23 files changed, 177 insertions, 102 deletions

diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index fa5ea6529333..0fc71ad42490 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -240,7 +240,8 @@ void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr);
 void ib_uverbs_event_handler(struct ib_event_handler *handler,
                              struct ib_event *event);
 int ib_uverbs_dealloc_xrcd(struct ib_uobject *uobject, struct ib_xrcd *xrcd,
-                           enum rdma_remove_reason why, struct ib_udata *udata);
+                           enum rdma_remove_reason why,
+                           struct uverbs_attr_bundle *attrs);
 
 int uverbs_dealloc_mw(struct ib_mw *mw);
 void ib_uverbs_detach_umcast(struct ib_qp *qp,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index fe63dfd5f1b6..da31dba33fc5 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -670,17 +670,18 @@ static int ib_uverbs_close_xrcd(struct uverbs_attr_bundle *attrs)
 }
 
 int ib_uverbs_dealloc_xrcd(struct ib_uobject *uobject, struct ib_xrcd *xrcd,
-                           enum rdma_remove_reason why, struct ib_udata *udata)
+                           enum rdma_remove_reason why,
+                           struct uverbs_attr_bundle *attrs)
 {
         struct inode *inode;
         int ret;
-        struct ib_uverbs_device *dev = uobject->context->ufile->device;
+        struct ib_uverbs_device *dev = attrs->ufile->device;
 
         inode = xrcd->inode;
         if (inode && !atomic_dec_and_test(&xrcd->usecnt))
                 return 0;
 
-        ret = ib_dealloc_xrcd(xrcd, udata);
+        ret = ib_dealloc_xrcd(xrcd, &attrs->driver_udata);
 
         if (ib_is_destroy_retryable(ret, why, uobject)) {
                 atomic_inc(&xrcd->usecnt);
diff --git a/drivers/infiniband/core/uverbs_std_types.c b/drivers/infiniband/core/uverbs_std_types.c
index c625f590a8f0..35b2e2c640cc 100644
--- a/drivers/infiniband/core/uverbs_std_types.c
+++ b/drivers/infiniband/core/uverbs_std_types.c
@@ -105,7 +105,7 @@ static int uverbs_free_qp(struct ib_uobject *uobject,
         if (uqp->uxrcd)
                 atomic_dec(&uqp->uxrcd->refcnt);
 
-        ib_uverbs_release_uevent(uobject->context->ufile, &uqp->uevent);
+        ib_uverbs_release_uevent(attrs->ufile, &uqp->uevent);
         return ret;
 }
 
@@ -138,7 +138,7 @@ static int uverbs_free_wq(struct ib_uobject *uobject,
         if (ib_is_destroy_retryable(ret, why, uobject))
                 return ret;
 
-        ib_uverbs_release_uevent(uobject->context->ufile, &uwq->uevent);
+        ib_uverbs_release_uevent(attrs->ufile, &uwq->uevent);
         return ret;
 }
 
@@ -163,7 +163,7 @@ static int uverbs_free_srq(struct ib_uobject *uobject,
                 atomic_dec(&us->uxrcd->refcnt);
         }
 
-        ib_uverbs_release_uevent(uobject->context->ufile, uevent);
+        ib_uverbs_release_uevent(attrs->ufile, uevent);
         return ret;
 }
 
@@ -180,9 +180,9 @@ static int uverbs_free_xrcd(struct ib_uobject *uobject,
         if (ret)
                 return ret;
 
-        mutex_lock(&uobject->context->ufile->device->xrcd_tree_mutex);
-        ret = ib_uverbs_dealloc_xrcd(uobject, xrcd, why, &attrs->driver_udata);
-        mutex_unlock(&uobject->context->ufile->device->xrcd_tree_mutex);
+        mutex_lock(&attrs->ufile->device->xrcd_tree_mutex);
+        ret = ib_uverbs_dealloc_xrcd(uobject, xrcd, why, attrs);
+        mutex_unlock(&attrs->ufile->device->xrcd_tree_mutex);
 
         return ret;
 }
diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index f03506ece016..cde608c268ff 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -49,7 +49,7 @@ static int uverbs_free_cq(struct ib_uobject *uobject,
                 return ret;
 
         ib_uverbs_release_ucq(
-                uobject->context->ufile,
+                attrs->ufile,
                 ev_queue ? container_of(ev_queue,
                                         struct ib_uverbs_completion_event_file,
                                         ev_queue) :
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index e10a56242998..bf07e93aeb94 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -760,8 +760,8 @@ static int iwch_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
         atomic_dec(&qhp->refcnt);
         wait_event(qhp->wait, !atomic_read(&qhp->refcnt));
 
-        ucontext = ib_qp->uobject ? to_iwch_ucontext(ib_qp->uobject->context)
-                                  : NULL;
+        ucontext = rdma_udata_to_drv_context(udata, struct iwch_ucontext,
+                                             ibucontext);
         cxio_destroy_qp(&rhp->rdev, &qhp->wq,
                         ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
 
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 562187f0c5af..571281888de0 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -30,6 +30,8 @@
  * SOFTWARE.
  */
 
+#include <rdma/uverbs_ioctl.h>
+
 #include "iw_cxgb4.h"
 
 static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
@@ -980,8 +982,8 @@ int c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
         atomic_dec(&chp->refcnt);
         wait_event(chp->wait, !atomic_read(&chp->refcnt));
 
-        ucontext = ib_cq->uobject ? to_c4iw_ucontext(ib_cq->uobject->context)
-                                  : NULL;
+        ucontext = rdma_udata_to_drv_context(udata, struct c4iw_ucontext,
+                                             ibucontext);
         destroy_cq(&chp->rhp->rdev, &chp->cq,
                    ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx,
                    chp->destroy_skb, chp->wr_waitp);
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 76e6544cf0b9..777231496cc6 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -2838,8 +2838,8 @@ int c4iw_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata)
         pr_debug("%s id %d\n", __func__, srq->wq.qid);
 
         xa_erase_irq(&rhp->qps, srq->wq.qid);
-        ucontext = ibsrq->uobject ?
-                to_c4iw_ucontext(ibsrq->uobject->context) : NULL;
+        ucontext = rdma_udata_to_drv_context(udata, struct c4iw_ucontext,
+                                             ibucontext);
         free_srq_queue(srq, ucontext ? &ucontext->uctx : &rhp->rdev.uctx,
                        srq->wr_waitp);
         c4iw_free_srq_idx(&rhp->rdev, srq->idx);
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index a4e95a310c16..305c362ef5c6 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -32,6 +32,7 @@
 
 #include <linux/platform_device.h>
 #include <rdma/ib_umem.h>
+#include <rdma/uverbs_ioctl.h>
 #include "hns_roce_device.h"
 #include "hns_roce_cmd.h"
 #include "hns_roce_hem.h"
@@ -456,12 +457,15 @@ int hns_roce_ib_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
                 hns_roce_free_cq(hr_dev, hr_cq);
                 hns_roce_mtt_cleanup(hr_dev, &hr_cq->hr_buf.hr_mtt);
 
-                if (ib_cq->uobject) {
+                if (udata) {
                         ib_umem_release(hr_cq->umem);
 
                         if (hr_cq->db_en == 1)
                                 hns_roce_db_unmap_user(
-                                        to_hr_ucontext(ib_cq->uobject->context),
+                                        rdma_udata_to_drv_context(
+                                                udata,
+                                                struct hns_roce_ucontext,
+                                                ibucontext),
                                         &hr_cq->db);
                 } else {
                         /* Free the buff of stored cq */
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 30b00240b7c8..b3cda5803c02 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -38,6 +38,7 @@
 #include <net/addrconf.h>
 #include <rdma/ib_addr.h>
 #include <rdma/ib_umem.h>
+#include <rdma/uverbs_ioctl.h>
 
 #include "hnae3.h"
 #include "hns_roce_common.h"
@@ -4442,7 +4443,7 @@ out:
 
 static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev,
                                          struct hns_roce_qp *hr_qp,
-                                         bool is_user)
+                                         struct ib_udata *udata)
 {
         struct hns_roce_cq *send_cq, *recv_cq;
         struct device *dev = hr_dev->dev;
@@ -4464,7 +4465,7 @@ static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev,
 
         hns_roce_lock_cqs(send_cq, recv_cq);
 
-        if (!is_user) {
+        if (!udata) {
                 __hns_roce_v2_cq_clean(recv_cq, hr_qp->qpn, hr_qp->ibqp.srq ?
                                        to_hr_srq(hr_qp->ibqp.srq) : NULL);
                 if (send_cq != recv_cq)
@@ -4485,16 +4486,18 @@ static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev,
 
         hns_roce_mtt_cleanup(hr_dev, &hr_qp->mtt);
 
-        if (is_user) {
+        if (udata) {
+                struct hns_roce_ucontext *context =
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct hns_roce_ucontext,
+                                ibucontext);
+
                 if (hr_qp->sq.wqe_cnt && (hr_qp->sdb_en == 1))
-                        hns_roce_db_unmap_user(
-                                to_hr_ucontext(hr_qp->ibqp.uobject->context),
-                                &hr_qp->sdb);
+                        hns_roce_db_unmap_user(context, &hr_qp->sdb);
 
                 if (hr_qp->rq.wqe_cnt && (hr_qp->rdb_en == 1))
-                        hns_roce_db_unmap_user(
-                                to_hr_ucontext(hr_qp->ibqp.uobject->context),
-                                &hr_qp->rdb);
+                        hns_roce_db_unmap_user(context, &hr_qp->rdb);
                 ib_umem_release(hr_qp->umem);
         } else {
                 kfree(hr_qp->sq.wrid);
@@ -4519,7 +4522,7 @@ static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
         struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
         int ret;
 
-        ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, ibqp->uobject);
+        ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
         if (ret) {
                 dev_err(hr_dev->dev, "Destroy qp failed(%d)\n", ret);
                 return ret;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index fd2d7426c832..fcb9e2448a49 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -2060,9 +2060,12 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
         if (iwmr->type != IW_MEMREG_TYPE_MEM) {
                 /* region is released. only test for userness. */
                 if (iwmr->region) {
-                        struct i40iw_ucontext *ucontext;
+                        struct i40iw_ucontext *ucontext =
+                                rdma_udata_to_drv_context(
+                                        udata,
+                                        struct i40iw_ucontext,
+                                        ibucontext);
 
-                        ucontext = to_ucontext(ibpd->uobject->context);
                         i40iw_del_memlist(iwmr, ucontext);
                 }
                 if (iwpbl->pbl_allocated && iwmr->type != IW_MEMREG_TYPE_QP)
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 0b730737fb25..5403a1ff7cc2 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -38,6 +38,7 @@
 
 #include "mlx4_ib.h"
 #include <rdma/mlx4-abi.h>
+#include <rdma/uverbs_ioctl.h>
 
 static void mlx4_ib_cq_comp(struct mlx4_cq *cq)
 {
@@ -493,8 +494,13 @@ int mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata)
         mlx4_cq_free(dev->dev, &mcq->mcq);
         mlx4_mtt_cleanup(dev->dev, &mcq->buf.mtt);
 
-        if (cq->uobject) {
-                mlx4_ib_db_unmap_user(to_mucontext(cq->uobject->context), &mcq->db);
+        if (udata) {
+                mlx4_ib_db_unmap_user(
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mlx4_ib_ucontext,
+                                ibucontext),
+                        &mcq->db);
                 ib_umem_release(mcq->umem);
         } else {
                 mlx4_ib_free_cq_buf(dev, &mcq->buf, cq->cqe);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 25dfdcc90a05..99ceffe5cfec 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1338,7 +1338,8 @@ static void destroy_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp)
 }
 
 static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
-                              enum mlx4_ib_source_type src, bool is_user)
+                              enum mlx4_ib_source_type src,
+                              struct ib_udata *udata)
 {
         struct mlx4_ib_cq *send_cq, *recv_cq;
         unsigned long flags;
@@ -1380,7 +1381,7 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
         list_del(&qp->qps_list);
         list_del(&qp->cq_send_list);
         list_del(&qp->cq_recv_list);
-        if (!is_user) {
+        if (!udata) {
                 __mlx4_ib_cq_clean(recv_cq, qp->mqp.qpn,
                                  qp->ibqp.srq ? to_msrq(qp->ibqp.srq): NULL);
                 if (send_cq != recv_cq)
@@ -1398,19 +1399,26 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
                 if (qp->flags & MLX4_IB_QP_NETIF)
                         mlx4_ib_steer_qp_free(dev, qp->mqp.qpn, 1);
                 else if (src == MLX4_IB_RWQ_SRC)
-                        mlx4_ib_release_wqn(to_mucontext(
-                                            qp->ibwq.uobject->context), qp, 1);
+                        mlx4_ib_release_wqn(
+                                rdma_udata_to_drv_context(
+                                        udata,
+                                        struct mlx4_ib_ucontext,
+                                        ibucontext),
+                                qp, 1);
                 else
                         mlx4_qp_release_range(dev->dev, qp->mqp.qpn, 1);
         }
 
         mlx4_mtt_cleanup(dev->dev, &qp->mtt);
 
-        if (is_user) {
+        if (udata) {
                 if (qp->rq.wqe_cnt) {
-                        struct mlx4_ib_ucontext *mcontext = !src ?
-                                to_mucontext(qp->ibqp.uobject->context) :
-                                to_mucontext(qp->ibwq.uobject->context);
+                        struct mlx4_ib_ucontext *mcontext =
+                                rdma_udata_to_drv_context(
+                                        udata,
+                                        struct mlx4_ib_ucontext,
+                                        ibucontext);
+
                         mlx4_ib_db_unmap_user(mcontext, &qp->db);
                 }
                 ib_umem_release(qp->umem);
@@ -1594,7 +1602,7 @@ struct ib_qp *mlx4_ib_create_qp(struct ib_pd *pd,
         return ibqp;
 }
 
-static int _mlx4_ib_destroy_qp(struct ib_qp *qp)
+static int _mlx4_ib_destroy_qp(struct ib_qp *qp, struct ib_udata *udata)
 {
         struct mlx4_ib_dev *dev = to_mdev(qp->device);
         struct mlx4_ib_qp *mqp = to_mqp(qp);
@@ -1615,7 +1623,7 @@ static int _mlx4_ib_destroy_qp(struct ib_qp *qp)
         if (qp->rwq_ind_tbl) {
                 destroy_qp_rss(dev, mqp);
         } else {
-                destroy_qp_common(dev, mqp, MLX4_IB_QP_SRC, qp->uobject);
+                destroy_qp_common(dev, mqp, MLX4_IB_QP_SRC, udata);
         }
 
         if (is_sqp(dev, mqp))
@@ -1637,7 +1645,7 @@ int mlx4_ib_destroy_qp(struct ib_qp *qp, struct ib_udata *udata)
                         ib_destroy_qp(sqp->roce_v2_gsi);
         }
 
-        return _mlx4_ib_destroy_qp(qp);
+        return _mlx4_ib_destroy_qp(qp, udata);
 }
 
 static int to_mlx4_st(struct mlx4_ib_dev *dev, enum mlx4_ib_qp_type type)
@@ -4252,7 +4260,7 @@ int mlx4_ib_destroy_wq(struct ib_wq *ibwq, struct ib_udata *udata)
         if (qp->counter_index)
                 mlx4_ib_free_qp_counter(dev, qp);
 
-        destroy_qp_common(dev, qp, MLX4_IB_RWQ_SRC, 1);
+        destroy_qp_common(dev, qp, MLX4_IB_RWQ_SRC, udata);
 
         kfree(qp);
 
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index b51f632f3f7d..2a20205d1662 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -280,8 +280,13 @@ int mlx4_ib_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
         mlx4_srq_free(dev->dev, &msrq->msrq);
         mlx4_mtt_cleanup(dev->dev, &msrq->mtt);
 
-        if (srq->uobject) {
-                mlx4_ib_db_unmap_user(to_mucontext(srq->uobject->context), &msrq->db);
+        if (udata) {
+                mlx4_ib_db_unmap_user(
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mlx4_ib_ucontext,
+                                ibucontext),
+                        &msrq->db);
                 ib_umem_release(msrq->umem);
         } else {
                 kvfree(msrq->wrid);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 5d238a8ee132..5bed098ccdef 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -796,9 +796,12 @@ err_umem:
         return err;
 }
 
-static void destroy_cq_user(struct mlx5_ib_cq *cq, struct ib_ucontext *context)
+static void destroy_cq_user(struct mlx5_ib_cq *cq, struct ib_udata *udata)
 {
-        mlx5_ib_db_unmap_user(to_mucontext(context), &cq->db);
+        struct mlx5_ib_ucontext *context = rdma_udata_to_drv_context(
+                udata, struct mlx5_ib_ucontext, ibucontext);
+
+        mlx5_ib_db_unmap_user(context, &cq->db);
         ib_umem_release(cq->buf.umem);
 }
 
@@ -923,7 +926,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev,
         INIT_LIST_HEAD(&cq->list_send_qp);
         INIT_LIST_HEAD(&cq->list_recv_qp);
 
-        if (context) {
+        if (udata) {
                 err = create_cq_user(dev, udata, context, cq, entries,
                                      &cqb, &cqe_size, &index, &inlen);
                 if (err)
@@ -985,8 +988,8 @@ err_cmd:
 
 err_cqb:
         kvfree(cqb);
-        if (context)
-                destroy_cq_user(cq, context);
+        if (udata)
+                destroy_cq_user(cq, udata);
         else
                 destroy_cq_kernel(dev, cq);
 
@@ -1000,14 +1003,10 @@ int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata)
 {
         struct mlx5_ib_dev *dev = to_mdev(cq->device);
         struct mlx5_ib_cq *mcq = to_mcq(cq);
-        struct ib_ucontext *context = NULL;
-
-        if (cq->uobject)
-                context = cq->uobject->context;
 
         mlx5_core_destroy_cq(dev->mdev, &mcq->mcq);
-        if (context)
-                destroy_cq_user(mcq, context);
+        if (udata)
+                destroy_cq_user(mcq, udata);
         else
                 destroy_cq_kernel(dev, mcq);
 
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 468544819c79..769a5952a0f6 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2329,7 +2329,10 @@ int mlx5_ib_dealloc_dm(struct ib_dm *ibdm, struct uverbs_attr_bundle *attrs)
         page_idx = (dm->dev_addr - pci_resource_start(memic->dev->pdev, 0) -
                     MLX5_CAP64_DEV_MEM(memic->dev, memic_bar_start_addr)) >>
                     PAGE_SHIFT;
-        bitmap_clear(to_mucontext(ibdm->uobject->context)->dm_pages,
+        bitmap_clear(rdma_udata_to_drv_context(
+                        &attrs->driver_udata,
+                        struct mlx5_ib_ucontext,
+                        ibucontext)->dm_pages,
                      page_idx,
                      DIV_ROUND_UP(act_size, PAGE_SIZE));
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index cd62c909b7eb..940ac1caa590 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -777,14 +777,17 @@ err_umem:
 }
 
 static void destroy_user_rq(struct mlx5_ib_dev *dev, struct ib_pd *pd,
-                            struct mlx5_ib_rwq *rwq)
+                            struct mlx5_ib_rwq *rwq, struct ib_udata *udata)
 {
-        struct mlx5_ib_ucontext *context;
+        struct mlx5_ib_ucontext *context =
+                rdma_udata_to_drv_context(
+                        udata,
+                        struct mlx5_ib_ucontext,
+                        ibucontext);
 
         if (rwq->create_flags & MLX5_IB_WQ_FLAGS_DELAY_DROP)
                 atomic_dec(&dev->delay_drop.rqs_cnt);
 
-        context = to_mucontext(pd->uobject->context);
         mlx5_ib_db_unmap_user(context, &rwq->db);
         if (rwq->umem)
                 ib_umem_release(rwq->umem);
@@ -983,11 +986,15 @@ err_bfreg:
 }
 
 static void destroy_qp_user(struct mlx5_ib_dev *dev, struct ib_pd *pd,
-                            struct mlx5_ib_qp *qp, struct mlx5_ib_qp_base *base)
+                            struct mlx5_ib_qp *qp, struct mlx5_ib_qp_base *base,
+                            struct ib_udata *udata)
 {
-        struct mlx5_ib_ucontext *context;
+        struct mlx5_ib_ucontext *context =
+                rdma_udata_to_drv_context(
+                        udata,
+                        struct mlx5_ib_ucontext,
+                        ibucontext);
 
-        context = to_mucontext(pd->uobject->context);
         mlx5_ib_db_unmap_user(context, &qp->db);
         if (base->ubuffer.umem)
                 ib_umem_release(base->ubuffer.umem);
@@ -2284,7 +2291,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 
 err_create:
         if (qp->create_type == MLX5_QP_USER)
-                destroy_qp_user(dev, pd, qp, base);
+                destroy_qp_user(dev, pd, qp, base, udata);
         else if (qp->create_type == MLX5_QP_KERNEL)
                 destroy_qp_kernel(dev, qp);
 
@@ -2395,7 +2402,8 @@ static int modify_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                                 const struct mlx5_modify_raw_qp_param *raw_qp_param,
                                 u8 lag_tx_affinity);
 
-static void destroy_qp_common(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp)
+static void destroy_qp_common(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+                              struct ib_udata *udata)
 {
         struct mlx5_ib_cq *send_cq, *recv_cq;
         struct mlx5_ib_qp_base *base;
@@ -2466,7 +2474,7 @@ static void destroy_qp_common(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp)
         if (qp->create_type == MLX5_QP_KERNEL)
                 destroy_qp_kernel(dev, qp);
         else if (qp->create_type == MLX5_QP_USER)
-                destroy_qp_user(dev, &get_pd(qp)->ibpd, qp, base);
+                destroy_qp_user(dev, &get_pd(qp)->ibpd, qp, base, udata);
 }
 
 static const char *ib_qp_type_str(enum ib_qp_type type)
@@ -2743,7 +2751,7 @@ int mlx5_ib_destroy_qp(struct ib_qp *qp, struct ib_udata *udata)
         if (mqp->qp_sub_type == MLX5_IB_QPT_DCT)
                 return mlx5_ib_destroy_dct(mqp);
 
-        destroy_qp_common(dev, mqp);
+        destroy_qp_common(dev, mqp, udata);
 
         kfree(mqp);
 
@@ -5959,7 +5967,7 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
 err_copy:
         mlx5_core_destroy_rq_tracked(dev->mdev, &rwq->core_qp);
 err_user_rq:
-        destroy_user_rq(dev, pd, rwq);
+        destroy_user_rq(dev, pd, rwq, udata);
 err:
         kfree(rwq);
         return ERR_PTR(err);
@@ -5971,7 +5979,7 @@ int mlx5_ib_destroy_wq(struct ib_wq *wq, struct ib_udata *udata)
         struct mlx5_ib_rwq *rwq = to_mrwq(wq);
 
         mlx5_core_destroy_rq_tracked(dev->mdev, &rwq->core_qp);
-        destroy_user_rq(dev, wq->pd, rwq);
+        destroy_user_rq(dev, wq->pd, rwq, udata);
         kfree(rwq);
 
         return 0;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index bc1ca6bcea43..2e389f3444c6 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -194,9 +194,15 @@ err_db:
         return err;
 }
 
-static void destroy_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq)
+static void destroy_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
+                             struct ib_udata *udata)
 {
-        mlx5_ib_db_unmap_user(to_mucontext(pd->uobject->context), &srq->db);
+        mlx5_ib_db_unmap_user(
+                rdma_udata_to_drv_context(
+                        udata,
+                        struct mlx5_ib_ucontext,
+                        ibucontext),
+                &srq->db);
         ib_umem_release(srq->umem);
 }
 
@@ -327,7 +333,7 @@ err_core:
 
 err_usr_kern_srq:
         if (udata)
-                destroy_srq_user(pd, srq);
+                destroy_srq_user(pd, srq, udata);
         else
                 destroy_srq_kernel(dev, srq);
 
@@ -395,7 +401,12 @@ int mlx5_ib_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
         mlx5_cmd_destroy_srq(dev, &msrq->msrq);
 
         if (srq->uobject) {
-                mlx5_ib_db_unmap_user(to_mucontext(srq->uobject->context), &msrq->db);
+                mlx5_ib_db_unmap_user(
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mlx5_ib_ucontext,
+                                ibucontext),
+                        &msrq->db);
                 ib_umem_release(msrq->umem);
         } else {
                 destroy_srq_kernel(dev, msrq);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 872f0ad556a7..9e4efd58c119 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -479,10 +479,12 @@ err_free:
 
 static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
 {
-        struct mthca_ucontext *context;
-
-        if (srq->uobject) {
-                context = to_mucontext(srq->uobject->context);
+        if (udata) {
+                struct mthca_ucontext *context =
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mthca_ucontext,
+                                ibucontext);
 
                 mthca_unmap_user_db(to_mdev(srq->device), &context->uar,
                                     context->db_tab, to_msrq(srq)->db_index);
@@ -609,14 +611,20 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
 
 static int mthca_destroy_qp(struct ib_qp *qp, struct ib_udata *udata)
 {
-        if (qp->uobject) {
+        if (udata) {
+                struct mthca_ucontext *context =
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mthca_ucontext,
+                                ibucontext);
+
                 mthca_unmap_user_db(to_mdev(qp->device),
-                                    &to_mucontext(qp->uobject->context)->uar,
-                                    to_mucontext(qp->uobject->context)->db_tab,
+                                    &context->uar,
+                                    context->db_tab,
                                     to_mqp(qp)->sq.db_index);
                 mthca_unmap_user_db(to_mdev(qp->device),
-                                    &to_mucontext(qp->uobject->context)->uar,
-                                    to_mucontext(qp->uobject->context)->db_tab,
+                                    &context->uar,
+                                    context->db_tab,
                                     to_mqp(qp)->rq.db_index);
         }
         mthca_free_qp(to_mdev(qp->device), to_mqp(qp));
@@ -829,14 +837,20 @@ out:
 
 static int mthca_destroy_cq(struct ib_cq *cq, struct ib_udata *udata)
 {
-        if (cq->uobject) {
+        if (udata) {
+                struct mthca_ucontext *context =
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct mthca_ucontext,
+                                ibucontext);
+
                 mthca_unmap_user_db(to_mdev(cq->device),
-                                    &to_mucontext(cq->uobject->context)->uar,
-                                    to_mucontext(cq->uobject->context)->db_tab,
+                                    &context->uar,
+                                    context->db_tab,
                                     to_mcq(cq)->arm_db_index);
                 mthca_unmap_user_db(to_mdev(cq->device),
-                                    &to_mucontext(cq->uobject->context)->uar,
-                                    to_mucontext(cq->uobject->context)->db_tab,
+                                    &context->uar,
+                                    context->db_tab,
                                     to_mcq(cq)->set_ci_db_index);
         }
         mthca_free_cq(to_mdev(cq->device), to_mcq(cq));
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4b7855c7dacf..244255b1e940 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -707,8 +707,12 @@ static void nes_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
         struct nes_device *nesdev = nesvnic->nesdev;
         struct nes_adapter *nesadapter = nesdev->nesadapter;
 
-        if ((ibpd->uobject) && (ibpd->uobject->context)) {
-                nesucontext = to_nesucontext(ibpd->uobject->context);
+        if (udata) {
+                nesucontext =
+                        rdma_udata_to_drv_context(
+                                udata,
+                                struct nes_ucontext,
+                                ibucontext);
                 nes_debug(NES_DBG_PD, "Clearing bit %u from allocated doorbells\n",
                                 nespd->mmap_db_index);
                 clear_bit(nespd->mmap_db_index, nesucontext->allocated_doorbells);
@@ -1337,8 +1341,12 @@ static int nes_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
         }
 
         if (nesqp->user_mode) {
-                if ((ibqp->uobject)&&(ibqp->uobject->context)) {
-                        nes_ucontext = to_nesucontext(ibqp->uobject->context);
+                if (udata) {
+                        nes_ucontext =
+                                rdma_udata_to_drv_context(
+                                        udata,
+                                        struct nes_ucontext,
+                                        ibucontext);
                         clear_bit(nesqp->mmap_sq_db_index, nes_ucontext->allocated_wqs);
                         nes_ucontext->mmap_nesqp[nesqp->mmap_sq_db_index] = NULL;
                         if (nes_ucontext->first_free_wq > nesqp->mmap_sq_db_index) {
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 42755e7a10a8..4cd16ad16430 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -986,7 +986,7 @@ int qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
 
         dev->ops->common->chain_free(dev->cdev, &cq->pbl);
 
-        if (ibcq->uobject && ibcq->uobject->context) {
+        if (udata) {
                 qedr_free_pbl(dev, &cq->q.pbl_info, cq->q.pbl_tbl);
                 ib_umem_release(cq->q.umem);
         }
@@ -2470,7 +2470,8 @@ err:
         return rc;
 }
 
-static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp)
+static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp,
+                                  struct ib_udata *udata)
 {
         int rc = 0;
 
@@ -2480,7 +2481,7 @@ static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp)
                         return rc;
         }
 
-        if (qp->ibqp.uobject && qp->ibqp.uobject->context)
+        if (udata)
                 qedr_cleanup_user(dev, qp);
         else
                 qedr_cleanup_kernel(dev, qp);
@@ -2532,7 +2533,7 @@ int qedr_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
         if (qp->qp_type == IB_QPT_GSI)
                 qedr_destroy_gsi_qp(dev);
 
-        qedr_free_qp_resources(dev, qp);
+        qedr_free_qp_resources(dev, qp, udata);
 
         if (atomic_dec_and_test(&qp->refcnt) &&
             rdma_protocol_iwarp(&dev->ibdev, 1)) {
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
index cdb6357337c0..e282eea8ecce 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
@@ -648,7 +648,7 @@ int usnic_ib_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
 
         usnic_dbg("va 0x%lx length 0x%zx\n", mr->umem->va, mr->umem->length);
 
-        usnic_uiom_reg_release(mr->umem, ibmr->uobject->context);
+        usnic_uiom_reg_release(mr->umem);
         kfree(mr);
         return 0;
 }
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
index 06862a6af185..da35d6fdfc5e 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
@@ -432,8 +432,7 @@ static inline size_t usnic_uiom_num_pages(struct usnic_uiom_reg *uiomr)
         return PAGE_ALIGN(uiomr->length + uiomr->offset) >> PAGE_SHIFT;
 }
 
-void usnic_uiom_reg_release(struct usnic_uiom_reg *uiomr,
-                            struct ib_ucontext *context)
+void usnic_uiom_reg_release(struct usnic_uiom_reg *uiomr)
 {
         __usnic_uiom_reg_release(uiomr->pd, uiomr, 1);
 
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.h b/drivers/infiniband/hw/usnic/usnic_uiom.h
index c88cfa087e3a..70be49b1ca05 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom.h
+++ b/drivers/infiniband/hw/usnic/usnic_uiom.h
@@ -90,7 +90,6 @@ void usnic_uiom_free_dev_list(struct device **devs);
 struct usnic_uiom_reg *usnic_uiom_reg_get(struct usnic_uiom_pd *pd,
                                                 unsigned long addr, size_t size,
                                                 int access, int dmasync);
-void usnic_uiom_reg_release(struct usnic_uiom_reg *uiomr,
-                            struct ib_ucontext *ucontext);
+void usnic_uiom_reg_release(struct usnic_uiom_reg *uiomr);
 int usnic_uiom_init(char *drv_name);
 #endif /* USNIC_UIOM_H_ */