1048
1049	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
1050		return -EFAULT;
1051
1052	result = ib_ucm_alloc_data(&param.private_data,
1053				   cmd.data, cmd.data_len);
1054	if (result)
1055		goto done;
1056
1057	result = ib_ucm_alloc_data(&param.info, cmd.info, cmd.info_len);
1058	if (result)
1059		goto done;
1060
1061	param.qp_num		= cmd.qpn;
1062	param.qkey		= cmd.qkey;
1063	param.status		= cmd.status;
1064	param.info_length	= cmd.info_len;
1065	param.private_data_len	= cmd.data_len;
1066
1067	ctx = ib_ucm_ctx_get(file, cmd.id);
1068	if (!IS_ERR(ctx)) {
1069		result = ib_send_cm_sidr_rep(ctx->cm_id, &param);
1070		ib_ucm_ctx_put(ctx);
1071	} else
1072		result = PTR_ERR(ctx);
1073
1074done:
1075	kfree(param.private_data);
1076	kfree(param.info);
1077	return result;
1078}
1079
1080static ssize_t (*ucm_cmd_table[])(struct ib_ucm_file *file,
1081				  const char __user *inbuf,
1082				  int in_len, int out_len) = {
1083	[IB_USER_CM_CMD_CREATE_ID]     = ib_ucm_create_id,
1084	[IB_USER_CM_CMD_DESTROY_ID]    = ib_ucm_destroy_id,
1085	[IB_USER_CM_CMD_ATTR_ID]       = ib_ucm_attr_id,
1086	[IB_USER_CM_CMD_LISTEN]        = ib_ucm_listen,
1087	[IB_USER_CM_CMD_NOTIFY]        = ib_ucm_notify,
1088	[IB_USER_CM_CMD_SEND_REQ]      = ib_ucm_send_req,
1089	[IB_USER_CM_CMD_SEND_REP]      = ib_ucm_send_rep,
1090	[IB_USER_CM_CMD_SEND_RTU]      = ib_ucm_send_rtu,
1091	[IB_USER_CM_CMD_SEND_DREQ]     = ib_ucm_send_dreq,
1092	[IB_USER_CM_CMD_SEND_DREP]     = ib_ucm_send_drep,
1093	[IB_USER_CM_CMD_SEND_REJ]      = ib_ucm_send_rej,
1094	[IB_USER_CM_CMD_SEND_MRA]      = ib_ucm_send_mra,
1095	[IB_USER_CM_CMD_SEND_LAP]      = ib_ucm_send_lap,
1096	[IB_USER_CM_CMD_SEND_APR]      = ib_ucm_send_apr,
1097	[IB_USER_CM_CMD_SEND_SIDR_REQ] = ib_ucm_send_sidr_req,
1098	[IB_USER_CM_CMD_SEND_SIDR_REP] = ib_ucm_send_sidr_rep,
1099	[IB_USER_CM_CMD_EVENT]	       = ib_ucm_event,
1100	[IB_USER_CM_CMD_INIT_QP_ATTR]  = ib_ucm_init_qp_attr,
1101};
1102
1103static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
1104			    size_t len, loff_t *pos)
1105{
1106	struct ib_ucm_file *file = filp->private_data;
1107	struct ib_ucm_cmd_hdr hdr;
1108	ssize_t result;
1109
1110	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
1111		return -EACCES;
1112
1113	if (len < sizeof(hdr))
1114		return -EINVAL;
1115
1116	if (copy_from_user(&hdr, buf, sizeof(hdr)))
1117		return -EFAULT;
1118
1119	if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
1120		return -EINVAL;
1121
1122	if (hdr.in + sizeof(hdr) > len)
1123		return -EINVAL;
1124
1125	result = ucm_cmd_table[hdr.cmd](file, buf + sizeof(hdr),
1126					hdr.in, hdr.out);
1127	if (!result)
1128		result = len;
1129
1130	return result;
1131}
1132
1133static unsigned int ib_ucm_poll(struct file *filp,
1134				struct poll_table_struct *wait)
1135{
1136	struct ib_ucm_file *file = filp->private_data;
1137	unsigned int mask = 0;
1138
1139	poll_wait(filp, &file->poll_wait, wait);
1140
1141	if (!list_empty(&file->events))
1142		mask = POLLIN | POLLRDNORM;
1143
1144	return mask;
1145}
1146
1147/*
1148 * ib_ucm_open() does not need the BKL:
1149 *
1150 *  - no global state is referred to;
1151 *  - there is no ioctl method to race against;
1152 *  - no further module initialization is required for open to work
1153 *    after the device is registered.
1154 */
1155static int ib_ucm_open(struct inode *inode, struct file *filp)
1156{
1157	struct ib_ucm_file *file;
1158
1159	file = kmalloc(sizeof(*file), GFP_KERNEL);
1160	if (!file)
1161		return -ENOMEM;
1162
1163	INIT_LIST_HEAD(&file->events);
1164	INIT_LIST_HEAD(&file->ctxs);
1165	init_waitqueue_head(&file->poll_wait);
1166
1167	mutex_init(&file->file_mutex);
1168
1169	filp->private_data = file;
1170	file->filp = filp;
1171	file->device = container_of(inode->i_cdev->si_drv1, struct ib_ucm_device, cdev);
1172
1173	return nonseekable_open(inode, filp);
1174}
1175
1176static int ib_ucm_close(struct inode *inode, struct file *filp)
1177{
1178	struct ib_ucm_file *file = filp->private_data;
1179	struct ib_ucm_context *ctx;
1180
1181	mutex_lock(&file->file_mutex);
1182	while (!list_empty(&file->ctxs)) {
1183		ctx = list_entry(file->ctxs.next,
1184				 struct ib_ucm_context, file_list);
1185		mutex_unlock(&file->file_mutex);
1186
1187		mutex_lock(&ctx_id_mutex);
1188		idr_remove(&ctx_id_table, ctx->id);
1189		mutex_unlock(&ctx_id_mutex);
1190
1191		ib_destroy_cm_id(ctx->cm_id);
1192		ib_ucm_cleanup_events(ctx);
1193		kfree(ctx);
1194
1195		mutex_lock(&file->file_mutex);
1196	}
1197	mutex_unlock(&file->file_mutex);
1198	kfree(file);
1199	return 0;
1200}
1201
1202static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
1203static void ib_ucm_release_dev(struct device *dev)
1204{
1205	struct ib_ucm_device *ucm_dev;
1206
1207	ucm_dev = container_of(dev, struct ib_ucm_device, dev);
1208	cdev_del(&ucm_dev->cdev);
1209	if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
1210		clear_bit(ucm_dev->devnum, dev_map);
1211	else
1212		clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, overflow_map);
1213	kfree(ucm_dev);
1214}
1215
1216static const struct file_operations ucm_fops = {
1217	.owner	 = THIS_MODULE,
1218	.open	 = ib_ucm_open,
1219	.release = ib_ucm_close,
1220	.write	 = ib_ucm_write,
1221	.poll    = ib_ucm_poll,
1222	.llseek	 = no_llseek,
1223};
1224
1225static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
1226			  char *buf)
1227{
1228	struct ib_ucm_device *ucm_dev;
1229
1230	ucm_dev = container_of(dev, struct ib_ucm_device, dev);
1231	return sprintf(buf, "%s\n", ucm_dev->ib_dev->name);
1232}
1233static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
1234
1235static dev_t overflow_maj;
1236static int find_overflow_devnum(void)
1237{
1238	int ret;
1239
1240	if (!overflow_maj) {
1241		ret = alloc_chrdev_region(&overflow_maj, 0, IB_UCM_MAX_DEVICES,
1242					  "infiniband_cm");
1243		if (ret) {
1244			pr_err("ucm: couldn't register dynamic device number\n");
1245			return ret;
1246		}
1247	}
1248
1249	ret = find_first_zero_bit(overflow_map, IB_UCM_MAX_DEVICES);
1250	if (ret >= IB_UCM_MAX_DEVICES)
1251		return -1;
1252
1253	return ret;
1254}
1255
1256static void ib_ucm_add_one(struct ib_device *device)
1257{
1258	int devnum;
1259	dev_t base;
1260	struct ib_ucm_device *ucm_dev;
1261
1262	if (!device->alloc_ucontext || !rdma_cap_ib_cm(device, 1))
1263		return;
1264
1265	ucm_dev = kzalloc(sizeof *ucm_dev, GFP_KERNEL);
1266	if (!ucm_dev)
1267		return;
1268
1269	ucm_dev->ib_dev = device;
1270
1271	devnum = find_first_zero_bit(dev_map, IB_UCM_MAX_DEVICES);
1272	if (devnum >= IB_UCM_MAX_DEVICES) {
1273		devnum = find_overflow_devnum();
1274		if (devnum < 0)
1275			goto err;
1276
1277		ucm_dev->devnum = devnum + IB_UCM_MAX_DEVICES;
1278		base = devnum + overflow_maj;
1279		set_bit(devnum, overflow_map);
1280	} else {
1281		ucm_dev->devnum = devnum;
1282		base = devnum + IB_UCM_BASE_DEV;
1283		set_bit(devnum, dev_map);
1284	}
1285
1286	cdev_init(&ucm_dev->cdev, &ucm_fops);
1287	ucm_dev->cdev.owner = THIS_MODULE;
1288	kobject_set_name(&ucm_dev->cdev.kobj, "ucm%d", ucm_dev->devnum);
1289	if (cdev_add(&ucm_dev->cdev, base, 1))
1290		goto err;
1291
1292	ucm_dev->dev.class = &cm_class;
1293	ucm_dev->dev.parent = device->dma_device;
1294	ucm_dev->dev.devt = ucm_dev->cdev.dev;
1295	ucm_dev->dev.release = ib_ucm_release_dev;
1296	dev_set_name(&ucm_dev->dev, "ucm%d", ucm_dev->devnum);
1297	if (device_register(&ucm_dev->dev))
1298		goto err_cdev;
1299
1300	if (device_create_file(&ucm_dev->dev, &dev_attr_ibdev))
1301		goto err_dev;
1302
1303	ib_set_client_data(device, &ucm_client, ucm_dev);
1304	return;
1305
1306err_dev:
1307	device_unregister(&ucm_dev->dev);
1308err_cdev:
1309	cdev_del(&ucm_dev->cdev);
1310	if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
1311		clear_bit(devnum, dev_map);
1312	else
1313		clear_bit(devnum, overflow_map);
1314err:
1315	kfree(ucm_dev);
1316	return;
1317}
1318
1319static void ib_ucm_remove_one(struct ib_device *device, void *client_data)
1320{
1321	struct ib_ucm_device *ucm_dev = client_data;
1322
1323	if (!ucm_dev)
1324		return;
1325
1326	device_unregister(&ucm_dev->dev);
1327}
1328
1329static CLASS_ATTR_STRING(abi_version, S_IRUGO,
1330			 __stringify(IB_USER_CM_ABI_VERSION));
1331
1332static int __init ib_ucm_init(void)
1333{
1334	int ret;
1335
1336	ret = register_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES,
1337				     "infiniband_cm");
1338	if (ret) {
1339		pr_err("ucm: couldn't register device number\n");
1340		goto error1;
1341	}
1342
1343	ret = class_create_file(&cm_class, &class_attr_abi_version.attr);
1344	if (ret) {
1345		pr_err("ucm: couldn't create abi_version attribute\n");
1346		goto error2;
1347	}
1348
1349	ret = ib_register_client(&ucm_client);
1350	if (ret) {
1351		pr_err("ucm: couldn't register client\n");
1352		goto error3;
1353	}
1354	return 0;
1355
1356error3:
1357	class_remove_file(&cm_class, &class_attr_abi_version.attr);
1358error2:
1359	unregister_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES);
1360error1:
1361	return ret;
1362}
1363
1364static void __exit ib_ucm_cleanup(void)
1365{
1366	ib_unregister_client(&ucm_client);
1367	class_remove_file(&cm_class, &class_attr_abi_version.attr);
1368	unregister_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES);
1369	if (overflow_maj)
1370		unregister_chrdev_region(overflow_maj, IB_UCM_MAX_DEVICES);
1371	idr_destroy(&ctx_id_table);
1372}
1373
1374module_init_order(ib_ucm_init, SI_ORDER_FIFTH);
1375module_exit_order(ib_ucm_cleanup, SI_ORDER_FIFTH);
1376