3 files changed, 95 insertions, 1 deletions

diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 00ce032fcead..5bcb2afd3dcb 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -195,6 +195,7 @@ IB_UVERBS_DECLARE_CMD(poll_cq);
 IB_UVERBS_DECLARE_CMD(req_notify_cq);
 IB_UVERBS_DECLARE_CMD(destroy_cq);
 IB_UVERBS_DECLARE_CMD(create_qp);
+IB_UVERBS_DECLARE_CMD(open_qp);
 IB_UVERBS_DECLARE_CMD(query_qp);
 IB_UVERBS_DECLARE_CMD(modify_qp);
 IB_UVERBS_DECLARE_CMD(destroy_qp);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index c4c308cd2034..254f1649c734 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1544,6 +1544,98 @@ err_put:
         return ret;
 }
 
+ssize_t ib_uverbs_open_qp(struct ib_uverbs_file *file,
+                          const char __user *buf, int in_len, int out_len)
+{
+        struct ib_uverbs_open_qp        cmd;
+        struct ib_uverbs_create_qp_resp resp;
+        struct ib_udata                 udata;
+        struct ib_uqp_object           *obj;
+        struct ib_xrcd                 *xrcd;
+        struct ib_uobject              *uninitialized_var(xrcd_uobj);
+        struct ib_qp                   *qp;
+        struct ib_qp_open_attr          attr;
+        int ret;
+
+        if (out_len < sizeof resp)
+                return -ENOSPC;
+
+        if (copy_from_user(&cmd, buf, sizeof cmd))
+                return -EFAULT;
+
+        INIT_UDATA(&udata, buf + sizeof cmd,
+                   (unsigned long) cmd.response + sizeof resp,
+                   in_len - sizeof cmd, out_len - sizeof resp);
+
+        obj = kmalloc(sizeof *obj, GFP_KERNEL);
+        if (!obj)
+                return -ENOMEM;
+
+        init_uobj(&obj->uevent.uobject, cmd.user_handle, file->ucontext, &qp_lock_key);
+        down_write(&obj->uevent.uobject.mutex);
+
+        xrcd = idr_read_xrcd(cmd.pd_handle, file->ucontext, &xrcd_uobj);
+        if (!xrcd) {
+                ret = -EINVAL;
+                goto err_put;
+        }
+
+        attr.event_handler = ib_uverbs_qp_event_handler;
+        attr.qp_context    = file;
+        attr.qp_num        = cmd.qpn;
+        attr.qp_type       = cmd.qp_type;
+
+        obj->uevent.events_reported = 0;
+        INIT_LIST_HEAD(&obj->uevent.event_list);
+        INIT_LIST_HEAD(&obj->mcast_list);
+
+        qp = ib_open_qp(xrcd, &attr);
+        if (IS_ERR(qp)) {
+                ret = PTR_ERR(qp);
+                goto err_put;
+        }
+
+        qp->uobject = &obj->uevent.uobject;
+
+        obj->uevent.uobject.object = qp;
+        ret = idr_add_uobj(&ib_uverbs_qp_idr, &obj->uevent.uobject);
+        if (ret)
+                goto err_destroy;
+
+        memset(&resp, 0, sizeof resp);
+        resp.qpn       = qp->qp_num;
+        resp.qp_handle = obj->uevent.uobject.id;
+
+        if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                         &resp, sizeof resp)) {
+                ret = -EFAULT;
+                goto err_remove;
+        }
+
+        put_xrcd_read(xrcd_uobj);
+
+        mutex_lock(&file->mutex);
+        list_add_tail(&obj->uevent.uobject.list, &file->ucontext->qp_list);
+        mutex_unlock(&file->mutex);
+
+        obj->uevent.uobject.live = 1;
+
+        up_write(&obj->uevent.uobject.mutex);
+
+        return in_len;
+
+err_remove:
+        idr_remove_uobj(&ib_uverbs_qp_idr, &obj->uevent.uobject);
+
+err_destroy:
+        ib_destroy_qp(qp);
+
+err_put:
+        put_xrcd_read(xrcd_uobj);
+        put_uobj_write(&obj->uevent.uobject);
+        return ret;
+}
+
 ssize_t ib_uverbs_query_qp(struct ib_uverbs_file *file,
                            const char __user *buf, int in_len,
                            int out_len)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 9c877e24eb60..485ea6c60d8b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -110,7 +110,8 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
         [IB_USER_VERBS_CMD_DESTROY_SRQ]         = ib_uverbs_destroy_srq,
         [IB_USER_VERBS_CMD_OPEN_XRCD]           = ib_uverbs_open_xrcd,
         [IB_USER_VERBS_CMD_CLOSE_XRCD]          = ib_uverbs_close_xrcd,
-        [IB_USER_VERBS_CMD_CREATE_XSRQ]         = ib_uverbs_create_xsrq
+        [IB_USER_VERBS_CMD_CREATE_XSRQ]         = ib_uverbs_create_xsrq,
+        [IB_USER_VERBS_CMD_OPEN_QP]             = ib_uverbs_open_qp
 };
 
 static void ib_uverbs_add_one(struct ib_device *device);