4 files changed, 253 insertions, 169 deletions

diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index f504c9b00c1b..1b09b735c5a8 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1215,15 +1215,18 @@ static void ib_ucm_release_dev(struct device *dev)
 
         ucm_dev = container_of(dev, struct ib_ucm_device, dev);
         cdev_del(&ucm_dev->cdev);
-        clear_bit(ucm_dev->devnum, dev_map);
+        if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
+                clear_bit(ucm_dev->devnum, dev_map);
+        else
+                clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, dev_map);
         kfree(ucm_dev);
 }
 
 static const struct file_operations ucm_fops = {
-        .owner   = THIS_MODULE,
-        .open    = ib_ucm_open,
+        .owner   = THIS_MODULE,
+        .open    = ib_ucm_open,
         .release = ib_ucm_close,
-        .write   = ib_ucm_write,
+        .write   = ib_ucm_write,
         .poll    = ib_ucm_poll,
 };
 
@@ -1237,8 +1240,32 @@ static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
 
+static dev_t overflow_maj;
+static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
+static int find_overflow_devnum(void)
+{
+        int ret;
+
+        if (!overflow_maj) {
+                ret = alloc_chrdev_region(&overflow_maj, 0, IB_UCM_MAX_DEVICES,
+                                          "infiniband_cm");
+                if (ret) {
+                        printk(KERN_ERR "ucm: couldn't register dynamic device number\n");
+                        return ret;
+                }
+        }
+
+        ret = find_first_zero_bit(overflow_map, IB_UCM_MAX_DEVICES);
+        if (ret >= IB_UCM_MAX_DEVICES)
+                return -1;
+
+        return ret;
+}
+
 static void ib_ucm_add_one(struct ib_device *device)
 {
+        int devnum;
+        dev_t base;
         struct ib_ucm_device *ucm_dev;
 
         if (!device->alloc_ucontext ||
@@ -1251,16 +1278,25 @@ static void ib_ucm_add_one(struct ib_device *device)
 
         ucm_dev->ib_dev = device;
 
-        ucm_dev->devnum = find_first_zero_bit(dev_map, IB_UCM_MAX_DEVICES);
-        if (ucm_dev->devnum >= IB_UCM_MAX_DEVICES)
-                goto err;
-
-        set_bit(ucm_dev->devnum, dev_map);
+        devnum = find_first_zero_bit(dev_map, IB_UCM_MAX_DEVICES);
+        if (devnum >= IB_UCM_MAX_DEVICES) {
+                devnum = find_overflow_devnum();
+                if (devnum < 0)
+                        goto err;
+
+                ucm_dev->devnum = devnum + IB_UCM_MAX_DEVICES;
+                base = devnum + overflow_maj;
+                set_bit(devnum, overflow_map);
+        } else {
+                ucm_dev->devnum = devnum;
+                base = devnum + IB_UCM_BASE_DEV;
+                set_bit(devnum, dev_map);
+        }
 
         cdev_init(&ucm_dev->cdev, &ucm_fops);
         ucm_dev->cdev.owner = THIS_MODULE;
         kobject_set_name(&ucm_dev->cdev.kobj, "ucm%d", ucm_dev->devnum);
-        if (cdev_add(&ucm_dev->cdev, IB_UCM_BASE_DEV + ucm_dev->devnum, 1))
+        if (cdev_add(&ucm_dev->cdev, base, 1))
                 goto err;
 
         ucm_dev->dev.class = &cm_class;
@@ -1281,7 +1317,10 @@ err_dev:
         device_unregister(&ucm_dev->dev);
 err_cdev:
         cdev_del(&ucm_dev->cdev);
-        clear_bit(ucm_dev->devnum, dev_map);
+        if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
+                clear_bit(devnum, dev_map);
+        else
+                clear_bit(devnum, overflow_map);
 err:
         kfree(ucm_dev);
         return;
@@ -1340,6 +1379,8 @@ static void __exit ib_ucm_cleanup(void)
         ib_unregister_client(&ucm_client);
         class_remove_file(&cm_class, &class_attr_abi_version);
         unregister_chrdev_region(IB_UCM_BASE_DEV, IB_UCM_MAX_DEVICES);
+        if (overflow_maj)
+                unregister_chrdev_region(overflow_maj, IB_UCM_MAX_DEVICES);
         idr_destroy(&ctx_id_table);
 }
 
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 7de02969ed7d..02d360cfc2f7 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -65,12 +65,9 @@ enum {
 };
 
 /*
- * Our lifetime rules for these structs are the following: each time a
- * device special file is opened, we look up the corresponding struct
- * ib_umad_port by minor in the umad_port[] table while holding the
- * port_lock.  If this lookup succeeds, we take a reference on the
- * ib_umad_port's struct ib_umad_device while still holding the
- * port_lock; if the lookup fails, we fail the open().  We drop these
+ * Our lifetime rules for these structs are the following:
+ * device special file is opened, we take a reference on the
+ * ib_umad_port's struct ib_umad_device. We drop these
  * references in the corresponding close().
  *
  * In addition to references coming from open character devices, there
@@ -78,19 +75,14 @@ enum {
  * module's reference taken when allocating the ib_umad_device in
  * ib_umad_add_one().
  *
- * When destroying an ib_umad_device, we clear all of its
- * ib_umad_ports from umad_port[] while holding port_lock before
- * dropping the module's reference to the ib_umad_device.  This is
- * always safe because any open() calls will either succeed and obtain
- * a reference before we clear the umad_port[] entries, or fail after
- * we clear the umad_port[] entries.
+ * When destroying an ib_umad_device, we drop the module's reference.
  */
 
 struct ib_umad_port {
-        struct cdev           *cdev;
+        struct cdev           cdev;
         struct device         *dev;
 
-        struct cdev           *sm_cdev;
+        struct cdev           sm_cdev;
         struct device         *sm_dev;
         struct semaphore       sm_sem;
 
@@ -136,7 +128,6 @@ static struct class *umad_class;
 static const dev_t base_dev = MKDEV(IB_UMAD_MAJOR, IB_UMAD_MINOR_BASE);
 
 static DEFINE_SPINLOCK(port_lock);
-static struct ib_umad_port *umad_port[IB_UMAD_MAX_PORTS];
 static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS);
 
 static void ib_umad_add_one(struct ib_device *device);
@@ -496,8 +487,8 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                 ah_attr.ah_flags = IB_AH_GRH;
                 memcpy(ah_attr.grh.dgid.raw, packet->mad.hdr.gid, 16);
                 ah_attr.grh.sgid_index     = packet->mad.hdr.gid_index;
-                ah_attr.grh.flow_label     = be32_to_cpu(packet->mad.hdr.flow_label);
-                ah_attr.grh.hop_limit      = packet->mad.hdr.hop_limit;
+                ah_attr.grh.flow_label     = be32_to_cpu(packet->mad.hdr.flow_label);
+                ah_attr.grh.hop_limit      = packet->mad.hdr.hop_limit;
                 ah_attr.grh.traffic_class  = packet->mad.hdr.traffic_class;
         }
 
@@ -528,9 +519,9 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                 goto err_ah;
         }
 
-        packet->msg->ah         = ah;
+        packet->msg->ah         = ah;
         packet->msg->timeout_ms = packet->mad.hdr.timeout_ms;
-        packet->msg->retries    = packet->mad.hdr.retries;
+        packet->msg->retries    = packet->mad.hdr.retries;
         packet->msg->context[0] = packet;
 
         /* Copy MAD header.  Any RMPP header is already in place. */
@@ -779,15 +770,11 @@ static long ib_umad_compat_ioctl(struct file *filp, unsigned int cmd,
 /*
  * ib_umad_open() does not need the BKL:
  *
- *  - umad_port[] accesses are protected by port_lock, the
- *    ib_umad_port structures are properly reference counted, and
+ *  - the ib_umad_port structures are properly reference counted, and
  *    everything else is purely local to the file being created, so
  *    races against other open calls are not a problem;
  *  - the ioctl method does not affect any global state outside of the
  *    file structure being operated on;
- *  - the port is added to umad_port[] as the last part of module
- *    initialization so the open method will either immediately run
- *    -ENXIO, or all required initialization will be done.
  */
 static int ib_umad_open(struct inode *inode, struct file *filp)
 {
@@ -795,13 +782,10 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
         struct ib_umad_file *file;
         int ret = 0;
 
-        spin_lock(&port_lock);
-        port = umad_port[iminor(inode) - IB_UMAD_MINOR_BASE];
+        port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
         if (port)
                 kref_get(&port->umad_dev->ref);
-        spin_unlock(&port_lock);
-
-        if (!port)
+        else
                 return -ENXIO;
 
         mutex_lock(&port->file_mutex);
@@ -872,16 +856,16 @@ static int ib_umad_close(struct inode *inode, struct file *filp)
 }
 
 static const struct file_operations umad_fops = {
-        .owner          = THIS_MODULE,
-        .read           = ib_umad_read,
-        .write          = ib_umad_write,
-        .poll           = ib_umad_poll,
+        .owner          = THIS_MODULE,
+        .read           = ib_umad_read,
+        .write          = ib_umad_write,
+        .poll           = ib_umad_poll,
         .unlocked_ioctl = ib_umad_ioctl,
 #ifdef CONFIG_COMPAT
-        .compat_ioctl   = ib_umad_compat_ioctl,
+        .compat_ioctl   = ib_umad_compat_ioctl,
 #endif
-        .open           = ib_umad_open,
-        .release        = ib_umad_close
+        .open           = ib_umad_open,
+        .release        = ib_umad_close
 };
 
 static int ib_umad_sm_open(struct inode *inode, struct file *filp)
@@ -892,13 +876,10 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
         };
         int ret;
 
-        spin_lock(&port_lock);
-        port = umad_port[iminor(inode) - IB_UMAD_MINOR_BASE - IB_UMAD_MAX_PORTS];
+        port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev);
         if (port)
                 kref_get(&port->umad_dev->ref);
-        spin_unlock(&port_lock);
-
-        if (!port)
+        else
                 return -ENXIO;
 
         if (filp->f_flags & O_NONBLOCK) {
@@ -949,8 +930,8 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
 }
 
 static const struct file_operations umad_sm_fops = {
-        .owner   = THIS_MODULE,
-        .open    = ib_umad_sm_open,
+        .owner   = THIS_MODULE,
+        .open    = ib_umad_sm_open,
         .release = ib_umad_sm_close
 };
 
@@ -990,16 +971,51 @@ static ssize_t show_abi_version(struct class *class, char *buf)
 }
 static CLASS_ATTR(abi_version, S_IRUGO, show_abi_version, NULL);
 
+static dev_t overflow_maj;
+static DECLARE_BITMAP(overflow_map, IB_UMAD_MAX_PORTS);
+static int find_overflow_devnum(void)
+{
+        int ret;
+
+        if (!overflow_maj) {
+                ret = alloc_chrdev_region(&overflow_maj, 0, IB_UMAD_MAX_PORTS * 2,
+                                          "infiniband_mad");
+                if (ret) {
+                        printk(KERN_ERR "user_mad: couldn't register dynamic device number\n");
+                        return ret;
+                }
+        }
+
+        ret = find_first_zero_bit(overflow_map, IB_UMAD_MAX_PORTS);
+        if (ret >= IB_UMAD_MAX_PORTS)
+                return -1;
+
+        return ret;
+}
+
 static int ib_umad_init_port(struct ib_device *device, int port_num,
                              struct ib_umad_port *port)
 {
+        int devnum;
+        dev_t base;
+
         spin_lock(&port_lock);
-        port->dev_num = find_first_zero_bit(dev_map, IB_UMAD_MAX_PORTS);
-        if (port->dev_num >= IB_UMAD_MAX_PORTS) {
+        devnum = find_first_zero_bit(dev_map, IB_UMAD_MAX_PORTS);
+        if (devnum >= IB_UMAD_MAX_PORTS) {
                 spin_unlock(&port_lock);
-                return -1;
+                devnum = find_overflow_devnum();
+                if (devnum < 0)
+                        return -1;
+
+                spin_lock(&port_lock);
+                port->dev_num = devnum + IB_UMAD_MAX_PORTS;
+                base = devnum + overflow_maj;
+                set_bit(devnum, overflow_map);
+        } else {
+                port->dev_num = devnum;
+                base = devnum + base_dev;
+                set_bit(devnum, dev_map);
         }
-        set_bit(port->dev_num, dev_map);
         spin_unlock(&port_lock);
 
         port->ib_dev   = device;
@@ -1008,17 +1024,14 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
         mutex_init(&port->file_mutex);
         INIT_LIST_HEAD(&port->file_list);
 
-        port->cdev = cdev_alloc();
-        if (!port->cdev)
-                return -1;
-        port->cdev->owner = THIS_MODULE;
-        port->cdev->ops   = &umad_fops;
-        kobject_set_name(&port->cdev->kobj, "umad%d", port->dev_num);
-        if (cdev_add(port->cdev, base_dev + port->dev_num, 1))
+        cdev_init(&port->cdev, &umad_fops);
+        port->cdev.owner = THIS_MODULE;
+        kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num);
+        if (cdev_add(&port->cdev, base, 1))
                 goto err_cdev;
 
         port->dev = device_create(umad_class, device->dma_device,
-                                  port->cdev->dev, port,
+                                  port->cdev.dev, port,
                                   "umad%d", port->dev_num);
         if (IS_ERR(port->dev))
                 goto err_cdev;
@@ -1028,17 +1041,15 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
         if (device_create_file(port->dev, &dev_attr_port))
                 goto err_dev;
 
-        port->sm_cdev = cdev_alloc();
-        if (!port->sm_cdev)
-                goto err_dev;
-        port->sm_cdev->owner = THIS_MODULE;
-        port->sm_cdev->ops   = &umad_sm_fops;
-        kobject_set_name(&port->sm_cdev->kobj, "issm%d", port->dev_num);
-        if (cdev_add(port->sm_cdev, base_dev + port->dev_num + IB_UMAD_MAX_PORTS, 1))
+        base += IB_UMAD_MAX_PORTS;
+        cdev_init(&port->sm_cdev, &umad_sm_fops);
+        port->sm_cdev.owner = THIS_MODULE;
+        kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num);
+        if (cdev_add(&port->sm_cdev, base, 1))
                 goto err_sm_cdev;
 
         port->sm_dev = device_create(umad_class, device->dma_device,
-                                     port->sm_cdev->dev, port,
+                                     port->sm_cdev.dev, port,
                                      "issm%d", port->dev_num);
         if (IS_ERR(port->sm_dev))
                 goto err_sm_cdev;
@@ -1048,24 +1059,23 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
         if (device_create_file(port->sm_dev, &dev_attr_port))
                 goto err_sm_dev;
 
-        spin_lock(&port_lock);
-        umad_port[port->dev_num] = port;
-        spin_unlock(&port_lock);
-
         return 0;
 
 err_sm_dev:
-        device_destroy(umad_class, port->sm_cdev->dev);
+        device_destroy(umad_class, port->sm_cdev.dev);
 
 err_sm_cdev:
-        cdev_del(port->sm_cdev);
+        cdev_del(&port->sm_cdev);
 
 err_dev:
-        device_destroy(umad_class, port->cdev->dev);
+        device_destroy(umad_class, port->cdev.dev);
 
 err_cdev:
-        cdev_del(port->cdev);
-        clear_bit(port->dev_num, dev_map);
+        cdev_del(&port->cdev);
+        if (port->dev_num < IB_UMAD_MAX_PORTS)
+                clear_bit(devnum, dev_map);
+        else
+                clear_bit(devnum, overflow_map);
 
         return -1;
 }
@@ -1079,15 +1089,11 @@ static void ib_umad_kill_port(struct ib_umad_port *port)
         dev_set_drvdata(port->dev,    NULL);
         dev_set_drvdata(port->sm_dev, NULL);
 
-        device_destroy(umad_class, port->cdev->dev);
-        device_destroy(umad_class, port->sm_cdev->dev);
+        device_destroy(umad_class, port->cdev.dev);
+        device_destroy(umad_class, port->sm_cdev.dev);
 
-        cdev_del(port->cdev);
-        cdev_del(port->sm_cdev);
-
-        spin_lock(&port_lock);
-        umad_port[port->dev_num] = NULL;
-        spin_unlock(&port_lock);
+        cdev_del(&port->cdev);
+        cdev_del(&port->sm_cdev);
 
         mutex_lock(&port->file_mutex);
 
@@ -1106,7 +1112,10 @@ static void ib_umad_kill_port(struct ib_umad_port *port)
 
         mutex_unlock(&port->file_mutex);
 
-        clear_bit(port->dev_num, dev_map);
+        if (port->dev_num < IB_UMAD_MAX_PORTS)
+                clear_bit(port->dev_num, dev_map);
+        else
+                clear_bit(port->dev_num - IB_UMAD_MAX_PORTS, overflow_map);
 }
 
 static void ib_umad_add_one(struct ib_device *device)
@@ -1214,6 +1223,8 @@ static void __exit ib_umad_cleanup(void)
         ib_unregister_client(&umad_client);
         class_destroy(umad_class);
         unregister_chrdev_region(base_dev, IB_UMAD_MAX_PORTS * 2);
+        if (overflow_maj)
+                unregister_chrdev_region(overflow_maj, IB_UMAD_MAX_PORTS * 2);
 }
 
 module_init(ib_umad_init);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index b3ea9587dc80..e54d9ac6d1ca 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -41,6 +41,7 @@
 #include <linux/idr.h>
 #include <linux/mutex.h>
 #include <linux/completion.h>
+#include <linux/cdev.h>
 
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_umem.h>
@@ -69,23 +70,23 @@
 
 struct ib_uverbs_device {
         struct kref                             ref;
+        int                                     num_comp_vectors;
         struct completion                       comp;
-        int                                     devnum;
-        struct cdev                            *cdev;
         struct device                          *dev;
         struct ib_device                       *ib_dev;
-        int                                     num_comp_vectors;
+        int                                     devnum;
+        struct cdev                             cdev;
 };
 
 struct ib_uverbs_event_file {
         struct kref                             ref;
+        int                                     is_async;
         struct ib_uverbs_file                  *uverbs_file;
         spinlock_t                              lock;
+        int                                     is_closed;
         wait_queue_head_t                       poll_wait;
         struct fasync_struct                   *async_queue;
         struct list_head                        event_list;
-        int                                     is_async;
-        int                                     is_closed;
 };
 
 struct ib_uverbs_file {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 5f284ffd430e..dbf04511cf0a 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -43,7 +43,6 @@
 #include <linux/sched.h>
 #include <linux/file.h>
 #include <linux/mount.h>
-#include <linux/cdev.h>
 
 #include <asm/uaccess.h>
 
@@ -75,40 +74,39 @@ DEFINE_IDR(ib_uverbs_qp_idr);
 DEFINE_IDR(ib_uverbs_srq_idr);
 
 static DEFINE_SPINLOCK(map_lock);
-static struct ib_uverbs_device *dev_table[IB_UVERBS_MAX_DEVICES];
 static DECLARE_BITMAP(dev_map, IB_UVERBS_MAX_DEVICES);
 
 static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
                                      const char __user *buf, int in_len,
                                      int out_len) = {
-        [IB_USER_VERBS_CMD_GET_CONTEXT]         = ib_uverbs_get_context,
-        [IB_USER_VERBS_CMD_QUERY_DEVICE]        = ib_uverbs_query_device,
-        [IB_USER_VERBS_CMD_QUERY_PORT]          = ib_uverbs_query_port,
-        [IB_USER_VERBS_CMD_ALLOC_PD]            = ib_uverbs_alloc_pd,
-        [IB_USER_VERBS_CMD_DEALLOC_PD]          = ib_uverbs_dealloc_pd,
-        [IB_USER_VERBS_CMD_REG_MR]              = ib_uverbs_reg_mr,
-        [IB_USER_VERBS_CMD_DEREG_MR]            = ib_uverbs_dereg_mr,
+        [IB_USER_VERBS_CMD_GET_CONTEXT]         = ib_uverbs_get_context,
+        [IB_USER_VERBS_CMD_QUERY_DEVICE]        = ib_uverbs_query_device,
+        [IB_USER_VERBS_CMD_QUERY_PORT]          = ib_uverbs_query_port,
+        [IB_USER_VERBS_CMD_ALLOC_PD]            = ib_uverbs_alloc_pd,
+        [IB_USER_VERBS_CMD_DEALLOC_PD]          = ib_uverbs_dealloc_pd,
+        [IB_USER_VERBS_CMD_REG_MR]              = ib_uverbs_reg_mr,
+        [IB_USER_VERBS_CMD_DEREG_MR]            = ib_uverbs_dereg_mr,
         [IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL] = ib_uverbs_create_comp_channel,
-        [IB_USER_VERBS_CMD_CREATE_CQ]           = ib_uverbs_create_cq,
-        [IB_USER_VERBS_CMD_RESIZE_CQ]           = ib_uverbs_resize_cq,
-        [IB_USER_VERBS_CMD_POLL_CQ]             = ib_uverbs_poll_cq,
-        [IB_USER_VERBS_CMD_REQ_NOTIFY_CQ]       = ib_uverbs_req_notify_cq,
-        [IB_USER_VERBS_CMD_DESTROY_CQ]          = ib_uverbs_destroy_cq,
-        [IB_USER_VERBS_CMD_CREATE_QP]           = ib_uverbs_create_qp,
-        [IB_USER_VERBS_CMD_QUERY_QP]            = ib_uverbs_query_qp,
-        [IB_USER_VERBS_CMD_MODIFY_QP]           = ib_uverbs_modify_qp,
-        [IB_USER_VERBS_CMD_DESTROY_QP]          = ib_uverbs_destroy_qp,
-        [IB_USER_VERBS_CMD_POST_SEND]           = ib_uverbs_post_send,
-        [IB_USER_VERBS_CMD_POST_RECV]           = ib_uverbs_post_recv,
-        [IB_USER_VERBS_CMD_POST_SRQ_RECV]       = ib_uverbs_post_srq_recv,
-        [IB_USER_VERBS_CMD_CREATE_AH]           = ib_uverbs_create_ah,
-        [IB_USER_VERBS_CMD_DESTROY_AH]          = ib_uverbs_destroy_ah,
-        [IB_USER_VERBS_CMD_ATTACH_MCAST]        = ib_uverbs_attach_mcast,
-        [IB_USER_VERBS_CMD_DETACH_MCAST]        = ib_uverbs_detach_mcast,
-        [IB_USER_VERBS_CMD_CREATE_SRQ]          = ib_uverbs_create_srq,
-        [IB_USER_VERBS_CMD_MODIFY_SRQ]          = ib_uverbs_modify_srq,
-        [IB_USER_VERBS_CMD_QUERY_SRQ]           = ib_uverbs_query_srq,
-        [IB_USER_VERBS_CMD_DESTROY_SRQ]         = ib_uverbs_destroy_srq,
+        [IB_USER_VERBS_CMD_CREATE_CQ]           = ib_uverbs_create_cq,
+        [IB_USER_VERBS_CMD_RESIZE_CQ]           = ib_uverbs_resize_cq,
+        [IB_USER_VERBS_CMD_POLL_CQ]             = ib_uverbs_poll_cq,
+        [IB_USER_VERBS_CMD_REQ_NOTIFY_CQ]       = ib_uverbs_req_notify_cq,
+        [IB_USER_VERBS_CMD_DESTROY_CQ]          = ib_uverbs_destroy_cq,
+        [IB_USER_VERBS_CMD_CREATE_QP]           = ib_uverbs_create_qp,
+        [IB_USER_VERBS_CMD_QUERY_QP]            = ib_uverbs_query_qp,
+        [IB_USER_VERBS_CMD_MODIFY_QP]           = ib_uverbs_modify_qp,
+        [IB_USER_VERBS_CMD_DESTROY_QP]          = ib_uverbs_destroy_qp,
+        [IB_USER_VERBS_CMD_POST_SEND]           = ib_uverbs_post_send,
+        [IB_USER_VERBS_CMD_POST_RECV]           = ib_uverbs_post_recv,
+        [IB_USER_VERBS_CMD_POST_SRQ_RECV]       = ib_uverbs_post_srq_recv,
+        [IB_USER_VERBS_CMD_CREATE_AH]           = ib_uverbs_create_ah,
+        [IB_USER_VERBS_CMD_DESTROY_AH]          = ib_uverbs_destroy_ah,
+        [IB_USER_VERBS_CMD_ATTACH_MCAST]        = ib_uverbs_attach_mcast,
+        [IB_USER_VERBS_CMD_DETACH_MCAST]        = ib_uverbs_detach_mcast,
+        [IB_USER_VERBS_CMD_CREATE_SRQ]          = ib_uverbs_create_srq,
+        [IB_USER_VERBS_CMD_MODIFY_SRQ]          = ib_uverbs_modify_srq,
+        [IB_USER_VERBS_CMD_QUERY_SRQ]           = ib_uverbs_query_srq,
+        [IB_USER_VERBS_CMD_DESTROY_SRQ]         = ib_uverbs_destroy_srq,
 };
 
 static struct vfsmount *uverbs_event_mnt;
@@ -370,7 +368,7 @@ static int ib_uverbs_event_close(struct inode *inode, struct file *filp)
 
 static const struct file_operations uverbs_event_fops = {
         .owner   = THIS_MODULE,
-        .read    = ib_uverbs_event_read,
+        .read    = ib_uverbs_event_read,
         .poll    = ib_uverbs_event_poll,
         .release = ib_uverbs_event_close,
         .fasync  = ib_uverbs_event_fasync
@@ -617,14 +615,12 @@ static int ib_uverbs_mmap(struct file *filp, struct vm_area_struct *vma)
 /*
  * ib_uverbs_open() does not need the BKL:
  *
- *  - dev_table[] accesses are protected by map_lock, the
- *    ib_uverbs_device structures are properly reference counted, and
+ *  - the ib_uverbs_device structures are properly reference counted and
  *    everything else is purely local to the file being created, so
  *    races against other open calls are not a problem;
  *  - there is no ioctl method to race against;
- *  - the device is added to dev_table[] as the last part of module
- *    initialization, the open method will either immediately run
- *    -ENXIO, or all required initialization will be done.
+ *  - the open method will either immediately run -ENXIO, or all
+ *    required initialization will be done.
  */
 static int ib_uverbs_open(struct inode *inode, struct file *filp)
 {
@@ -632,13 +628,10 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
         struct ib_uverbs_file *file;
         int ret;
 
-        spin_lock(&map_lock);
-        dev = dev_table[iminor(inode) - IB_UVERBS_BASE_MINOR];
+        dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
         if (dev)
                 kref_get(&dev->ref);
-        spin_unlock(&map_lock);
-
-        if (!dev)
+        else
                 return -ENXIO;
 
         if (!try_module_get(dev->ib_dev->owner)) {
@@ -685,17 +678,17 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
 }
 
 static const struct file_operations uverbs_fops = {
-        .owner   = THIS_MODULE,
-        .write   = ib_uverbs_write,
-        .open    = ib_uverbs_open,
+        .owner   = THIS_MODULE,
+        .write   = ib_uverbs_write,
+        .open    = ib_uverbs_open,
         .release = ib_uverbs_close
 };
 
 static const struct file_operations uverbs_mmap_fops = {
-        .owner   = THIS_MODULE,
-        .write   = ib_uverbs_write,
+        .owner   = THIS_MODULE,
+        .write   = ib_uverbs_write,
         .mmap    = ib_uverbs_mmap,
-        .open    = ib_uverbs_open,
+        .open    = ib_uverbs_open,
         .release = ib_uverbs_close
 };
 
@@ -735,8 +728,38 @@ static ssize_t show_abi_version(struct class *class, char *buf)
 }
 static CLASS_ATTR(abi_version, S_IRUGO, show_abi_version, NULL);
 
+static dev_t overflow_maj;
+static DECLARE_BITMAP(overflow_map, IB_UVERBS_MAX_DEVICES);
+
+/*
+ * If we have more than IB_UVERBS_MAX_DEVICES, dynamically overflow by
+ * requesting a new major number and doubling the number of max devices we
+ * support. It's stupid, but simple.
+ */
+static int find_overflow_devnum(void)
+{
+        int ret;
+
+        if (!overflow_maj) {
+                ret = alloc_chrdev_region(&overflow_maj, 0, IB_UVERBS_MAX_DEVICES,
+                                          "infiniband_verbs");
+                if (ret) {
+                        printk(KERN_ERR "user_verbs: couldn't register dynamic device number\n");
+                        return ret;
+                }
+        }
+
+        ret = find_first_zero_bit(overflow_map, IB_UVERBS_MAX_DEVICES);
+        if (ret >= IB_UVERBS_MAX_DEVICES)
+                return -1;
+
+        return ret;
+}
+
 static void ib_uverbs_add_one(struct ib_device *device)
 {
+        int devnum;
+        dev_t base;
         struct ib_uverbs_device *uverbs_dev;
 
         if (!device->alloc_ucontext)
@@ -750,28 +773,36 @@ static void ib_uverbs_add_one(struct ib_device *device)
         init_completion(&uverbs_dev->comp);
 
         spin_lock(&map_lock);
-        uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
-        if (uverbs_dev->devnum >= IB_UVERBS_MAX_DEVICES) {
+        devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
+        if (devnum >= IB_UVERBS_MAX_DEVICES) {
                 spin_unlock(&map_lock);
-                goto err;
+                devnum = find_overflow_devnum();
+                if (devnum < 0)
+                        goto err;
+
+                spin_lock(&map_lock);
+                uverbs_dev->devnum = devnum + IB_UVERBS_MAX_DEVICES;
+                base = devnum + overflow_maj;
+                set_bit(devnum, overflow_map);
+        } else {
+                uverbs_dev->devnum = devnum;
+                base = devnum + IB_UVERBS_BASE_DEV;
+                set_bit(devnum, dev_map);
         }
-        set_bit(uverbs_dev->devnum, dev_map);
         spin_unlock(&map_lock);
 
         uverbs_dev->ib_dev           = device;
         uverbs_dev->num_comp_vectors = device->num_comp_vectors;
 
-        uverbs_dev->cdev = cdev_alloc();
-        if (!uverbs_dev->cdev)
-                goto err;
-        uverbs_dev->cdev->owner = THIS_MODULE;
-        uverbs_dev->cdev->ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
-        kobject_set_name(&uverbs_dev->cdev->kobj, "uverbs%d", uverbs_dev->devnum);
-        if (cdev_add(uverbs_dev->cdev, IB_UVERBS_BASE_DEV + uverbs_dev->devnum, 1))
+        cdev_init(&uverbs_dev->cdev, NULL);
+        uverbs_dev->cdev.owner = THIS_MODULE;
+        uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
+        kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
+        if (cdev_add(&uverbs_dev->cdev, base, 1))
                 goto err_cdev;
 
         uverbs_dev->dev = device_create(uverbs_class, device->dma_device,
-                                        uverbs_dev->cdev->dev, uverbs_dev,
+                                        uverbs_dev->cdev.dev, uverbs_dev,
                                         "uverbs%d", uverbs_dev->devnum);
         if (IS_ERR(uverbs_dev->dev))
                 goto err_cdev;
@@ -781,20 +812,19 @@ static void ib_uverbs_add_one(struct ib_device *device)
         if (device_create_file(uverbs_dev->dev, &dev_attr_abi_version))
                 goto err_class;
 
-        spin_lock(&map_lock);
-        dev_table[uverbs_dev->devnum] = uverbs_dev;
-        spin_unlock(&map_lock);
-
         ib_set_client_data(device, &uverbs_client, uverbs_dev);
 
         return;
 
 err_class:
-        device_destroy(uverbs_class, uverbs_dev->cdev->dev);
+        device_destroy(uverbs_class, uverbs_dev->cdev.dev);
 
 err_cdev:
-        cdev_del(uverbs_dev->cdev);
-        clear_bit(uverbs_dev->devnum, dev_map);
+        cdev_del(&uverbs_dev->cdev);
+        if (uverbs_dev->devnum < IB_UVERBS_MAX_DEVICES)
+                clear_bit(devnum, dev_map);
+        else
+                clear_bit(devnum, overflow_map);
 
 err:
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
@@ -811,14 +841,13 @@ static void ib_uverbs_remove_one(struct ib_device *device)
                 return;
 
         dev_set_drvdata(uverbs_dev->dev, NULL);
-        device_destroy(uverbs_class, uverbs_dev->cdev->dev);
-        cdev_del(uverbs_dev->cdev);
+        device_destroy(uverbs_class, uverbs_dev->cdev.dev);
+        cdev_del(&uverbs_dev->cdev);
 
-        spin_lock(&map_lock);
-        dev_table[uverbs_dev->devnum] = NULL;
-        spin_unlock(&map_lock);
-
-        clear_bit(uverbs_dev->devnum, dev_map);
+        if (uverbs_dev->devnum < IB_UVERBS_MAX_DEVICES)
+                clear_bit(uverbs_dev->devnum, dev_map);
+        else
+                clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map);
 
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
         wait_for_completion(&uverbs_dev->comp);
@@ -908,6 +937,8 @@ static void __exit ib_uverbs_cleanup(void)
         unregister_filesystem(&uverbs_event_fs);
         class_destroy(uverbs_class);
         unregister_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES);
+        if (overflow_maj)
+                unregister_chrdev_region(overflow_maj, IB_UVERBS_MAX_DEVICES);
         idr_destroy(&ib_uverbs_pd_idr);
         idr_destroy(&ib_uverbs_mr_idr);
         idr_destroy(&ib_uverbs_mw_idr);